[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 60.214371][ T27] audit: type=1800 audit(1576117450.986:25): pid=8731 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 60.234295][ T27] audit: type=1800 audit(1576117450.996:26): pid=8731 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 60.256038][ T27] audit: type=1800 audit(1576117450.996:27): pid=8731 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.92' (ECDSA) to the list of known hosts. 2019/12/12 02:24:21 fuzzer started 2019/12/12 02:24:23 dialing manager at 10.128.0.26:42497 2019/12/12 02:24:24 syscalls: 2701 2019/12/12 02:24:24 code coverage: enabled 2019/12/12 02:24:24 comparison tracing: enabled 2019/12/12 02:24:24 extra coverage: enabled 2019/12/12 02:24:24 setuid sandbox: enabled 2019/12/12 02:24:24 namespace sandbox: enabled 2019/12/12 02:24:24 Android sandbox: /sys/fs/selinux/policy does not exist 2019/12/12 02:24:24 fault injection: enabled 2019/12/12 02:24:24 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/12/12 02:24:24 net packet injection: enabled 2019/12/12 02:24:24 net device setup: enabled 2019/12/12 02:24:24 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2019/12/12 02:24:24 devlink PCI setup: PCI device 0000:00:10.0 is not available 02:26:19 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x50000}]}) fchownat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0xffffffffffffffff, 0x0, 0x400) 02:26:19 executing program 1: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000006900)={0x1, 0x1, 0x3d, 0x508, 0x81, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x3c) syzkaller login: [ 188.799014][ T8898] IPVS: ftp: loaded support on port[0] = 21 02:26:19 executing program 2: creat(&(0x7f0000000100)='./file0\x00', 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='devpts\x00', 0x0, &(0x7f00000001c0)='/selinux/policy\x00') gettid() tkill(0x0, 0x3c) pipe(&(0x7f0000000440)) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000700), 0x2b2f496b7afd388, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000002c0)=0x0) prlimit64(r1, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) pipe2(0x0, 0x84000) r3 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r3, &(0x7f0000000600)=[{{&(0x7f0000000300)=@x25, 0x80, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/91, 0x5b}], 0x1, &(0x7f0000000500)=""/206, 0xce}}], 0x1, 0x0, 0x0) pipe(0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) open(&(0x7f0000000000)='./bus\x00', 0x4000000000141042, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) open_by_handle_at(0xffffffffffffffff, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r4 = open(&(0x7f00000000c0)='./file0\x00', 0x1af242, 0x0) ftruncate(r4, 0x28007d) openat$rfkill(0xffffffffffffff9c, 0x0, 0x2000, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) sendfile(r4, r4, 0x0, 0x2008000fffffffe) [ 188.992134][ T8898] chnl_net:caif_netlink_parms(): no params data found [ 189.000427][ T8901] IPVS: ftp: loaded support on port[0] = 21 [ 189.075865][ T8898] bridge0: port 1(bridge_slave_0) entered blocking state [ 189.085590][ T8898] bridge0: port 1(bridge_slave_0) entered disabled state [ 189.093904][ T8898] device bridge_slave_0 entered promiscuous mode [ 189.130751][ T8898] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.138267][ T8898] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.146207][ T8898] device bridge_slave_1 entered promiscuous mode [ 189.220745][ T8898] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link 02:26:20 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000300)={@mcast2}, 0x20) r2 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f0000000000)={'syz'}, &(0x7f0000000240)='X', 0x1, 0xfffffffffffffffe) r3 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f00000003c0)={r2, r3, r3}, 0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={'rmd128\x00'}}) [ 189.270957][ T8898] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 189.325443][ T8901] chnl_net:caif_netlink_parms(): no params data found [ 189.360565][ T8898] team0: Port device team_slave_0 added [ 189.372657][ T8904] IPVS: ftp: loaded support on port[0] = 21 [ 189.389502][ T8898] team0: Port device team_slave_1 added 02:26:20 executing program 4: msgrcv(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1e42a94ab0360f6db769"], 0x1, 0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0xd6d0c418f59fe7d3, 0x0) msgsnd(0x0, &(0x7f00000003c0)=ANY=[@ANYRESDEC, @ANYRESHEX, @ANYRESOCT, @ANYBLOB="28dc819571a46d359e443c3b4813df5e8f10bf96c2d0bfacb853", @ANYRES64], 0x5, 0x400) [ 189.500918][ T8898] device hsr_slave_0 entered promiscuous mode [ 189.528120][ T8898] device hsr_slave_1 entered promiscuous mode [ 189.621849][ T8907] IPVS: ftp: loaded support on port[0] = 21 [ 189.675803][ T8901] bridge0: port 1(bridge_slave_0) entered blocking state [ 189.683894][ T8901] bridge0: port 1(bridge_slave_0) entered disabled state [ 189.698780][ T8901] device bridge_slave_0 entered promiscuous mode [ 189.721642][ T8901] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.737762][ T8901] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.745551][ T8901] device bridge_slave_1 entered promiscuous mode [ 189.804735][ T8909] IPVS: ftp: loaded support on port[0] = 21 [ 189.832109][ T8901] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 189.854758][ T8898] netdevsim netdevsim0 netdevsim0: renamed from eth0 02:26:20 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x40000080806, 0x0) syz_open_procfs(0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), 0x0) openat$proc_capi20ncci(0xffffffffffffff9c, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r0, 0x20000003) r1 = socket$inet6(0xa, 0x6, 0x0) socket(0x10, 0x0, 0x0) socket(0x0, 0x2, 0x0) open(0x0, 0x0, 0x141) prctl$PR_SET_PTRACER(0x59616d61, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 189.956132][ T8901] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 189.979232][ T8898] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 190.056150][ T8898] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 190.132655][ T8898] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 190.183873][ T8901] team0: Port device team_slave_0 added [ 190.193553][ T8901] team0: Port device team_slave_1 added [ 190.215624][ T8911] IPVS: ftp: loaded support on port[0] = 21 [ 190.370776][ T8901] device hsr_slave_0 entered promiscuous mode [ 190.398547][ T8901] device hsr_slave_1 entered promiscuous mode [ 190.437826][ T8901] debugfs: Directory 'hsr0' with parent '/' already present! [ 190.471828][ T8907] chnl_net:caif_netlink_parms(): no params data found [ 190.492401][ T8904] chnl_net:caif_netlink_parms(): no params data found [ 190.569400][ T8901] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 190.640503][ T8901] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 190.757190][ T8901] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 190.820461][ T8901] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 190.861863][ T8904] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.869063][ T8904] bridge0: port 1(bridge_slave_0) entered disabled state [ 190.876845][ T8904] device bridge_slave_0 entered promiscuous mode [ 190.906652][ T8907] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.913822][ T8907] bridge0: port 1(bridge_slave_0) entered disabled state [ 190.923751][ T8907] device bridge_slave_0 entered promiscuous mode [ 190.931917][ T8904] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.939671][ T8904] bridge0: port 2(bridge_slave_1) entered disabled state [ 190.947386][ T8904] device bridge_slave_1 entered promiscuous mode [ 190.969884][ T8907] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.976983][ T8907] bridge0: port 2(bridge_slave_1) entered disabled state [ 190.984906][ T8907] device bridge_slave_1 entered promiscuous mode [ 191.005652][ T8904] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 191.020237][ T8904] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 191.035432][ T8907] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 191.045959][ T8909] chnl_net:caif_netlink_parms(): no params data found [ 191.074960][ T8907] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 191.093208][ T8904] team0: Port device team_slave_0 added [ 191.110366][ T8904] team0: Port device team_slave_1 added [ 191.182567][ T8909] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.190091][ T8909] bridge0: port 1(bridge_slave_0) entered disabled state [ 191.198165][ T8909] device bridge_slave_0 entered promiscuous mode [ 191.245709][ T8907] team0: Port device team_slave_0 added [ 191.252056][ T8909] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.259517][ T8909] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.267235][ T8909] device bridge_slave_1 entered promiscuous mode [ 191.312282][ T8904] device hsr_slave_0 entered promiscuous mode [ 191.368170][ T8904] device hsr_slave_1 entered promiscuous mode [ 191.407852][ T8904] debugfs: Directory 'hsr0' with parent '/' already present! [ 191.423993][ T8907] team0: Port device team_slave_1 added [ 191.449128][ T8898] 8021q: adding VLAN 0 to HW filter on device bond0 [ 191.458715][ T8911] chnl_net:caif_netlink_parms(): no params data found [ 191.491996][ T8909] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 191.504052][ T8909] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 191.557232][ T8911] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.566268][ T8911] bridge0: port 1(bridge_slave_0) entered disabled state [ 191.576304][ T8911] device bridge_slave_0 entered promiscuous mode [ 191.639840][ T8907] device hsr_slave_0 entered promiscuous mode [ 191.678012][ T8907] device hsr_slave_1 entered promiscuous mode [ 191.717853][ T8907] debugfs: Directory 'hsr0' with parent '/' already present! [ 191.735203][ T8898] 8021q: adding VLAN 0 to HW filter on device team0 [ 191.744854][ T8911] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.753574][ T8911] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.762551][ T8911] device bridge_slave_1 entered promiscuous mode [ 191.772169][ T8909] team0: Port device team_slave_0 added [ 191.781752][ T3693] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 191.789941][ T3693] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 191.804831][ T8904] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 191.864820][ T8904] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 191.932405][ T8904] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 191.982594][ T8909] team0: Port device team_slave_1 added [ 191.994520][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 192.003487][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 192.012014][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 192.019224][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 192.029028][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 192.037525][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 192.045971][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 192.053048][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 192.061331][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 192.071253][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 192.085794][ T8904] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 192.160999][ T8911] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 192.174595][ T8911] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 192.230093][ T8909] device hsr_slave_0 entered promiscuous mode [ 192.268109][ T8909] device hsr_slave_1 entered promiscuous mode [ 192.317805][ T8909] debugfs: Directory 'hsr0' with parent '/' already present! [ 192.336998][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 192.385066][ T8911] team0: Port device team_slave_0 added [ 192.394638][ T8901] 8021q: adding VLAN 0 to HW filter on device bond0 [ 192.402569][ T8907] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 192.450603][ T8907] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 192.511315][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 192.520228][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 192.529153][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 192.537609][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 192.547349][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 192.574656][ T8911] team0: Port device team_slave_1 added [ 192.587917][ T8907] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 192.650813][ T8907] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 192.728714][ T8909] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 192.772187][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 192.780659][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 192.789172][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 192.796734][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 192.818810][ T8901] 8021q: adding VLAN 0 to HW filter on device team0 [ 192.832640][ T8909] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 192.872595][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 192.882408][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 192.898378][ T8898] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 192.918175][ T8909] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 192.960720][ T8909] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 193.071089][ T8911] device hsr_slave_0 entered promiscuous mode [ 193.128119][ T8911] device hsr_slave_1 entered promiscuous mode [ 193.177791][ T8911] debugfs: Directory 'hsr0' with parent '/' already present! [ 193.203613][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 193.213267][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 193.221991][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 193.229102][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 193.237034][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 193.244578][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 193.251984][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 193.260922][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 193.269326][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 193.276355][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 193.292071][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 193.344684][ T8898] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 193.355464][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 193.364809][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 193.419021][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 193.430733][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 193.439400][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 193.453862][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 193.462607][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 193.474284][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 193.498003][ T8904] 8021q: adding VLAN 0 to HW filter on device bond0 [ 193.532378][ T8907] 8021q: adding VLAN 0 to HW filter on device bond0 [ 193.541836][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 193.550671][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 193.559350][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 193.590484][ T8901] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 193.618456][ T8911] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 193.661179][ T8911] netdevsim netdevsim5 netdevsim1: renamed from eth1 02:26:24 executing program 0: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = socket$inet6(0xa, 0x3, 0x9) recvmmsg(r0, &(0x7f0000002b40)=[{{0x0, 0x40000, 0x0}}], 0x4000000000003be, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4a, &(0x7f0000000000)=0x8, 0x4) [ 193.719825][ T8907] 8021q: adding VLAN 0 to HW filter on device team0 [ 193.731936][ T8904] 8021q: adding VLAN 0 to HW filter on device team0 [ 193.743840][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 193.752536][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 193.766825][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 193.792358][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 193.834594][ T8911] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 193.870930][ T8911] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 193.941167][ T8909] 8021q: adding VLAN 0 to HW filter on device bond0 [ 193.955470][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 193.966929][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 193.982975][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 193.990277][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 194.005709][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 194.014453][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 194.023901][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 194.031026][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 194.039185][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 194.046647][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 194.054194][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 194.062992][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 194.071787][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 194.078905][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 194.115346][ T8901] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 194.147055][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 194.155389][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 194.163586][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 194.181978][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 194.198087][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 194.207401][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 194.222867][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 194.232144][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 194.240798][ T8917] bridge0: port 2(bridge_slave_1) entered blocking state [ 194.247924][ T8917] bridge0: port 2(bridge_slave_1) entered forwarding state [ 194.255659][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 02:26:25 executing program 0: clone(0x84007bf7, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() mknod(&(0x7f0000000100)='./file0\x00', 0x1142, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) ptrace(0x10, r0) creat(&(0x7f0000000240)='./file0\x00', 0x0) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000ffc000/0x1000)=nil) ptrace(0x11, r0) [ 194.284997][ T8909] 8021q: adding VLAN 0 to HW filter on device team0 [ 194.317558][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 194.326767][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 194.348799][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 194.357373][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 194.365329][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 194.373229][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 194.382184][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 194.390711][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 194.407928][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 194.416633][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 194.425946][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 194.434885][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 194.443465][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 194.451955][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 194.460693][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 194.510406][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 194.529280][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 194.542962][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 194.559123][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 194.569078][ T8904] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 194.582958][ T8907] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 194.607809][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 194.620492][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 194.630120][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 194.637164][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 194.644815][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 194.655017][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 194.668194][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 194.675257][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 194.683969][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 194.708374][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 02:26:25 executing program 1: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000006900)={0x1, 0x1, 0x3d, 0x508, 0x81, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x3c) [ 194.767924][ T8911] 8021q: adding VLAN 0 to HW filter on device bond0 [ 194.803371][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 194.812757][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 194.813544][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 194.829693][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 194.838604][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 194.847080][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 194.854604][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 194.862136][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 194.871858][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 194.886950][ T8904] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 194.917508][ T8911] 8021q: adding VLAN 0 to HW filter on device team0 [ 194.925900][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 194.934114][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 194.942669][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 194.950873][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 194.959776][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 194.968163][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 194.975825][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 194.992784][ T8909] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 02:26:25 executing program 1: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000006900)={0x1, 0x1, 0x3d, 0x508, 0x81, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x3c) [ 195.014148][ T8907] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 195.027115][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 195.036820][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 195.046098][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 195.053204][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 195.075818][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 195.094066][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 195.104341][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 195.111459][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 195.123364][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 02:26:25 executing program 0: clone(0x100000203, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r0 = creat(&(0x7f00000002c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x101) close(r0) execve(&(0x7f0000000100)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) close(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) clone(0x3102001ff0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) creat(&(0x7f0000000280)='./file1\x00', 0x0) write$P9_RSTATFS(r1, &(0x7f0000000080)={0x43}, 0x43) [ 195.169561][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 195.199436][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 02:26:26 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0) io_setup(0x8, &(0x7f0000000200)=0x0) io_submit(r2, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x7600, 0x3, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) socket$unix(0x1, 0x0, 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) [ 195.214077][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 195.229674][ T8947] devpts: called with bogus options [ 195.247398][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready 02:26:26 executing program 1: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x0, &(0x7f0000006900)={0x1, 0x1, 0x3d, 0x508, 0x81, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x3c) [ 195.276592][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 195.351733][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 195.388592][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 195.397193][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 195.486903][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 195.487605][ T8961] attempt to access beyond end of device [ 195.500852][ T8961] loop2: rw=2049, want=78, limit=63 [ 195.506218][ T8961] Buffer I/O error on dev loop2, logical block 77, lost async page write [ 195.515225][ T8961] attempt to access beyond end of device [ 195.521370][ T8961] loop2: rw=2049, want=79, limit=63 [ 195.526592][ T8961] Buffer I/O error on dev loop2, logical block 78, lost async page write [ 195.538717][ T8961] attempt to access beyond end of device [ 195.544714][ T8961] loop2: rw=2049, want=80, limit=63 [ 195.550060][ T8961] Buffer I/O error on dev loop2, logical block 79, lost async page write [ 195.558782][ T8961] attempt to access beyond end of device [ 195.562216][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 195.564484][ T8961] loop2: rw=2049, want=81, limit=63 [ 195.564502][ T8961] Buffer I/O error on dev loop2, logical block 80, lost async page write [ 195.587467][ T8961] attempt to access beyond end of device [ 195.593275][ T8961] loop2: rw=2049, want=130, limit=63 [ 195.598898][ T8961] Buffer I/O error on dev loop2, logical block 129, lost async page write [ 195.607522][ T8961] attempt to access beyond end of device [ 195.613309][ T8961] loop2: rw=2049, want=131, limit=63 [ 195.619799][ T8961] Buffer I/O error on dev loop2, logical block 130, lost async page write [ 195.623877][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 02:26:26 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0) io_setup(0x8, &(0x7f0000000200)=0x0) io_submit(r2, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x7600, 0x3, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) [ 195.628446][ T8961] attempt to access beyond end of device [ 195.628459][ T8961] loop2: rw=2049, want=132, limit=63 [ 195.647553][ T8961] Buffer I/O error on dev loop2, logical block 131, lost async page write [ 195.656241][ T8961] attempt to access beyond end of device [ 195.664279][ T8961] loop2: rw=2049, want=133, limit=63 [ 195.676507][ T8911] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 195.689389][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 195.696848][ T3057] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 195.717780][ T8961] Buffer I/O error on dev loop2, logical block 132, lost async page write 02:26:26 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r0 = syz_open_procfs(0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0x8607) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r3, 0x0, 0x8607) sendfile(r3, 0xffffffffffffffff, 0x0, 0x4000002) socket(0x0, 0x2, 0x0) socket(0xa, 0x0, 0x0) syz_mount_image$xfs(0x0, 0x0, 0x0, 0x1, &(0x7f0000000600)=[{0x0}], 0x0, 0x0) listen(0xffffffffffffffff, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) gettid() gettid() getpeername$unix(r4, &(0x7f0000000440), &(0x7f00000001c0)=0x6e) migrate_pages(0x0, 0x7, 0x0, 0x0) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000380)=""/133, 0x695}) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x20700, 0x8, [], 0x0, 0x6, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000180)=0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r5 = syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x1) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0) [ 195.743774][ T8961] attempt to access beyond end of device [ 195.754985][ T8909] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 195.772352][ T8961] loop2: rw=2049, want=142, limit=63 02:26:26 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x0, 0x0) fcntl$setstatus(r2, 0x40b, 0x0) [ 195.818652][ T8961] Buffer I/O error on dev loop2, logical block 141, lost async page write [ 195.862876][ T8911] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 195.893035][ T8961] attempt to access beyond end of device [ 195.912260][ T8915] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 195.927829][ T8961] loop2: rw=2049, want=143, limit=63 [ 195.928009][ T8915] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 195.934267][ T8961] Buffer I/O error on dev loop2, logical block 142, lost async page write [ 195.969212][ T8961] attempt to access beyond end of device [ 195.998041][ T8961] loop2: rw=2049, want=144, limit=63 [ 196.008148][ C1] hrtimer: interrupt took 47950 ns [ 196.027990][ T8961] attempt to access beyond end of device [ 196.136097][ T8961] loop2: rw=2049, want=145, limit=63 [ 196.155360][ T8961] attempt to access beyond end of device [ 196.177544][ T8961] loop2: rw=2049, want=257, limit=63 [ 196.244981][ T27] kauditd_printk_skb: 3 callbacks suppressed [ 196.245030][ T27] audit: type=1804 audit(1576117587.016:31): pid=8961 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir841568244/syzkaller.m7mUsQ/1/file0/file0" dev="loop2" ino=22 res=1 [ 196.284176][ T8961] attempt to access beyond end of device [ 196.299358][ T8961] loop2: rw=2049, want=277, limit=63 02:26:27 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0) io_setup(0x8, &(0x7f0000000200)=0x0) io_submit(r2, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x7600, 0x3, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) socket$unix(0x1, 0x0, 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) 02:26:27 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r0 = syz_open_procfs(0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0x8607) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r3, 0x0, 0x8607) sendfile(r3, 0xffffffffffffffff, 0x0, 0x4000002) socket(0x0, 0x2, 0x0) socket(0xa, 0x0, 0x0) syz_mount_image$xfs(0x0, 0x0, 0x0, 0x1, &(0x7f0000000600)=[{0x0}], 0x0, 0x0) listen(0xffffffffffffffff, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) gettid() gettid() getpeername$unix(r4, &(0x7f0000000440), &(0x7f00000001c0)=0x6e) migrate_pages(0x0, 0x7, 0x0, 0x0) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000380)=""/133, 0x695}) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x20700, 0x8, [], 0x0, 0x6, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000180)=0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r5 = syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x1) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0) 02:26:27 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000100)="1400000052008102a00f80854a36b8ab959916fb", 0x14}], 0x1}, 0x0) r1 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) recvmsg$kcm(r0, &(0x7f0000004680)={0x0, 0x0, &(0x7f0000004600)=[{&(0x7f00000041c0)=""/251, 0xfb}], 0x1}, 0x0) 02:26:27 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0) io_setup(0x8, &(0x7f0000000200)=0x0) io_submit(r2, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x7600, 0x3, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) socket$unix(0x1, 0x0, 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) 02:26:27 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0) io_setup(0x8, &(0x7f0000000200)=0x0) io_submit(r2, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x7600, 0x3, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) 02:26:27 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r0 = syz_open_procfs(0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0x8607) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r3, 0x0, 0x8607) sendfile(r3, 0xffffffffffffffff, 0x0, 0x4000002) socket(0x0, 0x2, 0x0) socket(0xa, 0x0, 0x0) syz_mount_image$xfs(0x0, 0x0, 0x0, 0x1, &(0x7f0000000600)=[{0x0}], 0x0, 0x0) listen(0xffffffffffffffff, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) gettid() gettid() getpeername$unix(r4, &(0x7f0000000440), &(0x7f00000001c0)=0x6e) migrate_pages(0x0, 0x7, 0x0, 0x0) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000380)=""/133, 0x695}) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x20700, 0x8, [], 0x0, 0x6, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000180)=0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r5 = syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x1) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0) [ 196.847048][ T9051] attempt to access beyond end of device 02:26:27 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r0 = syz_open_procfs(0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0x8607) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r3, 0x0, 0x8607) sendfile(r3, 0xffffffffffffffff, 0x0, 0x4000002) socket(0x0, 0x2, 0x0) socket(0xa, 0x0, 0x0) syz_mount_image$xfs(0x0, 0x0, 0x0, 0x1, &(0x7f0000000600)=[{0x0}], 0x0, 0x0) listen(0xffffffffffffffff, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) gettid() gettid() getpeername$unix(r4, &(0x7f0000000440), &(0x7f00000001c0)=0x6e) migrate_pages(0x0, 0x7, 0x0, 0x0) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000380)=""/133, 0x695}) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x20700, 0x8, [], 0x0, 0x6, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000180)=0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r5 = syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x1) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0) [ 196.952593][ T9051] loop4: rw=2049, want=78, limit=63 [ 197.008099][ T9051] attempt to access beyond end of device [ 197.029079][ T9051] loop4: rw=2049, want=79, limit=63 [ 197.082136][ T9051] attempt to access beyond end of device [ 197.088281][ T9051] loop4: rw=2049, want=80, limit=63 [ 197.093643][ T9051] attempt to access beyond end of device [ 197.106347][ T9051] loop4: rw=2049, want=81, limit=63 [ 197.112061][ T9051] attempt to access beyond end of device [ 197.124629][ T9067] attempt to access beyond end of device [ 197.125015][ T9051] loop4: rw=2049, want=130, limit=63 [ 197.145909][ T9051] attempt to access beyond end of device [ 197.152342][ T9051] loop4: rw=2049, want=131, limit=63 [ 197.158056][ T9051] attempt to access beyond end of device [ 197.169865][ T9051] loop4: rw=2049, want=132, limit=63 [ 197.175277][ T9051] attempt to access beyond end of device [ 197.198751][ T9060] attempt to access beyond end of device [ 197.209973][ T9051] loop4: rw=2049, want=133, limit=63 [ 197.217432][ T9051] attempt to access beyond end of device [ 197.227955][ T9067] loop0: rw=2049, want=78, limit=63 [ 197.233216][ T9067] attempt to access beyond end of device [ 197.252543][ T9060] loop2: rw=2049, want=78, limit=63 [ 197.269659][ T9067] loop0: rw=2049, want=79, limit=63 [ 197.280636][ T9060] attempt to access beyond end of device [ 197.287584][ T9051] loop4: rw=2049, want=142, limit=63 [ 197.302939][ T9067] attempt to access beyond end of device [ 197.336105][ T9051] attempt to access beyond end of device [ 197.342661][ T9051] loop4: rw=2049, want=143, limit=63 [ 197.353941][ T9051] attempt to access beyond end of device [ 197.377629][ T9051] loop4: rw=2049, want=144, limit=63 [ 197.385648][ T9051] attempt to access beyond end of device [ 197.392527][ T9051] loop4: rw=2049, want=145, limit=63 [ 197.405378][ T9051] attempt to access beyond end of device [ 197.415838][ T9051] loop4: rw=2049, want=257, limit=63 [ 197.417472][ T9067] loop0: rw=2049, want=80, limit=63 [ 197.452574][ T9060] loop2: rw=2049, want=79, limit=63 [ 197.469318][ T9067] attempt to access beyond end of device [ 197.476254][ T9060] attempt to access beyond end of device [ 197.486609][ T9067] loop0: rw=2049, want=81, limit=63 [ 197.494722][ T9060] loop2: rw=2049, want=80, limit=63 [ 197.504647][ T9060] attempt to access beyond end of device [ 197.513067][ T9067] attempt to access beyond end of device [ 197.523212][ T9060] loop2: rw=2049, want=81, limit=63 [ 197.530904][ T9067] loop0: rw=2049, want=130, limit=63 02:26:28 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r0 = syz_open_procfs(0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0x8607) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r3, 0x0, 0x8607) sendfile(r3, 0xffffffffffffffff, 0x0, 0x4000002) socket(0x0, 0x2, 0x0) socket(0xa, 0x0, 0x0) syz_mount_image$xfs(0x0, 0x0, 0x0, 0x1, &(0x7f0000000600)=[{0x0}], 0x0, 0x0) listen(0xffffffffffffffff, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) gettid() gettid() getpeername$unix(r4, &(0x7f0000000440), &(0x7f00000001c0)=0x6e) migrate_pages(0x0, 0x7, 0x0, 0x0) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000380)=""/133, 0x695}) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x20700, 0x8, [], 0x0, 0x6, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000180)=0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r5 = syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x1) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0) [ 197.565647][ T9060] attempt to access beyond end of device 02:26:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r0 = syz_open_procfs(0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0x8607) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r3, 0x0, 0x8607) sendfile(r3, 0xffffffffffffffff, 0x0, 0x4000002) socket(0x0, 0x2, 0x0) socket(0xa, 0x0, 0x0) syz_mount_image$xfs(0x0, 0x0, 0x0, 0x1, &(0x7f0000000600)=[{0x0}], 0x0, 0x0) listen(0xffffffffffffffff, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) gettid() gettid() getpeername$unix(r4, &(0x7f0000000440), &(0x7f00000001c0)=0x6e) migrate_pages(0x0, 0x7, 0x0, 0x0) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000380)=""/133, 0x695}) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x20700, 0x8, [], 0x0, 0x6, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000180)=0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r5 = syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x1) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0) [ 197.619006][ T9067] attempt to access beyond end of device [ 197.624694][ T9067] loop0: rw=2049, want=131, limit=63 [ 197.634805][ T9060] loop2: rw=2049, want=130, limit=63 [ 197.653314][ T9060] attempt to access beyond end of device 02:26:28 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0) io_setup(0x8, &(0x7f0000000200)=0x0) io_submit(r2, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x7600, 0x3, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) socket$unix(0x1, 0x0, 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) [ 197.714910][ T9067] attempt to access beyond end of device [ 197.734012][ T9060] loop2: rw=2049, want=131, limit=63 02:26:28 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r0 = syz_open_procfs(0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0x8607) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r3, 0x0, 0x8607) sendfile(r3, 0xffffffffffffffff, 0x0, 0x4000002) socket(0x0, 0x2, 0x0) socket(0xa, 0x0, 0x0) syz_mount_image$xfs(0x0, 0x0, 0x0, 0x1, &(0x7f0000000600)=[{0x0}], 0x0, 0x0) listen(0xffffffffffffffff, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) gettid() gettid() getpeername$unix(r4, &(0x7f0000000440), &(0x7f00000001c0)=0x6e) migrate_pages(0x0, 0x7, 0x0, 0x0) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000380)=""/133, 0x695}) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x20700, 0x8, [], 0x0, 0x6, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000180)=0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r5 = syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x1) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0) [ 197.759318][ T9067] loop0: rw=2049, want=132, limit=63 [ 197.786204][ T9067] attempt to access beyond end of device [ 197.797865][ T9060] attempt to access beyond end of device [ 197.807147][ T9060] loop2: rw=2049, want=132, limit=63 [ 197.814224][ T9060] attempt to access beyond end of device [ 197.821608][ T9067] loop0: rw=2049, want=133, limit=63 [ 197.859234][ T9067] attempt to access beyond end of device [ 197.872222][ T9060] loop2: rw=2049, want=133, limit=63 [ 197.896513][ T9060] attempt to access beyond end of device [ 197.922833][ T9067] loop0: rw=2049, want=142, limit=63 [ 197.944461][ T9067] attempt to access beyond end of device [ 197.945247][ T9060] loop2: rw=2049, want=142, limit=63 [ 197.986312][ T9067] loop0: rw=2049, want=143, limit=63 [ 198.023717][ T9067] attempt to access beyond end of device [ 198.023884][ T9060] attempt to access beyond end of device [ 198.037966][ T9060] loop2: rw=2049, want=143, limit=63 [ 198.044160][ T9060] attempt to access beyond end of device [ 198.051262][ T9067] loop0: rw=2049, want=144, limit=63 [ 198.087283][ T9060] loop2: rw=2049, want=144, limit=63 [ 198.094679][ T9067] attempt to access beyond end of device [ 198.108405][ T9060] attempt to access beyond end of device [ 198.139335][ T9060] loop2: rw=2049, want=145, limit=63 [ 198.145223][ T9067] loop0: rw=2049, want=145, limit=63 [ 198.153507][ T9067] attempt to access beyond end of device [ 198.161211][ T9060] attempt to access beyond end of device [ 198.176662][ T9067] loop0: rw=2049, want=257, limit=63 [ 198.188819][ T9060] loop2: rw=2049, want=257, limit=63 02:26:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f0000000080)) 02:26:29 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0) io_setup(0x8, &(0x7f0000000200)=0x0) io_submit(r2, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x7600, 0x3, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) 02:26:29 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0) io_setup(0x8, &(0x7f0000000200)=0x0) io_submit(r2, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x7600, 0x3, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) socket$unix(0x1, 0x0, 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) 02:26:29 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r0 = syz_open_procfs(0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0x8607) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r3, 0x0, 0x8607) sendfile(r3, 0xffffffffffffffff, 0x0, 0x4000002) socket(0x0, 0x2, 0x0) socket(0xa, 0x0, 0x0) syz_mount_image$xfs(0x0, 0x0, 0x0, 0x1, &(0x7f0000000600)=[{0x0}], 0x0, 0x0) listen(0xffffffffffffffff, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) gettid() gettid() getpeername$unix(r4, &(0x7f0000000440), &(0x7f00000001c0)=0x6e) migrate_pages(0x0, 0x7, 0x0, 0x0) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000380)=""/133, 0x695}) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x20700, 0x8, [], 0x0, 0x6, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000180)=0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r5 = syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x1) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0) 02:26:29 executing program 3: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x40000000, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008108040f80ecdb4cb92e0a480e0010000000e8bd6efb250009000e000100400000ff050005001201", 0x33fe0}], 0x1}, 0x0) 02:26:29 executing program 4: r0 = socket(0x2, 0xc003, 0x6) connect$unix(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="8202262f664000000000f148da4b71a8e1ee7de20184f87a7830f9cffff7cb7a2606fc530b2e5d6923a8fe8cb673453e3cafe4f9d34867565ecd5a7cf0f01893e0e8b0caabbe1382ac33ba17494ef044f8796fb397a63ad4d2f2be0496a79a138e3131f4a269b52086eb323ca99f246084845237567131d1caa9cb88d9bc7c5f7f302a7e4db0e37765cf1fc815df3b8b3b92c71993d76304122029cba2ac7238e2a49dc12aa9a73ee87c0b35969cf26d896d49a73b9e5ecc00008e2114147394d0c72d60c5db3fd78ca175fe7beb97fa476c33a88aa3d9d02e962302465b8768ff7a68b110e0db76c7d088cca671f5764dcd2bed04f40ec3441f271679630462002e3e5bc0fa24ea512de0888b8e9e6e3ce141ad57c210a7c6"], 0x10) write(r0, &(0x7f0000000080)="9e69aa56000000000004bf9aab4230408600000000030c000000000000651c1ece0e018008e6b7ca", 0x28) 02:26:29 executing program 5: clone(0x84007bf7, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() mknod(&(0x7f0000000100)='./file0\x00', 0x1142, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) ptrace(0x10, r0) creat(&(0x7f0000000240)='./file0\x00', 0x0) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000, 0x0, &(0x7f0000ffc000/0x1000)=nil) [ 198.720755][ T9187] attempt to access beyond end of device [ 198.726443][ T9187] loop0: rw=2049, want=78, limit=63 [ 198.732907][ T9206] attempt to access beyond end of device [ 198.738877][ T9206] loop2: rw=2049, want=78, limit=63 [ 198.744195][ T9206] attempt to access beyond end of device [ 198.750077][ T9187] attempt to access beyond end of device [ 198.755784][ T9187] loop0: rw=2049, want=79, limit=63 [ 198.767777][ T9206] loop2: rw=2049, want=79, limit=63 [ 198.769032][ T9187] attempt to access beyond end of device [ 198.774043][ T9206] attempt to access beyond end of device [ 198.784604][ T9206] loop2: rw=2049, want=80, limit=63 [ 198.790023][ T9206] attempt to access beyond end of device [ 198.795864][ T9206] loop2: rw=2049, want=81, limit=63 [ 198.801310][ T9206] attempt to access beyond end of device [ 198.807061][ T9206] loop2: rw=2049, want=130, limit=63 [ 198.812589][ T9206] attempt to access beyond end of device 02:26:29 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000140)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000040), 0x1c) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = dup2(r1, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x129f0817) sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) [ 198.818660][ T9206] loop2: rw=2049, want=131, limit=63 [ 198.825385][ T9206] attempt to access beyond end of device [ 198.841842][ T9187] loop0: rw=2049, want=80, limit=63 [ 198.847801][ T9206] loop2: rw=2049, want=132, limit=63 [ 198.858376][ T9187] attempt to access beyond end of device [ 198.874246][ T9187] loop0: rw=2049, want=81, limit=63 [ 198.879637][ T9206] attempt to access beyond end of device [ 198.885403][ T9187] attempt to access beyond end of device [ 198.899121][ T9206] loop2: rw=2049, want=133, limit=63 [ 198.904566][ T9187] loop0: rw=2049, want=130, limit=63 [ 198.947971][ T9206] attempt to access beyond end of device [ 198.962062][ T9187] attempt to access beyond end of device [ 198.998842][ T9206] loop2: rw=2049, want=142, limit=63 [ 199.004312][ T9187] loop0: rw=2049, want=131, limit=63 [ 199.022041][ T9187] attempt to access beyond end of device [ 199.027891][ T9206] attempt to access beyond end of device 02:26:29 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r0 = syz_open_procfs(0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0x8607) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r3, 0x0, 0x8607) sendfile(r3, 0xffffffffffffffff, 0x0, 0x4000002) socket(0x0, 0x2, 0x0) socket(0xa, 0x0, 0x0) syz_mount_image$xfs(0x0, 0x0, 0x0, 0x1, &(0x7f0000000600)=[{0x0}], 0x0, 0x0) listen(0xffffffffffffffff, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) gettid() gettid() getpeername$unix(r4, &(0x7f0000000440), &(0x7f00000001c0)=0x6e) migrate_pages(0x0, 0x7, 0x0, 0x0) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000380)=""/133, 0x695}) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x20700, 0x8, [], 0x0, 0x6, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000180)=0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r5 = syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x1) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 199.082797][ T9187] loop0: rw=2049, want=132, limit=63 [ 199.093179][ T9206] loop2: rw=2049, want=143, limit=63 [ 199.108099][ T9206] attempt to access beyond end of device [ 199.109113][ T9187] attempt to access beyond end of device [ 199.124463][ T9206] loop2: rw=2049, want=144, limit=63 02:26:29 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xb, 0x101, 0x7, 0x5, 0x1}, 0x3c) r1 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', r0}, 0x10) [ 199.153073][ T9206] attempt to access beyond end of device [ 199.159204][ T9187] loop0: rw=2049, want=133, limit=63 [ 199.177883][ T9187] attempt to access beyond end of device [ 199.197837][ T9187] loop0: rw=2049, want=142, limit=63 [ 199.217774][ T9206] loop2: rw=2049, want=145, limit=63 [ 199.223397][ T9206] attempt to access beyond end of device [ 199.241769][ T9187] attempt to access beyond end of device 02:26:30 executing program 3: bpf$BPF_PROG_QUERY(0x6, &(0x7f0000000200)={0xffffffffffffffff, 0x4ecc159f23fd4566, 0x0, 0x0, 0x0}, 0x20) [ 199.275210][ T9187] loop0: rw=2049, want=143, limit=63 [ 199.280901][ T9206] loop2: rw=2049, want=257, limit=63 [ 199.300018][ T9187] attempt to access beyond end of device 02:26:30 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) recvmsg(r0, &(0x7f0000002e80)={0x0, 0x0, 0x0}, 0x0) [ 199.370030][ T9187] loop0: rw=2049, want=144, limit=63 02:26:30 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_pid(r0, &(0x7f0000000040), 0xfffffffffffffffa) [ 199.451025][ T9187] attempt to access beyond end of device [ 199.534162][ T9187] loop0: rw=2049, want=145, limit=63 [ 199.570444][ T9187] attempt to access beyond end of device [ 199.599108][ T9187] loop0: rw=2049, want=257, limit=63 02:26:30 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0) io_setup(0x8, &(0x7f0000000200)=0x0) io_submit(r2, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x7600, 0x3, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) 02:26:30 executing program 3: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/\x00\x00\x10\x00', 0x0, 0x0) 02:26:30 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x0) io_setup(0x8, &(0x7f0000000200)=0x0) io_submit(r2, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x7600, 0x3, 0x1, 0x0, r1, &(0x7f0000000000), 0x10000}]) socket$unix(0x1, 0x0, 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) 02:26:30 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r0 = syz_open_procfs(0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0x8607) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r3, 0x0, 0x8607) sendfile(r3, 0xffffffffffffffff, 0x0, 0x4000002) socket(0x0, 0x2, 0x0) socket(0xa, 0x0, 0x0) syz_mount_image$xfs(0x0, 0x0, 0x0, 0x1, &(0x7f0000000600)=[{0x0}], 0x0, 0x0) listen(0xffffffffffffffff, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) gettid() gettid() getpeername$unix(r4, &(0x7f0000000440), &(0x7f00000001c0)=0x6e) migrate_pages(0x0, 0x7, 0x0, 0x0) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000380)=""/133, 0x695}) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000540)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x20700, 0x8, [], 0x0, 0x6, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000180)=0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) r5 = syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x1) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 02:26:30 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2400, 0x0) 02:26:30 executing program 3: syz_open_dev$dri(&(0x7f00000002c0)='/dev/dri/card#\x00', 0x0, 0x80180) 02:26:30 executing program 3: r0 = socket$inet(0x2, 0x803, 0x85) sendto$inet(r0, 0x0, 0x157, 0xc850, &(0x7f0000514ff0), 0x10) 02:26:30 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000080)={'\xfe\x00\x00\x00\x00\x00\x00\x00\xe0t:T\x00', {0x2, 0x0, @multicast2}}) 02:26:30 executing program 3: openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) umount2(&(0x7f0000000540)='./file0\x00', 0x3) [ 200.288504][ T9286] attempt to access beyond end of device [ 200.294511][ T9286] loop0: rw=2049, want=78, limit=63 [ 200.308037][ T9286] attempt to access beyond end of device [ 200.314002][ T9286] loop0: rw=2049, want=79, limit=63 [ 200.325675][ T9286] attempt to access beyond end of device [ 200.331693][ T9286] loop0: rw=2049, want=80, limit=63 02:26:31 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000100)={'nlmon\t\x00\x7f\xed\xb1[\xe5\xa3\xcd\xb6\x00'}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x4cb], 0x100000}) setsockopt$IP_VS_SO_SET_EDIT(0xffffffffffffffff, 0x28, 0x2, &(0x7f0000000040)={0x0, @dev, 0x0, 0x0, 'sed\x00'}, 0x7) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 200.337236][ T9286] attempt to access beyond end of device [ 200.355868][ T9286] loop0: rw=2049, want=81, limit=63 02:26:31 executing program 5: r0 = socket$kcm(0x29, 0x2, 0x0) recvmsg(r0, &(0x7f0000002e80)={0x0, 0x0, 0x0}, 0x0) 02:26:31 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = creat(&(0x7f0000000240)='./bus\x00', 0x0) fcntl$setstatus(r2, 0x4, 0x44000) fallocate(r2, 0x0, 0x0, 0xa6ba0) io_setup(0x40000100000003, &(0x7f0000000200)=0x0) io_submit(r3, 0x653, &(0x7f0000000540)=[&(0x7f00000000c0)={0x804000000000000, 0x0, 0xd, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 200.414515][ T9286] attempt to access beyond end of device [ 200.474515][ T9286] loop0: rw=2049, want=130, limit=63 [ 200.531607][ T9312] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 200.569231][ T9286] buffer_io_error: 66 callbacks suppressed [ 200.569242][ T9286] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 200.696589][ T9308] list_del corruption. prev->next should be ffff888093096510, but was ffff88821b833670 [ 200.706986][ T9308] ------------[ cut here ]------------ [ 200.712453][ T9308] kernel BUG at lib/list_debug.c:51! [ 200.717839][ T9308] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 200.723908][ T9308] CPU: 0 PID: 9308 Comm: syz-executor.4 Not tainted 5.5.0-rc1-next-20191211-syzkaller #0 [ 200.733701][ T9308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 200.737647][ T9286] attempt to access beyond end of device [ 200.743783][ T9308] RIP: 0010:__list_del_entry_valid.cold+0xf/0x4f [ 200.743797][ T9308] Code: e8 c9 00 cb fd 0f 0b 48 89 f1 48 c7 c7 c0 10 70 88 4c 89 e6 e8 b5 00 cb fd 0f 0b 4c 89 f6 48 c7 c7 60 12 70 88 e8 a4 00 cb fd <0f> 0b 4c 89 ea 4c 89 f6 48 c7 c7 a0 11 70 88 e8 90 00 cb fd 0f 0b [ 200.743803][ T9308] RSP: 0018:ffffc90002837c00 EFLAGS: 00010282 [ 200.743812][ T9308] RAX: 0000000000000054 RBX: ffff8882199dae40 RCX: 0000000000000000 [ 200.743819][ T9308] RDX: 0000000000000000 RSI: ffffffff815e8576 RDI: fffff52000506f72 [ 200.743826][ T9308] RBP: ffffc90002837c18 R08: 0000000000000054 R09: ffffed1015d06621 [ 200.743834][ T9308] R10: ffffed1015d06620 R11: ffff8880ae833107 R12: ffff8882199daf40 [ 200.743842][ T9308] R13: ffff88821b833670 R14: ffff888093096510 R15: ffff888093096510 [ 200.743852][ T9308] FS: 0000000001b07940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 200.743859][ T9308] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 200.743866][ T9308] CR2: 00007f2a0a230b10 CR3: 00000000a8859000 CR4: 00000000001426f0 [ 200.743877][ T9308] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 200.743883][ T9308] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 200.743885][ T9308] Call Trace: [ 200.743901][ T9308] __dentry_kill+0x1fd/0x600 [ 200.743911][ T9308] ? dput+0x38/0xe10 [ 200.743922][ T9308] ? dput+0x38/0xe10 [ 200.743932][ T9308] dput+0x62f/0xe10 [ 200.743954][ T9308] simple_recursive_removal+0x5bc/0x6d0 [ 200.743968][ T9308] ? debugfs_rename+0x7f0/0x7f0 [ 200.743985][ T9308] debugfs_remove+0x5e/0x80 [ 200.743998][ T9308] kvm_put_kvm+0x136/0xcc0 [ 200.744013][ T9308] ? kvm_irqfd_release+0xe2/0x120 [ 200.744025][ T9308] ? kvm_irqfd_release+0xe2/0x120 [ 200.744038][ T9308] kvm_vm_release+0x44/0x60 [ 200.744050][ T9308] __fput+0x2ff/0x890 [ 200.744062][ T9308] ? kvm_dev_ioctl+0x17d0/0x17d0 [ 200.744075][ T9308] ____fput+0x16/0x20 [ 200.744088][ T9308] task_work_run+0x145/0x1c0 [ 200.744103][ T9308] exit_to_usermode_loop+0x316/0x380 [ 200.744121][ T9308] do_syscall_64+0x676/0x790 [ 200.752305][ T9286] loop0: rw=2049, want=131, limit=63 [ 200.756064][ T9308] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 200.756080][ T9308] RIP: 0033:0x4144a1 [ 200.777993][ T9286] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 200.781736][ T9308] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 200.781743][ T9308] RSP: 002b:00007ffcb2285920 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 200.814645][ T9286] attempt to access beyond end of device [ 200.821543][ T9308] RAX: 0000000000000000 RBX: 0000000000000006 RCX: 00000000004144a1 [ 200.821550][ T9308] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 200.821557][ T9308] RBP: 0000000000000001 R08: 00000000fc2b66a5 R09: 00000000fc2b66a9 [ 200.821564][ T9308] R10: 00007ffcb2285a00 R11: 0000000000000293 R12: 000000000075c9a0 [ 200.821570][ T9308] R13: 000000000075c9a0 R14: 0000000000760b40 R15: 000000000075bfd4 [ 200.821580][ T9308] Modules linked in: [ 200.821815][ T9308] ---[ end trace 5f692e39c211c7b9 ]--- [ 200.833104][ T9286] loop0: rw=2049, want=132, limit=63 [ 200.837136][ T9308] RIP: 0010:__list_del_entry_valid.cold+0xf/0x4f [ 200.837147][ T9308] Code: e8 c9 00 cb fd 0f 0b 48 89 f1 48 c7 c7 c0 10 70 88 4c 89 e6 e8 b5 00 cb fd 0f 0b 4c 89 f6 48 c7 c7 60 12 70 88 e8 a4 00 cb fd <0f> 0b 4c 89 ea 4c 89 f6 48 c7 c7 a0 11 70 88 e8 90 00 cb fd 0f 0b [ 200.837159][ T9308] RSP: 0018:ffffc90002837c00 EFLAGS: 00010282 [ 200.851855][ T4089] kobject: 'loop1' (0000000010ed213b): kobject_uevent_env [ 200.853125][ T9308] RAX: 0000000000000054 RBX: ffff8882199dae40 RCX: 0000000000000000 [ 200.881080][ T4089] kobject: 'loop1' (0000000010ed213b): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 200.886064][ T9308] RDX: 0000000000000000 RSI: ffffffff815e8576 RDI: fffff52000506f72 [ 200.886073][ T9308] RBP: ffffc90002837c18 R08: 0000000000000054 R09: ffffed1015d06621 [ 200.886081][ T9308] R10: ffffed1015d06620 R11: ffff8880ae833107 R12: ffff8882199daf40 [ 200.886089][ T9308] R13: ffff88821b833670 R14: ffff888093096510 R15: ffff888093096510 [ 200.886103][ T9308] FS: 0000000001b07940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 200.906332][ T9286] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 200.910043][ T9308] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 200.910051][ T9308] CR2: 00007f2a0a230b10 CR3: 00000000a8859000 CR4: 00000000001426f0 [ 200.910061][ T9308] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 200.910069][ T9308] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 200.910077][ T9308] Kernel panic - not syncing: Fatal exception [ 200.911755][ T9308] Kernel Offset: disabled [ 201.201899][ T9308] Rebooting in 86400 seconds..