[info] Using makefile-style concurrent boot in runlevel 2. [ 43.253722][ T26] audit: type=1800 audit(1573881531.945:21): pid=7453 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="bootlogs" dev="sda1" ino=2452 res=0 [ 43.303825][ T26] audit: type=1800 audit(1573881531.945:22): pid=7453 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="motd" dev="sda1" ino=2480 res=0 [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.61' (ECDSA) to the list of known hosts. 2019/11/16 05:19:02 fuzzer started 2019/11/16 05:19:04 dialing manager at 10.128.0.105:34521 2019/11/16 05:19:04 syscalls: 2566 2019/11/16 05:19:04 code coverage: enabled 2019/11/16 05:19:04 comparison tracing: enabled 2019/11/16 05:19:04 extra coverage: extra coverage is not supported by the kernel 2019/11/16 05:19:04 setuid sandbox: enabled 2019/11/16 05:19:04 namespace sandbox: enabled 2019/11/16 05:19:04 Android sandbox: /sys/fs/selinux/policy does not exist 2019/11/16 05:19:04 fault injection: enabled 2019/11/16 05:19:04 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/11/16 05:19:04 net packet injection: enabled 2019/11/16 05:19:04 net device setup: enabled 2019/11/16 05:19:04 concurrency sanitizer: enabled 2019/11/16 05:19:04 devlink PCI setup: PCI device 0000:00:10.0 is not available 2019/11/16 05:19:04 adding functions to KCSAN blacklist: 'find_next_bit' 'pipe_poll' 'ext4_has_free_clusters' 05:19:05 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = socket$inet(0x2, 0x803, 0xa0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000002d80)={@multicast2, @local}, 0xc) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x2, &(0x7f0000000300)={{{@in6=@empty={[0x8]}, @in=@remote}}, {{@in6=@mcast2}}}, 0xe8) 05:19:06 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f00000002c0)=0x1, 0x4) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='syz_tun\x00', 0x10) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @broadcast}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000740)='ip_vti0\x00', 0xfe52) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000080), 0x4) syzkaller login: [ 57.256399][ T7625] IPVS: ftp: loaded support on port[0] = 21 [ 57.343882][ T7625] chnl_net:caif_netlink_parms(): no params data found [ 57.403745][ T7625] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.420460][ T7625] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.440830][ T7625] device bridge_slave_0 entered promiscuous mode [ 57.451236][ T7625] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.480416][ T7625] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.488234][ T7625] device bridge_slave_1 entered promiscuous mode 05:19:06 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x200000000000df8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000040)=0xfff, 0x4) open(0x0, 0x101000, 0x20) sendto$inet(r1, 0x0, 0x0, 0x24054095, &(0x7f0000001180)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x448040, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000001c0)='veth1_to_bridge\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe16, 0x5dc, 0x0, 0xffffffffffffffa0) [ 57.506804][ T7625] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 57.517383][ T7625] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 57.531481][ T7628] IPVS: ftp: loaded support on port[0] = 21 [ 57.537229][ T7625] team0: Port device team_slave_0 added [ 57.547226][ T7625] team0: Port device team_slave_1 added [ 57.632978][ T7625] device hsr_slave_0 entered promiscuous mode [ 57.690662][ T7625] device hsr_slave_1 entered promiscuous mode [ 57.786266][ T7630] IPVS: ftp: loaded support on port[0] = 21 05:19:06 executing program 3: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) [ 57.869757][ T7625] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.876964][ T7625] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.884396][ T7625] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.891486][ T7625] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.944351][ T7628] chnl_net:caif_netlink_parms(): no params data found [ 58.071381][ T7625] 8021q: adding VLAN 0 to HW filter on device bond0 [ 58.142194][ T7628] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.149472][ T7628] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.191481][ T7628] device bridge_slave_0 entered promiscuous mode [ 58.230967][ T7628] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.238041][ T7628] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.290542][ T7628] device bridge_slave_1 entered promiscuous mode [ 58.326605][ T7625] 8021q: adding VLAN 0 to HW filter on device team0 [ 58.366266][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 58.381844][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.421015][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.452608][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 58.489668][ T7658] IPVS: ftp: loaded support on port[0] = 21 [ 58.501398][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 58.525251][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 58.541220][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.548379][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 58.609034][ T7628] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 58.644833][ T7630] chnl_net:caif_netlink_parms(): no params data found [ 58.663135][ T7656] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 58.673144][ T7656] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 58.701492][ T7656] bridge0: port 2(bridge_slave_1) entered blocking state 05:19:07 executing program 4: setresuid(0x0, 0xee01, 0x0) r0 = geteuid() setresuid(0x0, 0x0, r0) setfsuid(r0) [ 58.709319][ T7656] bridge0: port 2(bridge_slave_1) entered forwarding state [ 58.765708][ T7628] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 58.863024][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 58.906660][ T7628] team0: Port device team_slave_0 added [ 58.952899][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 58.962431][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 58.992250][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 59.032172][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 59.071140][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 59.080134][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 59.140948][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 59.162455][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 59.182490][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 59.211043][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 59.253221][ T7628] team0: Port device team_slave_1 added [ 59.260181][ T7625] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 59.351052][ T7630] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.358280][ T7630] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.363935][ T7662] IPVS: ftp: loaded support on port[0] = 21 05:19:08 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x3, 0x0, 0x1000, &(0x7f000003a000/0x1000)=nil}) r3 = eventfd(0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x0, 0x0, 0x1, r3}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 59.392450][ T7630] device bridge_slave_0 entered promiscuous mode [ 59.445210][ T7628] device hsr_slave_0 entered promiscuous mode [ 59.492151][ T7628] device hsr_slave_1 entered promiscuous mode [ 59.570453][ T7628] debugfs: Directory 'hsr0' with parent '/' already present! [ 59.591417][ T7630] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.598514][ T7630] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.606497][ T7630] device bridge_slave_1 entered promiscuous mode [ 59.629303][ T7673] IPVS: ftp: loaded support on port[0] = 21 [ 59.653244][ T7630] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.665374][ T7630] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.711056][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 59.718559][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 59.744185][ T7658] chnl_net:caif_netlink_parms(): no params data found [ 59.757227][ T7625] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 59.834613][ T7630] team0: Port device team_slave_0 added [ 59.893605][ T7630] team0: Port device team_slave_1 added [ 60.015024][ T7630] device hsr_slave_0 entered promiscuous mode [ 60.070627][ T7630] device hsr_slave_1 entered promiscuous mode [ 60.102404][ T7630] debugfs: Directory 'hsr0' with parent '/' already present! [ 60.109933][ T7658] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.120494][ T7658] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.128429][ T7658] device bridge_slave_0 entered promiscuous mode [ 60.181509][ T7628] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.229350][ T7658] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.240702][ T7658] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.248715][ T7658] device bridge_slave_1 entered promiscuous mode [ 60.295965][ T7628] 8021q: adding VLAN 0 to HW filter on device team0 [ 60.343350][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.351553][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.413471][ T7662] chnl_net:caif_netlink_parms(): no params data found [ 60.450426][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 60.459129][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 60.567587][ T3017] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.574714][ T3017] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.660905][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 60.694498][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 60.744258][ T3017] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.751436][ T3017] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.793829][ T7658] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.828974][ T7673] chnl_net:caif_netlink_parms(): no params data found [ 60.859428][ T7628] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 60.922861][ T7628] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 60.987028][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 61.024972][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 61.061487][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 61.110531][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 61.144024][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 61.203668][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 61.243476][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 61.281506][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 61.330754][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.381153][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 61.430824][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.525324][ T7658] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 05:19:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = socket$inet(0x2, 0x803, 0xa0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000002d80)={@multicast2, @local}, 0xc) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x2, &(0x7f0000000300)={{{@in6=@empty={[0x8]}, @in=@remote}}, {{@in6=@mcast2}}}, 0xe8) [ 61.573524][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 61.596222][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 61.641305][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 61.668011][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 61.720235][ T7630] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.754705][ T7628] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 61.791811][ T7662] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.811441][ T7662] bridge0: port 1(bridge_slave_0) entered disabled state [ 61.846952][ T7662] device bridge_slave_0 entered promiscuous mode [ 61.880765][ T7630] 8021q: adding VLAN 0 to HW filter on device team0 [ 61.909679][ T7658] team0: Port device team_slave_0 added [ 61.931379][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 61.939113][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.984042][ T7662] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.994278][ T7662] bridge0: port 2(bridge_slave_1) entered disabled state 05:19:10 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = socket$inet(0x2, 0x803, 0xa0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000002d80)={@multicast2, @local}, 0xc) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x2, &(0x7f0000000300)={{{@in6=@empty={[0x8]}, @in=@remote}}, {{@in6=@mcast2}}}, 0xe8) [ 62.030686][ T7662] device bridge_slave_1 entered promiscuous mode [ 62.091377][ T7658] team0: Port device team_slave_1 added [ 62.108650][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 62.118648][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 62.147356][ T3017] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.155016][ T3017] bridge0: port 1(bridge_slave_0) entered forwarding state [ 62.194797][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 62.213679][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 62.232503][ T3017] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.239975][ T3017] bridge0: port 2(bridge_slave_1) entered forwarding state [ 62.265017][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 62.291832][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 62.321649][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 62.342768][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 62.376312][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 62.395132][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 62.415310][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 62.427708][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 62.451912][ T7673] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.465606][ T7673] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.480805][ T7673] device bridge_slave_0 entered promiscuous mode [ 62.503495][ T7630] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 62.520161][ T7630] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 62.530747][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 62.538887][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 62.547065][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 62.556428][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 62.566383][ T7673] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.573561][ T7673] bridge0: port 2(bridge_slave_1) entered disabled state 05:19:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = socket$inet(0x2, 0x803, 0xa0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000002d80)={@multicast2, @local}, 0xc) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x2, &(0x7f0000000300)={{{@in6=@empty={[0x8]}, @in=@remote}}, {{@in6=@mcast2}}}, 0xe8) [ 62.583071][ T7673] device bridge_slave_1 entered promiscuous mode [ 62.642622][ T7658] device hsr_slave_0 entered promiscuous mode [ 62.680740][ T7658] device hsr_slave_1 entered promiscuous mode [ 62.720407][ T7658] debugfs: Directory 'hsr0' with parent '/' already present! [ 62.734699][ T7662] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 62.745241][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 62.752851][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 62.782553][ T7630] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 62.791497][ T7662] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 62.824347][ T7673] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link 05:19:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = socket$inet(0x2, 0x803, 0xa0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000002d80)={@multicast2, @local}, 0xc) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x2, &(0x7f0000000300)={{{@in6=@empty={[0x8]}, @in=@remote}}, {{@in6=@mcast2}}}, 0xe8) [ 62.914399][ T7673] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 62.979771][ T7662] team0: Port device team_slave_0 added [ 62.988208][ T7662] team0: Port device team_slave_1 added 05:19:11 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f00000002c0)=0x1, 0x4) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='syz_tun\x00', 0x10) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @broadcast}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000740)='ip_vti0\x00', 0xfe52) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000080), 0x4) [ 63.062010][ T7673] team0: Port device team_slave_0 added [ 63.068864][ T7673] team0: Port device team_slave_1 added 05:19:11 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = socket$inet(0x2, 0x803, 0xa0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000002d80)={@multicast2, @local}, 0xc) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x2, &(0x7f0000000300)={{{@in6=@empty={[0x8]}, @in=@remote}}, {{@in6=@mcast2}}}, 0xe8) [ 63.192692][ T7662] device hsr_slave_0 entered promiscuous mode [ 63.233843][ T7662] device hsr_slave_1 entered promiscuous mode [ 63.290363][ T7662] debugfs: Directory 'hsr0' with parent '/' already present! [ 63.442196][ T7673] device hsr_slave_0 entered promiscuous mode [ 63.480749][ T7673] device hsr_slave_1 entered promiscuous mode 05:19:12 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f00000002c0)=0x1, 0x4) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='syz_tun\x00', 0x10) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @broadcast}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000740)='ip_vti0\x00', 0xfe52) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000080), 0x4) 05:19:12 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") r1 = socket$inet(0x2, 0x803, 0xa0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000002d80)={@multicast2, @local}, 0xc) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x2, &(0x7f0000000300)={{{@in6=@empty={[0x8]}, @in=@remote}}, {{@in6=@mcast2}}}, 0xe8) [ 63.531132][ T7673] debugfs: Directory 'hsr0' with parent '/' already present! [ 63.544406][ T7658] 8021q: adding VLAN 0 to HW filter on device bond0 [ 63.584613][ C1] hrtimer: interrupt took 24857 ns [ 63.674674][ T7658] 8021q: adding VLAN 0 to HW filter on device team0 [ 63.781857][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 63.789646][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 63.960945][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 64.014940][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 64.120646][ T7704] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.127818][ T7704] bridge0: port 1(bridge_slave_0) entered forwarding state 05:19:12 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f00000002c0)=0x1, 0x4) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='syz_tun\x00', 0x10) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @broadcast}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000740)='ip_vti0\x00', 0xfe52) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000080), 0x4) [ 64.289326][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 64.380729][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 64.455319][ T7704] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.462463][ T7704] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.520891][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 64.556730][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 64.671469][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 64.679366][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 64.748838][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 64.844525][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 64.921053][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 65.021424][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 65.035352][ T7658] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 65.123380][ T7658] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 65.230627][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 65.239243][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 65.311453][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 65.319826][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 65.432183][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 65.505962][ T7662] 8021q: adding VLAN 0 to HW filter on device bond0 [ 65.551165][ T7658] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.568612][ T7673] 8021q: adding VLAN 0 to HW filter on device bond0 [ 65.638272][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 65.654022][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 65.735288][ T7662] 8021q: adding VLAN 0 to HW filter on device team0 [ 65.788351][ T7673] 8021q: adding VLAN 0 to HW filter on device team0 [ 65.826029][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 65.847222][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 65.930597][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 65.983470][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 66.091010][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 66.099975][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 66.171502][ T3017] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.178592][ T3017] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.275647][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 66.320867][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 66.373545][ T3017] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.380814][ T3017] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.460899][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 66.524087][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 66.553986][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 66.610932][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 66.650609][ T3017] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.657717][ T3017] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.723815][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 66.781007][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 66.834133][ T3017] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.841241][ T3017] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.893841][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 66.934041][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 66.974356][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 67.033559][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 67.061478][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 67.105085][ T3017] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 67.158931][ T7673] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 67.192126][ T7673] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 67.254579][ T7662] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 67.273605][ T7662] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 67.299147][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 67.307309][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 67.315911][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 67.325969][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 67.334793][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 67.344410][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 67.353079][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 67.361959][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 67.370416][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 67.379007][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 67.387874][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 67.397174][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 67.406165][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 67.414918][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 67.423475][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 67.432999][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 67.441388][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 67.449340][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 67.468949][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 67.484102][ T7661] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 67.510143][ T7673] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.522833][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 67.533214][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 67.550258][ T7662] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.730476][ T7918] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. 05:19:17 executing program 3: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) 05:19:17 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f00000002c0)=0x1, 0x4) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='syz_tun\x00', 0x10) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @broadcast}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000740)='ip_vti0\x00', 0xfe52) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000080), 0x4) 05:19:17 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x200000000000df8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000040)=0xfff, 0x4) open(0x0, 0x101000, 0x20) sendto$inet(r1, 0x0, 0x0, 0x24054095, &(0x7f0000001180)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x448040, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000001c0)='veth1_to_bridge\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe16, 0x5dc, 0x0, 0xffffffffffffffa0) 05:19:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f00000002c0)=0x1, 0x4) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='syz_tun\x00', 0x10) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @broadcast}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000740)='ip_vti0\x00', 0xfe52) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000080), 0x4) 05:19:17 executing program 4: setresuid(0x0, 0xee01, 0x0) r0 = geteuid() setresuid(0x0, 0x0, r0) setfsuid(r0) 05:19:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x3, 0x0, 0x1000, &(0x7f000003a000/0x1000)=nil}) r3 = eventfd(0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x0, 0x0, 0x1, r3}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 05:19:17 executing program 4: setresuid(0x0, 0xee01, 0x0) r0 = geteuid() setresuid(0x0, 0x0, r0) setfsuid(r0) 05:19:17 executing program 1: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) 05:19:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f00000002c0)=0x1, 0x4) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='syz_tun\x00', 0x10) connect$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @broadcast}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000740)='ip_vti0\x00', 0xfe52) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000080), 0x4) 05:19:17 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x200000000000df8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000040)=0xfff, 0x4) open(0x0, 0x101000, 0x20) sendto$inet(r1, 0x0, 0x0, 0x24054095, &(0x7f0000001180)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x448040, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000001c0)='veth1_to_bridge\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe16, 0x5dc, 0x0, 0xffffffffffffffa0) 05:19:17 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x3, 0x0, 0x1000, &(0x7f000003a000/0x1000)=nil}) r3 = eventfd(0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x0, 0x0, 0x1, r3}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 05:19:17 executing program 4: setresuid(0x0, 0xee01, 0x0) r0 = geteuid() setresuid(0x0, 0x0, r0) setfsuid(r0) 05:19:18 executing program 3: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) 05:19:18 executing program 0: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) 05:19:18 executing program 4: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) 05:19:18 executing program 2: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x200000000000df8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000040)=0xfff, 0x4) open(0x0, 0x101000, 0x20) sendto$inet(r1, 0x0, 0x0, 0x24054095, &(0x7f0000001180)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x448040, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000001c0)='veth1_to_bridge\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe16, 0x5dc, 0x0, 0xffffffffffffffa0) 05:19:18 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x3, 0x0, 0x1000, &(0x7f000003a000/0x1000)=nil}) r3 = eventfd(0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x0, 0x0, 0x1, r3}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 05:19:19 executing program 5: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) 05:19:19 executing program 2: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) 05:19:19 executing program 1: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) 05:19:21 executing program 0: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) 05:19:22 executing program 5: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) 05:19:22 executing program 3: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) 05:19:22 executing program 2: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) 05:19:22 executing program 4: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) 05:19:22 executing program 1: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) socket$inet6(0xa, 0x0, 0xf8) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r0 = syz_open_dev$rtc(0x0, 0x0, 0x2) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x7) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r1, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f00000001c0)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$PIO_CMAP(r4, 0x4b71, &(0x7f00000000c0)={0x2, 0x1000, 0x81, 0xffff, 0x2, 0x3}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@multicast2}}, &(0x7f0000000340)=0xe8) sendmsg$can_raw(r4, &(0x7f0000000900)={&(0x7f00000004c0)={0x1d, r5}, 0x10, &(0x7f0000000740)={&(0x7f0000000500)=@can={{0x1, 0x41, 0x0, 0x83}, 0x0, 0x1, 0x0, 0x0, "afdb4b64d379a7ef"}, 0x10}, 0x1, 0x0, 0x0, 0x40001}, 0x8840) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000000)=r5) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x128) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_vs\x00') preadv(r6, &(0x7f00000017c0), 0x33d, 0xf0ff7f00000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1000, 0x3}) [ 76.049004][ T8064] ================================================================== [ 76.057324][ T8064] BUG: KCSAN: data-race in pipe_wait / put_pipe_info [ 76.064102][ T8064] [ 76.066436][ T8064] read to 0xffff888103a3ff4c of 4 bytes by task 8104 on cpu 0: [ 76.073964][ T8064] pipe_wait+0xd7/0x140 [ 76.078104][ T8064] splice_from_pipe_next.part.0+0x6c/0x1d0 [ 76.083911][ T8064] __splice_from_pipe+0xa4/0x480 [ 76.088836][ T8064] do_vmsplice.part.0+0x1c5/0x210 [ 76.093844][ T8064] __do_sys_vmsplice+0x15f/0x1c0 [ 76.098936][ T8064] __x64_sys_vmsplice+0x5e/0x80 [ 76.103991][ T8064] do_syscall_64+0xcc/0x370 [ 76.108581][ T8064] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 76.114468][ T8064] [ 76.116783][ T8064] write to 0xffff888103a3ff4c of 4 bytes by task 8064 on cpu 1: [ 76.124397][ T8064] put_pipe_info+0x4d/0xb0 [ 76.128813][ T8064] pipe_release+0x152/0x1b0 [ 76.133301][ T8064] __fput+0x1e1/0x520 [ 76.137356][ T8064] ____fput+0x1f/0x30 [ 76.141522][ T8064] task_work_run+0xf6/0x130 [ 76.146030][ T8064] exit_to_usermode_loop+0x2b4/0x2c0 [ 76.151302][ T8064] do_syscall_64+0x353/0x370 [ 76.155881][ T8064] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 76.161860][ T8064] [ 76.164359][ T8064] Reported by Kernel Concurrency Sanitizer on: [ 76.170512][ T8064] CPU: 1 PID: 8064 Comm: syz-executor.3 Not tainted 5.4.0-rc7+ #0 [ 76.178308][ T8064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 76.188350][ T8064] ================================================================== [ 76.196390][ T8064] Kernel panic - not syncing: panic_on_warn set ... [ 76.202986][ T8064] CPU: 1 PID: 8064 Comm: syz-executor.3 Not tainted 5.4.0-rc7+ #0 [ 76.210774][ T8064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 76.220812][ T8064] Call Trace: [ 76.224109][ T8064] dump_stack+0x11d/0x181 [ 76.228461][ T8064] panic+0x210/0x640 [ 76.232358][ T8064] ? vprintk_func+0x8d/0x140 [ 76.236943][ T8064] kcsan_report.cold+0xc/0xd [ 76.241611][ T8064] kcsan_setup_watchpoint+0x3fe/0x460 [ 76.246997][ T8064] __tsan_unaligned_write4+0xc4/0x100 [ 76.252444][ T8064] put_pipe_info+0x4d/0xb0 [ 76.257109][ T8064] pipe_release+0x152/0x1b0 [ 76.261603][ T8064] __fput+0x1e1/0x520 [ 76.265575][ T8064] ? put_pipe_info+0xb0/0xb0 [ 76.270150][ T8064] ____fput+0x1f/0x30 [ 76.274291][ T8064] task_work_run+0xf6/0x130 [ 76.278781][ T8064] exit_to_usermode_loop+0x2b4/0x2c0 [ 76.284080][ T8064] do_syscall_64+0x353/0x370 [ 76.288777][ T8064] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 76.294737][ T8064] RIP: 0033:0x414201 [ 76.298637][ T8064] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 76.318326][ T8064] RSP: 002b:00007ffc82e70e40 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 76.326753][ T8064] RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000414201 [ 76.334716][ T8064] RDX: 0000000000000000 RSI: ffffffff824edca7 RDI: 0000000000000007 [ 76.342868][ T8064] RBP: 0000000000000001 R08: ffffffff816afff5 R09: 000000009779210f [ 76.350846][ T8064] R10: 00007ffc82e70f20 R11: 0000000000000293 R12: 000000000075c9a0 [ 76.358821][ T8064] R13: 000000000075c9a0 R14: 0000000000761ac0 R15: 000000000075bf2c [ 76.366907][ T8064] ? check_stack_object+0xd5/0x110 [ 76.372020][ T8064] ? debug_smp_processor_id+0x47/0x172 [ 76.379413][ T8064] Kernel Offset: disabled [ 76.383854][ T8064] Rebooting in 86400 seconds..