[....] Starting OpenBSD Secure Shell server: sshd[ 52.517209] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. [ 52.894312] audit: type=1800 audit(1539237520.947:29): pid=5917 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 52.913689] audit: type=1800 audit(1539237520.957:30): pid=5917 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 55.115112] random: sshd: uninitialized urandom read (32 bytes read) [ 55.615887] random: sshd: uninitialized urandom read (32 bytes read) [ 57.732296] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.1' (ECDSA) to the list of known hosts. [ 63.414793] random: sshd: uninitialized urandom read (32 bytes read) 2018/10/11 05:58:53 fuzzer started [ 67.777873] random: cc1: uninitialized urandom read (8 bytes read) 2018/10/11 05:58:58 dialing manager at 10.128.0.26:39089 2018/10/11 05:58:58 syscalls: 1 2018/10/11 05:58:58 code coverage: enabled 2018/10/11 05:58:58 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/10/11 05:58:58 setuid sandbox: enabled 2018/10/11 05:58:58 namespace sandbox: enabled 2018/10/11 05:58:58 Android sandbox: /sys/fs/selinux/policy does not exist 2018/10/11 05:58:58 fault injection: enabled 2018/10/11 05:58:58 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/10/11 05:58:58 net packed injection: /dev/net/tun can't be opened (open /dev/net/tun: cannot allocate memory) 2018/10/11 05:58:58 net device setup: enabled [ 72.598414] random: crng init done 06:00:39 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x40000000003, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'ip_vti0\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @dev}, 0x14) sendmmsg(r0, &(0x7f00000004c0)=[{{&(0x7f00000000c0)=@in6={0xa, 0x0, 0x2, @mcast2}, 0x80, &(0x7f0000000840), 0x0, &(0x7f0000000300)}}], 0x4000000000001fe, 0x0) [ 172.343487] IPVS: ftp: loaded support on port[0] = 21 [ 173.556903] bridge0: port 1(bridge_slave_0) entered blocking state [ 173.563441] bridge0: port 1(bridge_slave_0) entered disabled state [ 173.571936] device bridge_slave_0 entered promiscuous mode [ 173.716714] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.723713] bridge0: port 2(bridge_slave_1) entered disabled state [ 173.732111] device bridge_slave_1 entered promiscuous mode [ 173.860904] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 173.988752] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 174.377211] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 174.508155] bond0: Enslaving bond_slave_1 as an active interface with an up link 06:00:43 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$setstatus(r0, 0x4, 0x2000) openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/netlink\x00') perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, r1, &(0x7f0000000100), 0x80000002) [ 175.211896] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 175.220031] team0: Port device team_slave_0 added [ 175.426909] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 175.435172] team0: Port device team_slave_1 added [ 175.686473] IPVS: ftp: loaded support on port[0] = 21 [ 175.706008] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 175.714260] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 175.723354] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 175.856190] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 176.089653] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 176.097419] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 176.106607] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 176.385113] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 176.392799] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 176.401777] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 177.651314] bridge0: port 1(bridge_slave_0) entered blocking state [ 177.657888] bridge0: port 1(bridge_slave_0) entered disabled state [ 177.666345] device bridge_slave_0 entered promiscuous mode [ 177.923915] bridge0: port 2(bridge_slave_1) entered blocking state [ 177.930451] bridge0: port 2(bridge_slave_1) entered disabled state [ 177.939039] device bridge_slave_1 entered promiscuous mode [ 178.221857] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 178.480950] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 178.835077] bridge0: port 2(bridge_slave_1) entered blocking state [ 178.841662] bridge0: port 2(bridge_slave_1) entered forwarding state [ 178.848558] bridge0: port 1(bridge_slave_0) entered blocking state [ 178.855063] bridge0: port 1(bridge_slave_0) entered forwarding state [ 178.863874] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 179.033109] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 179.127240] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 179.336202] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 179.584930] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 179.592597] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 179.799006] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 179.806827] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 06:00:47 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f0000000000), 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001800010300000000000000000200000000000005000000000c000900950a4477"], 0x1}}, 0x0) [ 180.679500] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 180.687751] team0: Port device team_slave_0 added [ 180.994506] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 181.002770] team0: Port device team_slave_1 added [ 181.010366] IPVS: ftp: loaded support on port[0] = 21 [ 181.297926] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 181.305087] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 181.313912] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 181.621058] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 181.634440] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 181.643441] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 181.913836] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 181.921411] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 181.930491] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 182.229005] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 182.236809] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 182.245843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 183.573927] bridge0: port 1(bridge_slave_0) entered blocking state [ 183.580404] bridge0: port 1(bridge_slave_0) entered disabled state [ 183.588851] device bridge_slave_0 entered promiscuous mode [ 183.829163] bridge0: port 2(bridge_slave_1) entered blocking state [ 183.835710] bridge0: port 2(bridge_slave_1) entered disabled state [ 183.844126] device bridge_slave_1 entered promiscuous mode [ 184.072193] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 184.311847] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 185.182235] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 185.265341] bridge0: port 2(bridge_slave_1) entered blocking state [ 185.271877] bridge0: port 2(bridge_slave_1) entered forwarding state [ 185.278759] bridge0: port 1(bridge_slave_0) entered blocking state [ 185.285342] bridge0: port 1(bridge_slave_0) entered forwarding state [ 185.294054] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 185.434847] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 185.729542] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 185.736864] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 185.942038] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 185.950611] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 186.201900] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 186.799412] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 186.807568] team0: Port device team_slave_0 added 06:00:54 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x0, 0x9db20258b8fb6c00) close(r1) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00) [ 187.017901] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 187.026132] team0: Port device team_slave_1 added [ 187.388229] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 187.395561] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 187.404379] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 187.732584] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 187.739975] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 187.748885] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 188.103201] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 188.110742] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 188.119518] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 188.350137] IPVS: ftp: loaded support on port[0] = 21 [ 188.440826] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 188.448599] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 188.457650] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 189.421699] 8021q: adding VLAN 0 to HW filter on device bond0 [ 190.504486] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 191.349799] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.356396] bridge0: port 1(bridge_slave_0) entered disabled state [ 191.364787] device bridge_slave_0 entered promiscuous mode [ 191.687330] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.693959] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.702523] device bridge_slave_1 entered promiscuous mode [ 191.854655] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 191.861094] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 191.869176] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 192.056466] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 192.297283] bridge0: port 2(bridge_slave_1) entered blocking state [ 192.303851] bridge0: port 2(bridge_slave_1) entered forwarding state [ 192.310830] bridge0: port 1(bridge_slave_0) entered blocking state [ 192.317430] bridge0: port 1(bridge_slave_0) entered forwarding state [ 192.326141] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 192.428117] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 192.792139] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 193.059216] 8021q: adding VLAN 0 to HW filter on device team0 [ 193.510887] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 193.856895] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 194.185221] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 194.192552] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 194.523511] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 194.530610] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 195.415867] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 195.424041] team0: Port device team_slave_0 added 06:01:03 executing program 4: clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ptrace(0xfff0000000000000, 0x0) r0 = gettid() rt_sigqueueinfo(r0, 0x8, &(0x7f0000000200)) [ 195.743563] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 195.751738] team0: Port device team_slave_1 added [ 196.142971] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 196.150075] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 196.158934] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 196.483907] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 196.490991] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 196.499734] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 196.839702] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 196.847526] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 196.856633] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 197.222543] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 197.230176] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 197.239054] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 197.517529] IPVS: ftp: loaded support on port[0] = 21 [ 199.419087] 8021q: adding VLAN 0 to HW filter on device bond0 [ 200.956432] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 201.244162] bridge0: port 1(bridge_slave_0) entered blocking state [ 201.250704] bridge0: port 1(bridge_slave_0) entered disabled state [ 201.259238] device bridge_slave_0 entered promiscuous mode [ 201.296695] bridge0: port 2(bridge_slave_1) entered blocking state [ 201.303211] bridge0: port 2(bridge_slave_1) entered forwarding state [ 201.310075] bridge0: port 1(bridge_slave_0) entered blocking state [ 201.316610] bridge0: port 1(bridge_slave_0) entered forwarding state [ 201.325091] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 201.332447] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 201.649613] bridge0: port 2(bridge_slave_1) entered blocking state [ 201.656154] bridge0: port 2(bridge_slave_1) entered disabled state [ 201.664480] device bridge_slave_1 entered promiscuous mode [ 202.025850] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 202.344400] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 202.407190] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 202.413741] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 202.421750] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 06:01:10 executing program 0: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) close(r0) syz_open_procfs(0x0, &(0x7f00004c6f8b)='mounts\x00') epoll_pwait(r1, &(0x7f0000000040)=[{}], 0x1, 0x51eacc36, &(0x7f0000000080), 0x8) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f00000004c0)=ANY=[], &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)="7379736673002a864f4bc00bce1bdb20637213b1e894d120715f9dc1125b042c7226eb0136d9624ea1d23374a660fe5ac173722fd367ad22e8553025a2e8be0bc5514379af7213d32b8d5d06dc8fbf2c849ed9cdefc74b03dfa9cb5a90b28b4b24d7862c3d66fca53167d5424235435a3dbb76bc7d3c42fc2e9c696114a6f888f0da85277683cfc1c4d2bf71c255a3134d64cc3fed8e97798deb8631cbf7682c9fa2ed031465aa191df922f764297cba22a8499d177f49fba940f55bbc8b723fd374f1fed78c8aeec6811d9b5879487387d56594a14c2588274de84fa27610302b3fb54172a8c910a07e7c76ea465aa68402", 0x0, &(0x7f0000000080)) 06:01:11 executing program 0: pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$DRM_IOCTL_ADD_BUFS(r0, 0xc0206416, &(0x7f0000000080)={0x0, 0x0, 0x7fff00, 0x2, 0x8, 0x7fff}) r1 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x4, 0x0) ioctl$int_in(r1, 0xa00000c0045007, &(0x7f0000000000)) syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x40, 0x2000) 06:01:11 executing program 0: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000240)={0x0, 0x3, 0x1, 0x1, 0x2, 0x101, 0x9, 0x100000001, 0x0, 0x7fffffff, 0x4}, 0xb) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) r2 = dup3(r1, r1, 0x80000) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f0000000000)={0x7f, 0x4, 0x8000, 0x6, 0x7fffffff, 0x1, 0x4, 0x9, 0x0}, &(0x7f0000000040)=0x20) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000180)={r3, @in6={{0xa, 0x4e22, 0x6, @dev={0xfe, 0x80, [], 0x19}, 0x1}}, 0x7f, 0x1000}, &(0x7f0000000100)=0x90) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000280), 0xffffffffffffff41}], 0xffffffffffffd24) [ 203.687970] bond0: Enslaving bond_slave_0 as an active interface with an up link 06:01:11 executing program 0: ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000240)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000200)={{&(0x7f0000011000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f00000001c0)={&(0x7f0000013000/0x3000)=nil, &(0x7f0000013000/0x1000)=nil, 0x3000}) socket$nl_crypto(0x10, 0x3, 0x15) pwrite64(0xffffffffffffffff, &(0x7f0000000100)="0f4877ceee26c646562593ac872feca33be151192efd17c830977057e1bfee85c0451dc8fa3d29da5841a446ffd4241ab83767c76768d7958cbd74f625b1d29fcdb48e14c30c9fbc3004915fcc8b4e12495664d620d36105efff6beda5b6084e444d1caea2f3458c3f2846db7ec1079f1e269aaa294c6259101453707f689a1fc4", 0x81, 0x26) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000400)='/dev/mixer\x00', 0x101800, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000440)={0x9, 0x0, 0x10002, 0x800}) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000480)={r1, 0xffff}) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x1000, 0x100) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e20, @loopback}}, 0x5, 0x80}, &(0x7f0000000040)=0x90) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000000340)={r3, @in6={{0xa, 0x4e23, 0x1000, @remote, 0xfffffffffffffffe}}}, 0x84) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(0xffffffffffffffff, 0x404c534a, &(0x7f0000000080)={0x8, 0x9, 0x1}) [ 203.962706] 8021q: adding VLAN 0 to HW filter on device team0 [ 204.147199] bond0: Enslaving bond_slave_1 as an active interface with an up link 06:01:12 executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r1, &(0x7f0000000040)="29a39075838062c84cd0be56dfb11a9e43d7d861131a8bb0d3e7eb3327e954080ee9508717b7b2f039d5ec8be02ce7915c92f41fbfe41ff35d8f03df6ad59a80df42063d727d75f225279a13023bfc0dc45cb3", &(0x7f0000000180)=""/81}, 0x18) unshare(0x28020400) r2 = getpid() ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000200)={[], 0x80, 0x0, 0x0, 0x100, 0xfff, r2}) bind(r0, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000300)={@multicast1, @empty, 0x0}, &(0x7f0000000340)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000380)={'team0\x00', r3}) syncfs(r1) [ 204.585894] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 204.593789] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 06:01:12 executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r1, &(0x7f0000000040)="29a39075838062c84cd0be56dfb11a9e43d7d861131a8bb0d3e7eb3327e954080ee9508717b7b2f039d5ec8be02ce7915c92f41fbfe41ff35d8f03df6ad59a80df42063d727d75f225279a13023bfc0dc45cb3", &(0x7f0000000180)=""/81}, 0x18) unshare(0x28020400) r2 = getpid() ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000200)={[], 0x80, 0x0, 0x0, 0x100, 0xfff, r2}) bind(r0, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000300)={@multicast1, @empty, 0x0}, &(0x7f0000000340)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000380)={'team0\x00', r3}) syncfs(r1) [ 204.967309] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 204.974561] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 06:01:13 executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r1, &(0x7f0000000040)="29a39075838062c84cd0be56dfb11a9e43d7d861131a8bb0d3e7eb3327e954080ee9508717b7b2f039d5ec8be02ce7915c92f41fbfe41ff35d8f03df6ad59a80df42063d727d75f225279a13023bfc0dc45cb3", &(0x7f0000000180)=""/81}, 0x18) unshare(0x28020400) r2 = getpid() ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000200)={[], 0x80, 0x0, 0x0, 0x100, 0xfff, r2}) bind(r0, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000300)={@multicast1, @empty, 0x0}, &(0x7f0000000340)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000380)={'team0\x00', r3}) syncfs(r1) 06:01:13 executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r1, &(0x7f0000000040)="29a39075838062c84cd0be56dfb11a9e43d7d861131a8bb0d3e7eb3327e954080ee9508717b7b2f039d5ec8be02ce7915c92f41fbfe41ff35d8f03df6ad59a80df42063d727d75f225279a13023bfc0dc45cb3", &(0x7f0000000180)=""/81}, 0x18) unshare(0x28020400) r2 = getpid() ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000200)={[], 0x80, 0x0, 0x0, 0x100, 0xfff, r2}) bind(r0, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000300)={@multicast1, @empty, 0x0}, &(0x7f0000000340)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000380)={'team0\x00', r3}) syncfs(r1) [ 206.015338] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 206.023499] team0: Port device team_slave_0 added [ 206.422642] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 206.430644] team0: Port device team_slave_1 added [ 206.783456] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 206.790565] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 206.799368] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 207.045670] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 207.053046] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 207.062110] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 207.394190] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 207.402083] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 207.410929] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 207.609202] 8021q: adding VLAN 0 to HW filter on device bond0 [ 207.677984] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 207.685877] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 207.694800] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 208.540858] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 209.487905] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 209.494583] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 209.502518] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 210.328106] 8021q: adding VLAN 0 to HW filter on device team0 [ 210.476369] bridge0: port 2(bridge_slave_1) entered blocking state [ 210.482917] bridge0: port 2(bridge_slave_1) entered forwarding state [ 210.489816] bridge0: port 1(bridge_slave_0) entered blocking state [ 210.496490] bridge0: port 1(bridge_slave_0) entered forwarding state [ 210.505173] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 210.512049] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 06:01:19 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000140)='memory.high\x00', 0x2, 0x0) sendfile(r1, r1, 0x0, 0x12) [ 213.620893] 8021q: adding VLAN 0 to HW filter on device bond0 [ 214.339708] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 214.946264] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 214.952757] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 214.960420] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 06:01:23 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x85b, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_ASSIGN_DEV_IRQ(r1, 0x4040ae70, &(0x7f0000000040)) [ 215.526736] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. [ 215.689533] 8021q: adding VLAN 0 to HW filter on device team0 [ 218.222390] 8021q: adding VLAN 0 to HW filter on device bond0 [ 218.697415] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready 06:01:27 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x0, 0x9db20258b8fb6c00) close(r1) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00) [ 219.173212] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 219.179629] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 219.187590] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 219.699473] 8021q: adding VLAN 0 to HW filter on device team0 06:01:29 executing program 4: setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x0, 0x0, 0x400}, 0x6) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x0, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) readv(r0, &(0x7f0000000180)=[{&(0x7f0000000240)=""/154, 0x9a}, {&(0x7f0000000300)=""/72, 0x48}, {&(0x7f0000000380)=""/184, 0xb8}], 0x34b) 06:01:29 executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r1, &(0x7f0000000040)="29a39075838062c84cd0be56dfb11a9e43d7d861131a8bb0d3e7eb3327e954080ee9508717b7b2f039d5ec8be02ce7915c92f41fbfe41ff35d8f03df6ad59a80df42063d727d75f225279a13023bfc0dc45cb3", &(0x7f0000000180)=""/81}, 0x18) unshare(0x28020400) r2 = getpid() ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000200)={[], 0x80, 0x0, 0x0, 0x100, 0xfff, r2}) bind(r0, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000300)={@multicast1, @empty, 0x0}, &(0x7f0000000340)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000380)={'team0\x00', r3}) 06:01:29 executing program 5: r0 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x8, 0x201) ioctl$KVM_S390_INTERRUPT_CPU(r0, 0x4010ae94, &(0x7f0000000040)={0x5, 0x6, 0x4}) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000080)={0x0, 0xb7, "2f49a92c2e5de94e8ae83dbbf612b083386a4f0ab33d415e26a78d5c7c47e6c0997d5fd9acae61a17a88b9abcb0fcaa4d82b13beba40969b43fa44896c58986b9ac2d2e62bac3cf1a9500daccae5d13742d0e80ee159d4eb249a07aa9fd95bfd7dbe39496a2ea97c54627be4160d438674e7f2d333c406753ad4e791bbd9cdc69eb69f5b9689c781198b723e46d6858d895cd8f4f1887528a26caf6fd87579b76b2e01542e042a9eac72e18ad1f4c4f9594872e33476e3"}, &(0x7f0000000140)=0xbf) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000180)={r1, 0x6}, 0x8) connect$pptp(r0, &(0x7f00000001c0)={0x18, 0x2, {0x2}}, 0x1e) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000200)=0xfffffffffffffffa) r2 = fcntl$getown(r0, 0x9) getsockopt$inet_tcp_buf(r0, 0x6, 0x1a, &(0x7f0000000240)=""/157, &(0x7f0000000300)=0x9d) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) select(0x40, &(0x7f0000000340)={0x8, 0xfffffffffffffffb, 0xe0, 0x100000000, 0x7, 0x10001, 0x979}, &(0x7f0000000380)={0x8, 0x8, 0x3, 0x3, 0x0, 0xd0f, 0x80000000, 0x4}, &(0x7f00000003c0)={0x3f, 0xfffffffffffffff9, 0x3, 0x3, 0x0, 0x400, 0x3, 0x8000}, &(0x7f0000000400)={0x77359400}) ioctl$KVM_GET_DEBUGREGS(r0, 0x8080aea1, &(0x7f0000000440)) r3 = request_key(&(0x7f00000005c0)='big_key\x00', &(0x7f0000000600)={'syz', 0x3}, &(0x7f0000000640)='cgroup\'\x00', 0xfffffffffffffff8) add_key(&(0x7f00000004c0)='id_resolver\x00', &(0x7f0000000500)={'syz', 0x1}, &(0x7f0000000540)="56dbf53d49176aaa91c507f4a55ee2d83f5dd001d3cea0fb5378c882f14e4c0520a39a486918e46587db485908e57f881d7467ec5c9d7755ab0fe749f7afd54e8839fb3523a101a10dde890aa0d3de5af8bcf44235cd3b0e518051b66754462c22d3", 0x62, r3) bind$can_raw(r0, &(0x7f0000000680), 0x10) listxattr(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)=""/252, 0xfc) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000800)={0x0, 0x0, 0x9, 0x0, [], [{0xd70a, 0x1, 0x7fff, 0x0, 0x2, 0x5}, {0x200, 0x800, 0x80000000, 0x380000000000000, 0x91b4, 0x28f}], [[], [], [], [], [], [], [], [], []]}) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000b00), &(0x7f0000000b40)=0x4) r4 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0x76c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000cc0)={r0, &(0x7f0000000b80)="8f6a7ccbb9a0d73e2460d7634a223729baab44e84374e1e3461591c4368efcdc7ff04b026ae1fec99301bb7dbbb64a885d218cf1fd6fc740c37ee5a0299b5f74842f33880c52c997ad5946a7efca6fcf8e82e58a7f1f2a7121ed615e39c7726b338774ab906276dfbaced2e2f51c72af7d28bfc59ce87d8fbc180afaf0f1b0162341", &(0x7f0000000c40)="6be543ea63c5238303ed19294dcdfa2d2bf7d6bd4b23068c8896c4178544302740d01acf5060b72c30d17fdff25e9c48fcbe23fa7a465b49b8e9b3f9e55d47ba58fa82aa779d4f7c656f65d9446f421b2dd23f27e9c402ff74d042007021b9649a50d3a925274aeb12e26db577a486e47c8ed8e7a245d67b", 0x1}, 0x20) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000d00), 0x4) write$eventfd(r0, &(0x7f0000000d40)=0x4d6f, 0x8) tee(r0, r4, 0xffffffffffffffc0, 0x4) get_thread_area(&(0x7f0000000d80)={0x9, 0x20001000, 0x5000, 0x2, 0x53, 0x10000, 0x8, 0x3ff, 0x100000001, 0x8}) recvmmsg(r0, &(0x7f00000059c0)=[{{&(0x7f0000000dc0)=@ipx, 0x80, &(0x7f0000002100)=[{&(0x7f0000000e40)=""/76, 0x4c}, {&(0x7f0000000ec0)=""/61, 0x3d}, {&(0x7f0000000f00)=""/4096, 0x1000}, {&(0x7f0000001f00)=""/221, 0xdd}, {&(0x7f0000002000)=""/233, 0xe9}], 0x5, &(0x7f0000002180)=""/119, 0x77, 0x3}, 0x80}, {{0x0, 0x0, &(0x7f0000003600)=[{&(0x7f0000002200)=""/87, 0x57}, {&(0x7f0000002280)=""/52, 0x34}, {&(0x7f00000022c0)=""/4096, 0x1000}, {&(0x7f00000032c0)=""/191, 0xbf}, {&(0x7f0000003380)=""/73, 0x49}, {&(0x7f0000003400)=""/241, 0xf1}, {&(0x7f0000003500)=""/173, 0xad}, {&(0x7f00000035c0)=""/44, 0x2c}], 0x8, &(0x7f0000003680)=""/153, 0x99, 0x9b3c}, 0x10000}, {{&(0x7f0000003740)=@l2, 0x80, &(0x7f00000037c0), 0x0, &(0x7f0000003800)=""/186, 0xba, 0x3}, 0x1}, {{&(0x7f00000038c0)=@un=@abs, 0x80, &(0x7f0000004980)=[{&(0x7f0000003940)=""/18, 0x12}, {&(0x7f0000003980)=""/4096, 0x1000}], 0x2, &(0x7f00000049c0)=""/4096, 0x1000, 0x8001}, 0x2}], 0x4, 0x40000000, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000005ac0)={r1, 0x9}, 0x8) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r0, 0xc1105511, &(0x7f0000005b40)={{0x7, 0x0, 0x666, 0x6f6452cc}, 0x0, 0x30, 0x3ad, r2, 0x5, 0x101, 'syz0\x00', &(0x7f0000005b00)=['\x00', 'id_resolver\x00', 'cgroup\'\x00', 'cgroup\'\x00', 'syz'], 0x20, [], [0x1, 0x598, 0x9, 0x10000]}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000005e00)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000005dc0)={0xffffffffffffffff}, 0x13f, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000005e40)={0xe, 0x18, 0xfa00, @ib_path={&(0x7f0000005c80)=[{0x2, 0x0, [0xc9, 0x0, 0x5, 0x9, 0xfffffffffffffffa, 0x1000, 0xffffffffffffffa8, 0x6, 0x2, 0xfffffffffffffff9, 0x6, 0x81, 0x4, 0x2, 0x80, 0x1]}, {0x20, 0x0, [0x3, 0x3, 0x1f, 0x4, 0x1f, 0x1b9, 0x1, 0x4ae3, 0x0, 0x1ff, 0x8, 0x2, 0xfff, 0x3, 0x5, 0x1]}, {0x8, 0x0, [0x3, 0x3, 0x47, 0x86, 0x4, 0x200, 0x8, 0x8, 0x4, 0xbc, 0x100, 0x80, 0x5a, 0x3ff, 0x4, 0x7831]}, {0x1, 0x0, [0x3, 0x5, 0x40, 0x0, 0x0, 0x8000, 0x7, 0x7fff, 0x34b97cb3, 0x8001, 0x1, 0x7, 0x8, 0x4, 0x86, 0x9]}], r5, 0x1, 0x1, 0x120}}, 0x20) 06:01:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x0, 0x0, 0x400}, 0x6) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x0, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) readv(r0, &(0x7f0000000180)=[{&(0x7f0000000240)=""/154, 0x9a}, {&(0x7f0000000300)=""/72, 0x48}, {&(0x7f0000000380)=""/184, 0xb8}], 0x34b) 06:01:29 executing program 1: 06:01:29 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x0, 0x9db20258b8fb6c00) close(r1) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00) 06:01:29 executing program 1: perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) sendto$inet(r0, &(0x7f0000865000), 0xebce, 0x0, &(0x7f0000fd9ff0)={0x2, 0x4e20, @loopback}, 0x10) 06:01:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x0, 0x0, 0x400}, 0x6) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x0, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) readv(r0, &(0x7f0000000180)=[{&(0x7f0000000240)=""/154, 0x9a}, {&(0x7f0000000300)=""/72, 0x48}, {&(0x7f0000000380)=""/184, 0xb8}], 0x34b) 06:01:30 executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r1, &(0x7f0000000040)="29a39075838062c84cd0be56dfb11a9e43d7d861131a8bb0d3e7eb3327e954080ee9508717b7b2f039d5ec8be02ce7915c92f41fbfe41ff35d8f03df6ad59a80df42063d727d75f225279a13023bfc0dc45cb3", &(0x7f0000000180)=""/81}, 0x18) unshare(0x28020400) r2 = getpid() ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000200)={[], 0x80, 0x0, 0x0, 0x100, 0xfff, r2}) bind(r0, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000300)={@multicast1}, &(0x7f0000000340)=0xc) [ 222.101854] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 06:01:30 executing program 4: setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x0, 0x0, 0x400}, 0x6) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x0, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) readv(r0, &(0x7f0000000180)=[{&(0x7f0000000240)=""/154, 0x9a}, {&(0x7f0000000300)=""/72, 0x48}, {&(0x7f0000000380)=""/184, 0xb8}], 0x34b) 06:01:30 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$bt_hci(r0, 0x0, 0x0, &(0x7f0000000240)=""/142, &(0x7f0000000080)=0x8e) r1 = getpid() sched_setscheduler(r1, 0x0, &(0x7f0000000200)) r2 = syz_open_procfs(0x0, &(0x7f0000000100)="2f65786500000000000409004bddd9de91be10ee9ed554fa07424adee9cbc699ec2ca576e50000bcd7a071fb35331ce39c5ad0cf73770bd4246847a1914e4fb0aa9b15eaa94bcd0e700ed63b44338e84ad4ec2f11f6f2adb8dc2fdb18231446f43142ebe700b2231e8fceed6b22a373c9409675ac8d0b53033123fb3037d66241aafe0f880e7a51d1b036ade315a544d2581fe8653d0cff54369df8c2fce21dcb1cb965669f9a75345ac3479cd51dc7de364c9c272c83ed9e666ca25aad2e7a26e3d6c62d0f8b9065cfca311c06d0744db265aa0e486707c51fd108c0c6ccae6ff42274af94d30fce8836ff9d00bdd") socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000023c0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0xc020660b, 0x730200) 06:01:30 executing program 1: 06:01:30 executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r1, &(0x7f0000000040)="29a39075838062c84cd0be56dfb11a9e43d7d861131a8bb0d3e7eb3327e954080ee9508717b7b2f039d5ec8be02ce7915c92f41fbfe41ff35d8f03df6ad59a80df42063d727d75f225279a13023bfc0dc45cb3", &(0x7f0000000180)=""/81}, 0x18) unshare(0x28020400) r2 = getpid() ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000200)={[], 0x80, 0x0, 0x0, 0x100, 0xfff, r2}) bind(r0, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80) 06:01:30 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x0, 0x9db20258b8fb6c00) close(r1) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000240)) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00) [ 223.235026] IPVS: ftp: loaded support on port[0] = 21 [ 224.045099] bridge0: port 1(bridge_slave_0) entered blocking state [ 224.051505] bridge0: port 1(bridge_slave_0) entered disabled state [ 224.059878] device bridge_slave_0 entered promiscuous mode [ 224.137243] bridge0: port 2(bridge_slave_1) entered blocking state [ 224.143742] bridge0: port 2(bridge_slave_1) entered disabled state [ 224.151257] device bridge_slave_1 entered promiscuous mode [ 224.229737] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 224.306299] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 224.536867] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 224.618765] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 224.768206] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 224.775331] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 225.008335] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 225.016039] team0: Port device team_slave_0 added [ 225.091913] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 225.099505] team0: Port device team_slave_1 added [ 225.173854] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 225.254573] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 225.330903] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 225.338361] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 225.347231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 225.415745] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 225.423079] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 225.431778] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 226.275780] bridge0: port 2(bridge_slave_1) entered blocking state [ 226.282237] bridge0: port 2(bridge_slave_1) entered forwarding state [ 226.288960] bridge0: port 1(bridge_slave_0) entered blocking state [ 226.295479] bridge0: port 1(bridge_slave_0) entered forwarding state [ 226.303299] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 226.711986] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 229.422777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 229.713111] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 229.997334] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 230.003675] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 230.011443] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 230.384803] 8021q: adding VLAN 0 to HW filter on device team0 06:01:40 executing program 5: 06:01:40 executing program 4: 06:01:40 executing program 1: 06:01:40 executing program 0: socket$alg(0x26, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r0, &(0x7f0000000040)="29a39075838062c84cd0be56dfb11a9e43d7d861131a8bb0d3e7eb3327e954080ee9508717b7b2f039d5ec8be02ce7915c92f41fbfe41ff35d8f03df6ad59a80df42063d727d75f225279a13023bfc0dc45cb3", &(0x7f0000000180)=""/81}, 0x18) unshare(0x28020400) r1 = getpid() ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000200)={[], 0x80, 0x0, 0x0, 0x100, 0xfff, r1}) 06:01:40 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$bt_hci(r0, 0x0, 0x0, &(0x7f0000000240)=""/142, &(0x7f0000000080)=0x8e) r1 = getpid() sched_setscheduler(r1, 0x0, &(0x7f0000000200)) r2 = syz_open_procfs(0x0, &(0x7f0000000100)="2f65786500000000000409004bddd9de91be10ee9ed554fa07424adee9cbc699ec2ca576e50000bcd7a071fb35331ce39c5ad0cf73770bd4246847a1914e4fb0aa9b15eaa94bcd0e700ed63b44338e84ad4ec2f11f6f2adb8dc2fdb18231446f43142ebe700b2231e8fceed6b22a373c9409675ac8d0b53033123fb3037d66241aafe0f880e7a51d1b036ade315a544d2581fe8653d0cff54369df8c2fce21dcb1cb965669f9a75345ac3479cd51dc7de364c9c272c83ed9e666ca25aad2e7a26e3d6c62d0f8b9065cfca311c06d0744db265aa0e486707c51fd108c0c6ccae6ff42274af94d30fce8836ff9d00bdd") socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000023c0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0xc020660b, 0x730200) 06:01:40 executing program 3: 06:01:40 executing program 1: 06:01:40 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x1f1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$ndb(&(0x7f00000004c0)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x8000004800) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000680)='/proc/self/net/pfkey\x00', 0x20400, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000500)={0x0, 0x0, 0x9, 0x7}, &(0x7f0000000580)=0x10) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000640)={r5, 0x3}, &(0x7f0000000740)=0x8) io_submit(0x0, 0x1, &(0x7f0000000700)=[&(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f00000005c0)="51fe7334fbcd43c2c53350080b8cdbdc0c61fd23478eee786c80b287d551eb966a4b12f9bf761b453b19e3d36df9d9a6988436e9ed4961c0d60611a27ee1d2529f662c7901d81cbae0bafe1e88f1af2aa2bd1ef35c6abbead2489923f076a8f7c97353891ddce78c2dbc83edcdd07af3832d268e231440ffd41b", 0x7a, 0x3, 0x0, 0x1, r4}]) ioctl$sock_inet_SIOCDELRT(r1, 0x890c, &(0x7f0000000440)={0x8, {0x2, 0x4e22}, {0x2, 0x4e20, @broadcast}, {0x2, 0x4e21, @broadcast}, 0x2, 0xb9, 0xde, 0x3, 0x6, &(0x7f00000001c0)='team_slave_0\x00', 0x9, 0x0, 0xffffffff}) ioctl$sock_inet_SIOCDELRT(r1, 0x890c, &(0x7f0000000380)={0x1, {0x2, 0x4e22, @remote}, {0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x20}}, {0x2, 0x4e22, @local}, 0x104, 0x2, 0x400, 0x8, 0x1f, &(0x7f0000000340)='veth0\x00', 0x1, 0x10000, 0x3}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = socket$inet6(0xa, 0x1000000000002, 0x0) r8 = gettid() r9 = socket$inet(0x2, 0x6, 0x0) setsockopt$inet_opts(r9, 0x0, 0x4, &(0x7f000064effb)="8907040000", 0x5) connect$inet(r9, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000340), &(0x7f0000000080)}}, &(0x7f0000583ffc)) sendto$inet(r9, &(0x7f0000000080)="201fb3025d3f8378493fc97126768b68e273d3dfc191037b7f645e0c", 0x1c, 0x0, &(0x7f00000000c0)={0x2, 0x4e22, @local}, 0x10) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000e60000)) dup2(r7, r9) tkill(r8, 0x14) fsync(r0) ioctl$SCSI_IOCTL_SYNC(r3, 0x4) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000140)={[], 0x0, 0xfff, 0x3a9}) fcntl$getflags(0xffffffffffffffff, 0x0) r10 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x84000, 0x1) fchmodat(r10, &(0x7f00000002c0)='./file0\x00', 0x1a) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={r10, r0, 0xd, 0x2}, 0x10) 06:01:40 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x107d}, 0xfeb0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000000100)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffffbd, 0x0, 0x2}, [@ldst={0x7, 0x18d1fb, 0x21}]}, &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0x3e9, &(0x7f000000cf3d)=""/195}, 0x48) 06:01:40 executing program 5: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ae9000/0x1000)=nil, 0x1000, 0x0, 0x400011, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) [ 232.714084] hrtimer: interrupt took 34931 ns 06:01:40 executing program 0: socket$alg(0x26, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r0, &(0x7f0000000040)="29a39075838062c84cd0be56dfb11a9e43d7d861131a8bb0d3e7eb3327e954080ee9508717b7b2f039d5ec8be02ce7915c92f41fbfe41ff35d8f03df6ad59a80df42063d727d75f225279a13023bfc0dc45cb3", &(0x7f0000000180)=""/81}, 0x18) unshare(0x28020400) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000200)={[], 0x80, 0x0, 0x0, 0x100, 0xfff}) 06:01:40 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$bt_hci(r0, 0x0, 0x0, &(0x7f0000000240)=""/142, &(0x7f0000000080)=0x8e) r1 = getpid() sched_setscheduler(r1, 0x0, &(0x7f0000000200)) r2 = syz_open_procfs(0x0, &(0x7f0000000100)="2f65786500000000000409004bddd9de91be10ee9ed554fa07424adee9cbc699ec2ca576e50000bcd7a071fb35331ce39c5ad0cf73770bd4246847a1914e4fb0aa9b15eaa94bcd0e700ed63b44338e84ad4ec2f11f6f2adb8dc2fdb18231446f43142ebe700b2231e8fceed6b22a373c9409675ac8d0b53033123fb3037d66241aafe0f880e7a51d1b036ade315a544d2581fe8653d0cff54369df8c2fce21dcb1cb965669f9a75345ac3479cd51dc7de364c9c272c83ed9e666ca25aad2e7a26e3d6c62d0f8b9065cfca311c06d0744db265aa0e486707c51fd108c0c6ccae6ff42274af94d30fce8836ff9d00bdd") socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000023c0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0xc020660b, 0x730200) 06:01:40 executing program 1: sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f00000002c0)='syzkaller\x00', &(0x7f0000000300), &(0x7f0000000340)='vmnet1]\x00', 0xfffffffffffffffe) recvmmsg(0xffffffffffffffff, &(0x7f00000020c0)=[{{&(0x7f0000000c80)=@generic, 0x80, &(0x7f0000001e00), 0x0, &(0x7f0000001e40)=""/237, 0xed}}], 0x1, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000140)) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='attr/fscreate\x00') pwritev(r0, &(0x7f0000001400), 0x2a6, 0x0) 06:01:41 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, &(0x7f0000000100)="40fedca28669ae35093449d5933b109c02563082f5bf1cb1bfbb9a") r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/snmp6\x00') read$eventfd(r0, &(0x7f0000000040), 0x8) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x1, &(0x7f000039a000)=[{}]}, 0x10) r1 = getpgid(0xffffffffffffffff) ptrace$pokeuser(0x6, r1, 0x0, 0x0) 06:01:41 executing program 5: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ae9000/0x1000)=nil, 0x1000, 0x0, 0x400011, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) 06:01:41 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x20601, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18}, 0xfdd7) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000180)={0xa, 0x4}, 0xc) 06:01:41 executing program 2: clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$bt_hci(r0, 0x0, 0x0, &(0x7f0000000240)=""/142, &(0x7f0000000080)=0x8e) r1 = getpid() sched_setscheduler(r1, 0x0, &(0x7f0000000200)) r2 = syz_open_procfs(0x0, &(0x7f0000000100)="2f65786500000000000409004bddd9de91be10ee9ed554fa07424adee9cbc699ec2ca576e50000bcd7a071fb35331ce39c5ad0cf73770bd4246847a1914e4fb0aa9b15eaa94bcd0e700ed63b44338e84ad4ec2f11f6f2adb8dc2fdb18231446f43142ebe700b2231e8fceed6b22a373c9409675ac8d0b53033123fb3037d66241aafe0f880e7a51d1b036ade315a544d2581fe8653d0cff54369df8c2fce21dcb1cb965669f9a75345ac3479cd51dc7de364c9c272c83ed9e666ca25aad2e7a26e3d6c62d0f8b9065cfca311c06d0744db265aa0e486707c51fd108c0c6ccae6ff42274af94d30fce8836ff9d00bdd") socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000023c0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0xc020660b, 0x730200) [ 233.670946] ================================================================== [ 233.678466] BUG: KMSAN: uninit-value in vmap_page_range_noflush+0x975/0xed0 [ 233.685586] CPU: 1 PID: 7651 Comm: syz-executor4 Not tainted 4.19.0-rc4+ #66 [ 233.692792] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 233.702167] Call Trace: [ 233.704777] dump_stack+0x306/0x460 [ 233.708424] ? vmap_page_range_noflush+0x975/0xed0 [ 233.713405] kmsan_report+0x1a2/0x2e0 [ 233.717262] __msan_warning+0x7c/0xe0 [ 233.721567] vmap_page_range_noflush+0x975/0xed0 [ 233.726372] map_vm_area+0x17d/0x1f0 [ 233.730117] kmsan_vmap+0xf2/0x180 [ 233.733679] vmap+0x3a1/0x510 [ 233.736808] ? relay_open_buf+0x81e/0x19d0 [ 233.741066] relay_open_buf+0x81e/0x19d0 [ 233.745164] relay_open+0xabb/0x1370 [ 233.748912] do_blk_trace_setup+0xaf7/0x1780 [ 233.753375] __blk_trace_setup+0x20b/0x380 [ 233.757667] blk_trace_ioctl+0x274/0x970 [ 233.761761] ? kmsan_set_origin_inline+0x6b/0x120 [ 233.766627] ? __msan_poison_alloca+0x17a/0x210 06:01:41 executing program 3: [ 233.771316] ? apic_timer_interrupt+0xa/0x20 [ 233.775755] ? block_llseek+0x190/0x190 [ 233.779749] ? blkdev_ioctl+0x32c/0x55e0 [ 233.783831] blkdev_ioctl+0x1aaa/0x55e0 [ 233.787828] ? do_futex+0xada/0x59c0 [ 233.791584] ? task_kmsan_context_state+0x6b/0x120 [ 233.796542] ? kmsan_set_origin_inline+0x6b/0x120 [ 233.801407] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 233.806786] ? vmalloc_to_page+0x57d/0x6b0 [ 233.811046] ? kmsan_set_origin_inline+0x6b/0x120 [ 233.815921] block_ioctl+0x16f/0x1d0 [ 233.819650] ? block_llseek+0x190/0x190 [ 233.823641] do_vfs_ioctl+0xcf3/0x2810 [ 233.827562] ? security_file_ioctl+0x92/0x200 [ 233.832077] __se_sys_ioctl+0x1da/0x270 [ 233.836091] __x64_sys_ioctl+0x4a/0x70 [ 233.840012] do_syscall_64+0xbe/0x100 [ 233.843878] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 233.849163] RIP: 0033:0x457519 [ 233.852374] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 233.871285] RSP: 002b:00007f0998933c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 233.879005] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457519 [ 233.879018] RDX: 0000000020000140 RSI: 00000000c0481273 RDI: 0000000000000004 [ 233.879029] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 233.879056] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f09989346d4 [ 233.886617] PM: Marking nosave pages: [mem 0x0009f000-0x000fffff] [ 233.893602] R13: 00000000004be982 R14: 00000000004ce680 R15: 00000000ffffffff [ 233.893625] [ 233.893632] Uninit was created at: [ 233.893654] kmsan_internal_poison_shadow+0xc8/0x1d0 [ 233.893668] kmsan_kmalloc+0xa4/0x120 [ 233.893683] __kmalloc+0x14b/0x440 [ 233.893698] kmsan_vmap+0x9b/0x180 [ 233.893715] vmap+0x3a1/0x510 [ 233.893730] relay_open_buf+0x81e/0x19d0 [ 233.893744] relay_open+0xabb/0x1370 [ 233.893758] do_blk_trace_setup+0xaf7/0x1780 [ 233.893787] __blk_trace_setup+0x20b/0x380 [ 233.893799] blk_trace_ioctl+0x274/0x970 [ 233.893828] blkdev_ioctl+0x1aaa/0x55e0 [ 233.901142] PM: Marking nosave pages: [mem 0xbfffd000-0xffffffff] [ 233.908354] block_ioctl+0x16f/0x1d0 [ 233.908369] do_vfs_ioctl+0xcf3/0x2810 [ 233.908384] __se_sys_ioctl+0x1da/0x270 [ 233.908398] __x64_sys_ioctl+0x4a/0x70 [ 233.908413] do_syscall_64+0xbe/0x100 [ 233.908431] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 233.908438] ================================================================== [ 233.908444] Disabling lock debugging due to kernel taint [ 233.908454] Kernel panic - not syncing: panic_on_warn set ... [ 233.908454] [ 233.908471] CPU: 1 PID: 7651 Comm: syz-executor4 Tainted: G B 4.19.0-rc4+ #66 [ 233.908492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 233.934809] PM: Basic memory bitmaps created [ 233.935995] Call Trace: [ 233.936026] dump_stack+0x306/0x460 [ 234.050395] panic+0x54c/0xafa [ 234.053645] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 234.059111] kmsan_report+0x2d3/0x2e0 [ 234.062936] __msan_warning+0x7c/0xe0 [ 234.066758] vmap_page_range_noflush+0x975/0xed0 06:01:42 executing program 5: [ 234.071560] map_vm_area+0x17d/0x1f0 [ 234.075301] kmsan_vmap+0xf2/0x180 [ 234.078866] vmap+0x3a1/0x510 [ 234.081989] ? relay_open_buf+0x81e/0x19d0 [ 234.086244] relay_open_buf+0x81e/0x19d0 [ 234.090335] relay_open+0xabb/0x1370 [ 234.094090] do_blk_trace_setup+0xaf7/0x1780 [ 234.098534] __blk_trace_setup+0x20b/0x380 [ 234.102795] blk_trace_ioctl+0x274/0x970 [ 234.106891] ? kmsan_set_origin_inline+0x6b/0x120 [ 234.111757] ? __msan_poison_alloca+0x17a/0x210 [ 234.116438] ? apic_timer_interrupt+0xa/0x20 [ 234.120880] ? block_llseek+0x190/0x190 [ 234.124896] ? blkdev_ioctl+0x32c/0x55e0 [ 234.128980] blkdev_ioctl+0x1aaa/0x55e0 [ 234.132975] ? do_futex+0xada/0x59c0 [ 234.136720] ? task_kmsan_context_state+0x6b/0x120 [ 234.141686] ? kmsan_set_origin_inline+0x6b/0x120 [ 234.146548] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 234.151948] ? vmalloc_to_page+0x57d/0x6b0 [ 234.156227] ? kmsan_set_origin_inline+0x6b/0x120 [ 234.161092] block_ioctl+0x16f/0x1d0 [ 234.164826] ? block_llseek+0x190/0x190 [ 234.168821] do_vfs_ioctl+0xcf3/0x2810 [ 234.172755] ? security_file_ioctl+0x92/0x200 [ 234.177270] __se_sys_ioctl+0x1da/0x270 [ 234.181275] __x64_sys_ioctl+0x4a/0x70 [ 234.185174] do_syscall_64+0xbe/0x100 [ 234.188989] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 234.194269] RIP: 0033:0x457519 [ 234.197489] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 234.216404] RSP: 002b:00007f0998933c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 234.224127] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457519 [ 234.231418] RDX: 0000000020000140 RSI: 00000000c0481273 RDI: 0000000000000004 [ 234.238707] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 234.245985] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f09989346d4 [ 234.253262] R13: 00000000004be982 R14: 00000000004ce680 R15: 00000000ffffffff [ 234.261812] Kernel Offset: disabled [ 234.265445] Rebooting in 86400 seconds..