[ 218.392304][ T40] audit: type=1400 audit(1589538336.836:41): avc: denied { map } for pid=9582 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '[localhost]:12539' (ECDSA) to the list of known hosts. [ 221.768725][ T40] audit: type=1400 audit(1589538340.216:42): avc: denied { map } for pid=9594 comm="syz-fuzzer" path="/syz-fuzzer" dev="sda1" ino=16524 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 2020/05/15 10:25:40 fuzzer started 2020/05/15 10:25:41 dialing manager at 10.0.2.10:37263 2020/05/15 10:25:41 syscalls: 3017 2020/05/15 10:25:41 code coverage: enabled 2020/05/15 10:25:41 comparison tracing: enabled 2020/05/15 10:25:41 extra coverage: enabled 2020/05/15 10:25:41 setuid sandbox: enabled 2020/05/15 10:25:41 namespace sandbox: enabled 2020/05/15 10:25:41 Android sandbox: /sys/fs/selinux/policy does not exist 2020/05/15 10:25:41 fault injection: enabled 2020/05/15 10:25:41 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2020/05/15 10:25:41 net packet injection: enabled 2020/05/15 10:25:41 net device setup: enabled 2020/05/15 10:25:41 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2020/05/15 10:25:41 devlink PCI setup: PCI device 0000:00:10.0 is not available 2020/05/15 10:25:41 USB emulation: /dev/raw-gadget does not exist [ 223.167941][ T40] audit: type=1400 audit(1589538341.606:43): avc: denied { integrity } for pid=9613 comm="syz-executor" lockdown_reason="debugfs access" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=lockdown permissive=1 10:26:43 executing program 0: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r2, &(0x7f0000000340)=ANY=[], 0x4e) sendfile(r2, r2, &(0x7f0000000240), 0x7fff) [ 285.214563][ T40] audit: type=1400 audit(1589538403.656:44): avc: denied { map } for pid=9616 comm="syz-executor.0" path="/sys/kernel/debug/kcov" dev="debugfs" ino=1050 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 10:26:43 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) 10:26:44 executing program 2: r0 = socket(0x1e, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @empty}}, 0x1c) sendmmsg(r2, &(0x7f0000000280)=[{{0x0, 0x7000000, 0x0}}], 0x400000000000085, 0x0) [ 286.660591][ T9618] IPVS: ftp: loaded support on port[0] = 21 [ 286.681728][ T9620] IPVS: ftp: loaded support on port[0] = 21 10:26:45 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) unshare(0x44000600) ioctl$BLKPG(r0, 0x127a, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) [ 287.293108][ T9622] IPVS: ftp: loaded support on port[0] = 21 [ 287.518047][ T9618] chnl_net:caif_netlink_parms(): no params data found [ 287.568427][ T9620] chnl_net:caif_netlink_parms(): no params data found [ 287.709777][ T9625] IPVS: ftp: loaded support on port[0] = 21 [ 287.893260][ T9618] bridge0: port 1(bridge_slave_0) entered blocking state [ 287.912935][ T9618] bridge0: port 1(bridge_slave_0) entered disabled state [ 287.936924][ T9618] device bridge_slave_0 entered promiscuous mode [ 287.988496][ T9620] bridge0: port 1(bridge_slave_0) entered blocking state [ 288.007307][ T9620] bridge0: port 1(bridge_slave_0) entered disabled state [ 288.030124][ T9620] device bridge_slave_0 entered promiscuous mode [ 288.060531][ T9618] bridge0: port 2(bridge_slave_1) entered blocking state [ 288.079448][ T9618] bridge0: port 2(bridge_slave_1) entered disabled state [ 288.102202][ T9618] device bridge_slave_1 entered promiscuous mode [ 288.158487][ T9618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 288.183705][ T9620] bridge0: port 2(bridge_slave_1) entered blocking state [ 288.210088][ T9620] bridge0: port 2(bridge_slave_1) entered disabled state [ 288.251933][ T9620] device bridge_slave_1 entered promiscuous mode [ 288.287679][ T9618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 288.393229][ T9618] team0: Port device team_slave_0 added [ 288.423500][ T9620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 288.459360][ T9620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 288.508960][ T9618] team0: Port device team_slave_1 added [ 288.623634][ T9618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 288.644872][ T9618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 288.720055][ T9618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 288.760899][ T9618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 288.774966][ T9618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 288.888309][ T9618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 288.988329][ T9620] team0: Port device team_slave_0 added [ 289.021248][ T9622] chnl_net:caif_netlink_parms(): no params data found [ 289.077220][ T9620] team0: Port device team_slave_1 added [ 289.280282][ T9618] device hsr_slave_0 entered promiscuous mode [ 289.345358][ T9618] device hsr_slave_1 entered promiscuous mode [ 289.419702][ T9620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 289.435219][ T9620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 289.494212][ T9620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 289.536155][ T9620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 289.549593][ T9620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 289.597766][ T9620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 289.688261][ T9625] chnl_net:caif_netlink_parms(): no params data found [ 289.940864][ T9620] device hsr_slave_0 entered promiscuous mode [ 290.045025][ T9620] device hsr_slave_1 entered promiscuous mode [ 290.094998][ T9620] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 290.112377][ T9620] Cannot create hsr debugfs directory [ 290.163407][ T9622] bridge0: port 1(bridge_slave_0) entered blocking state [ 290.181768][ T9622] bridge0: port 1(bridge_slave_0) entered disabled state [ 290.205567][ T9622] device bridge_slave_0 entered promiscuous mode [ 290.229903][ T9622] bridge0: port 2(bridge_slave_1) entered blocking state [ 290.248426][ T9622] bridge0: port 2(bridge_slave_1) entered disabled state [ 290.267468][ T9622] device bridge_slave_1 entered promiscuous mode [ 290.429942][ T9622] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 290.460622][ T9622] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 290.516440][ T9625] bridge0: port 1(bridge_slave_0) entered blocking state [ 290.566005][ T9625] bridge0: port 1(bridge_slave_0) entered disabled state [ 290.613299][ T9625] device bridge_slave_0 entered promiscuous mode [ 290.679364][ T9625] bridge0: port 2(bridge_slave_1) entered blocking state [ 290.710211][ T9625] bridge0: port 2(bridge_slave_1) entered disabled state [ 290.749669][ T9625] device bridge_slave_1 entered promiscuous mode [ 290.846284][ T9622] team0: Port device team_slave_0 added [ 290.889079][ T9622] team0: Port device team_slave_1 added [ 290.927068][ T9625] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 291.002169][ T9625] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 291.058127][ T9622] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 291.078135][ T9622] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 291.153391][ T9622] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 291.209516][ T9622] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 291.241588][ T9622] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 291.302025][ T9622] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 291.322580][ T9625] team0: Port device team_slave_0 added [ 291.349145][ T9625] team0: Port device team_slave_1 added [ 291.361823][ T40] audit: type=1400 audit(1589538409.806:45): avc: denied { create } for pid=9618 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 291.387616][ T9618] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 291.416824][ T40] audit: type=1400 audit(1589538409.806:46): avc: denied { write } for pid=9618 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 291.416847][ T40] audit: type=1400 audit(1589538409.806:47): avc: denied { read } for pid=9618 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 291.698929][ T9618] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 291.791378][ T9618] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 291.911396][ T9618] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 292.008910][ T9625] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 292.035999][ T9625] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 292.099029][ T9625] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 292.220935][ T9622] device hsr_slave_0 entered promiscuous mode [ 292.285196][ T9622] device hsr_slave_1 entered promiscuous mode [ 292.344712][ T9622] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 292.360657][ T9622] Cannot create hsr debugfs directory [ 292.391497][ T9625] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 292.421107][ T9625] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 292.487342][ T9625] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 292.618768][ T9625] device hsr_slave_0 entered promiscuous mode [ 292.685195][ T9625] device hsr_slave_1 entered promiscuous mode [ 292.744588][ T9625] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 292.763126][ T9625] Cannot create hsr debugfs directory [ 292.777902][ T9620] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 292.889116][ T9620] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 293.090346][ T9620] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 293.227151][ T9620] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 293.499951][ T9622] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 293.569443][ T9622] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 293.663900][ T9622] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 293.788943][ T9622] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 293.923004][ T9625] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 294.002302][ T9625] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 294.082125][ T9625] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 294.197151][ T9625] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 294.372925][ T9618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 294.431592][ T9620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 294.459026][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 294.488131][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 294.517839][ T9618] 8021q: adding VLAN 0 to HW filter on device team0 [ 294.571234][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 294.600283][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 294.619134][ T23] bridge0: port 1(bridge_slave_0) entered blocking state [ 294.636695][ T23] bridge0: port 1(bridge_slave_0) entered forwarding state [ 294.673856][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 294.693254][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 294.717632][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 294.738930][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 294.753630][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 294.769997][ T23] bridge0: port 2(bridge_slave_1) entered blocking state [ 294.783055][ T23] bridge0: port 2(bridge_slave_1) entered forwarding state [ 294.811516][ T9620] 8021q: adding VLAN 0 to HW filter on device team0 [ 294.844828][ T3456] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 294.865654][ T3456] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 294.896384][ T3456] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 294.927470][ T3456] bridge0: port 1(bridge_slave_0) entered blocking state [ 294.942777][ T3456] bridge0: port 1(bridge_slave_0) entered forwarding state [ 294.966979][ T9625] 8021q: adding VLAN 0 to HW filter on device bond0 [ 294.995493][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 295.015244][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 295.036164][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 295.053959][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 295.080892][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 295.094955][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 295.118844][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 295.136448][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 295.153171][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 295.182594][ T9622] 8021q: adding VLAN 0 to HW filter on device bond0 [ 295.204690][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 295.231538][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 295.261302][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 295.281907][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 295.302798][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 295.324838][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 295.346218][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 295.376352][ T9625] 8021q: adding VLAN 0 to HW filter on device team0 [ 295.400988][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 295.417891][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 295.435254][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 295.455181][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 295.473301][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 295.487943][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 295.506297][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 295.521632][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 295.545850][ T9618] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 295.566480][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 295.586906][ T18] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 295.615638][ T9622] 8021q: adding VLAN 0 to HW filter on device team0 [ 295.650824][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 295.667444][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 295.685914][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 295.707274][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 295.723161][ T4046] bridge0: port 1(bridge_slave_0) entered blocking state [ 295.736929][ T4046] bridge0: port 1(bridge_slave_0) entered forwarding state [ 295.751260][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 295.767564][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 295.794862][ T4046] bridge0: port 2(bridge_slave_1) entered blocking state [ 295.810689][ T4046] bridge0: port 2(bridge_slave_1) entered forwarding state [ 295.827147][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 295.851515][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 295.875230][ T4046] bridge0: port 2(bridge_slave_1) entered blocking state [ 295.892264][ T4046] bridge0: port 2(bridge_slave_1) entered forwarding state [ 295.931410][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 295.958452][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 296.006596][ T9618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 296.041037][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 296.066458][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 296.092985][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 296.125907][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 296.153438][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 296.180989][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 296.202799][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 296.227264][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 296.266818][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 296.293034][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 296.325272][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 296.350715][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 296.368850][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 296.385490][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 296.417223][ T9646] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 296.443702][ T9646] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 296.463736][ T9646] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 296.482483][ T9646] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 296.519481][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 296.556016][ T9647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 296.585243][ T9647] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 296.608199][ T9647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 296.628157][ T9647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 296.652566][ T9647] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 296.672617][ T9647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 296.691986][ T9647] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 296.734636][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 296.759270][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 296.780664][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 296.799487][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 296.822239][ T9625] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 296.847731][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 296.865444][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 296.911553][ T9620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 296.941013][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 296.960480][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 296.992984][ T9622] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 297.021685][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 297.041661][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 297.069443][ T9643] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 297.088655][ T9643] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 297.115988][ T9618] device veth0_vlan entered promiscuous mode [ 297.134856][ T9647] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 297.156217][ T9647] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 297.192737][ T9625] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 297.212435][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 297.231498][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 297.269486][ T9618] device veth1_vlan entered promiscuous mode [ 297.303437][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 297.332380][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 297.356613][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 297.387493][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 297.415118][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 297.433118][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 297.466297][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 297.494130][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 297.538400][ T9622] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 297.562389][ T9647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 297.589868][ T9647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 297.622887][ T9620] device veth0_vlan entered promiscuous mode [ 297.677897][ T9643] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 297.698192][ T9643] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 297.716145][ T9625] device veth0_vlan entered promiscuous mode [ 297.737897][ T9643] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 297.754985][ T9643] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 297.777810][ T9643] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 297.806501][ T9643] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 297.853933][ T9620] device veth1_vlan entered promiscuous mode [ 297.888551][ T9618] device veth0_macvtap entered promiscuous mode [ 297.938186][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 297.991003][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 298.034076][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 298.101761][ T9618] device veth1_macvtap entered promiscuous mode [ 298.143638][ T9625] device veth1_vlan entered promiscuous mode [ 298.217615][ T9622] device veth0_vlan entered promiscuous mode [ 298.237602][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 298.265372][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 298.281571][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 298.297417][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 298.332491][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 298.368638][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 298.403082][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 298.439233][ T9618] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 298.471395][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 298.505455][ T2621] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 298.540825][ T9618] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 298.560605][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 298.591332][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 298.626932][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 298.650027][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 298.685554][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 298.710312][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 298.836873][ T9622] device veth1_vlan entered promiscuous mode [ 298.856994][ T9625] device veth0_macvtap entered promiscuous mode [ 298.895566][ T9620] device veth0_macvtap entered promiscuous mode [ 299.043121][ T9625] device veth1_macvtap entered promiscuous mode [ 299.158781][ T9620] device veth1_macvtap entered promiscuous mode [ 299.161999][ T40] audit: type=1400 audit(1589538417.606:48): avc: denied { associate } for pid=9618 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 299.230557][ T9620] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 299.317813][ T9620] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 299.378219][ T9620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 299.433325][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 299.478823][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 299.522114][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 299.568954][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 299.608363][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 299.636999][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 299.667645][ T9620] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 299.706900][ T9620] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 299.747469][ T9620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 299.812224][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 299.852393][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 299.997722][ T9625] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 300.048223][ T9625] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.108345][ T9625] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 300.186547][ T9625] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.251179][ T9625] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 300.306038][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 300.344868][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 300.425671][ T9625] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 300.470700][ T9625] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.515193][ T9625] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 300.565139][ T9625] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.610017][ T9625] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 300.640180][ T9622] device veth0_macvtap entered promiscuous mode [ 300.670071][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 300.713413][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 300.757502][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 300.795334][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 300.867326][ T35] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready 10:26:59 executing program 0: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r2, &(0x7f0000000340)=ANY=[], 0x4e) sendfile(r2, r2, &(0x7f0000000240), 0x7fff) [ 301.012318][ T9622] device veth1_macvtap entered promiscuous mode [ 301.212373][ T9659] binder: 9658:9659 ioctl c0046209 0 returned -22 10:26:59 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) [ 301.302901][ T9622] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 301.346495][ T9622] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 301.361093][ T9665] binder: 9664:9665 ioctl c0046209 0 returned -22 10:26:59 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) [ 301.382242][ T9622] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 301.448818][ T9622] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! 10:26:59 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) [ 301.494464][ T9622] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 301.535548][ T9622] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 301.545382][ T9672] binder: 9671:9672 ioctl c0046209 0 returned -22 [ 301.576055][ T9622] batman_adv: batadv0: Interface activated: batadv_slave_0 10:27:00 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) [ 301.631107][ T9622] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 301.677488][ T9622] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 301.701135][ T9676] binder: 9675:9676 ioctl c0046209 0 returned -22 10:27:00 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) [ 301.737839][ T9622] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 301.737845][ T9622] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 301.737870][ T9622] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 301.737873][ T9622] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 301.745361][ T9622] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 301.909899][ T9679] binder: 9678:9679 ioctl c0046209 0 returned -22 [ 302.025579][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 302.071578][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 302.102211][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 302.126768][ T4046] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 302.238172][ T9684] IPVS: ftp: loaded support on port[0] = 21 [ 302.435038][ T9684] IPVS: ftp: loaded support on port[0] = 21 10:27:01 executing program 0: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r2, &(0x7f0000000340)=ANY=[], 0x4e) sendfile(r2, r2, &(0x7f0000000240), 0x7fff) 10:27:01 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) [ 302.808050][ T2025] tipc: TX() has been purged, node left! 10:27:01 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) unshare(0x44000600) ioctl$BLKPG(r0, 0x127a, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) 10:27:01 executing program 2: r0 = socket(0x1e, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @empty}}, 0x1c) sendmmsg(r2, &(0x7f0000000280)=[{{0x0, 0x7000000, 0x0}}], 0x400000000000085, 0x0) [ 302.878861][ T9696] binder: 9692:9696 ioctl c0046209 0 returned -22 10:27:01 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) [ 302.935618][ T9694] IPVS: ftp: loaded support on port[0] = 21 [ 303.033337][ T9704] binder: 9703:9704 ioctl c0046209 0 returned -22 10:27:01 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) 10:27:01 executing program 3: r0 = socket(0x1e, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @empty}}, 0x1c) sendmmsg(r2, &(0x7f0000000280)=[{{0x0, 0x7000000, 0x0}}], 0x400000000000085, 0x0) [ 303.151566][ T9709] binder: 9707:9709 ioctl c0046209 0 returned -22 10:27:01 executing program 2: r0 = socket(0x1e, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @empty}}, 0x1c) sendmmsg(r2, &(0x7f0000000280)=[{{0x0, 0x7000000, 0x0}}], 0x400000000000085, 0x0) 10:27:01 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, 0x0) 10:27:02 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, 0x0) 10:27:02 executing program 2: r0 = socket(0x1e, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @empty}}, 0x1c) sendmmsg(r2, &(0x7f0000000280)=[{{0x0, 0x7000000, 0x0}}], 0x400000000000085, 0x0) 10:27:02 executing program 3: r0 = socket(0x1e, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @empty}}, 0x1c) sendmmsg(r2, &(0x7f0000000280)=[{{0x0, 0x7000000, 0x0}}], 0x400000000000085, 0x0) 10:27:02 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000380)='/dev/loop#\x00', 0x0, 0x0) unshare(0x44000600) ioctl$BLKPG(r0, 0x127a, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) 10:27:02 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, 0x0) [ 303.873104][ T9732] IPVS: ftp: loaded support on port[0] = 21 10:27:02 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) 10:27:02 executing program 2: r0 = socket(0x1e, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) sendmmsg(r2, &(0x7f0000000280)=[{{0x0, 0x7000000, 0x0}}], 0x400000000000085, 0x0) 10:27:02 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) 10:27:02 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) 10:27:02 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) 10:27:02 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) 10:27:02 executing program 1: syz_open_dev$binderN(0x0, 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) 10:27:02 executing program 0: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) write$P9_RREADLINK(r2, &(0x7f0000000340)=ANY=[], 0x4e) sendfile(r2, r2, &(0x7f0000000240), 0x7fff) 10:27:02 executing program 2: r0 = socket(0x1e, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) sendmmsg(r2, &(0x7f0000000280)=[{{0x0, 0x7000000, 0x0}}], 0x400000000000085, 0x0) 10:27:02 executing program 1: syz_open_dev$binderN(0x0, 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) 10:27:02 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) 10:27:02 executing program 1: syz_open_dev$binderN(0x0, 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) clone(0x1918ffd, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) [ 304.466345][ T9776] binder: 9774:9776 ioctl c0046209 0 returned -22 10:27:02 executing program 2: r0 = socket(0x1e, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) sendmmsg(r2, &(0x7f0000000280)=[{{0x0, 0x7000000, 0x0}}], 0x400000000000085, 0x0) 10:27:03 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) 10:27:03 executing program 3: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xd4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000180)='./bus\x00', 0x151042, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/diskstats\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x4000000000010046) [ 304.640208][ T9783] binder: 9781:9783 ioctl c0046209 0 returned -22 [ 304.689492][ T40] audit: type=1400 audit(1589538423.136:49): avc: denied { open } for pid=9788 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1 [ 304.802299][ T40] audit: type=1400 audit(1589538423.136:50): avc: denied { kernel } for pid=9788 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1 [ 304.935967][ T40] audit: type=1400 audit(1589538423.136:51): avc: denied { confidentiality } for pid=9788 comm="syz-executor.3" lockdown_reason="unsafe use of perf" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=lockdown permissive=1 10:27:03 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0) 10:27:04 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000001280)='/dev/bus/usb/00#/00#\x00', 0x1aa1, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x12, r0, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) [ 305.569807][ T9796] binder: 9795:9796 ioctl c0046209 0 returned -22 [ 305.616118][ T40] audit: type=1400 audit(1589538424.056:52): avc: denied { map } for pid=9797 comm="syz-executor.0" path="/dev/bus/usb/007/001" dev="devtmpfs" ino=26051 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usb_device_t:s0 tclass=chr_file permissive=1 [ 305.622678][ T9800] ------------[ cut here ]------------ [ 305.925271][ T9800] memtype_reserve failed: [mem 0xffffffffff000-0x00000fff], req write-back [ 305.994080][ T9800] WARNING: CPU: 1 PID: 9800 at arch/x86/mm/pat/memtype.c:589 memtype_reserve+0x69f/0x820 [ 305.994424][ T9800] Kernel panic - not syncing: panic_on_warn set ... [ 306.077190][ T9800] CPU: 1 PID: 9800 Comm: syz-executor.0 Not tainted 5.7.0-rc5-syzkaller #0 [ 306.077190][ T9800] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 306.167711][ T9800] Call Trace: [ 306.167711][ T9800] dump_stack+0x188/0x20d [ 306.167711][ T9800] ? memtype_reserve+0x5b0/0x820 [ 306.232047][ T9800] panic+0x2e3/0x75c [ 306.232047][ T9800] ? add_taint.cold+0x16/0x16 [ 306.232047][ T9800] ? __probe_kernel_read+0x188/0x1d0 [ 306.232047][ T9800] ? __warn.cold+0x14/0x35 [ 306.232047][ T9800] ? memtype_reserve+0x69f/0x820 [ 306.232047][ T9800] __warn.cold+0x2f/0x35 [ 306.232047][ T9800] ? irq_work_queue+0xc3/0x100 [ 306.232047][ T9800] ? memtype_reserve+0x69f/0x820 [ 306.232047][ T9800] report_bug+0x27b/0x2f0 [ 306.232047][ T9800] do_error_trap+0x12b/0x220 [ 306.232047][ T9800] ? memtype_reserve+0x69f/0x820 [ 306.232047][ T9800] do_invalid_op+0x32/0x40 [ 306.232047][ T9800] ? memtype_reserve+0x69f/0x820 [ 306.232047][ T9800] invalid_op+0x23/0x30 [ 306.232047][ T9800] RIP: 0010:memtype_reserve+0x69f/0x820 [ 306.444736][ T9800] Code: 48 8b 2c ed 80 ff 28 88 e8 ae ad 3e 00 48 8d 4b ff 49 89 e8 4c 89 e2 48 c7 c6 e0 ff 28 88 48 c7 c7 40 f8 28 88 e8 79 e8 0f 00 <0f> 0b 41 bf ea ff ff ff e9 03 fc ff ff 41 bf ea ff ff ff e9 f8 fb [ 306.539041][ T9800] RSP: 0018:ffffc900027677a0 EFLAGS: 00010282 [ 306.539041][ T9800] RAX: 0000000000000000 RBX: 0000000000001000 RCX: 0000000000000000 [ 306.539041][ T9800] RDX: 0000000000040000 RSI: ffffffff815ce651 RDI: fffff520004ecee6 [ 306.539041][ T9800] RBP: ffffffff8828fe00 R08: ffff8880669d0080 R09: ffffed10059e66a9 [ 306.539041][ T9800] R10: ffff88802cf33547 R11: ffffed10059e66a8 R12: 000ffffffffff000 [ 306.539041][ T9800] R13: 1ffff920004ecefa R14: dffffc0000000000 R15: 0000000000000000 [ 306.539041][ T9800] ? vprintk_func+0x81/0x17e [ 306.539041][ T9800] ? _raw_spin_unlock_irqrestore+0x9b/0xe0 [ 306.539041][ T9800] ? stack_depot_save+0x252/0x440 [ 306.539041][ T9800] ? pat_init+0x440/0x440 [ 306.539041][ T9800] ? __init_cache_modes+0x270/0x270 [ 306.539041][ T9800] ? save_stack+0x32/0x40 [ 306.539041][ T9800] ? save_stack+0x1b/0x40 [ 306.539041][ T9800] reserve_pfn_range+0x173/0x470 [ 306.539041][ T9800] ? entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 306.539041][ T9800] ? arch_io_reserve_memtype_wc+0xa0/0xa0 [ 306.539041][ T9800] ? find_held_lock+0x2d/0x110 [ 306.539041][ T9800] track_pfn_remap+0x18b/0x280 [ 306.539041][ T9800] remap_pfn_range+0x202/0xbf0 [ 306.539041][ T9800] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 306.539041][ T9800] ? __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 306.539041][ T9800] ? copy_page_range+0x1f00/0x1f00 [ 306.539041][ T9800] ? __kmalloc+0x62f/0x7a0 [ 306.539041][ T9800] ? hcd_buffer_alloc+0x1ed/0x290 [ 306.539041][ T9800] dma_direct_mmap+0x197/0x260 [ 306.539041][ T9800] dma_mmap_attrs+0xfe/0x150 [ 306.539041][ T9800] usbdev_mmap+0x3ae/0x730 [ 306.539041][ T9800] ? usbdev_vm_close+0x40/0x40 [ 306.539041][ T9800] mmap_region+0xafb/0x1540 [ 306.539041][ T9800] ? __x64_sys_brk+0x6e0/0x6e0 [ 306.539041][ T9800] ? security_mmap_addr+0x81/0xa0 [ 306.539041][ T9800] ? get_unmapped_area+0x2a0/0x3c0 [ 306.539041][ T9800] do_mmap+0x849/0x1160 [ 306.539041][ T9800] vm_mmap_pgoff+0x197/0x200 [ 306.539041][ T9800] ? randomize_stack_top+0x100/0x100 [ 306.539041][ T9800] ? ksys_dup3+0x3c0/0x3c0 [ 306.539041][ T9800] ? ns_to_kernel_old_timeval+0x100/0x100 [ 306.539041][ T9800] ksys_mmap_pgoff+0x457/0x5b0 [ 306.539041][ T9800] ? find_mergeable_anon_vma+0x2c0/0x2c0 [ 306.539041][ T9800] ? __ia32_sys_clock_settime+0x260/0x260 [ 306.539041][ T9800] ? trace_hardirqs_off_caller+0x55/0x230 [ 306.539041][ T9800] do_syscall_64+0xf6/0x7d0 [ 306.539041][ T9800] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 306.539041][ T9800] RIP: 0033:0x45c699 [ 306.539041][ T9800] Code: 1d b2 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b1 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 306.539041][ T9800] RSP: 002b:00007f0377046c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 306.539041][ T9800] RAX: ffffffffffffffda RBX: 000000000074bf00 RCX: 000000000045c699 [ 306.539041][ T9800] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000020ffe000 [ 306.539041][ T9800] RBP: 0000000000709540 R08: 0000000000000003 R09: 0000000000000000 [ 306.539041][ T9800] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f03770476d4 [ 306.539041][ T9800] R13: 000000000000073e R14: 00000000006ec5c0 R15: 00000000004b0d76 [ 306.539041][ T9800] Kernel Offset: disabled [ 306.539041][ T9800] Rebooting in 86400 seconds..