[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 41.833958] kauditd_printk_skb: 8 callbacks suppressed [ 41.833972] audit: type=1400 audit(1538636495.567:35): avc: denied { map } for pid=5900 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.10.22' (ECDSA) to the list of known hosts. 2018/10/04 07:01:42 fuzzer started [ 48.496684] audit: type=1400 audit(1538636502.227:36): avc: denied { map } for pid=5909 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16479 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/10/04 07:01:44 dialing manager at 10.128.0.26:32985 2018/10/04 07:01:44 syscalls: 1 2018/10/04 07:01:44 code coverage: enabled 2018/10/04 07:01:44 comparison tracing: enabled 2018/10/04 07:01:44 setuid sandbox: enabled 2018/10/04 07:01:44 namespace sandbox: enabled 2018/10/04 07:01:44 Android sandbox: /sys/fs/selinux/policy does not exist 2018/10/04 07:01:44 fault injection: enabled 2018/10/04 07:01:44 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/10/04 07:01:44 net packed injection: enabled 2018/10/04 07:01:44 net device setup: enabled 07:04:00 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) keyctl$set_reqkey_keyring(0x10, 0xffffffffffffffff) [ 187.110569] audit: type=1400 audit(1538636640.847:37): avc: denied { map } for pid=5923 comm="syz-executor0" path="/sys/kernel/debug/kcov" dev="debugfs" ino=14769 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 187.176601] IPVS: ftp: loaded support on port[0] = 21 07:04:01 executing program 1: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000240)=""/246) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000040)=0x600210) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = memfd_create(&(0x7f0000000080)="73970ddb08df8c656c667b7070703070707031236d643573756d00", 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r0, r2, &(0x7f00000ddff8), 0x102002700) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x10, &(0x7f0000000100)="0249c83d6d345f8f762070") r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000340)) sendmmsg(r4, &(0x7f0000007980)=[{{&(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x2, 0x4, 0x1, {0xa, 0x4e23, 0x8, @ipv4={[], [], @broadcast}, 0x6}}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000200)="9576dd792c1d6ef9b450ab3dbcbe43c700d0ca376af4747273941a6bd5963ac52e882089fecc85929ac9bf451aead95f71327910f5fb6d74ada81d0b5cec565b54dacba7ffdd9a70c5406ecf219b56c2968555e1d460cc921825afb2b4531f045de4c1f14f0ba76ee5e0df1c89358f0720b80e9a6160567824c7722339fc684d982418611a84162fe8e965", 0x8b}], 0x1, &(0x7f0000000440), 0x0, 0x4000814}, 0x1}], 0x1, 0x8080) sendto$llc(r4, &(0x7f0000000000)="298248337a8d2a6b177cac842110cf5c2017fca5d843bce67d7fe54070b5bdaf737e5c3ab8647625fd292234c6d4883aa100742e3fba9e0f40c44e5fe4cdf0a2d7399822a502e9f3687cfa974cca2f13699d1021edbd3f8ee471fa782d2521279cf828ea38c6c075", 0x68, 0x4000000, 0x0, 0x0) clock_nanosleep(0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f0000000480)) r5 = gettid() perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000000380), &(0x7f0000000400)=0x14) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000600)) sendmsg$nl_generic(r6, &(0x7f0000000080)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000a80)=ANY=[@ANYBLOB="1400e2628da5fdff000000000000000001000000d52926887375437576769ac4d6e3eb5678bf5c72e2108469e3d9b39d1aa1e89487a778bf9ab7d65f00000000c8d000258378af9427736aa5ecbbf9935a000020881f48513ecc04f5dca99fb3726b510c1cf1f72b4fdedab950209a7560dbf61de92e83c9aa6e72937c35489a56a71ecf1484393730efcfbeddccdf5a93701ee17faf46e24c4339edd94f9166455198fa48ebf2edd37001ebdeaf5a19e56a25969d2354321fd1a3306a0ff4fe7d46e5dd372c788633b9d7fdccf1c6ed713d459422e5fdbe633ded13885e3fa76d37565f5dbdb9be15f9b560781c51f3b0a2b33e0f635e6307ca2fab561a3c8d5b1434f736b2a5e7f3e496556df951ae622490d8501500feb353102175b21233bb05619a69784228269c00210000000000000000000000967c6b0c006c4c17b7706826957b4930f9d6ec6b4ed97482eaadb905c6fa5ff81c41a7f2cc965e9cd002c1303b7e8d0369f4c396d3afd5be99c5996fbec8e531cbe5b8296e6019f1754044bc7f68b205678bf59a549e36f3d519e786491d182d2374f24eb370ad5063f5e01f308ca06b71aca5a419bf5df1ed56d993995a6892035cb8eb4aad9f801e72dac4aa216dd2df068eaa5057efdb8bdb021ae71ea6b0e86d90d2c4fc7cc745ff1ebb4a3468b0084f45f7b546c263f7e775556c653bad9741b18c1fe499c3bc961ffc28b36db6"], 0x1}}, 0x0) recvmsg(r6, &(0x7f0000003f00)={&(0x7f0000002a00)=@can, 0x80, &(0x7f0000003d80), 0x0, &(0x7f0000003e00)=""/240, 0xf0}, 0x0) prctl$seccomp(0x16, 0x3, &(0x7f0000000680)={0x7, &(0x7f0000000640)=[{0x8, 0xfff, 0x8, 0xc99a}, {0xffffffffffffff80, 0x4, 0x5, 0x2}, {0xb337dc8, 0x1e, 0x100, 0x1f}, {0x1ff, 0x80000001, 0x0, 0x1ff}, {0x4, 0xa36b, 0x100000000, 0x6}, {0x7fffffff, 0x3ff, 0xffffffff, 0x401}, {0x7, 0x3f, 0x3, 0x8001}]}) clock_nanosleep(0x2, 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000180)) r7 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x9, 0x19c6a6b4e739ed0e) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000004c0)={{{@in, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000440)=0xfffffffffffffd4b) bind$packet(r7, &(0x7f0000004a80)={0x11, 0x10, r8, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r5, 0x1000000000014) [ 187.418197] IPVS: ftp: loaded support on port[0] = 21 07:04:01 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x105084) [ 187.645991] IPVS: ftp: loaded support on port[0] = 21 07:04:01 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000000)=[{0x3}, {0x0, 0xffff}], 0x2) semop(0x0, &(0x7f0000000240)=[{0x0, 0x7fff}], 0x1) [ 188.084277] IPVS: ftp: loaded support on port[0] = 21 07:04:02 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0xfffffffffffffff8, 0x2000) ioctl$KDDISABIO(r1, 0x4b37) r2 = syz_open_dev$usb(&(0x7f0000000400)='/dev/bus/usb/00#/00#\x00', 0xe240, 0x0) ioctl$VT_OPENQRY(r2, 0x5600, &(0x7f0000000440)) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000340)={'filter\x00'}, &(0x7f0000000680)=0x78) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000200)="21fa7b7573746564405c235e77a241007ac6088ec8c695d0b1b2a0215398989bc3bbe4c7babb944729c199a0622cb71e830c0d95e27a8d59ba5ec4eba8dbe0345534f042403bc0a88b99ea894234e9a8c1e71f1413176d1869329fa2254912d56362a3100ec8d6165b7f137e5c6e494a274797353cce83239f3b17e065a970e8b93cd4018a2ec9c6acb57e6e") syz_open_pts(r0, 0x0) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000002c0)) getegid() mount$fuseblk(&(0x7f0000000000)='/dev/loop0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='fuseblk\x00', 0x1000000, &(0x7f00000004c0)=ANY=[@ANYBLOB]) [ 188.339859] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.346480] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.359371] device bridge_slave_0 entered promiscuous mode [ 188.469668] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.476099] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.497523] device bridge_slave_1 entered promiscuous mode [ 188.525175] IPVS: ftp: loaded support on port[0] = 21 [ 188.580327] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 188.687086] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 07:04:02 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x0, 0x1, &(0x7f0000001fe8)=ANY=[@ANYBLOB="8cfec426d1832dca7f"], &(0x7f0000003ff6)='syzkaller\x00', 0x0, 0xc3, &(0x7f0000000000)=""/195}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000001fd8)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffff87}, [@ldst={0x7, 0x0, 0x3}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x437, &(0x7f000000cf3d)=""/195}, 0x48) [ 188.845300] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.868101] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.877990] device bridge_slave_0 entered promiscuous mode [ 188.982033] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.982548] IPVS: ftp: loaded support on port[0] = 21 [ 189.008576] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.015772] device bridge_slave_1 entered promiscuous mode [ 189.030130] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 189.075165] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 189.177641] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 189.194697] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 189.269241] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 189.276180] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 189.340410] bridge0: port 1(bridge_slave_0) entered blocking state [ 189.350067] bridge0: port 1(bridge_slave_0) entered disabled state [ 189.357202] device bridge_slave_0 entered promiscuous mode [ 189.371107] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 189.391535] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 189.463025] bridge0: port 2(bridge_slave_1) entered blocking state [ 189.478545] bridge0: port 2(bridge_slave_1) entered disabled state [ 189.485769] device bridge_slave_1 entered promiscuous mode [ 189.502889] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 189.601502] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 189.632126] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 189.689768] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 189.719969] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 189.729424] team0: Port device team_slave_0 added [ 189.841047] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 189.867442] team0: Port device team_slave_1 added [ 189.955554] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 189.987203] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.005358] bridge0: port 1(bridge_slave_0) entered disabled state [ 190.013350] device bridge_slave_0 entered promiscuous mode [ 190.024911] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 190.045488] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 190.063670] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 190.074724] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.085469] bridge0: port 2(bridge_slave_1) entered disabled state [ 190.092963] device bridge_slave_1 entered promiscuous mode [ 190.104841] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 190.138328] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 190.161476] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 190.179056] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 190.200490] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 190.216138] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 190.236190] team0: Port device team_slave_0 added [ 190.276734] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 190.312710] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 190.327314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 190.337084] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 190.345685] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 190.354189] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 190.384685] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 190.395769] team0: Port device team_slave_1 added [ 190.401883] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 190.420697] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 190.442906] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 190.460971] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 190.484636] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 190.510254] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 190.522535] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 190.536540] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 190.547645] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.558541] bridge0: port 1(bridge_slave_0) entered disabled state [ 190.565741] device bridge_slave_0 entered promiscuous mode [ 190.616656] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 190.644873] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.663322] bridge0: port 2(bridge_slave_1) entered disabled state [ 190.671131] device bridge_slave_1 entered promiscuous mode [ 190.679198] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 190.692261] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 190.707286] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 190.748995] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 190.758778] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 190.771880] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 190.789314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 190.829295] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 190.859102] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 190.867339] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.875359] bridge0: port 1(bridge_slave_0) entered disabled state [ 190.883315] device bridge_slave_0 entered promiscuous mode [ 190.893167] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 190.914413] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 190.947348] team0: Port device team_slave_0 added [ 190.981492] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.987932] bridge0: port 2(bridge_slave_1) entered disabled state [ 190.995271] device bridge_slave_1 entered promiscuous mode [ 191.005351] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 191.014351] team0: Port device team_slave_1 added [ 191.024349] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 191.044152] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 191.096219] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 191.103296] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 191.113547] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 191.133296] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 191.147209] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 191.163929] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 191.188689] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 191.195922] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 191.210272] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 191.273948] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 191.289348] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 191.296749] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 191.320258] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 191.342689] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 191.392793] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 191.416155] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 191.429099] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 191.451987] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 191.496836] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 191.504240] team0: Port device team_slave_0 added [ 191.594513] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 191.638697] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 191.646236] team0: Port device team_slave_1 added [ 191.683313] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 191.748270] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 191.783727] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.790129] bridge0: port 2(bridge_slave_1) entered forwarding state [ 191.796766] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.803152] bridge0: port 1(bridge_slave_0) entered forwarding state [ 191.829427] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 191.862570] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 191.882134] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.888536] bridge0: port 2(bridge_slave_1) entered forwarding state [ 191.895160] bridge0: port 1(bridge_slave_0) entered blocking state [ 191.901542] bridge0: port 1(bridge_slave_0) entered forwarding state [ 191.919440] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 191.968623] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 191.975789] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 191.993806] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 192.002031] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 192.017315] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 192.045822] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 192.055824] team0: Port device team_slave_0 added [ 192.079716] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 192.089248] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 192.110417] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 192.136656] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 192.158074] team0: Port device team_slave_1 added [ 192.267580] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 192.274898] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 192.283269] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 192.302828] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 192.339462] team0: Port device team_slave_0 added [ 192.399861] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 192.408244] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 192.424237] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 192.479559] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 192.489657] team0: Port device team_slave_1 added [ 192.495578] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 192.519029] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 192.530385] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 192.561954] bridge0: port 2(bridge_slave_1) entered blocking state [ 192.568349] bridge0: port 2(bridge_slave_1) entered forwarding state [ 192.575026] bridge0: port 1(bridge_slave_0) entered blocking state [ 192.581439] bridge0: port 1(bridge_slave_0) entered forwarding state [ 192.598986] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 192.613673] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 192.654251] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 192.669339] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 192.698959] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 192.749087] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 192.820654] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 192.838861] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 192.855536] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 192.931122] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 192.947999] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 192.966797] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 192.987805] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 193.254184] bridge0: port 2(bridge_slave_1) entered blocking state [ 193.260617] bridge0: port 2(bridge_slave_1) entered forwarding state [ 193.267247] bridge0: port 1(bridge_slave_0) entered blocking state [ 193.273659] bridge0: port 1(bridge_slave_0) entered forwarding state [ 193.307571] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 193.999390] bridge0: port 2(bridge_slave_1) entered blocking state [ 194.005787] bridge0: port 2(bridge_slave_1) entered forwarding state [ 194.012426] bridge0: port 1(bridge_slave_0) entered blocking state [ 194.018803] bridge0: port 1(bridge_slave_0) entered forwarding state [ 194.035495] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 194.046243] bridge0: port 2(bridge_slave_1) entered blocking state [ 194.052655] bridge0: port 2(bridge_slave_1) entered forwarding state [ 194.059306] bridge0: port 1(bridge_slave_0) entered blocking state [ 194.065663] bridge0: port 1(bridge_slave_0) entered forwarding state [ 194.087667] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 194.100631] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 194.111628] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 194.129726] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 195.548666] 8021q: adding VLAN 0 to HW filter on device bond0 [ 195.858939] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 196.100024] 8021q: adding VLAN 0 to HW filter on device bond0 [ 196.194250] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 196.208582] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 196.216942] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 196.519270] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 196.549447] 8021q: adding VLAN 0 to HW filter on device bond0 [ 196.599388] 8021q: adding VLAN 0 to HW filter on device team0 [ 196.877866] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 196.893902] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 196.909399] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 196.932626] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 197.288866] 8021q: adding VLAN 0 to HW filter on device team0 [ 197.304055] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 197.325645] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 197.334184] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 197.357184] 8021q: adding VLAN 0 to HW filter on device bond0 [ 197.699634] 8021q: adding VLAN 0 to HW filter on device team0 [ 197.738363] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 197.869230] 8021q: adding VLAN 0 to HW filter on device bond0 [ 198.001937] 8021q: adding VLAN 0 to HW filter on device bond0 [ 198.090929] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 198.097085] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 198.108996] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 198.260769] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 198.371413] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 198.486897] 8021q: adding VLAN 0 to HW filter on device team0 [ 198.640881] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 198.647059] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 198.659513] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 198.824792] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 198.840556] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 198.850793] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 198.930360] audit: type=1400 audit(1538636652.667:38): avc: denied { create } for pid=7260 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 199.015568] audit: type=1400 audit(1538636652.697:39): avc: denied { write } for pid=7260 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 199.028568] 8021q: adding VLAN 0 to HW filter on device team0 [ 199.111272] audit: type=1400 audit(1538636652.697:40): avc: denied { read } for pid=7260 comm="syz-executor1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 199.200415] 8021q: adding VLAN 0 to HW filter on device team0 07:04:13 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$l2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r2, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) connect$l2tp(r1, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr}, 0x4, 0x1}}, 0x2e) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x2, 0x32, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$PPPIOCGL2TPSTATS(r1, 0x40047459, &(0x7f0000000180)) 07:04:13 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond_slave_0\x00', 0x0}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x0, 0x0) sendmsg$nfc_llcp(r2, &(0x7f0000000380)={&(0x7f0000000200)={0x27, 0x0, 0x1, 0x7, 0x5, 0x401, "a786a07ec3450f04ae3dd3da1cc060716be962d27274c09ea024e5e11a44fb50a9417a6650d627f7a7f543a4d3c74e3db6937872ca3a9141a50e937654f9be", 0x12}, 0x60, &(0x7f0000000100)=[{&(0x7f0000000280)="4882da3d02a63e6df8e781c0b6119ba038b52ff2e1b0f1490a12354ab04d090e6480d15a550aa8a977ffaeb4b40f1df0baa9eda217f1d657fa192b2392e402113540823cd25af5896acf59ddc92948b4619288a5758d5f57290b4d41f70f0e1a6b32137649a017287c4bc8ba428d20863603a41a434e7a25c7fe04bc644878c8df7a57155188776ffd46395b410691df93f6c7d13df030dd190347f1542718d56e31f902ce8991023f052b2d6e1a22d81554c3b7083b4fc098cb31720051f90a35f0a85f2d11a443de817a7adde08095509a8ff7aca4dffee17530b481bc1a712a7ec82b63e80e07e875f636d3a5a57a722cf7135c76fd0a26fc5ff5", 0xfc}], 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@newqdisc={0x24, 0x5e, 0x7, 0x0, 0x0, {0x0, r1, {0xffffff9e}}}, 0x24}}, 0x0) 07:04:13 executing program 1: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000240)=""/246) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000040)=0x600210) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = memfd_create(&(0x7f0000000080)="73970ddb08df8c656c667b7070703070707031236d643573756d00", 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r0, r2, &(0x7f00000ddff8), 0x102002700) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x10, &(0x7f0000000100)="0249c83d6d345f8f762070") r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000340)) sendmmsg(r4, &(0x7f0000007980)=[{{&(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x2, 0x4, 0x1, {0xa, 0x4e23, 0x8, @ipv4={[], [], @broadcast}, 0x6}}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000200)="9576dd792c1d6ef9b450ab3dbcbe43c700d0ca376af4747273941a6bd5963ac52e882089fecc85929ac9bf451aead95f71327910f5fb6d74ada81d0b5cec565b54dacba7ffdd9a70c5406ecf219b56c2968555e1d460cc921825afb2b4531f045de4c1f14f0ba76ee5e0df1c89358f0720b80e9a6160567824c7722339fc684d982418611a84162fe8e965", 0x8b}], 0x1, &(0x7f0000000440), 0x0, 0x4000814}, 0x1}], 0x1, 0x8080) sendto$llc(r4, &(0x7f0000000000)="298248337a8d2a6b177cac842110cf5c2017fca5d843bce67d7fe54070b5bdaf737e5c3ab8647625fd292234c6d4883aa100742e3fba9e0f40c44e5fe4cdf0a2d7399822a502e9f3687cfa974cca2f13699d1021edbd3f8ee471fa782d2521279cf828ea38c6c075", 0x68, 0x4000000, 0x0, 0x0) clock_nanosleep(0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f0000000480)) r5 = gettid() perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000000380), &(0x7f0000000400)=0x14) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000600)) sendmsg$nl_generic(r6, &(0x7f0000000080)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000a80)=ANY=[@ANYBLOB="1400e2628da5fdff000000000000000001000000d52926887375437576769ac4d6e3eb5678bf5c72e2108469e3d9b39d1aa1e89487a778bf9ab7d65f00000000c8d000258378af9427736aa5ecbbf9935a000020881f48513ecc04f5dca99fb3726b510c1cf1f72b4fdedab950209a7560dbf61de92e83c9aa6e72937c35489a56a71ecf1484393730efcfbeddccdf5a93701ee17faf46e24c4339edd94f9166455198fa48ebf2edd37001ebdeaf5a19e56a25969d2354321fd1a3306a0ff4fe7d46e5dd372c788633b9d7fdccf1c6ed713d459422e5fdbe633ded13885e3fa76d37565f5dbdb9be15f9b560781c51f3b0a2b33e0f635e6307ca2fab561a3c8d5b1434f736b2a5e7f3e496556df951ae622490d8501500feb353102175b21233bb05619a69784228269c00210000000000000000000000967c6b0c006c4c17b7706826957b4930f9d6ec6b4ed97482eaadb905c6fa5ff81c41a7f2cc965e9cd002c1303b7e8d0369f4c396d3afd5be99c5996fbec8e531cbe5b8296e6019f1754044bc7f68b205678bf59a549e36f3d519e786491d182d2374f24eb370ad5063f5e01f308ca06b71aca5a419bf5df1ed56d993995a6892035cb8eb4aad9f801e72dac4aa216dd2df068eaa5057efdb8bdb021ae71ea6b0e86d90d2c4fc7cc745ff1ebb4a3468b0084f45f7b546c263f7e775556c653bad9741b18c1fe499c3bc961ffc28b36db6"], 0x1}}, 0x0) recvmsg(r6, &(0x7f0000003f00)={&(0x7f0000002a00)=@can, 0x80, &(0x7f0000003d80), 0x0, &(0x7f0000003e00)=""/240, 0xf0}, 0x0) prctl$seccomp(0x16, 0x3, &(0x7f0000000680)={0x7, &(0x7f0000000640)=[{0x8, 0xfff, 0x8, 0xc99a}, {0xffffffffffffff80, 0x4, 0x5, 0x2}, {0xb337dc8, 0x1e, 0x100, 0x1f}, {0x1ff, 0x80000001, 0x0, 0x1ff}, {0x4, 0xa36b, 0x100000000, 0x6}, {0x7fffffff, 0x3ff, 0xffffffff, 0x401}, {0x7, 0x3f, 0x3, 0x8001}]}) clock_nanosleep(0x2, 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000180)) r7 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x9, 0x19c6a6b4e739ed0e) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000004c0)={{{@in, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000440)=0xfffffffffffffd4b) bind$packet(r7, &(0x7f0000004a80)={0x11, 0x10, r8, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r5, 0x1000000000014) 07:04:13 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000240)=""/246) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000040)=0x600210) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = memfd_create(&(0x7f0000000080)="73970ddb08df8c656c667b7070703070707031236d643573756d00", 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r0, r2, &(0x7f00000ddff8), 0x102002700) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x10, &(0x7f0000000100)="0249c83d6d345f8f762070") r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000340)) sendmmsg(r4, &(0x7f0000007980)=[{{&(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x2, 0x4, 0x1, {0xa, 0x4e23, 0x8, @ipv4={[], [], @broadcast}, 0x6}}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000200)="9576dd792c1d6ef9b450ab3dbcbe43c700d0ca376af4747273941a6bd5963ac52e882089fecc85929ac9bf451aead95f71327910f5fb6d74ada81d0b5cec565b54dacba7ffdd9a70c5406ecf219b56c2968555e1d460cc921825afb2b4531f045de4c1f14f0ba76ee5e0df1c89358f0720b80e9a6160567824c7722339fc684d982418611a84162fe8e965", 0x8b}], 0x1, &(0x7f0000000440), 0x0, 0x4000814}, 0x1}], 0x1, 0x8080) sendto$llc(r4, &(0x7f0000000000)="298248337a8d2a6b177cac842110cf5c2017fca5d843bce67d7fe54070b5bdaf737e5c3ab8647625fd292234c6d4883aa100742e3fba9e0f40c44e5fe4cdf0a2d7399822a502e9f3687cfa974cca2f13699d1021edbd3f8ee471fa782d2521279cf828ea38c6c075", 0x68, 0x4000000, 0x0, 0x0) clock_nanosleep(0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f0000000480)) r5 = gettid() perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000000380), &(0x7f0000000400)=0x14) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000600)) sendmsg$nl_generic(r6, &(0x7f0000000080)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000a80)=ANY=[@ANYBLOB="1400e2628da5fdff000000000000000001000000d52926887375437576769ac4d6e3eb5678bf5c72e2108469e3d9b39d1aa1e89487a778bf9ab7d65f00000000c8d000258378af9427736aa5ecbbf9935a000020881f48513ecc04f5dca99fb3726b510c1cf1f72b4fdedab950209a7560dbf61de92e83c9aa6e72937c35489a56a71ecf1484393730efcfbeddccdf5a93701ee17faf46e24c4339edd94f9166455198fa48ebf2edd37001ebdeaf5a19e56a25969d2354321fd1a3306a0ff4fe7d46e5dd372c788633b9d7fdccf1c6ed713d459422e5fdbe633ded13885e3fa76d37565f5dbdb9be15f9b560781c51f3b0a2b33e0f635e6307ca2fab561a3c8d5b1434f736b2a5e7f3e496556df951ae622490d8501500feb353102175b21233bb05619a69784228269c00210000000000000000000000967c6b0c006c4c17b7706826957b4930f9d6ec6b4ed97482eaadb905c6fa5ff81c41a7f2cc965e9cd002c1303b7e8d0369f4c396d3afd5be99c5996fbec8e531cbe5b8296e6019f1754044bc7f68b205678bf59a549e36f3d519e786491d182d2374f24eb370ad5063f5e01f308ca06b71aca5a419bf5df1ed56d993995a6892035cb8eb4aad9f801e72dac4aa216dd2df068eaa5057efdb8bdb021ae71ea6b0e86d90d2c4fc7cc745ff1ebb4a3468b0084f45f7b546c263f7e775556c653bad9741b18c1fe499c3bc961ffc28b36db6"], 0x1}}, 0x0) recvmsg(r6, &(0x7f0000003f00)={&(0x7f0000002a00)=@can, 0x80, &(0x7f0000003d80), 0x0, &(0x7f0000003e00)=""/240, 0xf0}, 0x0) prctl$seccomp(0x16, 0x3, &(0x7f0000000680)={0x7, &(0x7f0000000640)=[{0x8, 0xfff, 0x8, 0xc99a}, {0xffffffffffffff80, 0x4, 0x5, 0x2}, {0xb337dc8, 0x1e, 0x100, 0x1f}, {0x1ff, 0x80000001, 0x0, 0x1ff}, {0x4, 0xa36b, 0x100000000, 0x6}, {0x7fffffff, 0x3ff, 0xffffffff, 0x401}, {0x7, 0x3f, 0x3, 0x8001}]}) clock_nanosleep(0x2, 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000180)) r7 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x9, 0x19c6a6b4e739ed0e) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000004c0)={{{@in, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000440)=0xfffffffffffffd4b) bind$packet(r7, &(0x7f0000004a80)={0x11, 0x10, r8, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r5, 0x1000000000014) 07:04:13 executing program 2: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000000c0)=ANY=[@ANYBLOB="b702000000000000bfa3000000000000070303000000ffff7a0af0f8fff8ffffff79a4f0ff00000000b7070000ffffffff2d64050000000400010000000404000001000000b70500000a00fe000000070000000000000000b70000000000002095000000000000000000000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x0, 0x10, 0x18, &(0x7f0000000000)="5ae02efc441a80536af0d1d96ac723fa", &(0x7f0000000040)=""/24}, 0x28) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/rtc0\x00', 0x2b8000, 0x0) ioctl$DRM_IOCTL_GET_MAGIC(r1, 0x80046402, &(0x7f0000000300)=0x200) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r0, 0x0, 0xfc, 0x9c, &(0x7f0000000380)="489bceb5e2a7bfd788d54c086b28888169863f95177682823b1f4e14f4ff7a7da0a3ad90026470534c787300f1ef7d353832b56b6774c8ed2f5b37364755bc12b71942494c7d49e83c19e6dda32fa70f579c3c109a24e28b492b471ea2e842fa8eaed90ac8b7b93792cb63e9928dad6211298a6585e231db47b04832c16c2cbd1d5df1856cac9a4a0ad1ea6b07ad56763eb5030c467c891bfb206aa621492930e67d096e994c2956171d5d2666ae6901fcc89aa1b9b16654dcbae604b70597272bb15253d42e491969ed6370ce24a176d7430072fbb4a99e9ab2de8836995192713ac85202c83fc483e67124aff438528e6f3778913d46e614341c4b", &(0x7f0000000140)=""/156, 0xcba}, 0x28) 07:04:13 executing program 2: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000a00)='/dev/userio\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x800000000000006) getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000000), &(0x7f0000000040)=0x4) dup2(r1, r0) [ 199.942392] audit: type=1400 audit(1538636653.677:41): avc: denied { prog_load } for pid=7409 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 07:04:13 executing program 2: r0 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0x14, &(0x7f0000000000), 0x4) sendmsg(r0, &(0x7f00000031c0)={&(0x7f0000002f40)=@in6={0xa, 0x0, 0x1, @mcast1}, 0x80, &(0x7f0000003180)}, 0x0) syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x7, 0x300) 07:04:13 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000000)={0x0, @aes256}) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x0, 0x0) fsetxattr$security_selinux(r1, &(0x7f0000000100)='security.selinux\x00', &(0x7f0000000140)='system_u:object_r:aud:td_exec_t:s0\x00', 0x23, 0x0) [ 200.233156] hrtimer: interrupt took 37678 ns [ 200.251951] audit: type=1400 audit(1538636653.977:42): avc: denied { mac_admin } for pid=7452 comm="syz-executor2" capability=33 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability2 permissive=1 [ 200.252688] SELinux: Context system_u:object_r:aud:td_exec_t:s0 is not valid (left unmapped). [ 200.330100] audit: type=1400 audit(1538636654.067:43): avc: denied { associate } for pid=7452 comm="syz-executor2" name="mixer" dev="devtmpfs" ino=15927 scontext=system_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem permissive=1 07:04:14 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000000)={0x0, @aes256}) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x0, 0x0) fsetxattr$security_selinux(r1, &(0x7f0000000100)='security.selinux\x00', &(0x7f0000000140)='system_u:object_r:aud:td_exec_t:s0\x00', 0x23, 0x0) 07:04:14 executing program 3: r0 = msgget$private(0x0, 0x0) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000300)=[&(0x7f0000000080)='\x00', &(0x7f0000000280)='\x00', &(0x7f00000002c0)='-\x00'], &(0x7f0000000380)=[&(0x7f0000000340)='[(vmnet1cgroup\x00']) msgrcv(r0, &(0x7f00000000c0)={0x0, ""/134}, 0x8e, 0x2, 0x0) getpeername(0xffffffffffffffff, &(0x7f00000003c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, &(0x7f0000000440)=0x80) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000480)=0xffffffffffffffff, 0x4) msgrcv(r0, &(0x7f0000000180)={0x0, ""/197}, 0xcd, 0x0, 0x0) msgsnd(r0, &(0x7f0000000040)={0x3}, 0x8, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000700)) [ 200.853079] audit: type=1400 audit(1538636654.587:44): avc: denied { prog_run } for pid=7519 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 07:04:14 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000140)="6e65742f6465765f6d6361737400c087ea55011e14c9e347dd1f55a6026a1cb7e067f3c577981c0994a1e80d90d49d68bdbc91fab9c1c7f063e676e83c740e2d647534a1045850a23665d81ca07270193f5d003c10e34239844c5b6e8d1721c0b53a91c2f6ec1e5484645db3df") ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000200)={'rose0@\x00', {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}}) r1 = syz_open_procfs(0x0, &(0x7f0000865ff5)='clear_refs\x00') r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) sendmsg$nl_route(r0, &(0x7f0000000c00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x3f}, 0xc, &(0x7f0000000480)={&(0x7f0000000c80)=ANY=[@ANYBLOB="510000005200020029bd7000fddbdf250a0000000800060005000300010000000c00050003000000080003000000000008000300ef9b811c7cbff30700ffffff08000300010000000800050005000000"], 0x1}, 0x1, 0x0, 0x0, 0x80000020000011}, 0xfffffffffffffffd) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0x0, 0x20000801, &(0x7f0000000080)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) vmsplice(0xffffffffffffffff, &(0x7f0000002680), 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)="766574683100000000ffffffffffef00", 0x10) io_setup(0x5, &(0x7f0000000d00)=0x0) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000800)={{{@in, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000900)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000940)={0x0, 0x0, 0x0}, &(0x7f0000000980)=0xc) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000009c0)={0x0, 0x0}, &(0x7f0000000a00)=0xc) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r2) mount$fuse(0x0, &(0x7f0000000780)='./file0\x00', &(0x7f00000007c0)='fuse\x00', 0x1400, &(0x7f0000000a40)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r5}, 0x2c, {'group_id', 0x3d, r6}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x6}}], [{@subj_type={'subj_type', 0x3d, 'lo'}}, {@dont_measure='dont_measure'}, {@audit='audit'}, {@pcr={'pcr', 0x3d, 0x15}}, {@fowner_eq={'fowner', 0x3d, r7}}]}}) io_getevents(r4, 0x8000, 0x9, &(0x7f00000004c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000600)={0x0, 0x1c9c380}) sendto$inet(r3, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00'}) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000400)={0x0, @multicast2, @dev}, &(0x7f0000000440)=0xc) r8 = socket$inet_tcp(0x2, 0x1, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_ifreq(r9, 0x8936, &(0x7f0000000b40)={'yam0\x00', @ifru_names='gre0\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000240)=0x1, &(0x7f0000000280)=0x4) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r8, 0x84, 0x18, &(0x7f0000000040)={0x0, 0x2}, &(0x7f0000000640)=0x8) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f00000002c0)) sendfile(r1, r0, &(0x7f0000000000)=0xf, 0xd) 07:04:14 executing program 1: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000240)=""/246) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000040)=0x600210) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = memfd_create(&(0x7f0000000080)="73970ddb08df8c656c667b7070703070707031236d643573756d00", 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r0, r2, &(0x7f00000ddff8), 0x102002700) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x10, &(0x7f0000000100)="0249c83d6d345f8f762070") r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000340)) sendmmsg(r4, &(0x7f0000007980)=[{{&(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x2, 0x4, 0x1, {0xa, 0x4e23, 0x8, @ipv4={[], [], @broadcast}, 0x6}}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000200)="9576dd792c1d6ef9b450ab3dbcbe43c700d0ca376af4747273941a6bd5963ac52e882089fecc85929ac9bf451aead95f71327910f5fb6d74ada81d0b5cec565b54dacba7ffdd9a70c5406ecf219b56c2968555e1d460cc921825afb2b4531f045de4c1f14f0ba76ee5e0df1c89358f0720b80e9a6160567824c7722339fc684d982418611a84162fe8e965", 0x8b}], 0x1, &(0x7f0000000440), 0x0, 0x4000814}, 0x1}], 0x1, 0x8080) sendto$llc(r4, &(0x7f0000000000)="298248337a8d2a6b177cac842110cf5c2017fca5d843bce67d7fe54070b5bdaf737e5c3ab8647625fd292234c6d4883aa100742e3fba9e0f40c44e5fe4cdf0a2d7399822a502e9f3687cfa974cca2f13699d1021edbd3f8ee471fa782d2521279cf828ea38c6c075", 0x68, 0x4000000, 0x0, 0x0) clock_nanosleep(0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f0000000480)) r5 = gettid() perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000000380), &(0x7f0000000400)=0x14) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000600)) sendmsg$nl_generic(r6, &(0x7f0000000080)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000a80)=ANY=[@ANYBLOB="1400e2628da5fdff000000000000000001000000d52926887375437576769ac4d6e3eb5678bf5c72e2108469e3d9b39d1aa1e89487a778bf9ab7d65f00000000c8d000258378af9427736aa5ecbbf9935a000020881f48513ecc04f5dca99fb3726b510c1cf1f72b4fdedab950209a7560dbf61de92e83c9aa6e72937c35489a56a71ecf1484393730efcfbeddccdf5a93701ee17faf46e24c4339edd94f9166455198fa48ebf2edd37001ebdeaf5a19e56a25969d2354321fd1a3306a0ff4fe7d46e5dd372c788633b9d7fdccf1c6ed713d459422e5fdbe633ded13885e3fa76d37565f5dbdb9be15f9b560781c51f3b0a2b33e0f635e6307ca2fab561a3c8d5b1434f736b2a5e7f3e496556df951ae622490d8501500feb353102175b21233bb05619a69784228269c00210000000000000000000000967c6b0c006c4c17b7706826957b4930f9d6ec6b4ed97482eaadb905c6fa5ff81c41a7f2cc965e9cd002c1303b7e8d0369f4c396d3afd5be99c5996fbec8e531cbe5b8296e6019f1754044bc7f68b205678bf59a549e36f3d519e786491d182d2374f24eb370ad5063f5e01f308ca06b71aca5a419bf5df1ed56d993995a6892035cb8eb4aad9f801e72dac4aa216dd2df068eaa5057efdb8bdb021ae71ea6b0e86d90d2c4fc7cc745ff1ebb4a3468b0084f45f7b546c263f7e775556c653bad9741b18c1fe499c3bc961ffc28b36db6"], 0x1}}, 0x0) recvmsg(r6, &(0x7f0000003f00)={&(0x7f0000002a00)=@can, 0x80, &(0x7f0000003d80), 0x0, &(0x7f0000003e00)=""/240, 0xf0}, 0x0) prctl$seccomp(0x16, 0x3, &(0x7f0000000680)={0x7, &(0x7f0000000640)=[{0x8, 0xfff, 0x8, 0xc99a}, {0xffffffffffffff80, 0x4, 0x5, 0x2}, {0xb337dc8, 0x1e, 0x100, 0x1f}, {0x1ff, 0x80000001, 0x0, 0x1ff}, {0x4, 0xa36b, 0x100000000, 0x6}, {0x7fffffff, 0x3ff, 0xffffffff, 0x401}, {0x7, 0x3f, 0x3, 0x8001}]}) clock_nanosleep(0x2, 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000180)) r7 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x9, 0x19c6a6b4e739ed0e) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000004c0)={{{@in, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000440)=0xfffffffffffffd4b) bind$packet(r7, &(0x7f0000004a80)={0x11, 0x10, r8, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r5, 0x1000000000014) 07:04:14 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000001fe8)=ANY=[@ANYBLOB="a4d54dbc"], &(0x7f0000003ff6)='syzkaller\x00', 0x0, 0xc3, &(0x7f0000009f3d)=""/195}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000001fd8)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x25}, [@ldst={0x7}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x437, &(0x7f000000cf3d)=""/195}, 0x48) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/member\x00', 0x2, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f00000004c0)={0x4000000, 0x9698, 0x0, 0x0, 0x80000001}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000640)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$KDDELIO(r2, 0x4b35, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000140)=0x80000000032, 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000980)='team0\x00', 0x10) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000080)) ioctl$sock_inet6_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000f00)) connect$inet(r1, &(0x7f0000000400)={0x2, 0x0, @remote}, 0x10000005d) setsockopt$inet6_group_source_req(r2, 0x29, 0x0, &(0x7f0000000700)={0xa96, {{0xa, 0x0, 0x37d2, @mcast2, 0xb1ba}}, {{0xa, 0x4e20, 0x4, @remote, 0x60ef5889}}}, 0x108) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000c00)) getresgid(&(0x7f00000005c0), &(0x7f0000000940)=0x0, &(0x7f0000000b80)) fchown(r0, 0x0, r3) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000200)=ANY=[@ANYBLOB="04000000000000000a004e2205000000fe80000000000000000000000000a33d144053113400bb0180000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f6b5b889060000000a004e2105000000fe80000000000000000000000000001d0700000000000000000000000000000000000000000000000000000000000000e2ffffff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e22cb674d77ff01000000000000000000000000000107000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e21ffffffffff0200000000000000003900000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008"], 0x1) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000680), &(0x7f00000006c0)=0x4) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) io_setup(0x400, &(0x7f00000008c0)) recvmmsg(r2, &(0x7f00000028c0)=[{{&(0x7f00000009c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr}}}, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000f40)=""/113, 0x71}], 0x1, &(0x7f0000000fc0)=""/235, 0xeb}, 0x21e}, {{&(0x7f00000010c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, 0x80, &(0x7f0000001240)=[{&(0x7f0000001140)=""/199, 0xc7}], 0x1, &(0x7f0000001280)=""/118, 0x76, 0x20}, 0x2}], 0x2, 0x40, 0x0) 07:04:14 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000240)=""/246) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000040)=0x600210) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = memfd_create(&(0x7f0000000080)="73970ddb08df8c656c667b7070703070707031236d643573756d00", 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r0, r2, &(0x7f00000ddff8), 0x102002700) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x10, &(0x7f0000000100)="0249c83d6d345f8f762070") r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000340)) sendmmsg(r4, &(0x7f0000007980)=[{{&(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x2, 0x4, 0x1, {0xa, 0x4e23, 0x8, @ipv4={[], [], @broadcast}, 0x6}}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000200)="9576dd792c1d6ef9b450ab3dbcbe43c700d0ca376af4747273941a6bd5963ac52e882089fecc85929ac9bf451aead95f71327910f5fb6d74ada81d0b5cec565b54dacba7ffdd9a70c5406ecf219b56c2968555e1d460cc921825afb2b4531f045de4c1f14f0ba76ee5e0df1c89358f0720b80e9a6160567824c7722339fc684d982418611a84162fe8e965", 0x8b}], 0x1, &(0x7f0000000440), 0x0, 0x4000814}, 0x1}], 0x1, 0x8080) sendto$llc(r4, &(0x7f0000000000)="298248337a8d2a6b177cac842110cf5c2017fca5d843bce67d7fe54070b5bdaf737e5c3ab8647625fd292234c6d4883aa100742e3fba9e0f40c44e5fe4cdf0a2d7399822a502e9f3687cfa974cca2f13699d1021edbd3f8ee471fa782d2521279cf828ea38c6c075", 0x68, 0x4000000, 0x0, 0x0) clock_nanosleep(0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f0000000480)) r5 = gettid() perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000000380), &(0x7f0000000400)=0x14) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000600)) sendmsg$nl_generic(r6, &(0x7f0000000080)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000a80)=ANY=[@ANYBLOB="1400e2628da5fdff000000000000000001000000d52926887375437576769ac4d6e3eb5678bf5c72e2108469e3d9b39d1aa1e89487a778bf9ab7d65f00000000c8d000258378af9427736aa5ecbbf9935a000020881f48513ecc04f5dca99fb3726b510c1cf1f72b4fdedab950209a7560dbf61de92e83c9aa6e72937c35489a56a71ecf1484393730efcfbeddccdf5a93701ee17faf46e24c4339edd94f9166455198fa48ebf2edd37001ebdeaf5a19e56a25969d2354321fd1a3306a0ff4fe7d46e5dd372c788633b9d7fdccf1c6ed713d459422e5fdbe633ded13885e3fa76d37565f5dbdb9be15f9b560781c51f3b0a2b33e0f635e6307ca2fab561a3c8d5b1434f736b2a5e7f3e496556df951ae622490d8501500feb353102175b21233bb05619a69784228269c00210000000000000000000000967c6b0c006c4c17b7706826957b4930f9d6ec6b4ed97482eaadb905c6fa5ff81c41a7f2cc965e9cd002c1303b7e8d0369f4c396d3afd5be99c5996fbec8e531cbe5b8296e6019f1754044bc7f68b205678bf59a549e36f3d519e786491d182d2374f24eb370ad5063f5e01f308ca06b71aca5a419bf5df1ed56d993995a6892035cb8eb4aad9f801e72dac4aa216dd2df068eaa5057efdb8bdb021ae71ea6b0e86d90d2c4fc7cc745ff1ebb4a3468b0084f45f7b546c263f7e775556c653bad9741b18c1fe499c3bc961ffc28b36db6"], 0x1}}, 0x0) recvmsg(r6, &(0x7f0000003f00)={&(0x7f0000002a00)=@can, 0x80, &(0x7f0000003d80), 0x0, &(0x7f0000003e00)=""/240, 0xf0}, 0x0) prctl$seccomp(0x16, 0x3, &(0x7f0000000680)={0x7, &(0x7f0000000640)=[{0x8, 0xfff, 0x8, 0xc99a}, {0xffffffffffffff80, 0x4, 0x5, 0x2}, {0xb337dc8, 0x1e, 0x100, 0x1f}, {0x1ff, 0x80000001, 0x0, 0x1ff}, {0x4, 0xa36b, 0x100000000, 0x6}, {0x7fffffff, 0x3ff, 0xffffffff, 0x401}, {0x7, 0x3f, 0x3, 0x8001}]}) clock_nanosleep(0x2, 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000180)) r7 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x9, 0x19c6a6b4e739ed0e) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000004c0)={{{@in, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000440)=0xfffffffffffffd4b) bind$packet(r7, &(0x7f0000004a80)={0x11, 0x10, r8, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r5, 0x1000000000014) 07:04:14 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000000)=@generic={0x1, 0x4c55, 0x3}) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_SET_KEYBIT(r0, 0x40045565, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x2, 0x0) write$P9_RRENAME(r2, &(0x7f00000000c0)={0x7, 0x15, 0x1}, 0x7) [ 200.992998] input: syz1 as /devices/virtual/input/input5 [ 201.084643] input: syz1 as /devices/virtual/input/input6 07:04:14 executing program 5: r0 = socket(0x840000000015, 0x805, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x1012, r1, 0x0) fcntl$getown(r1, 0x9) perf_event_open(&(0x7f0000000180)={0x6, 0x4e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1081}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB=')'], 0x1) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x32, 0xffffffffffffffff, 0x0) [ 201.227146] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 07:04:15 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000001fe8)=ANY=[@ANYBLOB="a4d54dbc"], &(0x7f0000003ff6)='syzkaller\x00', 0x0, 0xc3, &(0x7f0000009f3d)=""/195}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000001fd8)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x25}, [@ldst={0x7}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x437, &(0x7f000000cf3d)=""/195}, 0x48) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/member\x00', 0x2, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f00000004c0)={0x4000000, 0x9698, 0x0, 0x0, 0x80000001}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000640)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$KDDELIO(r2, 0x4b35, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000140)=0x80000000032, 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000980)='team0\x00', 0x10) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000080)) ioctl$sock_inet6_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000f00)) connect$inet(r1, &(0x7f0000000400)={0x2, 0x0, @remote}, 0x10000005d) setsockopt$inet6_group_source_req(r2, 0x29, 0x0, &(0x7f0000000700)={0xa96, {{0xa, 0x0, 0x37d2, @mcast2, 0xb1ba}}, {{0xa, 0x4e20, 0x4, @remote, 0x60ef5889}}}, 0x108) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000c00)) getresgid(&(0x7f00000005c0), &(0x7f0000000940)=0x0, &(0x7f0000000b80)) fchown(r0, 0x0, r3) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000200)=ANY=[@ANYBLOB="04000000000000000a004e2205000000fe80000000000000000000000000a33d144053113400bb0180000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f6b5b889060000000a004e2105000000fe80000000000000000000000000001d0700000000000000000000000000000000000000000000000000000000000000e2ffffff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e22cb674d77ff01000000000000000000000000000107000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e21ffffffffff0200000000000000003900000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008"], 0x1) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000680), &(0x7f00000006c0)=0x4) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) io_setup(0x400, &(0x7f00000008c0)) recvmmsg(r2, &(0x7f00000028c0)=[{{&(0x7f00000009c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr}}}, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000f40)=""/113, 0x71}], 0x1, &(0x7f0000000fc0)=""/235, 0xeb}, 0x21e}, {{&(0x7f00000010c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, 0x80, &(0x7f0000001240)=[{&(0x7f0000001140)=""/199, 0xc7}], 0x1, &(0x7f0000001280)=""/118, 0x76, 0x20}, 0x2}], 0x2, 0x40, 0x0) 07:04:15 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000140)="6e65742f6465765f6d6361737400c087ea55011e14c9e347dd1f55a6026a1cb7e067f3c577981c0994a1e80d90d49d68bdbc91fab9c1c7f063e676e83c740e2d647534a1045850a23665d81ca07270193f5d003c10e34239844c5b6e8d1721c0b53a91c2f6ec1e5484645db3df") ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000200)={'rose0@\x00', {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}}) r1 = syz_open_procfs(0x0, &(0x7f0000865ff5)='clear_refs\x00') r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) sendmsg$nl_route(r0, &(0x7f0000000c00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x3f}, 0xc, &(0x7f0000000480)={&(0x7f0000000c80)=ANY=[@ANYBLOB="510000005200020029bd7000fddbdf250a0000000800060005000300010000000c00050003000000080003000000000008000300ef9b811c7cbff30700ffffff08000300010000000800050005000000"], 0x1}, 0x1, 0x0, 0x0, 0x80000020000011}, 0xfffffffffffffffd) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0x0, 0x20000801, &(0x7f0000000080)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) vmsplice(0xffffffffffffffff, &(0x7f0000002680), 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)="766574683100000000ffffffffffef00", 0x10) io_setup(0x5, &(0x7f0000000d00)=0x0) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000800)={{{@in, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000900)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000940)={0x0, 0x0, 0x0}, &(0x7f0000000980)=0xc) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000009c0)={0x0, 0x0}, &(0x7f0000000a00)=0xc) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r2) mount$fuse(0x0, &(0x7f0000000780)='./file0\x00', &(0x7f00000007c0)='fuse\x00', 0x1400, &(0x7f0000000a40)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r5}, 0x2c, {'group_id', 0x3d, r6}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x6}}], [{@subj_type={'subj_type', 0x3d, 'lo'}}, {@dont_measure='dont_measure'}, {@audit='audit'}, {@pcr={'pcr', 0x3d, 0x15}}, {@fowner_eq={'fowner', 0x3d, r7}}]}}) io_getevents(r4, 0x8000, 0x9, &(0x7f00000004c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000600)={0x0, 0x1c9c380}) sendto$inet(r3, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00'}) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000400)={0x0, @multicast2, @dev}, &(0x7f0000000440)=0xc) r8 = socket$inet_tcp(0x2, 0x1, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_ifreq(r9, 0x8936, &(0x7f0000000b40)={'yam0\x00', @ifru_names='gre0\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000240)=0x1, &(0x7f0000000280)=0x4) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r8, 0x84, 0x18, &(0x7f0000000040)={0x0, 0x2}, &(0x7f0000000640)=0x8) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f00000002c0)) sendfile(r1, r0, &(0x7f0000000000)=0xf, 0xd) 07:04:15 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000140)="6e65742f6465765f6d6361737400c087ea55011e14c9e347dd1f55a6026a1cb7e067f3c577981c0994a1e80d90d49d68bdbc91fab9c1c7f063e676e83c740e2d647534a1045850a23665d81ca07270193f5d003c10e34239844c5b6e8d1721c0b53a91c2f6ec1e5484645db3df") ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000200)={'rose0@\x00', {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}}) r1 = syz_open_procfs(0x0, &(0x7f0000865ff5)='clear_refs\x00') r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) sendmsg$nl_route(r0, &(0x7f0000000c00)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x3f}, 0xc, &(0x7f0000000480)={&(0x7f0000000c80)=ANY=[@ANYBLOB="510000005200020029bd7000fddbdf250a0000000800060005000300010000000c00050003000000080003000000000008000300ef9b811c7cbff30700ffffff08000300010000000800050005000000"], 0x1}, 0x1, 0x0, 0x0, 0x80000020000011}, 0xfffffffffffffffd) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r3, &(0x7f0000000080), 0x0, 0x20000801, &(0x7f0000000080)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) vmsplice(0xffffffffffffffff, &(0x7f0000002680), 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)="766574683100000000ffffffffffef00", 0x10) io_setup(0x5, &(0x7f0000000d00)=0x0) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000800)={{{@in, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000900)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000940)={0x0, 0x0, 0x0}, &(0x7f0000000980)=0xc) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000009c0)={0x0, 0x0}, &(0x7f0000000a00)=0xc) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r2) mount$fuse(0x0, &(0x7f0000000780)='./file0\x00', &(0x7f00000007c0)='fuse\x00', 0x1400, &(0x7f0000000a40)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r5}, 0x2c, {'group_id', 0x3d, r6}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x6}}], [{@subj_type={'subj_type', 0x3d, 'lo'}}, {@dont_measure='dont_measure'}, {@audit='audit'}, {@pcr={'pcr', 0x3d, 0x15}}, {@fowner_eq={'fowner', 0x3d, r7}}]}}) io_getevents(r4, 0x8000, 0x9, &(0x7f00000004c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000600)={0x0, 0x1c9c380}) sendto$inet(r3, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00'}) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000400)={0x0, @multicast2, @dev}, &(0x7f0000000440)=0xc) r8 = socket$inet_tcp(0x2, 0x1, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_ifreq(r9, 0x8936, &(0x7f0000000b40)={'yam0\x00', @ifru_names='gre0\x00'}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000240)=0x1, &(0x7f0000000280)=0x4) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r8, 0x84, 0x18, &(0x7f0000000040)={0x0, 0x2}, &(0x7f0000000640)=0x8) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f00000002c0)) sendfile(r1, r0, &(0x7f0000000000)=0xf, 0xd) [ 201.640404] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, 07:04:15 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x0, 0x0, &(0x7f0000001fe8)=ANY=[@ANYBLOB="a4d54dbc"], &(0x7f0000003ff6)='syzkaller\x00', 0x0, 0xc3, &(0x7f0000009f3d)=""/195}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000001fd8)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x25}, [@ldst={0x7}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x437, &(0x7f000000cf3d)=""/195}, 0x48) openat$selinux_member(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/member\x00', 0x2, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f00000004c0)={0x4000000, 0x9698, 0x0, 0x0, 0x80000001}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000640)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$KDDELIO(r2, 0x4b35, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000140)=0x80000000032, 0x4) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x2001001, &(0x7f0000002640)=ANY=[]) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000980)='team0\x00', 0x10) syz_mount_image$ext4(&(0x7f0000000040)="0000000080", &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x100020, &(0x7f0000000100)={[{@inode_readahead_blks={'inode_readahead_blks'}}]}) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000080)) ioctl$sock_inet6_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000f00)) connect$inet(r1, &(0x7f0000000400)={0x2, 0x0, @remote}, 0x10000005d) setsockopt$inet6_group_source_req(r2, 0x29, 0x0, &(0x7f0000000700)={0xa96, {{0xa, 0x0, 0x37d2, @mcast2, 0xb1ba}}, {{0xa, 0x4e20, 0x4, @remote, 0x60ef5889}}}, 0x108) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000c00)) getresgid(&(0x7f00000005c0), &(0x7f0000000940)=0x0, &(0x7f0000000b80)) fchown(r0, 0x0, r3) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000200)=ANY=[@ANYBLOB="04000000000000000a004e2205000000fe80000000000000000000000000a33d144053113400bb0180000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f6b5b889060000000a004e2105000000fe80000000000000000000000000001d0700000000000000000000000000000000000000000000000000000000000000e2ffffff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e22cb674d77ff01000000000000000000000000000107000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e21ffffffffff0200000000000000003900000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008"], 0x1) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000680), &(0x7f00000006c0)=0x4) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000600), &(0x7f0000000ac0)=0xc) io_setup(0x400, &(0x7f00000008c0)) recvmmsg(r2, &(0x7f00000028c0)=[{{&(0x7f00000009c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr}}}, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000f40)=""/113, 0x71}], 0x1, &(0x7f0000000fc0)=""/235, 0xeb}, 0x21e}, {{&(0x7f00000010c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, 0x80, &(0x7f0000001240)=[{&(0x7f0000001140)=""/199, 0xc7}], 0x1, &(0x7f0000001280)=""/118, 0x76, 0x20}, 0x2}], 0x2, 0x40, 0x0) 07:04:15 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) io_setup(0x5, &(0x7f0000000000)=0x0) r2 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x9, 0x800) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r2, 0xc0045516, &(0x7f0000000080)=0x800) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80001080}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x5c, r3, 0x4, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_SOCKETS={0x3c, 0x7, [{0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r2}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20004001}, 0x4000000) ioctl$sock_SIOCDELDLCI(0xffffffffffffffff, 0x8981, &(0x7f0000000180)={"55e0722aa927ac62449c2095324700", 0x8}) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000001000), 0x0, 0xffffffffffffffff}]) 07:04:15 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000240)=""/246) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000040)=0x600210) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = memfd_create(&(0x7f0000000080)="73970ddb08df8c656c667b7070703070707031236d643573756d00", 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r0, r2, &(0x7f00000ddff8), 0x102002700) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x10, &(0x7f0000000100)="0249c83d6d345f8f762070") r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000340)) sendmmsg(r4, &(0x7f0000007980)=[{{&(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x2, 0x4, 0x1, {0xa, 0x4e23, 0x8, @ipv4={[], [], @broadcast}, 0x6}}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000200)="9576dd792c1d6ef9b450ab3dbcbe43c700d0ca376af4747273941a6bd5963ac52e882089fecc85929ac9bf451aead95f71327910f5fb6d74ada81d0b5cec565b54dacba7ffdd9a70c5406ecf219b56c2968555e1d460cc921825afb2b4531f045de4c1f14f0ba76ee5e0df1c89358f0720b80e9a6160567824c7722339fc684d982418611a84162fe8e965", 0x8b}], 0x1, &(0x7f0000000440), 0x0, 0x4000814}, 0x1}], 0x1, 0x8080) sendto$llc(r4, &(0x7f0000000000)="298248337a8d2a6b177cac842110cf5c2017fca5d843bce67d7fe54070b5bdaf737e5c3ab8647625fd292234c6d4883aa100742e3fba9e0f40c44e5fe4cdf0a2d7399822a502e9f3687cfa974cca2f13699d1021edbd3f8ee471fa782d2521279cf828ea38c6c075", 0x68, 0x4000000, 0x0, 0x0) clock_nanosleep(0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f0000000480)) r5 = gettid() perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000000380), &(0x7f0000000400)=0x14) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000600)) sendmsg$nl_generic(r6, &(0x7f0000000080)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000a80)=ANY=[@ANYBLOB="1400e2628da5fdff000000000000000001000000d52926887375437576769ac4d6e3eb5678bf5c72e2108469e3d9b39d1aa1e89487a778bf9ab7d65f00000000c8d000258378af9427736aa5ecbbf9935a000020881f48513ecc04f5dca99fb3726b510c1cf1f72b4fdedab950209a7560dbf61de92e83c9aa6e72937c35489a56a71ecf1484393730efcfbeddccdf5a93701ee17faf46e24c4339edd94f9166455198fa48ebf2edd37001ebdeaf5a19e56a25969d2354321fd1a3306a0ff4fe7d46e5dd372c788633b9d7fdccf1c6ed713d459422e5fdbe633ded13885e3fa76d37565f5dbdb9be15f9b560781c51f3b0a2b33e0f635e6307ca2fab561a3c8d5b1434f736b2a5e7f3e496556df951ae622490d8501500feb353102175b21233bb05619a69784228269c00210000000000000000000000967c6b0c006c4c17b7706826957b4930f9d6ec6b4ed97482eaadb905c6fa5ff81c41a7f2cc965e9cd002c1303b7e8d0369f4c396d3afd5be99c5996fbec8e531cbe5b8296e6019f1754044bc7f68b205678bf59a549e36f3d519e786491d182d2374f24eb370ad5063f5e01f308ca06b71aca5a419bf5df1ed56d993995a6892035cb8eb4aad9f801e72dac4aa216dd2df068eaa5057efdb8bdb021ae71ea6b0e86d90d2c4fc7cc745ff1ebb4a3468b0084f45f7b546c263f7e775556c653bad9741b18c1fe499c3bc961ffc28b36db6"], 0x1}}, 0x0) recvmsg(r6, &(0x7f0000003f00)={&(0x7f0000002a00)=@can, 0x80, &(0x7f0000003d80), 0x0, &(0x7f0000003e00)=""/240, 0xf0}, 0x0) prctl$seccomp(0x16, 0x3, &(0x7f0000000680)={0x7, &(0x7f0000000640)=[{0x8, 0xfff, 0x8, 0xc99a}, {0xffffffffffffff80, 0x4, 0x5, 0x2}, {0xb337dc8, 0x1e, 0x100, 0x1f}, {0x1ff, 0x80000001, 0x0, 0x1ff}, {0x4, 0xa36b, 0x100000000, 0x6}, {0x7fffffff, 0x3ff, 0xffffffff, 0x401}, {0x7, 0x3f, 0x3, 0x8001}]}) clock_nanosleep(0x2, 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000180)) r7 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x9, 0x19c6a6b4e739ed0e) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000004c0)={{{@in, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000440)=0xfffffffffffffd4b) bind$packet(r7, &(0x7f0000004a80)={0x11, 0x10, r8, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r5, 0x1000000000014) 07:04:15 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [0x40000084]}) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 07:04:15 executing program 1: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000240)=""/246) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000040)=0x600210) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = memfd_create(&(0x7f0000000080)="73970ddb08df8c656c667b7070703070707031236d643573756d00", 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r0, r2, &(0x7f00000ddff8), 0x102002700) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x10, &(0x7f0000000100)="0249c83d6d345f8f762070") r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000340)) sendmmsg(r4, &(0x7f0000007980)=[{{&(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x2, 0x4, 0x1, {0xa, 0x4e23, 0x8, @ipv4={[], [], @broadcast}, 0x6}}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000200)="9576dd792c1d6ef9b450ab3dbcbe43c700d0ca376af4747273941a6bd5963ac52e882089fecc85929ac9bf451aead95f71327910f5fb6d74ada81d0b5cec565b54dacba7ffdd9a70c5406ecf219b56c2968555e1d460cc921825afb2b4531f045de4c1f14f0ba76ee5e0df1c89358f0720b80e9a6160567824c7722339fc684d982418611a84162fe8e965", 0x8b}], 0x1, &(0x7f0000000440), 0x0, 0x4000814}, 0x1}], 0x1, 0x8080) sendto$llc(r4, &(0x7f0000000000)="298248337a8d2a6b177cac842110cf5c2017fca5d843bce67d7fe54070b5bdaf737e5c3ab8647625fd292234c6d4883aa100742e3fba9e0f40c44e5fe4cdf0a2d7399822a502e9f3687cfa974cca2f13699d1021edbd3f8ee471fa782d2521279cf828ea38c6c075", 0x68, 0x4000000, 0x0, 0x0) clock_nanosleep(0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f0000000480)) r5 = gettid() perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000000380), &(0x7f0000000400)=0x14) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000600)) sendmsg$nl_generic(r6, &(0x7f0000000080)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000a80)=ANY=[@ANYBLOB="1400e2628da5fdff000000000000000001000000d52926887375437576769ac4d6e3eb5678bf5c72e2108469e3d9b39d1aa1e89487a778bf9ab7d65f00000000c8d000258378af9427736aa5ecbbf9935a000020881f48513ecc04f5dca99fb3726b510c1cf1f72b4fdedab950209a7560dbf61de92e83c9aa6e72937c35489a56a71ecf1484393730efcfbeddccdf5a93701ee17faf46e24c4339edd94f9166455198fa48ebf2edd37001ebdeaf5a19e56a25969d2354321fd1a3306a0ff4fe7d46e5dd372c788633b9d7fdccf1c6ed713d459422e5fdbe633ded13885e3fa76d37565f5dbdb9be15f9b560781c51f3b0a2b33e0f635e6307ca2fab561a3c8d5b1434f736b2a5e7f3e496556df951ae622490d8501500feb353102175b21233bb05619a69784228269c00210000000000000000000000967c6b0c006c4c17b7706826957b4930f9d6ec6b4ed97482eaadb905c6fa5ff81c41a7f2cc965e9cd002c1303b7e8d0369f4c396d3afd5be99c5996fbec8e531cbe5b8296e6019f1754044bc7f68b205678bf59a549e36f3d519e786491d182d2374f24eb370ad5063f5e01f308ca06b71aca5a419bf5df1ed56d993995a6892035cb8eb4aad9f801e72dac4aa216dd2df068eaa5057efdb8bdb021ae71ea6b0e86d90d2c4fc7cc745ff1ebb4a3468b0084f45f7b546c263f7e775556c653bad9741b18c1fe499c3bc961ffc28b36db6"], 0x1}}, 0x0) recvmsg(r6, &(0x7f0000003f00)={&(0x7f0000002a00)=@can, 0x80, &(0x7f0000003d80), 0x0, &(0x7f0000003e00)=""/240, 0xf0}, 0x0) prctl$seccomp(0x16, 0x3, &(0x7f0000000680)={0x7, &(0x7f0000000640)=[{0x8, 0xfff, 0x8, 0xc99a}, {0xffffffffffffff80, 0x4, 0x5, 0x2}, {0xb337dc8, 0x1e, 0x100, 0x1f}, {0x1ff, 0x80000001, 0x0, 0x1ff}, {0x4, 0xa36b, 0x100000000, 0x6}, {0x7fffffff, 0x3ff, 0xffffffff, 0x401}, {0x7, 0x3f, 0x3, 0x8001}]}) clock_nanosleep(0x2, 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000180)) r7 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x9, 0x19c6a6b4e739ed0e) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000004c0)={{{@in, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000440)=0xfffffffffffffd4b) bind$packet(r7, &(0x7f0000004a80)={0x11, 0x10, r8, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r5, 0x1000000000014) [ 202.009973] EXT4-fs (sda1): re-mounted. Opts: inode_readahead_blks=0x0000000000000000, [ 202.049051] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 07:04:15 executing program 2: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x615, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fsetxattr(r0, &(0x7f0000000000)=@random={'os2.', 'S:\x00'}, &(0x7f0000000100)='posix_acl_accesscgroup-vmnet0@\x00', 0x1f, 0x1) close(r0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) migrate_pages(0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240)) 07:04:15 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) write$binfmt_script(r0, &(0x7f0000002ec0)={'3! ', './file0'}, 0x3138) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x4000, 0x0) 07:04:15 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat(r0, &(0x7f0000000040)='./file0\x00', 0x2000, 0x8) ioctl$TIOCMSET(r1, 0x5418, &(0x7f0000000080)=0x8) fcntl$addseals(r0, 0x409, 0xf) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x800, 0x0) preadv(r2, &(0x7f0000000140), 0x10000000000000cc, 0x0) 07:04:16 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) write$binfmt_script(r0, &(0x7f0000002ec0)={'3! ', './file0'}, 0x3138) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x4000, 0x0) 07:04:16 executing program 5: r0 = memfd_create(&(0x7f0000000080)="74086e750000000000000000008c00", 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ftruncate(r0, 0x0) dup2(r1, r0) r3 = getpgid(0xffffffffffffffff) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000000)=0x0) rt_tgsigqueueinfo(r3, r4, 0x1f, &(0x7f0000000040)={0x9, 0x5, 0x8, 0x7}) 07:04:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000700)={&(0x7f0000000000), 0xc, &(0x7f00000006c0)={&(0x7f0000004340)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}]}, 0x48}}, 0x0) recvmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)=""/6, 0x6}, {&(0x7f0000000080)=""/190, 0xbe}], 0x2, &(0x7f0000000180)=""/86, 0x56, 0x209}, 0x1) 07:04:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000000340)=ANY=[]) mkdir(&(0x7f0000001700)='./file1\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) fstat(0xffffffffffffffff, &(0x7f0000000540)) r0 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x40000, 0x0) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r1, 0x80045300, &(0x7f00000001c0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x0, 0x0) utime(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x1, 0x943}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) fstatfs(r0, &(0x7f00000002c0)=""/4096) 07:04:16 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/checkreqprot\x00', 0x200c0, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x12, 0x8, "4987dfd7a78922a3383a2b7eb4f117779ec14aa0c4e3bfa5a621c33eca5c6bad7d71fdb862639da66d5aed5afc434f853af02942af8cc20331e25b1c01766e94", "91aefd76f082adb0990fb1dec4a85869354254f018a9814d6c7f15358012b0c798dcf08cfa6a54f2ad53b954ad660f40055434d173bfccf0a3112a98a2839eb3", "9e458755d820e9ef9fb1e42715c56f026ea22ddde1d25daf842bd72cea183148", [0x5, 0xfffffffffffffff9]}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000600)='/dev/sequencer2\x00', 0x1ffffffffffffb, 0x0) epoll_wait(0xffffffffffffffff, &(0x7f00000005c0)=[{}, {}, {}], 0x3, 0x3) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000000140)) r2 = fcntl$getown(r1, 0x9) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getegid() fchown(r1, r3, r4) fcntl$setown(r1, 0x8, r2) perf_event_open(&(0x7f0000001640)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d, 0x8, 0x9, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0x8000, 0x2, 0x0, 0x0, 0x0, 0xb0b, 0x935, 0x1000, 0x9ea, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000540)}, 0x0, 0x0, 0x0, 0x0, 0xe4, 0x4fad433c, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25d1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fdatasync(r0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f00000001c0)={0x0, 0x1, 0x10, 0x444, 0x2153}, &(0x7f0000000280)=0x18) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000002c0)={r6, 0x3ff}, &(0x7f0000000500)=0x8) r7 = dup2(r5, r1) r8 = syz_open_dev$amidi(&(0x7f0000000240)='/dev/amidi#\x00', 0x2, 0x82) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r7, 0x84, 0x6, &(0x7f0000000640), &(0x7f0000000340)=0x84) ppoll(&(0x7f0000000180)=[{0xffffffffffffffff, 0x200}, {r7, 0x4}, {r8}], 0x3, &(0x7f0000000200), &(0x7f0000000300)={0x3}, 0x8) 07:04:16 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000040)={{{@in=@dev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}}}, &(0x7f0000000140)=0xe8) socketpair$inet6(0xa, 0x3, 0x40, &(0x7f00000002c0)) r2 = getuid() sendmsg$nl_xfrm(r0, &(0x7f0000001a80)={&(0x7f0000000000), 0xc, &(0x7f0000001a40)={&(0x7f0000000180)=@flushpolicy={0x118, 0x1d, 0x500, 0x70bd2a, 0x25dfdbfe, "", [@sa={0xe4, 0x6, {{@in=@local, @in6, 0x4e23, 0x0, 0x4e24, 0x0, 0x0, 0x20, 0x20, 0x7f, r1, r2}, {@in6=@remote, 0x4d3, 0x3f}, @in=@multicast2, {0x1, 0x7ff, 0x2, 0xff, 0x9, 0x8, 0x4, 0x9}, {0x6, 0x17f4, 0x5, 0x200}, {0x9, 0x400, 0x7}, 0x70bd28, 0x3503, 0x2, 0x3, 0x3, 0x10}}, @lifetime_val={0x24, 0x9, {0xd2, 0x101, 0xb8, 0x1a69}}]}, 0xfca3}}, 0x0) [ 202.423619] FAT-fs (loop4): bogus number of reserved sectors [ 202.439250] FAT-fs (loop4): Can't find a valid FAT filesystem [ 202.547676] FAT-fs (loop4): bogus number of reserved sectors [ 202.557397] FAT-fs (loop4): Can't find a valid FAT filesystem [ 202.576240] overlayfs: filesystem on './file0' not supported as upperdir 07:04:16 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000240)=""/246) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000040)=0x600210) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = memfd_create(&(0x7f0000000080)="73970ddb08df8c656c667b7070703070707031236d643573756d00", 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r0, r2, &(0x7f00000ddff8), 0x102002700) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x10, &(0x7f0000000100)="0249c83d6d345f8f762070") r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000340)) sendmmsg(r4, &(0x7f0000007980)=[{{&(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x2, 0x4, 0x1, {0xa, 0x4e23, 0x8, @ipv4={[], [], @broadcast}, 0x6}}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000200)="9576dd792c1d6ef9b450ab3dbcbe43c700d0ca376af4747273941a6bd5963ac52e882089fecc85929ac9bf451aead95f71327910f5fb6d74ada81d0b5cec565b54dacba7ffdd9a70c5406ecf219b56c2968555e1d460cc921825afb2b4531f045de4c1f14f0ba76ee5e0df1c89358f0720b80e9a6160567824c7722339fc684d982418611a84162fe8e965", 0x8b}], 0x1, &(0x7f0000000440), 0x0, 0x4000814}, 0x1}], 0x1, 0x8080) sendto$llc(r4, &(0x7f0000000000)="298248337a8d2a6b177cac842110cf5c2017fca5d843bce67d7fe54070b5bdaf737e5c3ab8647625fd292234c6d4883aa100742e3fba9e0f40c44e5fe4cdf0a2d7399822a502e9f3687cfa974cca2f13699d1021edbd3f8ee471fa782d2521279cf828ea38c6c075", 0x68, 0x4000000, 0x0, 0x0) clock_nanosleep(0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f0000000480)) gettid() perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000000380), &(0x7f0000000400)=0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000600)) sendmsg$nl_generic(r5, &(0x7f0000000080)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000a80)=ANY=[@ANYBLOB="1400e2628da5fdff000000000000000001000000d52926887375437576769ac4d6e3eb5678bf5c72e2108469e3d9b39d1aa1e89487a778bf9ab7d65f00000000c8d000258378af9427736aa5ecbbf9935a000020881f48513ecc04f5dca99fb3726b510c1cf1f72b4fdedab950209a7560dbf61de92e83c9aa6e72937c35489a56a71ecf1484393730efcfbeddccdf5a93701ee17faf46e24c4339edd94f9166455198fa48ebf2edd37001ebdeaf5a19e56a25969d2354321fd1a3306a0ff4fe7d46e5dd372c788633b9d7fdccf1c6ed713d459422e5fdbe633ded13885e3fa76d37565f5dbdb9be15f9b560781c51f3b0a2b33e0f635e6307ca2fab561a3c8d5b1434f736b2a5e7f3e496556df951ae622490d8501500feb353102175b21233bb05619a69784228269c00210000000000000000000000967c6b0c006c4c17b7706826957b4930f9d6ec6b4ed97482eaadb905c6fa5ff81c41a7f2cc965e9cd002c1303b7e8d0369f4c396d3afd5be99c5996fbec8e531cbe5b8296e6019f1754044bc7f68b205678bf59a549e36f3d519e786491d182d2374f24eb370ad5063f5e01f308ca06b71aca5a419bf5df1ed56d993995a6892035cb8eb4aad9f801e72dac4aa216dd2df068eaa5057efdb8bdb021ae71ea6b0e86d90d2c4fc7cc745ff1ebb4a3468b0084f45f7b546c263f7e775556c653bad9741b18c1fe499c3bc961ffc28b36db6"], 0x1}}, 0x0) recvmsg(r5, &(0x7f0000003f00)={&(0x7f0000002a00)=@can, 0x80, &(0x7f0000003d80), 0x0, &(0x7f0000003e00)=""/240, 0xf0}, 0x0) prctl$seccomp(0x16, 0x3, &(0x7f0000000680)={0x7, &(0x7f0000000640)=[{0x8, 0xfff, 0x8, 0xc99a}, {0xffffffffffffff80, 0x4, 0x5, 0x2}, {0xb337dc8, 0x1e, 0x100, 0x1f}, {0x1ff, 0x80000001, 0x0, 0x1ff}, {0x4, 0xa36b, 0x100000000, 0x6}, {0x7fffffff, 0x3ff, 0xffffffff, 0x401}, {0x7, 0x3f, 0x3, 0x8001}]}) clock_nanosleep(0x2, 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000180)) r6 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x9, 0x19c6a6b4e739ed0e) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000004c0)={{{@in, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000440)=0xfffffffffffffd4b) bind$packet(r6, &(0x7f0000004a80)={0x11, 0x10, r7, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) 07:04:16 executing program 5: socketpair$inet6_sctp(0xa, 0x5, 0x84, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000001c0), 0x4) syz_init_net_socket$bt_l2cap(0x1f, 0x200000000001, 0x0) socketpair(0x9, 0x800, 0xff, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_ASSIGN_SET_MSIX_NR(r1, 0x4008ae73, &(0x7f0000000080)={0x6, 0x4}) getsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, &(0x7f0000000140), 0xffffffffffffff10) socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_ifreq(r0, 0x8924, &(0x7f00000000c0)={'tunl0\x00', @ifru_flags=0x2000}) 07:04:16 executing program 1: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000240)=""/246) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000040)=0x600210) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = memfd_create(&(0x7f0000000080)="73970ddb08df8c656c667b7070703070707031236d643573756d00", 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r0, r2, &(0x7f00000ddff8), 0x102002700) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x10, &(0x7f0000000100)="0249c83d6d345f8f762070") r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000340)) sendmmsg(r4, &(0x7f0000007980)=[{{&(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x2, 0x4, 0x1, {0xa, 0x4e23, 0x8, @ipv4={[], [], @broadcast}, 0x6}}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000200)="9576dd792c1d6ef9b450ab3dbcbe43c700d0ca376af4747273941a6bd5963ac52e882089fecc85929ac9bf451aead95f71327910f5fb6d74ada81d0b5cec565b54dacba7ffdd9a70c5406ecf219b56c2968555e1d460cc921825afb2b4531f045de4c1f14f0ba76ee5e0df1c89358f0720b80e9a6160567824c7722339fc684d982418611a84162fe8e965", 0x8b}], 0x1, &(0x7f0000000440), 0x0, 0x4000814}, 0x1}], 0x1, 0x8080) sendto$llc(r4, &(0x7f0000000000)="298248337a8d2a6b177cac842110cf5c2017fca5d843bce67d7fe54070b5bdaf737e5c3ab8647625fd292234c6d4883aa100742e3fba9e0f40c44e5fe4cdf0a2d7399822a502e9f3687cfa974cca2f13699d1021edbd3f8ee471fa782d2521279cf828ea38c6c075", 0x68, 0x4000000, 0x0, 0x0) clock_nanosleep(0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f0000000480)) gettid() perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000000380), &(0x7f0000000400)=0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000600)) sendmsg$nl_generic(r5, &(0x7f0000000080)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000a80)=ANY=[@ANYBLOB="1400e2628da5fdff000000000000000001000000d52926887375437576769ac4d6e3eb5678bf5c72e2108469e3d9b39d1aa1e89487a778bf9ab7d65f00000000c8d000258378af9427736aa5ecbbf9935a000020881f48513ecc04f5dca99fb3726b510c1cf1f72b4fdedab950209a7560dbf61de92e83c9aa6e72937c35489a56a71ecf1484393730efcfbeddccdf5a93701ee17faf46e24c4339edd94f9166455198fa48ebf2edd37001ebdeaf5a19e56a25969d2354321fd1a3306a0ff4fe7d46e5dd372c788633b9d7fdccf1c6ed713d459422e5fdbe633ded13885e3fa76d37565f5dbdb9be15f9b560781c51f3b0a2b33e0f635e6307ca2fab561a3c8d5b1434f736b2a5e7f3e496556df951ae622490d8501500feb353102175b21233bb05619a69784228269c00210000000000000000000000967c6b0c006c4c17b7706826957b4930f9d6ec6b4ed97482eaadb905c6fa5ff81c41a7f2cc965e9cd002c1303b7e8d0369f4c396d3afd5be99c5996fbec8e531cbe5b8296e6019f1754044bc7f68b205678bf59a549e36f3d519e786491d182d2374f24eb370ad5063f5e01f308ca06b71aca5a419bf5df1ed56d993995a6892035cb8eb4aad9f801e72dac4aa216dd2df068eaa5057efdb8bdb021ae71ea6b0e86d90d2c4fc7cc745ff1ebb4a3468b0084f45f7b546c263f7e775556c653bad9741b18c1fe499c3bc961ffc28b36db6"], 0x1}}, 0x0) recvmsg(r5, &(0x7f0000003f00)={&(0x7f0000002a00)=@can, 0x80, &(0x7f0000003d80), 0x0, &(0x7f0000003e00)=""/240, 0xf0}, 0x0) prctl$seccomp(0x16, 0x3, &(0x7f0000000680)={0x7, &(0x7f0000000640)=[{0x8, 0xfff, 0x8, 0xc99a}, {0xffffffffffffff80, 0x4, 0x5, 0x2}, {0xb337dc8, 0x1e, 0x100, 0x1f}, {0x1ff, 0x80000001, 0x0, 0x1ff}, {0x4, 0xa36b, 0x100000000, 0x6}, {0x7fffffff, 0x3ff, 0xffffffff, 0x401}, {0x7, 0x3f, 0x3, 0x8001}]}) clock_nanosleep(0x2, 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000180)) r6 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x9, 0x19c6a6b4e739ed0e) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000004c0)={{{@in, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000440)=0xfffffffffffffd4b) bind$packet(r6, &(0x7f0000004a80)={0x11, 0x10, r7, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) 07:04:16 executing program 3: syz_read_part_table(0x0, 0x1, &(0x7f0000000100)=[{&(0x7f0000000040)="02005400000001000000ff07000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}]) r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x1e, 0x10000) ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f0000000080)={0x630, 0x81, 0x7f, 0x100, 0x80, 0x80}) 07:04:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000000340)=ANY=[]) mkdir(&(0x7f0000001700)='./file1\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) fstat(0xffffffffffffffff, &(0x7f0000000540)) r0 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x40000, 0x0) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r1, 0x80045300, &(0x7f00000001c0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x0, 0x0) utime(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x1, 0x943}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) fstatfs(r0, &(0x7f00000002c0)=""/4096) 07:04:16 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/checkreqprot\x00', 0x200c0, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x12, 0x8, "4987dfd7a78922a3383a2b7eb4f117779ec14aa0c4e3bfa5a621c33eca5c6bad7d71fdb862639da66d5aed5afc434f853af02942af8cc20331e25b1c01766e94", "91aefd76f082adb0990fb1dec4a85869354254f018a9814d6c7f15358012b0c798dcf08cfa6a54f2ad53b954ad660f40055434d173bfccf0a3112a98a2839eb3", "9e458755d820e9ef9fb1e42715c56f026ea22ddde1d25daf842bd72cea183148", [0x5, 0xfffffffffffffff9]}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000600)='/dev/sequencer2\x00', 0x1ffffffffffffb, 0x0) epoll_wait(0xffffffffffffffff, &(0x7f00000005c0)=[{}, {}, {}], 0x3, 0x3) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000000140)) r2 = fcntl$getown(r1, 0x9) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getegid() fchown(r1, r3, r4) fcntl$setown(r1, 0x8, r2) perf_event_open(&(0x7f0000001640)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d, 0x8, 0x9, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0x8000, 0x2, 0x0, 0x0, 0x0, 0xb0b, 0x935, 0x1000, 0x9ea, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000540)}, 0x0, 0x0, 0x0, 0x0, 0xe4, 0x4fad433c, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25d1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fdatasync(r0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f00000001c0)={0x0, 0x1, 0x10, 0x444, 0x2153}, &(0x7f0000000280)=0x18) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000002c0)={r6, 0x3ff}, &(0x7f0000000500)=0x8) r7 = dup2(r5, r1) r8 = syz_open_dev$amidi(&(0x7f0000000240)='/dev/amidi#\x00', 0x2, 0x82) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r7, 0x84, 0x6, &(0x7f0000000640), &(0x7f0000000340)=0x84) ppoll(&(0x7f0000000180)=[{0xffffffffffffffff, 0x200}, {r7, 0x4}, {r8}], 0x3, &(0x7f0000000200), &(0x7f0000000300)={0x3}, 0x8) 07:04:16 executing program 5: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/checkreqprot\x00', 0x200c0, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x12, 0x8, "4987dfd7a78922a3383a2b7eb4f117779ec14aa0c4e3bfa5a621c33eca5c6bad7d71fdb862639da66d5aed5afc434f853af02942af8cc20331e25b1c01766e94", "91aefd76f082adb0990fb1dec4a85869354254f018a9814d6c7f15358012b0c798dcf08cfa6a54f2ad53b954ad660f40055434d173bfccf0a3112a98a2839eb3", "9e458755d820e9ef9fb1e42715c56f026ea22ddde1d25daf842bd72cea183148", [0x5, 0xfffffffffffffff9]}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000600)='/dev/sequencer2\x00', 0x1ffffffffffffb, 0x0) epoll_wait(0xffffffffffffffff, &(0x7f00000005c0)=[{}, {}, {}], 0x3, 0x3) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000000140)) r2 = fcntl$getown(r1, 0x9) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getegid() fchown(r1, r3, r4) fcntl$setown(r1, 0x8, r2) perf_event_open(&(0x7f0000001640)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d, 0x8, 0x9, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0x8000, 0x2, 0x0, 0x0, 0x0, 0xb0b, 0x935, 0x1000, 0x9ea, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000540)}, 0x0, 0x0, 0x0, 0x0, 0xe4, 0x4fad433c, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25d1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fdatasync(r0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f00000001c0)={0x0, 0x1, 0x10, 0x444, 0x2153}, &(0x7f0000000280)=0x18) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000002c0)={r6, 0x3ff}, &(0x7f0000000500)=0x8) r7 = dup2(r5, r1) r8 = syz_open_dev$amidi(&(0x7f0000000240)='/dev/amidi#\x00', 0x2, 0x82) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r7, 0x84, 0x6, &(0x7f0000000640), &(0x7f0000000340)=0x84) ppoll(&(0x7f0000000180)=[{0xffffffffffffffff, 0x200}, {r7, 0x4}, {r8}], 0x3, &(0x7f0000000200), &(0x7f0000000300)={0x3}, 0x8) 07:04:16 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') r1 = creat(&(0x7f0000000440)='./file0\x00', 0x8) ioctl$BLKRAGET(r1, 0x1263, &(0x7f0000000480)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000006cd6a1b97408ad1382580000000000000000", @ANYPTR=&(0x7f00000005c0)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[@ANYBLOB="00000000000000006fa011fdf1cc4a7b68c27910662d27f61b5a6a40f8be5a12aab9ec6d3b724beb5029befef6a53db4dcd7e59c9356919b1e3bd033dece47639c43cd185615cde6088e73f400ad0cf5530b54954359cd823a879276636924986e875c503ec5d3c4f8f26154a93afd61e49d135c800e21aa3d407cd80000000000000000000000"]], 0x0, 0x0, &(0x7f0000000300)}) timer_create(0x3, &(0x7f0000000140)={0x0, 0x2a, 0x6, @thr={&(0x7f0000000280)="db704c2d282459afdc1d1bd0e27f4fd39bfeda61847a7f112d9c864224af27964d98273d82e3cad228877b93dfceeff2fc372d0980fe66969b7ade26d2dd33f3d7d7490d83b1f3926e06038e7778da62087055e5a7ade363b5be71d5ac122897dacdfafb073040c8bf2d5192600fe8094255c376eb364a3aef65c4dcfa47f2669de084c36b594d54891aec37301958351de6e5e1fe3fb1f47435380a8c4f0cad1fc16eb1a92a3b1b80d143260b10d575cdd48d61b9473ebb173daf3d688f74dec85167e981b01b7bbc6d52e98e87b83c1254236dba1177529cde02bff58abba40249cf22141e7bb94300be4e47cb572151a8e0a18ce9df8b8e32", &(0x7f00000000c0)="cf0f08a88f0d7d141a1473570f0b360252c1e64ecc7d36a5cfd6534abb400b4a6b9b6167c4e5a179786e831cc4cd59b5957ba7e7e4ef064793c8263615449932dde61f349b70d3990eec67b1559757e9c3e73968c6966dd98c08f8a19cde5c1ab3338d4508e3821f85cb26628cdd"}}, &(0x7f0000000200)=0x0) timer_settime(r2, 0x1, &(0x7f0000000380), &(0x7f00000003c0)) clock_gettime(0x0, &(0x7f0000000580)={0x0, 0x0}) timer_settime(r2, 0x0, &(0x7f00000005c0)={{r3, r4+30000000}}, 0x0) ioctl$UI_DEV_CREATE(r1, 0x5501) [ 202.941478] FAT-fs (loop4): bogus number of reserved sectors [ 202.963203] FAT-fs (loop4): Can't find a valid FAT filesystem [ 202.979038] loop3: p1[DM] [ 202.981903] loop3: partition table partially beyond EOD, truncated [ 202.989946] loop3: p1 start 1 is beyond EOD, truncated [ 203.006025] binder: 7700:7703 transaction failed 29189/-22, size 6377681656202181025-0 line 2855 07:04:16 executing program 5: socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000100), 0x4) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=0x4) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vhci\x00', 0x90941, 0x0) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f00000003c0)={0x4, &(0x7f0000000380)=[{0x1, 0x0, 0x7, 0x40}, {0x982b, 0x0, 0x2f65}, {0x0, 0x2, 0x6c6, 0x2}, {0x8, 0x6, 0x10000, 0x9}]}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/ip_mr_cache\x00') ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffff9c, 0xc0086420, &(0x7f0000000240)={0x0}) ioctl$DRM_IOCTL_SWITCH_CTX(r1, 0x40086424, &(0x7f0000000280)={r2, 0x1}) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) utimensat(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={{0x77359400}, {0x77359400}}, 0x100) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = gettid() ioprio_get$pid(0x2, r4) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @local, 0x2000000006}, 0x1c) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) semget$private(0x0, 0x0, 0x600) semop(0x0, &(0x7f00000001c0)=[{0x4}, {0x3, 0x0, 0x1800}], 0x2) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000036e, 0x0) perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) [ 203.034251] binder: 7700:7703 transaction failed 29189/-22, size 6377681656202181025-0 line 2855 [ 203.059512] binder: undelivered TRANSACTION_ERROR: 29189 [ 203.065414] binder: undelivered TRANSACTION_ERROR: 29189 07:04:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000000340)=ANY=[]) mkdir(&(0x7f0000001700)='./file1\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) fstat(0xffffffffffffffff, &(0x7f0000000540)) r0 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x40000, 0x0) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r1, 0x80045300, &(0x7f00000001c0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x0, 0x0) utime(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x1, 0x943}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) fstatfs(r0, &(0x7f00000002c0)=""/4096) 07:04:16 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x3, 0x101000) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000440)={&(0x7f0000000340), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, 0x0, 0x0, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6fd6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x840}, 0x10) r2 = dup(0xffffffffffffffff) write$apparmor_current(0xffffffffffffffff, &(0x7f00000000c0)=@hat={'changehat ', 0x4, 0x5e, ['\x00', ':\x00', '/dev/kvm\x00', '/dev/kvm\x00', '\x00', 'vmnet0ppp1\x00', '/dev/kvm\x00']}, 0x47) r3 = gettid() stat(&(0x7f0000000d80)='./file0\x00', &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = socket$vsock_stream(0x28, 0x1, 0x0) r6 = getpid() getgroups(0x8, &(0x7f0000000f00)=[0xffffffffffffffff, 0xffffffffffffffff, 0xee01, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff, 0x0, 0x0]) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001500)=[{&(0x7f00000002c0)=@file={0x0, './file1\x00'}, 0x6e, &(0x7f0000000800), 0x0, 0x0, 0x0, 0x20000090}, {&(0x7f00000008c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000d00)=[{&(0x7f0000000c40)}], 0x1, &(0x7f0000000f40)=[@cred={0x20, 0x1, 0x2, r3, r4}], 0x20, 0xc080}, {&(0x7f0000001000)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000001380)=[{&(0x7f00000011c0)="4fc5baee33eb9709a4080dab6e44f9d1425b7b19c908711e180f4f300b9e5057dcad", 0x22}], 0x1, &(0x7f00000013c0)=[@rights={0x28, 0x1, 0x1, [r0, r5, r2, r0, r0, r2]}, @rights={0x18, 0x1, 0x1, [0xffffffffffffffff]}, @rights={0x10}, @cred={0x20, 0x1, 0x2, r6, 0x0, r7}], 0x70, 0x20044091}], 0x3, 0x0) prctl$setmm(0x23, 0x3, &(0x7f0000ffb000/0x4000)=nil) r8 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) getsockname$packet(r1, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000004c0)=0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1d, 0xc, &(0x7f0000000180)=@raw=[@map={0x18, 0x0, 0x1, 0x0, r2}, @exit, @generic={0x0, 0xc000000000, 0x3, 0xfffffffffffffffb}, @map={0x18, 0x4, 0x1, 0x0, r2}, @exit, @alu={0x0, 0xac, 0x0, 0x0, 0x3, 0x80, 0xfffffffffffffffc}], &(0x7f0000000380)='syzkaller\x00', 0x2, 0x0, 0x0, 0x40f00, 0x1, [], r9, 0x9}, 0x48) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f00000015c0)='/dev/kvm\x00', 0x80000, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000000)={0x0, 0x3, 0x0, 0x21000000, &(0x7f0000fff000/0x1000)=nil}) keyctl$search(0xa, 0x0, &(0x7f0000002640)='.request_key_auth\x00', &(0x7f0000002680)={'syz'}, 0x0) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x2, 0x0) ioctl$KVM_GET_DIRTY_LOG(r11, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000c00000/0x400000)=nil}) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r8, 0x84, 0x6c, &(0x7f0000000200)={0x0, 0x6a, "111807f296fb425c5b4138c49e71b8d51cf6ca940d6a9329c25aea664b781d7b23486c478ee8e47fad1ce22554f2a0ed3b8e6b8910a5904a154c5c7cfa6af8a87ff2f71f55d6b179f2555ff22d5d944799583908d186e4319967c20c6300b9d08a0f3522d491c1183f86"}, &(0x7f0000000280)=0x72) quotactl(0x0, &(0x7f0000000640)='./file0\x00', 0x0, &(0x7f0000000680)) close(r10) 07:04:16 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local, @rand_addr}, 0xc) getsockopt$inet_mtu(r3, 0x0, 0x29, &(0x7f0000000040), &(0x7f0000000000)=0x4) ioctl$sock_inet_SIOCGARP(r3, 0x8953, &(0x7f0000000080)={{0x2, 0x0, @broadcast}, {0x0, @link_local}, 0xfffffffffffffffe, {}, "000000000000fed71fffffffffff00"}) close(r2) dup3(r1, r2, 0x0) [ 203.220415] FAT-fs (loop4): bogus number of reserved sectors [ 203.235403] FAT-fs (loop4): Can't find a valid FAT filesystem 07:04:17 executing program 4: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000000340)=ANY=[]) mkdir(&(0x7f0000001700)='./file1\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}]}) fstat(0xffffffffffffffff, &(0x7f0000000540)) r0 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x40000, 0x0) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r1, 0x80045300, &(0x7f00000001c0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x0, 0x0) utime(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x1, 0x943}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) fstatfs(r0, &(0x7f00000002c0)=""/4096) 07:04:17 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000000)) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) [ 203.725506] FAT-fs (loop4): bogus number of reserved sectors [ 203.735219] FAT-fs (loop4): Can't find a valid FAT filesystem 07:04:17 executing program 1: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000240)=""/246) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000040)=0x600210) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = memfd_create(&(0x7f0000000080)="73970ddb08df8c656c667b7070703070707031236d643573756d00", 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r0, r2, &(0x7f00000ddff8), 0x102002700) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x10, &(0x7f0000000100)="0249c83d6d345f8f762070") r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000340)) sendmmsg(r4, &(0x7f0000007980)=[{{&(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x2, 0x4, 0x1, {0xa, 0x4e23, 0x8, @ipv4={[], [], @broadcast}, 0x6}}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000200)="9576dd792c1d6ef9b450ab3dbcbe43c700d0ca376af4747273941a6bd5963ac52e882089fecc85929ac9bf451aead95f71327910f5fb6d74ada81d0b5cec565b54dacba7ffdd9a70c5406ecf219b56c2968555e1d460cc921825afb2b4531f045de4c1f14f0ba76ee5e0df1c89358f0720b80e9a6160567824c7722339fc684d982418611a84162fe8e965", 0x8b}], 0x1, &(0x7f0000000440), 0x0, 0x4000814}, 0x1}], 0x1, 0x8080) sendto$llc(r4, &(0x7f0000000000)="298248337a8d2a6b177cac842110cf5c2017fca5d843bce67d7fe54070b5bdaf737e5c3ab8647625fd292234c6d4883aa100742e3fba9e0f40c44e5fe4cdf0a2d7399822a502e9f3687cfa974cca2f13699d1021edbd3f8ee471fa782d2521279cf828ea38c6c075", 0x68, 0x4000000, 0x0, 0x0) clock_nanosleep(0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f0000000480)) gettid() perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000000380), &(0x7f0000000400)=0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000600)) sendmsg$nl_generic(r5, &(0x7f0000000080)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000a80)=ANY=[@ANYBLOB="1400e2628da5fdff000000000000000001000000d52926887375437576769ac4d6e3eb5678bf5c72e2108469e3d9b39d1aa1e89487a778bf9ab7d65f00000000c8d000258378af9427736aa5ecbbf9935a000020881f48513ecc04f5dca99fb3726b510c1cf1f72b4fdedab950209a7560dbf61de92e83c9aa6e72937c35489a56a71ecf1484393730efcfbeddccdf5a93701ee17faf46e24c4339edd94f9166455198fa48ebf2edd37001ebdeaf5a19e56a25969d2354321fd1a3306a0ff4fe7d46e5dd372c788633b9d7fdccf1c6ed713d459422e5fdbe633ded13885e3fa76d37565f5dbdb9be15f9b560781c51f3b0a2b33e0f635e6307ca2fab561a3c8d5b1434f736b2a5e7f3e496556df951ae622490d8501500feb353102175b21233bb05619a69784228269c00210000000000000000000000967c6b0c006c4c17b7706826957b4930f9d6ec6b4ed97482eaadb905c6fa5ff81c41a7f2cc965e9cd002c1303b7e8d0369f4c396d3afd5be99c5996fbec8e531cbe5b8296e6019f1754044bc7f68b205678bf59a549e36f3d519e786491d182d2374f24eb370ad5063f5e01f308ca06b71aca5a419bf5df1ed56d993995a6892035cb8eb4aad9f801e72dac4aa216dd2df068eaa5057efdb8bdb021ae71ea6b0e86d90d2c4fc7cc745ff1ebb4a3468b0084f45f7b546c263f7e775556c653bad9741b18c1fe499c3bc961ffc28b36db6"], 0x1}}, 0x0) recvmsg(r5, &(0x7f0000003f00)={&(0x7f0000002a00)=@can, 0x80, &(0x7f0000003d80), 0x0, &(0x7f0000003e00)=""/240, 0xf0}, 0x0) prctl$seccomp(0x16, 0x3, &(0x7f0000000680)={0x7, &(0x7f0000000640)=[{0x8, 0xfff, 0x8, 0xc99a}, {0xffffffffffffff80, 0x4, 0x5, 0x2}, {0xb337dc8, 0x1e, 0x100, 0x1f}, {0x1ff, 0x80000001, 0x0, 0x1ff}, {0x4, 0xa36b, 0x100000000, 0x6}, {0x7fffffff, 0x3ff, 0xffffffff, 0x401}, {0x7, 0x3f, 0x3, 0x8001}]}) clock_nanosleep(0x2, 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000180)) r6 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x9, 0x19c6a6b4e739ed0e) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000004c0)={{{@in, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000440)=0xfffffffffffffd4b) bind$packet(r6, &(0x7f0000004a80)={0x11, 0x10, r7, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) 07:04:17 executing program 2: r0 = syz_open_dev$usb(&(0x7f0000000280)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x2) ioctl$FS_IOC_FSGETXATTR(r0, 0xc0185500, &(0x7f0000000040)={0xa3, 0x4c}) syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x20, 0x400000) 07:04:17 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000240)=""/246) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000040)=0x600210) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = memfd_create(&(0x7f0000000080)="73970ddb08df8c656c667b7070703070707031236d643573756d00", 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r0, r2, &(0x7f00000ddff8), 0x102002700) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x10, &(0x7f0000000100)="0249c83d6d345f8f762070") r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000340)) sendmmsg(r4, &(0x7f0000007980)=[{{&(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x2, 0x4, 0x1, {0xa, 0x4e23, 0x8, @ipv4={[], [], @broadcast}, 0x6}}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000200)="9576dd792c1d6ef9b450ab3dbcbe43c700d0ca376af4747273941a6bd5963ac52e882089fecc85929ac9bf451aead95f71327910f5fb6d74ada81d0b5cec565b54dacba7ffdd9a70c5406ecf219b56c2968555e1d460cc921825afb2b4531f045de4c1f14f0ba76ee5e0df1c89358f0720b80e9a6160567824c7722339fc684d982418611a84162fe8e965", 0x8b}], 0x1, &(0x7f0000000440), 0x0, 0x4000814}, 0x1}], 0x1, 0x8080) sendto$llc(r4, &(0x7f0000000000)="298248337a8d2a6b177cac842110cf5c2017fca5d843bce67d7fe54070b5bdaf737e5c3ab8647625fd292234c6d4883aa100742e3fba9e0f40c44e5fe4cdf0a2d7399822a502e9f3687cfa974cca2f13699d1021edbd3f8ee471fa782d2521279cf828ea38c6c075", 0x68, 0x4000000, 0x0, 0x0) clock_nanosleep(0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f0000000480)) gettid() perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000000380), &(0x7f0000000400)=0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000600)) sendmsg$nl_generic(r5, &(0x7f0000000080)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000a80)=ANY=[@ANYBLOB="1400e2628da5fdff000000000000000001000000d52926887375437576769ac4d6e3eb5678bf5c72e2108469e3d9b39d1aa1e89487a778bf9ab7d65f00000000c8d000258378af9427736aa5ecbbf9935a000020881f48513ecc04f5dca99fb3726b510c1cf1f72b4fdedab950209a7560dbf61de92e83c9aa6e72937c35489a56a71ecf1484393730efcfbeddccdf5a93701ee17faf46e24c4339edd94f9166455198fa48ebf2edd37001ebdeaf5a19e56a25969d2354321fd1a3306a0ff4fe7d46e5dd372c788633b9d7fdccf1c6ed713d459422e5fdbe633ded13885e3fa76d37565f5dbdb9be15f9b560781c51f3b0a2b33e0f635e6307ca2fab561a3c8d5b1434f736b2a5e7f3e496556df951ae622490d8501500feb353102175b21233bb05619a69784228269c00210000000000000000000000967c6b0c006c4c17b7706826957b4930f9d6ec6b4ed97482eaadb905c6fa5ff81c41a7f2cc965e9cd002c1303b7e8d0369f4c396d3afd5be99c5996fbec8e531cbe5b8296e6019f1754044bc7f68b205678bf59a549e36f3d519e786491d182d2374f24eb370ad5063f5e01f308ca06b71aca5a419bf5df1ed56d993995a6892035cb8eb4aad9f801e72dac4aa216dd2df068eaa5057efdb8bdb021ae71ea6b0e86d90d2c4fc7cc745ff1ebb4a3468b0084f45f7b546c263f7e775556c653bad9741b18c1fe499c3bc961ffc28b36db6"], 0x1}}, 0x0) recvmsg(r5, &(0x7f0000003f00)={&(0x7f0000002a00)=@can, 0x80, &(0x7f0000003d80), 0x0, &(0x7f0000003e00)=""/240, 0xf0}, 0x0) prctl$seccomp(0x16, 0x3, &(0x7f0000000680)={0x7, &(0x7f0000000640)=[{0x8, 0xfff, 0x8, 0xc99a}, {0xffffffffffffff80, 0x4, 0x5, 0x2}, {0xb337dc8, 0x1e, 0x100, 0x1f}, {0x1ff, 0x80000001, 0x0, 0x1ff}, {0x4, 0xa36b, 0x100000000, 0x6}, {0x7fffffff, 0x3ff, 0xffffffff, 0x401}, {0x7, 0x3f, 0x3, 0x8001}]}) clock_nanosleep(0x2, 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000180)) r6 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x9, 0x19c6a6b4e739ed0e) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000004c0)={{{@in, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000440)=0xfffffffffffffd4b) bind$packet(r6, &(0x7f0000004a80)={0x11, 0x10, r7, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) 07:04:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x3, 0x101000) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000440)={&(0x7f0000000340), 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, 0x0, 0x0, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6fd6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x840}, 0x10) r2 = dup(0xffffffffffffffff) write$apparmor_current(0xffffffffffffffff, &(0x7f00000000c0)=@hat={'changehat ', 0x4, 0x5e, ['\x00', ':\x00', '/dev/kvm\x00', '/dev/kvm\x00', '\x00', 'vmnet0ppp1\x00', '/dev/kvm\x00']}, 0x47) r3 = gettid() stat(&(0x7f0000000d80)='./file0\x00', &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = socket$vsock_stream(0x28, 0x1, 0x0) r6 = getpid() getgroups(0x8, &(0x7f0000000f00)=[0xffffffffffffffff, 0xffffffffffffffff, 0xee01, 0xffffffffffffffff, 0xee00, 0xffffffffffffffff, 0x0, 0x0]) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001500)=[{&(0x7f00000002c0)=@file={0x0, './file1\x00'}, 0x6e, &(0x7f0000000800), 0x0, 0x0, 0x0, 0x20000090}, {&(0x7f00000008c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000d00)=[{&(0x7f0000000c40)}], 0x1, &(0x7f0000000f40)=[@cred={0x20, 0x1, 0x2, r3, r4}], 0x20, 0xc080}, {&(0x7f0000001000)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000001380)=[{&(0x7f00000011c0)="4fc5baee33eb9709a4080dab6e44f9d1425b7b19c908711e180f4f300b9e5057dcad", 0x22}], 0x1, &(0x7f00000013c0)=[@rights={0x28, 0x1, 0x1, [r0, r5, r2, r0, r0, r2]}, @rights={0x18, 0x1, 0x1, [0xffffffffffffffff]}, @rights={0x10}, @cred={0x20, 0x1, 0x2, r6, 0x0, r7}], 0x70, 0x20044091}], 0x3, 0x0) prctl$setmm(0x23, 0x3, &(0x7f0000ffb000/0x4000)=nil) r8 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) getsockname$packet(r1, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000004c0)=0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1d, 0xc, &(0x7f0000000180)=@raw=[@map={0x18, 0x0, 0x1, 0x0, r2}, @exit, @generic={0x0, 0xc000000000, 0x3, 0xfffffffffffffffb}, @map={0x18, 0x4, 0x1, 0x0, r2}, @exit, @alu={0x0, 0xac, 0x0, 0x0, 0x3, 0x80, 0xfffffffffffffffc}], &(0x7f0000000380)='syzkaller\x00', 0x2, 0x0, 0x0, 0x40f00, 0x1, [], r9, 0x9}, 0x48) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f00000015c0)='/dev/kvm\x00', 0x80000, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000000)={0x0, 0x3, 0x0, 0x21000000, &(0x7f0000fff000/0x1000)=nil}) keyctl$search(0xa, 0x0, &(0x7f0000002640)='.request_key_auth\x00', &(0x7f0000002680)={'syz'}, 0x0) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x2, 0x0) ioctl$KVM_GET_DIRTY_LOG(r11, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000c00000/0x400000)=nil}) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r8, 0x84, 0x6c, &(0x7f0000000200)={0x0, 0x6a, "111807f296fb425c5b4138c49e71b8d51cf6ca940d6a9329c25aea664b781d7b23486c478ee8e47fad1ce22554f2a0ed3b8e6b8910a5904a154c5c7cfa6af8a87ff2f71f55d6b179f2555ff22d5d944799583908d186e4319967c20c6300b9d08a0f3522d491c1183f86"}, &(0x7f0000000280)=0x72) quotactl(0x0, &(0x7f0000000640)='./file0\x00', 0x0, &(0x7f0000000680)) close(r10) 07:04:17 executing program 5: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000240)=""/246) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000040)=0x600210) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = memfd_create(&(0x7f0000000080)="73970ddb08df8c656c667b7070703070707031236d643573756d00", 0x0) pwritev(r2, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) sendfile(r0, r2, &(0x7f00000ddff8), 0x102002700) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x10, &(0x7f0000000100)="0249c83d6d345f8f762070") r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000340)) sendmmsg(r4, &(0x7f0000007980)=[{{&(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x2, 0x4, 0x1, {0xa, 0x4e23, 0x8, @ipv4={[], [], @broadcast}, 0x6}}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000200)="9576dd792c1d6ef9b450ab3dbcbe43c700d0ca376af4747273941a6bd5963ac52e882089fecc85929ac9bf451aead95f71327910f5fb6d74ada81d0b5cec565b54dacba7ffdd9a70c5406ecf219b56c2968555e1d460cc921825afb2b4531f045de4c1f14f0ba76ee5e0df1c89358f0720b80e9a6160567824c7722339fc684d982418611a84162fe8e965", 0x8b}], 0x1, &(0x7f0000000440), 0x0, 0x4000814}, 0x1}], 0x1, 0x8080) sendto$llc(r4, &(0x7f0000000000)="298248337a8d2a6b177cac842110cf5c2017fca5d843bce67d7fe54070b5bdaf737e5c3ab8647625fd292234c6d4883aa100742e3fba9e0f40c44e5fe4cdf0a2d7399822a502e9f3687cfa974cca2f13699d1021edbd3f8ee471fa782d2521279cf828ea38c6c075", 0x68, 0x4000000, 0x0, 0x0) clock_nanosleep(0x3, 0x0, &(0x7f0000000140)={0x77359400}, &(0x7f0000000480)) gettid() perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000000380), &(0x7f0000000400)=0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000600)) sendmsg$nl_generic(r5, &(0x7f0000000080)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000a80)=ANY=[@ANYBLOB="1400e2628da5fdff000000000000000001000000d52926887375437576769ac4d6e3eb5678bf5c72e2108469e3d9b39d1aa1e89487a778bf9ab7d65f00000000c8d000258378af9427736aa5ecbbf9935a000020881f48513ecc04f5dca99fb3726b510c1cf1f72b4fdedab950209a7560dbf61de92e83c9aa6e72937c35489a56a71ecf1484393730efcfbeddccdf5a93701ee17faf46e24c4339edd94f9166455198fa48ebf2edd37001ebdeaf5a19e56a25969d2354321fd1a3306a0ff4fe7d46e5dd372c788633b9d7fdccf1c6ed713d459422e5fdbe633ded13885e3fa76d37565f5dbdb9be15f9b560781c51f3b0a2b33e0f635e6307ca2fab561a3c8d5b1434f736b2a5e7f3e496556df951ae622490d8501500feb353102175b21233bb05619a69784228269c00210000000000000000000000967c6b0c006c4c17b7706826957b4930f9d6ec6b4ed97482eaadb905c6fa5ff81c41a7f2cc965e9cd002c1303b7e8d0369f4c396d3afd5be99c5996fbec8e531cbe5b8296e6019f1754044bc7f68b205678bf59a549e36f3d519e786491d182d2374f24eb370ad5063f5e01f308ca06b71aca5a419bf5df1ed56d993995a6892035cb8eb4aad9f801e72dac4aa216dd2df068eaa5057efdb8bdb021ae71ea6b0e86d90d2c4fc7cc745ff1ebb4a3468b0084f45f7b546c263f7e775556c653bad9741b18c1fe499c3bc961ffc28b36db6"], 0x1}}, 0x0) recvmsg(r5, &(0x7f0000003f00)={&(0x7f0000002a00)=@can, 0x80, &(0x7f0000003d80), 0x0, &(0x7f0000003e00)=""/240, 0xf0}, 0x0) prctl$seccomp(0x16, 0x3, &(0x7f0000000680)={0x7, &(0x7f0000000640)=[{0x8, 0xfff, 0x8, 0xc99a}, {0xffffffffffffff80, 0x4, 0x5, 0x2}, {0xb337dc8, 0x1e, 0x100, 0x1f}, {0x1ff, 0x80000001, 0x0, 0x1ff}, {0x4, 0xa36b, 0x100000000, 0x6}, {0x7fffffff, 0x3ff, 0xffffffff, 0x401}, {0x7, 0x3f, 0x3, 0x8001}]}) clock_nanosleep(0x2, 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000180)) r6 = syz_open_dev$audion(&(0x7f00000001c0)='/dev/audio#\x00', 0x9, 0x19c6a6b4e739ed0e) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000004c0)={{{@in, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000000440)=0xfffffffffffffd4b) bind$packet(r6, &(0x7f0000004a80)={0x11, 0x10, r7, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) 07:04:17 executing program 4: r0 = socket$inet6(0xa, 0x1000002000000802, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x9, 0x0) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000080)=0x5, &(0x7f00000000c0)=0x1) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@mcast2, 0x0, 0x0, 0xff, 0x1, 0x40}, 0x20) [ 203.846781] vhci_hcd: invalid port number 76 [ 203.852818] ================================================================== [ 203.860210] BUG: KASAN: use-after-free in vhci_hub_control+0x1b6d/0x1be0 [ 203.860226] Read of size 4 at addr ffff8801ce3f033c by task syz-executor2/7762 [ 203.860230] [ 203.860255] CPU: 0 PID: 7762 Comm: syz-executor2 Not tainted 4.19.0-rc6+ #45 [ 203.883257] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 203.883262] Call Trace: [ 203.883285] dump_stack+0x1c4/0x2b4 [ 203.883306] ? dump_stack_print_info.cold.2+0x52/0x52 [ 203.904021] ? printk+0xa7/0xcf [ 203.904035] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 203.904055] print_address_description.cold.8+0x9/0x1ff [ 203.912072] kasan_report.cold.9+0x242/0x309 [ 203.912088] ? vhci_hub_control+0x1b6d/0x1be0 [ 203.912105] __asan_report_load4_noabort+0x14/0x20 [ 203.912123] vhci_hub_control+0x1b6d/0x1be0 [ 203.921880] ? vhci_hcd_probe+0x240/0x240 [ 203.921895] ? kasan_unpoison_shadow+0x35/0x50 [ 203.921914] ? kasan_kmalloc+0xc7/0xe0 [ 203.931314] ? __kmalloc+0x31c/0x760 [ 203.931329] ? kasan_check_write+0x14/0x20 [ 203.931345] ? do_raw_spin_lock+0xc1/0x200 [ 203.931365] ? usb_hcd_submit_urb+0x6fc/0x20a0 [ 203.939814] usb_hcd_submit_urb+0x17bb/0x20a0 [ 203.939829] ? vhci_hcd_probe+0x240/0x240 [ 203.939847] ? usb_create_hcd+0x40/0x40 [ 203.939867] ? do_syscall_64+0x1b9/0x820 [ 203.981656] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 203.987023] ? __x64_sys_ioctl+0x73/0xb0 [ 203.991084] ? do_syscall_64+0x1b9/0x820 [ 203.995143] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 204.000506] ? ___might_sleep+0x1ed/0x300 [ 204.004655] ? lock_release+0x970/0x970 [ 204.008642] ? arch_local_save_flags+0x40/0x40 [ 204.013228] ? __mutex_lock+0x85e/0x1700 [ 204.017290] ? __lockdep_init_map+0x105/0x590 [ 204.021784] ? __lockdep_init_map+0x105/0x590 [ 204.026284] usb_submit_urb+0x893/0x14e0 [ 204.030355] usb_start_wait_urb+0x13d/0x370 [ 204.034679] ? sg_clean+0x240/0x240 [ 204.038315] usb_control_msg+0x332/0x4e0 [ 204.042382] ? usb_start_wait_urb+0x370/0x370 [ 204.046876] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 204.052421] proc_control+0x99b/0xef0 [ 204.056225] ? proc_bulk+0xa70/0xa70 [ 204.059944] usbdev_do_ioctl+0x1eb8/0x3b50 [ 204.064178] ? processcompl_compat+0x680/0x680 [ 204.068763] ? kasan_check_read+0x11/0x20 [ 204.072915] ? do_raw_spin_unlock+0xa7/0x2f0 [ 204.077324] ? mark_held_locks+0x130/0x130 [ 204.081590] ? drop_futex_key_refs.isra.15+0x6d/0xe0 [ 204.086729] ? futex_wake+0x304/0x760 [ 204.090544] ? bpf_prog_kallsyms_find+0xde/0x4a0 [ 204.095306] ? avc_has_extended_perms+0x8cb/0x15a0 [ 204.100236] ? lock_downgrade+0x900/0x900 [ 204.104393] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 204.110212] ? do_futex+0x249/0x26d0 [ 204.113932] ? do_raw_spin_unlock+0xa7/0x2f0 [ 204.118340] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 204.123372] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 204.128912] ? avc_has_extended_perms+0xab2/0x15a0 [ 204.133845] ? avc_ss_reset+0x190/0x190 [ 204.137824] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 204.145110] ? __fget+0x4d1/0x740 [ 204.148568] ? ___might_sleep+0x1ed/0x300 [ 204.152721] ? arch_local_save_flags+0x40/0x40 [ 204.157302] ? __might_fault+0x12b/0x1e0 [ 204.161363] ? lock_downgrade+0x900/0x900 [ 204.165519] usbdev_ioctl+0x25/0x30 [ 204.169149] ? usbdev_compat_ioctl+0x30/0x30 [ 204.173558] do_vfs_ioctl+0x1de/0x1720 [ 204.177447] ? ioctl_preallocate+0x300/0x300 [ 204.181858] ? selinux_file_mprotect+0x620/0x620 [ 204.186628] ? __rhashtable_walk_find_next+0x620/0xe60 [ 204.191910] ? __sanitizer_cov_trace_cmp2+0x1b/0x20 [ 204.196923] ? put_timespec64+0x10f/0x1b0 [ 204.201071] ? nsecs_to_jiffies+0x30/0x30 [ 204.205221] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 204.210761] ? security_file_ioctl+0x94/0xc0 [ 204.215170] ksys_ioctl+0xa9/0xd0 [ 204.218640] __x64_sys_ioctl+0x73/0xb0 [ 204.222535] do_syscall_64+0x1b9/0x820 [ 204.226422] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 204.231787] ? syscall_return_slowpath+0x5e0/0x5e0 [ 204.236716] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 204.241562] ? trace_hardirqs_on_caller+0x310/0x310 [ 204.246580] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 204.251625] ? prepare_exit_to_usermode+0x291/0x3b0 [ 204.257011] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 204.261864] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 204.267051] RIP: 0033:0x457579 [ 204.270248] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 204.289154] RSP: 002b:00007f8bf0368c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 204.296866] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579 [ 204.304138] RDX: 0000000020000040 RSI: 00000000c0185500 RDI: 0000000000000003 [ 204.311417] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 204.318690] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8bf03696d4 [ 204.325964] R13: 00000000004bf6c0 R14: 00000000004cf598 R15: 00000000ffffffff [ 204.333241] [ 204.334862] The buggy address belongs to the page: [ 204.339789] page:ffffea000738fc00 count:0 mapcount:-128 mapping:0000000000000000 index:0x0 [ 204.348187] flags: 0x2fffc0000000000() [ 204.352076] raw: 02fffc0000000000 ffffea00070ded48 ffffea0007025a48 0000000000000000 [ 204.359961] raw: 0000000000000000 0000000000000000 00000000ffffff7f 0000000000000000 [ 204.367833] page dumped because: kasan: bad access detected [ 204.373529] [ 204.375177] Memory state around the buggy address: [ 204.380105] ffff8801ce3f0200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 204.387464] ffff8801ce3f0280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 204.394823] >ffff8801ce3f0300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 204.402172] ^ [ 204.407357] ffff8801ce3f0380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 204.414717] ffff8801ce3f0400: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 204.422066] ================================================================== [ 204.429423] Kernel panic - not syncing: panic_on_warn set ... [ 204.429423] [ 204.436793] CPU: 0 PID: 7762 Comm: syz-executor2 Tainted: G B 4.19.0-rc6+ #45 [ 204.445391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 204.454746] Call Trace: [ 204.457346] dump_stack+0x1c4/0x2b4 [ 204.460979] ? dump_stack_print_info.cold.2+0x52/0x52 [ 204.466172] ? lock_downgrade+0x900/0x900 [ 204.470323] panic+0x238/0x4e7 [ 204.473519] ? add_taint.cold.5+0x16/0x16 [ 204.477669] ? print_shadow_for_address+0xb6/0x116 [ 204.482607] ? trace_hardirqs_off+0xaf/0x310 [ 204.487029] kasan_end_report+0x47/0x4f [ 204.491002] kasan_report.cold.9+0x76/0x309 [ 204.495328] ? vhci_hub_control+0x1b6d/0x1be0 [ 204.499828] __asan_report_load4_noabort+0x14/0x20 [ 204.504764] vhci_hub_control+0x1b6d/0x1be0 [ 204.509091] ? vhci_hcd_probe+0x240/0x240 [ 204.513240] ? kasan_unpoison_shadow+0x35/0x50 [ 204.517821] ? kasan_kmalloc+0xc7/0xe0 [ 204.521712] ? __kmalloc+0x31c/0x760 [ 204.525429] ? kasan_check_write+0x14/0x20 [ 204.529665] ? do_raw_spin_lock+0xc1/0x200 [ 204.533901] ? usb_hcd_submit_urb+0x6fc/0x20a0 [ 204.538490] usb_hcd_submit_urb+0x17bb/0x20a0 [ 204.542988] ? vhci_hcd_probe+0x240/0x240 [ 204.547144] ? usb_create_hcd+0x40/0x40 [ 204.551211] ? do_syscall_64+0x1b9/0x820 [ 204.555272] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 204.560644] ? __x64_sys_ioctl+0x73/0xb0 [ 204.564709] ? do_syscall_64+0x1b9/0x820 [ 204.568772] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 204.574152] ? ___might_sleep+0x1ed/0x300 [ 204.578300] ? lock_release+0x970/0x970 [ 204.582276] ? arch_local_save_flags+0x40/0x40 [ 204.586860] ? __mutex_lock+0x85e/0x1700 [ 204.590923] ? __lockdep_init_map+0x105/0x590 [ 204.595417] ? __lockdep_init_map+0x105/0x590 [ 204.600009] usb_submit_urb+0x893/0x14e0 [ 204.604078] usb_start_wait_urb+0x13d/0x370 [ 204.608401] ? sg_clean+0x240/0x240 [ 204.612039] usb_control_msg+0x332/0x4e0 [ 204.616101] ? usb_start_wait_urb+0x370/0x370 [ 204.620607] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 204.626159] proc_control+0x99b/0xef0 [ 204.629966] ? proc_bulk+0xa70/0xa70 [ 204.633685] usbdev_do_ioctl+0x1eb8/0x3b50 [ 204.637922] ? processcompl_compat+0x680/0x680 [ 204.642503] ? kasan_check_read+0x11/0x20 [ 204.646657] ? do_raw_spin_unlock+0xa7/0x2f0 [ 204.651065] ? mark_held_locks+0x130/0x130 [ 204.655306] ? drop_futex_key_refs.isra.15+0x6d/0xe0 [ 204.660411] ? futex_wake+0x304/0x760 [ 204.664219] ? bpf_prog_kallsyms_find+0xde/0x4a0 [ 204.668982] ? avc_has_extended_perms+0x8cb/0x15a0 [ 204.673915] ? lock_downgrade+0x900/0x900 [ 204.678065] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 204.683865] ? do_futex+0x249/0x26d0 [ 204.687582] ? do_raw_spin_unlock+0xa7/0x2f0 [ 204.692004] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 204.696647] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 204.702187] ? avc_has_extended_perms+0xab2/0x15a0 [ 204.707119] ? avc_ss_reset+0x190/0x190 [ 204.711099] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 204.716903] ? __fget+0x4d1/0x740 [ 204.720362] ? ___might_sleep+0x1ed/0x300 [ 204.724514] ? arch_local_save_flags+0x40/0x40 [ 204.729094] ? __might_fault+0x12b/0x1e0 [ 204.733159] ? lock_downgrade+0x900/0x900 [ 204.737310] usbdev_ioctl+0x25/0x30 [ 204.740940] ? usbdev_compat_ioctl+0x30/0x30 [ 204.745351] do_vfs_ioctl+0x1de/0x1720 [ 204.749241] ? ioctl_preallocate+0x300/0x300 [ 204.753658] ? selinux_file_mprotect+0x620/0x620 [ 204.758411] ? __rhashtable_walk_find_next+0x620/0xe60 [ 204.763691] ? __sanitizer_cov_trace_cmp2+0x1b/0x20 [ 204.768704] ? put_timespec64+0x10f/0x1b0 [ 204.772851] ? nsecs_to_jiffies+0x30/0x30 [ 204.777024] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 204.782565] ? security_file_ioctl+0x94/0xc0 [ 204.786980] ksys_ioctl+0xa9/0xd0 [ 204.790436] __x64_sys_ioctl+0x73/0xb0 [ 204.794326] do_syscall_64+0x1b9/0x820 [ 204.798215] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 204.803580] ? syscall_return_slowpath+0x5e0/0x5e0 [ 204.808519] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 204.813362] ? trace_hardirqs_on_caller+0x310/0x310 [ 204.818378] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 204.823396] ? prepare_exit_to_usermode+0x291/0x3b0 [ 204.828414] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 204.833262] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 204.838449] RIP: 0033:0x457579 [ 204.841648] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 204.860546] RSP: 002b:00007f8bf0368c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 204.868256] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579 [ 204.875578] RDX: 0000000020000040 RSI: 00000000c0185500 RDI: 0000000000000003 [ 204.882852] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 204.890119] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8bf03696d4 [ 204.897387] R13: 00000000004bf6c0 R14: 00000000004cf598 R15: 00000000ffffffff [ 204.905726] Kernel Offset: disabled [ 204.909401] Rebooting in 86400 seconds..