[ 38.211912][ T25] audit: type=1800 audit(1554663819.388:25): pid=7747 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 38.232104][ T25] audit: type=1800 audit(1554663819.388:26): pid=7747 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 38.257438][ T25] audit: type=1800 audit(1554663819.388:27): pid=7747 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] startpar: service(s) returned failure: rsyslog ...[?25l[?1c7[FAIL8[?25h[?0c failed! Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.244' (ECDSA) to the list of known hosts. 2019/04/07 19:04:03 fuzzer started 2019/04/07 19:04:06 dialing manager at 10.128.0.26:34543 2019/04/07 19:04:06 syscalls: 2408 2019/04/07 19:04:06 code coverage: enabled 2019/04/07 19:04:06 comparison tracing: enabled 2019/04/07 19:04:06 extra coverage: extra coverage is not supported by the kernel 2019/04/07 19:04:06 setuid sandbox: enabled 2019/04/07 19:04:06 namespace sandbox: enabled 2019/04/07 19:04:06 Android sandbox: /sys/fs/selinux/policy does not exist 2019/04/07 19:04:06 fault injection: enabled 2019/04/07 19:04:06 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/04/07 19:04:06 net packet injection: enabled 2019/04/07 19:04:06 net device setup: enabled 19:06:16 executing program 0: syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000028000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f000075cf53), 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_PVERSION(0xffffffffffffffff, 0x80045300, 0x0) waitid(0x0, 0x0, 0x0, 0xa0000004, 0x0) syzkaller login: [ 195.486926][ T7933] IPVS: ftp: loaded support on port[0] = 21 19:06:16 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fstatfs(r1, 0x0) [ 195.596300][ T7933] chnl_net:caif_netlink_parms(): no params data found [ 195.698474][ T7933] bridge0: port 1(bridge_slave_0) entered blocking state [ 195.724361][ T7933] bridge0: port 1(bridge_slave_0) entered disabled state [ 195.733177][ T7933] device bridge_slave_0 entered promiscuous mode [ 195.743827][ T7933] bridge0: port 2(bridge_slave_1) entered blocking state [ 195.751088][ T7933] bridge0: port 2(bridge_slave_1) entered disabled state [ 195.759488][ T7933] device bridge_slave_1 entered promiscuous mode [ 195.797832][ T7936] IPVS: ftp: loaded support on port[0] = 21 [ 195.805085][ T7933] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 195.815567][ T7933] bond0: Enslaving bond_slave_1 as an active interface with an up link 19:06:17 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) pwrite64(r0, 0x0, 0x0, 0x0) [ 195.847303][ T7933] team0: Port device team_slave_0 added [ 195.867433][ T7933] team0: Port device team_slave_1 added [ 195.965644][ T7933] device hsr_slave_0 entered promiscuous mode 19:06:17 executing program 3: syz_mount_image$hfsplus(&(0x7f0000001640)='hfsplus\x00', &(0x7f0000001680)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 196.022970][ T7933] device hsr_slave_1 entered promiscuous mode [ 196.110556][ T7938] IPVS: ftp: loaded support on port[0] = 21 [ 196.145716][ T7933] bridge0: port 2(bridge_slave_1) entered blocking state [ 196.153194][ T7933] bridge0: port 2(bridge_slave_1) entered forwarding state [ 196.161279][ T7933] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.168575][ T7933] bridge0: port 1(bridge_slave_0) entered forwarding state 19:06:17 executing program 4: io_setup(0xac08, &(0x7f0000000480)=0x0) io_getevents(r0, 0x1, 0x1, &(0x7f00000001c0)=[{}], &(0x7f00000000c0)={0x0, 0x1c9c380}) [ 196.312294][ T7941] IPVS: ftp: loaded support on port[0] = 21 [ 196.374267][ T7936] chnl_net:caif_netlink_parms(): no params data found [ 196.481271][ T7933] 8021q: adding VLAN 0 to HW filter on device bond0 [ 196.518994][ T7936] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.529994][ T7936] bridge0: port 1(bridge_slave_0) entered disabled state [ 196.538661][ T7936] device bridge_slave_0 entered promiscuous mode [ 196.549481][ T7936] bridge0: port 2(bridge_slave_1) entered blocking state [ 196.557275][ T7936] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.567796][ T7936] device bridge_slave_1 entered promiscuous mode [ 196.598703][ T7943] IPVS: ftp: loaded support on port[0] = 21 19:06:17 executing program 5: syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/ipc\x00') [ 196.672509][ T7936] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 196.686452][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 196.695419][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.707159][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 196.738468][ T7936] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 196.756247][ T7933] 8021q: adding VLAN 0 to HW filter on device team0 [ 196.780412][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 196.791237][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 196.817354][ T7936] team0: Port device team_slave_0 added [ 196.835251][ T7938] chnl_net:caif_netlink_parms(): no params data found [ 196.845719][ T7936] team0: Port device team_slave_1 added [ 196.861610][ T7948] IPVS: ftp: loaded support on port[0] = 21 [ 196.899597][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 196.908402][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 196.917182][ T3753] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.924316][ T3753] bridge0: port 1(bridge_slave_0) entered forwarding state [ 196.977856][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 196.987299][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 196.995921][ T3753] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.003009][ T3753] bridge0: port 2(bridge_slave_1) entered forwarding state [ 197.010822][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 197.020038][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 197.084711][ T7936] device hsr_slave_0 entered promiscuous mode [ 197.153168][ T7936] device hsr_slave_1 entered promiscuous mode [ 197.242085][ T7945] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 197.251235][ T7945] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 197.260256][ T7945] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 197.274414][ T7941] chnl_net:caif_netlink_parms(): no params data found [ 197.295260][ T7938] bridge0: port 1(bridge_slave_0) entered blocking state [ 197.303397][ T7938] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.311122][ T7938] device bridge_slave_0 entered promiscuous mode [ 197.328524][ T7943] chnl_net:caif_netlink_parms(): no params data found [ 197.346354][ T7938] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.356709][ T7938] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.365322][ T7938] device bridge_slave_1 entered promiscuous mode [ 197.372303][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 197.381766][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 197.439760][ T7945] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 197.449463][ T7945] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 197.485993][ T7941] bridge0: port 1(bridge_slave_0) entered blocking state [ 197.493785][ T7941] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.501565][ T7941] device bridge_slave_0 entered promiscuous mode [ 197.509928][ T7941] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.517131][ T7941] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.524901][ T7941] device bridge_slave_1 entered promiscuous mode [ 197.531686][ T7945] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 197.540473][ T7945] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 197.559445][ T7938] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 197.572634][ T7938] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 197.582157][ T7933] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 197.596621][ T7943] bridge0: port 1(bridge_slave_0) entered blocking state [ 197.604991][ T7943] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.613001][ T7943] device bridge_slave_0 entered promiscuous mode [ 197.622060][ T7943] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.629499][ T7943] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.637654][ T7943] device bridge_slave_1 entered promiscuous mode [ 197.671756][ T7938] team0: Port device team_slave_0 added [ 197.683485][ T7938] team0: Port device team_slave_1 added [ 197.710002][ T7943] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 197.721999][ T7941] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 197.795481][ T7938] device hsr_slave_0 entered promiscuous mode [ 197.842790][ T7938] device hsr_slave_1 entered promiscuous mode [ 197.904385][ T7943] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 197.925835][ T7941] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 197.996278][ T7943] team0: Port device team_slave_0 added [ 198.002191][ T7948] chnl_net:caif_netlink_parms(): no params data found [ 198.030719][ T7943] team0: Port device team_slave_1 added [ 198.039841][ T7933] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 198.055653][ T7941] team0: Port device team_slave_0 added [ 198.126512][ T7943] device hsr_slave_0 entered promiscuous mode [ 198.182964][ T7943] device hsr_slave_1 entered promiscuous mode [ 198.243957][ T7941] team0: Port device team_slave_1 added [ 198.309661][ T7936] 8021q: adding VLAN 0 to HW filter on device bond0 [ 198.365429][ T7941] device hsr_slave_0 entered promiscuous mode [ 198.432788][ T7941] device hsr_slave_1 entered promiscuous mode [ 198.528060][ T7948] bridge0: port 1(bridge_slave_0) entered blocking state [ 198.539606][ T7948] bridge0: port 1(bridge_slave_0) entered disabled state [ 198.560515][ T7948] device bridge_slave_0 entered promiscuous mode [ 198.573630][ T7938] 8021q: adding VLAN 0 to HW filter on device bond0 [ 198.581503][ T7948] bridge0: port 2(bridge_slave_1) entered blocking state [ 198.589805][ T7948] bridge0: port 2(bridge_slave_1) entered disabled state [ 198.597832][ T7948] device bridge_slave_1 entered promiscuous mode [ 198.619941][ T7936] 8021q: adding VLAN 0 to HW filter on device team0 [ 198.644906][ C1] hrtimer: interrupt took 25395 ns [ 198.653099][ T7938] 8021q: adding VLAN 0 to HW filter on device team0 [ 198.674780][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 198.694230][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 198.724298][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 198.732117][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 198.774606][ T7948] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 198.791553][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 198.803604][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 198.818273][ T3753] bridge0: port 1(bridge_slave_0) entered blocking state [ 198.825449][ T3753] bridge0: port 1(bridge_slave_0) entered forwarding state [ 198.839234][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 198.848124][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 198.857091][ T3753] bridge0: port 2(bridge_slave_1) entered blocking state [ 198.864225][ T3753] bridge0: port 2(bridge_slave_1) entered forwarding state 19:06:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flock(0xffffffffffffffff, 0x2) flock(0xffffffffffffffff, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000000040)={@remote}, 0x14) setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, 0x0, 0x0) [ 198.872221][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 198.881087][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 198.890276][ T3753] bridge0: port 1(bridge_slave_0) entered blocking state [ 198.897455][ T3753] bridge0: port 1(bridge_slave_0) entered forwarding state [ 198.936956][ T7948] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 198.978167][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 198.986112][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 198.994483][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 199.003379][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 199.011987][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 199.021725][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 199.030818][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 199.039534][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 199.048185][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 199.057002][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 199.066597][ T3754] bridge0: port 2(bridge_slave_1) entered blocking state [ 199.073713][ T3754] bridge0: port 2(bridge_slave_1) entered forwarding state [ 199.081294][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 199.090948][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 199.119293][ T7948] team0: Port device team_slave_0 added [ 199.139143][ T7936] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 199.150829][ T7936] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 199.166033][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 199.175158][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 199.184363][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 199.192866][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 199.201430][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 199.210090][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 199.218656][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 199.227446][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 199.235909][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 199.250579][ T7941] 8021q: adding VLAN 0 to HW filter on device bond0 [ 199.259860][ T7948] team0: Port device team_slave_1 added 19:06:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) flock(0xffffffffffffffff, 0x2) flock(0xffffffffffffffff, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000000040)={@remote}, 0x14) setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, 0x0, 0x0) [ 199.278435][ T7936] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 199.291348][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 199.306699][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 199.320906][ T7938] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 199.335421][ T7938] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 199.372537][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 199.380839][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 199.390757][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 199.401277][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 199.410265][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 199.419695][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 199.435939][ T7943] 8021q: adding VLAN 0 to HW filter on device bond0 [ 199.446660][ T7941] 8021q: adding VLAN 0 to HW filter on device team0 19:06:20 executing program 0: r0 = memfd_create(&(0x7f0000000380)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x2) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x100000000000001) r2 = dup2(r1, r0) r3 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r4 = memfd_create(&(0x7f0000000140)=',!\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) r5 = syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10080020}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0xac, r5, 0xb08, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="7f84461bb8d376c8bec4502cae45dde7"}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x10}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffffffffffffffc}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}]}]}, 0xac}}, 0x10) pwritev(r4, &(0x7f0000000400)=[{&(0x7f0000000340)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4) ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, 0x0) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x2183f, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000180)=0xc) getgroups(0x1, &(0x7f00000001c0)=[0x0]) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {0x1, 0x5}, [{0x2, 0x7}], {0x4, 0x2}, [{0x8, 0x7, r6}], {0x10, 0x2}, {0x20, 0x7}}, 0x34, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendfile(r3, r4, 0x0, 0x80003) [ 199.466782][ T2899] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 19:06:20 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x4002) io_setup(0x3, &(0x7f0000000080)=0x0) io_submit(r1, 0x3300, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) [ 199.516233][ T7948] device hsr_slave_0 entered promiscuous mode [ 199.574082][ T7948] device hsr_slave_1 entered promiscuous mode [ 199.663096][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 199.707397][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 199.767015][ T3754] bridge0: port 1(bridge_slave_0) entered blocking state [ 199.774195][ T3754] bridge0: port 1(bridge_slave_0) entered forwarding state [ 199.802495][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 199.829980][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 199.838748][ T3754] bridge0: port 2(bridge_slave_1) entered blocking state [ 199.845905][ T3754] bridge0: port 2(bridge_slave_1) entered forwarding state [ 199.854152][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 199.863114][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 199.872971][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 199.895587][ T7938] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 199.914189][ T7943] 8021q: adding VLAN 0 to HW filter on device team0 [ 199.934527][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 19:06:21 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x1ff) [ 199.955542][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 199.970927][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 199.982215][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 200.005274][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 200.029015][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready 19:06:21 executing program 1: r0 = memfd_create(&(0x7f0000000380)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x2) r1 = syz_open_dev$sndseq(0x0, 0x0, 0x100000000000001) r2 = dup2(r1, r0) r3 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r4 = memfd_create(&(0x7f0000000140)=',!\x00', 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10080020}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0xb0, r5, 0xb08, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="7f84461bb8d376c8bec4502cae45dde7"}]}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'eql\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x10}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffffffffffffffc}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}]}]}, 0xb0}}, 0x10) pwritev(r4, &(0x7f0000000400)=[{&(0x7f0000000340)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4) ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, &(0x7f0000000000)) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x2183f, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000180)=0xc) getgroups(0x1, &(0x7f00000001c0)=[0x0]) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [], {0x4, 0x2}, [{0x8, 0x7, r6}], {0x10, 0x2}, {0x20, 0x7}}, 0x2c, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendfile(r3, r4, 0x0, 0x80003) [ 200.053293][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 200.061777][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 200.133941][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 200.141849][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready 19:06:21 executing program 1: r0 = memfd_create(&(0x7f0000000380)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x2) r1 = syz_open_dev$sndseq(0x0, 0x0, 0x100000000000001) r2 = dup2(r1, r0) r3 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r4 = memfd_create(&(0x7f0000000140)=',!\x00', 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10080020}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0xb0, r5, 0xb08, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="7f84461bb8d376c8bec4502cae45dde7"}]}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'eql\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x10}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffffffffffffffc}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}]}]}, 0xb0}}, 0x10) pwritev(r4, &(0x7f0000000400)=[{&(0x7f0000000340)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4) ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, &(0x7f0000000000)) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x2183f, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000180)=0xc) getgroups(0x1, &(0x7f00000001c0)=[0x0]) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [], {0x4, 0x2}, [{0x8, 0x7, r6}], {0x10, 0x2}, {0x20, 0x7}}, 0x2c, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendfile(r3, r4, 0x0, 0x80003) 19:06:21 executing program 2: r0 = syz_open_dev$swradio(&(0x7f0000000340)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_G_FREQUENCY(r0, 0xc02c5638, &(0x7f0000000380)={0x1ff}) [ 200.203838][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 200.232282][ T3754] bridge0: port 1(bridge_slave_0) entered blocking state [ 200.239490][ T3754] bridge0: port 1(bridge_slave_0) entered forwarding state [ 200.329701][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 200.338872][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 200.347826][ T3754] bridge0: port 2(bridge_slave_1) entered blocking state [ 200.354987][ T3754] bridge0: port 2(bridge_slave_1) entered forwarding state [ 200.370077][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 19:06:21 executing program 2: mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) io_setup(0x3, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x10, 0x1, 0x0, r0, 0x0}]) [ 200.380179][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 200.404370][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 200.443073][ T7941] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 200.486240][ T7948] 8021q: adding VLAN 0 to HW filter on device bond0 [ 200.500797][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 200.510428][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 200.529702][ T7941] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 200.566710][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 200.578956][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 200.595904][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 200.612831][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 200.621747][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 200.642065][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 200.651510][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 200.660941][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 200.670869][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 200.679650][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 200.690076][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 200.704782][ T7948] 8021q: adding VLAN 0 to HW filter on device team0 [ 200.714652][ T7943] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 200.774751][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 200.789832][ T42] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 200.806099][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 200.813300][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 200.830138][ T8015] hfsplus: unable to find HFS+ superblock [ 200.857439][ T7943] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 200.880123][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 200.889435][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 200.898804][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 200.916809][ T3753] bridge0: port 2(bridge_slave_1) entered blocking state [ 200.923963][ T3753] bridge0: port 2(bridge_slave_1) entered forwarding state [ 200.944386][ T3753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 200.960034][ T8015] hfsplus: unable to find HFS+ superblock [ 200.988674][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 200.999436][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready 19:06:22 executing program 3: [ 201.036633][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 201.059185][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 201.069862][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 201.090534][ T7948] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 201.127412][ T7948] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 201.151911][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 201.161541][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 201.170378][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 201.179074][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 201.187685][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 201.204497][ T7948] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 201.213019][ T3754] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 19:06:22 executing program 4: 19:06:22 executing program 0: r0 = memfd_create(&(0x7f0000000380)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x2) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x100000000000001) r2 = dup2(r1, r0) r3 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r4 = memfd_create(&(0x7f0000000140)=',!\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) r5 = syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10080020}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0xac, r5, 0xb08, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="7f84461bb8d376c8bec4502cae45dde7"}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x10}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffffffffffffffc}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}]}]}, 0xac}}, 0x10) pwritev(r4, &(0x7f0000000400)=[{&(0x7f0000000340)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4) ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, 0x0) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x2183f, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000180)=0xc) getgroups(0x1, &(0x7f00000001c0)=[0x0]) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {0x1, 0x5}, [{0x2, 0x7}], {0x4, 0x2}, [{0x8, 0x7, r6}], {0x10, 0x2}, {0x20, 0x7}}, 0x34, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendfile(r3, r4, 0x0, 0x80003) 19:06:22 executing program 2: r0 = memfd_create(&(0x7f0000000380)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x2) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x100000000000001) r2 = dup2(r1, r0) r3 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r4 = memfd_create(&(0x7f0000000140)=',!\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) r5 = syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10080020}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0xac, r5, 0xb08, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="7f84461bb8d376c8bec4502cae45dde7"}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x10}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffffffffffffffc}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}]}]}, 0xac}}, 0x10) pwritev(r4, &(0x7f0000000400)=[{&(0x7f0000000340)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4) ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, 0x0) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x2183f, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000180)=0xc) getgroups(0x1, &(0x7f00000001c0)=[0x0]) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {0x1, 0x5}, [{0x2, 0x7}], {0x4, 0x2}, [{0x8, 0x7, r6}], {0x10, 0x2}, {0x20, 0x7}}, 0x34, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendfile(r3, r4, 0x0, 0x80003) 19:06:22 executing program 3: 19:06:22 executing program 1: 19:06:22 executing program 5: 19:06:22 executing program 3: 19:06:22 executing program 5: 19:06:22 executing program 1: 19:06:22 executing program 4: 19:06:22 executing program 2: 19:06:22 executing program 5: 19:06:22 executing program 3: 19:06:23 executing program 1: 19:06:23 executing program 4: 19:06:23 executing program 2: 19:06:23 executing program 5: 19:06:23 executing program 0: 19:06:23 executing program 3: 19:06:23 executing program 4: 19:06:23 executing program 2: 19:06:23 executing program 1: 19:06:23 executing program 5: 19:06:23 executing program 3: 19:06:23 executing program 2: 19:06:23 executing program 0: 19:06:23 executing program 4: 19:06:23 executing program 1: 19:06:23 executing program 3: 19:06:23 executing program 5: 19:06:23 executing program 0: 19:06:23 executing program 5: 19:06:23 executing program 2: 19:06:23 executing program 4: 19:06:23 executing program 3: 19:06:23 executing program 1: 19:06:23 executing program 0: 19:06:23 executing program 5: 19:06:23 executing program 2: 19:06:23 executing program 3: 19:06:23 executing program 1: 19:06:23 executing program 4: 19:06:23 executing program 0: 19:06:24 executing program 2: 19:06:24 executing program 5: 19:06:24 executing program 3: 19:06:24 executing program 1: 19:06:24 executing program 4: 19:06:24 executing program 0: 19:06:24 executing program 5: 19:06:24 executing program 2: 19:06:24 executing program 3: 19:06:24 executing program 4: 19:06:24 executing program 1: 19:06:24 executing program 5: 19:06:24 executing program 3: 19:06:24 executing program 0: 19:06:24 executing program 4: 19:06:24 executing program 2: 19:06:24 executing program 1: 19:06:24 executing program 3: 19:06:24 executing program 4: 19:06:24 executing program 5: 19:06:24 executing program 2: 19:06:24 executing program 0: 19:06:24 executing program 3: 19:06:24 executing program 4: 19:06:24 executing program 5: clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet_icmp_raw(0x2, 0x3, 0x1) open(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000dddfc8)={0x0, 0x0, &(0x7f00008a7000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c00000003060d01ff0488fffdffff2e0a0000000c000100060d00007d5500010c00020000002201f6f00061"], 0x2c}}, 0x0) exit_group(0x0) 19:06:24 executing program 1: ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000015c0)='veth1\x00\x00\x00\x00\xff\xff\xff\xff\xff\xef\x00', 0xb) r1 = dup2(r0, r0) sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="b6aafdf6a2c83eb5831c660d8c923460b593a4c06b8ba4569709666e3ee7bf606b856a95415923614fda796cfadfd2f3d4b1de160676c1ffff59bcb6d1011df1adf25edbb4339c8b4e9ef8abbdb0e00a1f3535ae18785c"], 0x1}}, 0x44801) sendmsg$FOU_CMD_DEL(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0xfffffdef, 0xc0, 0x0, 0x0) ioctl$VIDIOC_DQEVENT(r1, 0x80785659, &(0x7f00000003c0)={0x0, @ctrl={0x0, 0x0, @value64}}) ftruncate(0xffffffffffffffff, 0x4) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f0000000800)=ANY=[]) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000440)='/dev/sequencer\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) epoll_create1(0x80000) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000480)={0x0, 0x48, "f8bf9129408c3a5f2a4ae09aa757d4bcc9f458976ea89e1c0a060c51431006d2788b2357516155e3984ca23c3ad7d65dcd96aa4870a067929aa6e38cb187e682b6b5ac3b45798504"}, 0x0) close(0xffffffffffffffff) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f00000000c0)) setsockopt$IP_VS_SO_SET_DEL(0xffffffffffffffff, 0x0, 0x484, &(0x7f00000001c0)={0x11, @broadcast, 0x0, 0x0, 'dh\x00', 0x24, 0x90c8}, 0x2c) 19:06:24 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0x400) fsetxattr$security_selinux(r0, 0x0, 0x0, 0x0, 0x0) 19:06:24 executing program 0: r0 = memfd_create(&(0x7f0000000380)='queue1\x00\x00\x00\x00\x00\x00\x00\x001-G\xadf;\x00\x00\x00\x00\x01\xb7\v\x04\x00\x00\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xcc', 0x4) r1 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x0) memfd_create(0x0, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup3(r1, r0, 0x0) 19:06:24 executing program 3: 19:06:24 executing program 4: [ 203.709617][ T8180] netlink: 'syz-executor.5': attribute type 1 has an invalid length. 19:06:24 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(r2, 0x112, 0xa, &(0x7f0000000080), 0x4) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$kcm(r1, &(0x7f0000003d00)={&(0x7f0000000380)=@in={0x2, 0x4e23, @multicast1}, 0x80, 0x0}, 0xfd00) write$cgroup_subtree(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="c59cb651485ba89c2e73a72c268816ce714fbe04982b2b1976a1fa700b65fbddf19c1f3f05c9abb5bcfdbe4a42b686349b0e666ce913a19686b8a4c1200711db414b1c754aeeaa73e872da8224d803feef"], 0x51) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000000000)=0x1) 19:06:25 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x14) ppoll(&(0x7f0000000040)=[{r0}], 0x1, 0x0, 0x0, 0x0) write$uinput_user_dev(r0, &(0x7f0000000bc0)={'syz0\x00'}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000600)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14]}, 0x45c) 19:06:25 executing program 3: mkdir(&(0x7f0000508ff6)='./control\x00', 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd'}, 0x0, &(0x7f0000000180)='gfs2meta\x00', 0x4006, &(0x7f00000003c0)='proc\x00') 19:06:25 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x80045105, &(0x7f00000000c0)) [ 203.946046][ T8206] input: syz0 as /devices/virtual/input/input5 [ 204.005980][ T8203] check_preemption_disabled: 3 callbacks suppressed [ 204.006171][ T8203] BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.2/8203 [ 204.024511][ T8203] caller is sk_mc_loop+0x1d/0x210 [ 204.029962][ T8203] CPU: 1 PID: 8203 Comm: syz-executor.2 Not tainted 5.1.0-rc3-next-20190405 #19 [ 204.039519][ T8203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 204.049614][ T8203] Call Trace: [ 204.052949][ T8203] dump_stack+0x172/0x1f0 [ 204.057487][ T8203] __this_cpu_preempt_check+0x246/0x270 [ 204.063381][ T8203] sk_mc_loop+0x1d/0x210 [ 204.067673][ T8203] ip_mc_output+0x2ef/0xf70 [ 204.072418][ T8203] ? __ip_queue_xmit+0x1bf0/0x1bf0 [ 204.077743][ T8203] ? ip_append_data.part.0+0x170/0x170 [ 204.083269][ T8203] ? retint_kernel+0x2d/0x2d [ 204.088043][ T8203] ip_local_out+0xc4/0x1b0 [ 204.092937][ T8203] ip_send_skb+0x42/0xf0 [ 204.097211][ T8203] udp_send_skb.isra.0+0x6b2/0x1180 [ 204.103237][ T8203] udp_push_pending_frames+0x5c/0xf0 [ 204.103266][ T8203] udp_sendmsg+0x12ff/0x2820 [ 204.103284][ T8203] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 204.103299][ T8203] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 204.103351][ T8203] ? lockdep_hardirqs_on+0x418/0x5d0 [ 204.103366][ T8203] ? ip_reply_glue_bits+0xc0/0xc0 [ 204.103401][ T8203] ? udp4_lib_lookup_skb+0x440/0x440 [ 204.103429][ T8203] ? retint_kernel+0x2d/0x2d [ 204.103457][ T8203] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 204.103471][ T8203] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 204.103482][ T8203] ? lockdep_hardirqs_on+0x418/0x5d0 [ 204.103492][ T8203] ? retint_kernel+0x2d/0x2d [ 204.103506][ T8203] ? trace_hardirqs_on_caller+0x6a/0x220 [ 204.103520][ T8203] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 204.103535][ T8203] ? retint_kernel+0x2d/0x2d [ 204.103552][ T8203] ? udp4_lib_lookup_skb+0x440/0x440 [ 204.164401][ T8203] inet_sendmsg+0x147/0x5e0 [ 204.164419][ T8203] ? udp4_lib_lookup_skb+0x440/0x440 [ 204.164432][ T8203] ? inet_sendmsg+0x147/0x5e0 19:06:25 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x0) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000040)='trusted.overlay.redirect\x00', 0x0, 0x0, 0x3) 19:06:25 executing program 0: r0 = memfd_create(&(0x7f0000000380)='queue1\x00\x00\x00\x00\x00\x00\x00\x001-G\xadf;\x00\x00\x00\x00\x01\xb7\v\x04\x00\x00\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xcc', 0x4) r1 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x0) memfd_create(0x0, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup3(r1, r0, 0x0) [ 204.164445][ T8203] ? ipip_gro_receive+0x100/0x100 [ 204.164463][ T8203] sock_sendmsg+0xdd/0x130 [ 204.164479][ T8203] sock_write_iter+0x27c/0x3e0 [ 204.164496][ T8203] ? sock_sendmsg+0x130/0x130 [ 204.164524][ T8203] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 204.164540][ T8203] ? iov_iter_init+0xee/0x220 [ 204.164564][ T8203] new_sync_write+0x4c7/0x760 [ 204.175267][ T8203] ? default_llseek+0x2e0/0x2e0 [ 204.175291][ T8203] ? common_file_perm+0x238/0x720 [ 204.175307][ T8203] ? retint_kernel+0x2d/0x2d 19:06:25 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x80045105, &(0x7f00000000c0)) [ 204.175365][ T8203] ? apparmor_file_permission+0x25/0x30 [ 204.175381][ T8203] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 204.175399][ T8203] ? security_file_permission+0x94/0x380 [ 204.175411][ T8203] ? rw_verify_area+0xb2/0x360 [ 204.175427][ T8203] __vfs_write+0xe4/0x110 [ 204.175445][ T8203] vfs_write+0x20c/0x580 [ 204.175465][ T8203] ksys_write+0xea/0x1f0 [ 204.175483][ T8203] ? __ia32_sys_read+0xb0/0xb0 [ 204.175508][ T8203] __x64_sys_write+0x73/0xb0 [ 204.302230][ T8203] ? do_syscall_64+0x5b/0x610 [ 204.307032][ T8203] do_syscall_64+0x103/0x610 [ 204.311748][ T8203] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 204.317668][ T8203] RIP: 0033:0x4582b9 [ 204.317686][ T8203] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 204.317694][ T8203] RSP: 002b:00007f4209506c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 19:06:25 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) flock(r0, 0x1) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) 19:06:25 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f000075cf53), 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_PVERSION(0xffffffffffffffff, 0x80045300, 0x0) waitid(0x0, 0x0, 0x0, 0xa0000004, 0x0) [ 204.317709][ T8203] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 204.317719][ T8203] RDX: 0000000000000051 RSI: 00000000200000c0 RDI: 0000000000000006 [ 204.317727][ T8203] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 204.317735][ T8203] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f42095076d4 [ 204.317752][ T8203] R13: 00000000004c7a90 R14: 00000000004ddb68 R15: 00000000ffffffff [ 204.419594][ T8218] BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.2/8218 [ 204.429527][ T8218] caller is sk_mc_loop+0x1d/0x210 [ 204.434683][ T8218] CPU: 1 PID: 8218 Comm: syz-executor.2 Not tainted 5.1.0-rc3-next-20190405 #19 [ 204.443904][ T8218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 204.454220][ T8218] Call Trace: [ 204.457553][ T8218] dump_stack+0x172/0x1f0 [ 204.461945][ T8218] __this_cpu_preempt_check+0x246/0x270 [ 204.467536][ T8218] sk_mc_loop+0x1d/0x210 [ 204.471922][ T8218] ip_mc_output+0x2ef/0xf70 [ 204.476465][ T8218] ? __ip_queue_xmit+0x1bf0/0x1bf0 [ 204.481626][ T8218] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 204.488169][ T8218] ? prandom_u32_state+0x13/0x180 [ 204.493234][ T8218] ? ip_append_data.part.0+0x170/0x170 [ 204.498721][ T8218] ? __ip_make_skb+0xf15/0x1820 [ 204.503761][ T8218] ip_local_out+0xc4/0x1b0 [ 204.508652][ T8218] ip_send_skb+0x42/0xf0 [ 204.513495][ T8218] udp_send_skb.isra.0+0x6b2/0x1180 [ 204.518898][ T8218] udp_push_pending_frames+0x5c/0xf0 [ 204.524494][ T8218] udp_sendmsg+0x12ff/0x2820 [ 204.524516][ T8218] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 204.524535][ T8218] ? ip_reply_glue_bits+0xc0/0xc0 [ 204.524553][ T8218] ? udp4_lib_lookup_skb+0x440/0x440 [ 204.524575][ T8218] ? preempt_schedule+0x4b/0x60 [ 204.524589][ T8218] ? preempt_schedule_common+0x4f/0xe0 [ 204.524614][ T8218] ? ___might_sleep+0x163/0x280 [ 204.524632][ T8218] ? __might_sleep+0x95/0x190 [ 204.524659][ T8218] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 204.556514][ T8218] ? aa_sk_perm+0x288/0x880 [ 204.576818][ T8218] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 204.582403][ T8218] inet_sendmsg+0x147/0x5e0 [ 204.586942][ T8218] ? udp4_lib_lookup_skb+0x440/0x440 [ 204.592459][ T8218] ? inet_sendmsg+0x147/0x5e0 [ 204.592475][ T8218] ? ipip_gro_receive+0x100/0x100 [ 204.592494][ T8218] sock_sendmsg+0xdd/0x130 [ 204.592511][ T8218] sock_write_iter+0x27c/0x3e0 [ 204.592527][ T8218] ? sock_sendmsg+0x130/0x130 [ 204.592554][ T8218] ? aa_path_link+0x460/0x460 [ 204.592569][ T8218] ? find_held_lock+0x35/0x130 [ 204.592585][ T8218] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 204.592609][ T8218] ? iov_iter_init+0xee/0x220 [ 204.620965][ T8218] new_sync_write+0x4c7/0x760 [ 204.620987][ T8218] ? default_llseek+0x2e0/0x2e0 [ 204.621012][ T8218] ? common_file_perm+0x238/0x720 [ 204.621034][ T8218] ? __fget+0x381/0x550 [ 204.654073][ T8218] ? apparmor_file_permission+0x25/0x30 [ 204.654093][ T8218] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 204.654113][ T8218] ? security_file_permission+0x94/0x380 [ 204.654132][ T8218] __vfs_write+0xe4/0x110 [ 204.654152][ T8218] vfs_write+0x20c/0x580 [ 204.654170][ T8218] ksys_write+0xea/0x1f0 [ 204.654186][ T8218] ? __ia32_sys_read+0xb0/0xb0 [ 204.654203][ T8218] ? do_syscall_64+0x26/0x610 [ 204.654219][ T8218] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 204.654232][ T8218] ? do_syscall_64+0x26/0x610 [ 204.654253][ T8218] __x64_sys_write+0x73/0xb0 [ 204.654274][ T8218] do_syscall_64+0x103/0x610 [ 204.677013][ T8218] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 204.677028][ T8218] RIP: 0033:0x4582b9 [ 204.677044][ T8218] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 204.677060][ T8218] RSP: 002b:00007f42094e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 19:06:25 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x80080, 0x0) r1 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BLKFLSBUF(r1, 0x1261, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/ip_tables_targets\x00') r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vcs\x00', 0x200000, 0x0) sendto$inet(r2, 0x0, 0xfe5d, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_ADD_BUFS(0xffffffffffffffff, 0xc0206416, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r3, 0x1276, 0x0) ioctl$BLKTRACESETUP(r3, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x2779}) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, 0x0) r4 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCDELRT(r4, 0x890c, &(0x7f0000000040)={@remote, @dev, @empty, 0x0, 0x40, 0x0, 0x100, 0x0, 0x40000003}) r5 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x160) getsockopt$inet_pktinfo(r5, 0x0, 0x8, &(0x7f0000000180)={0x0, @dev}, &(0x7f00000001c0)=0xc) unshare(0x400) ioctl$TCSETS(r0, 0x40045431, 0x0) r6 = syz_open_pts(r0, 0x0) read(r6, 0x0, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x0, 0x0) close(r6) 19:06:25 executing program 3: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$rose(r0, 0x104, 0x7, &(0x7f0000001a80), 0xbe) 19:06:25 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x80045105, &(0x7f00000000c0)) 19:06:25 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000000200)=[{{0x0, 0x0, &(0x7f0000002580)=[{&(0x7f00000012c0)=""/115, 0x73}], 0x1, 0x0, 0x1d}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/ip6_tables_targets\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x2000000) [ 204.690379][ T8218] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 204.690389][ T8218] RDX: 0000000000000051 RSI: 00000000200000c0 RDI: 000000000000000a [ 204.690397][ T8218] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 204.690406][ T8218] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f42094e66d4 [ 204.690416][ T8218] R13: 00000000004c7a90 R14: 00000000004ddb68 R15: 00000000ffffffff [ 204.828508][ T8233] input: syz0 as /devices/virtual/input/input6 19:06:26 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x80080, 0x0) ioctl$TCSBRK(0xffffffffffffffff, 0x5409, 0x79) r1 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BLKFLSBUF(r1, 0x1261, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/ip_tables_targets\x00') r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vcs\x00', 0x200000, 0x0) sendto$inet(r3, 0x0, 0xfe5d, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_ADD_BUFS(0xffffffffffffffff, 0xc0206416, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r4, 0x1276, 0x0) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x2779}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, 0x0) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000040)={@remote, @dev, @empty, 0x0, 0x40, 0x0, 0x100, 0x0, 0x40000003}) unshare(0x400) ioctl$TCSETS(r0, 0x40045431, 0x0) r5 = syz_open_pts(r0, 0x0) read(r5, 0x0, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x0, 0x0) fsetxattr$security_selinux(r2, 0x0, 0x0, 0x0, 0x0) 19:06:26 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x80045105, &(0x7f00000000c0)) 19:06:26 executing program 3: r0 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'gretap0\x00', &(0x7f00000000c0)=@ethtool_sset_info={0x9}}) 19:06:26 executing program 2: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000000)={{0x6, @rose}, [@rose, @rose, @default, @netrom, @netrom, @rose, @rose]}, 0x48) listen(r0, 0x0) getpeername$netrom(r0, &(0x7f0000003b40)={{0x3, @bcast}, [@rose, @null, @bcast, @default, @null, @remote, @netrom, @default]}, &(0x7f00000039c0)=0x48) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000740)='bcsf0\x00') socket$isdn_base(0x22, 0x3, 0x0) recvmmsg(r1, &(0x7f0000003640)=[{{0x0, 0x0, &(0x7f0000003500)=[{0x0}, {&(0x7f0000003200)=""/4, 0x4}, {0x0}, {&(0x7f00000033c0)=""/27, 0x1b}, {&(0x7f0000003400)=""/2, 0x2}, {&(0x7f0000003440)=""/185, 0xb9}], 0x6}}], 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000b00)='bcsf0\x00\x00\x00\x00\x00\x00h\x11\x00') socket$inet6(0xa, 0x0, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) 19:06:26 executing program 0: r0 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) gettid() sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, 0x0, 0x4000000) unshare(0x600) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = perf_event_open(&(0x7f0000000580)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x21) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r4, 0xc08c5335, &(0x7f0000000440)={0x803, 0x0, 0x9, 'queue1\x00'}) uname(&(0x7f0000000300)=""/66) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000680)={'syzkaller0\x00', {0x2, 0x0, @empty}}) fcntl$setpipe(r2, 0x407, 0x1) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000400)=0x0) ptrace(0x11, r5) seccomp(0x0, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x7, 0x4, 0x6, 0x8}]}) sysfs$2(0x2, 0x200000000000, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000280)={'bond_slave_0\x00'}) pwrite64(r4, &(0x7f0000000600), 0x0, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r4, 0x4010640d, &(0x7f00000003c0)={0x9, 0xfffffffffffffff6}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5335, &(0x7f00000007c0)={0xce68, 0x7fff, 0x0, 'queue1\x00', 0xffff}) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000000)={'bond_slave_0\x00', {0x2, 0x0, @local}}) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f00000006c0)={0x1, 0x0, @pic={0x0, 0x1, 0x2, 0x100, 0x0, 0x1, 0x800, 0x200, 0x0, 0x10000, 0x8, 0x7, 0x2, 0x400, 0x0, 0x1}}) recvmsg(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x2000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 19:06:26 executing program 4: ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0x80045105, &(0x7f00000000c0)) 19:06:26 executing program 3: openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) socket$inet6(0xa, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000780)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, 0x0}], 0x1, 0x0, &(0x7f0000000040), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 19:06:26 executing program 4: ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0x80045105, &(0x7f00000000c0)) [ 205.250400][ T8260] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 19:06:27 executing program 2: syz_mount_image$ext4(&(0x7f0000000000)='ext2\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x8000, 0x0) 19:06:27 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r0, 0x40605346, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue1\x00'}) 19:06:27 executing program 3: r0 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) gettid() sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, 0x0, 0x4000000) unshare(0x600) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = perf_event_open(&(0x7f0000000580)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x21) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r4, 0xc08c5335, &(0x7f0000000440)={0x803, 0x0, 0x9, 'queue1\x00'}) uname(&(0x7f0000000300)=""/66) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000680)={'syzkaller0\x00', {0x2, 0x0, @empty}}) fcntl$setpipe(r2, 0x407, 0x1) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000400)=0x0) ptrace(0x11, r5) seccomp(0x0, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x7, 0x4, 0x6, 0x8}]}) sysfs$2(0x2, 0x200000000000, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000280)={'bond_slave_0\x00'}) pwrite64(r4, &(0x7f0000000600), 0x0, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r4, 0x4010640d, &(0x7f00000003c0)={0x9, 0xfffffffffffffff6}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5335, &(0x7f00000007c0)={0xce68, 0x7fff, 0x0, 'queue1\x00', 0xffff}) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000000)={'bond_slave_0\x00', {0x2, 0x0, @local}}) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f00000006c0)={0x1, 0x0, @pic={0x0, 0x1, 0x2, 0x100, 0x0, 0x1, 0x800, 0x200, 0x0, 0x10000, 0x8, 0x7, 0x2, 0x400, 0x0, 0x1}}) recvmsg(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x2000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 19:06:27 executing program 0: r0 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) gettid() sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, 0x0, 0x4000000) unshare(0x600) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = perf_event_open(&(0x7f0000000580)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x21) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r4, 0xc08c5335, &(0x7f0000000440)={0x803, 0x0, 0x9, 'queue1\x00'}) uname(&(0x7f0000000300)=""/66) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000680)={'syzkaller0\x00', {0x2, 0x0, @empty}}) fcntl$setpipe(r2, 0x407, 0x1) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000400)=0x0) ptrace(0x11, r5) seccomp(0x0, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x7, 0x4, 0x6, 0x8}]}) sysfs$2(0x2, 0x200000000000, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000280)={'bond_slave_0\x00'}) pwrite64(r4, &(0x7f0000000600), 0x0, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r4, 0x4010640d, &(0x7f00000003c0)={0x9, 0xfffffffffffffff6}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5335, &(0x7f00000007c0)={0xce68, 0x7fff, 0x0, 'queue1\x00', 0xffff}) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000000)={'bond_slave_0\x00', {0x2, 0x0, @local}}) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f00000006c0)={0x1, 0x0, @pic={0x0, 0x1, 0x2, 0x100, 0x0, 0x1, 0x800, 0x200, 0x0, 0x10000, 0x8, 0x7, 0x2, 0x400, 0x0, 0x1}}) recvmsg(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x2000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 206.719055][ T8339] ALSA: seq fatal error: cannot create timer (-22) [ 206.788421][ T8343] ALSA: seq fatal error: cannot create timer (-22) 19:06:28 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x80080, 0x0) ioctl$TCSBRK(0xffffffffffffffff, 0x5409, 0x79) r1 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BLKFLSBUF(r1, 0x1261, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/ip_tables_targets\x00') r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vcs\x00', 0x200000, 0x0) sendto$inet(r3, 0x0, 0xfe5d, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_ADD_BUFS(0xffffffffffffffff, 0xc0206416, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACETEARDOWN(r4, 0x1276, 0x0) ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x2779}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, 0x0) ioctl$sock_inet6_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000040)={@remote, @dev, @empty, 0x0, 0x40, 0x0, 0x100, 0x0, 0x40000003}) unshare(0x400) ioctl$TCSETS(r0, 0x40045431, 0x0) r5 = syz_open_pts(r0, 0x0) read(r5, 0x0, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x0, 0x0) fsetxattr$security_selinux(r2, 0x0, 0x0, 0x0, 0x0) 19:06:28 executing program 4: ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0x80045105, &(0x7f00000000c0)) 19:06:28 executing program 2: r0 = memfd_create(&(0x7f0000000380)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x2) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x100000000000001) r2 = dup2(r1, r0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r4 = memfd_create(&(0x7f0000000140)=',!\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10080020}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0xcc, r5, 0xb08, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="7f84461bb8d376c8bec4502cae45dde7"}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'eql\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xa, 0x1}}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x10}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffffffffffffffc}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}]}]}, 0xcc}}, 0x10) pwritev(r4, &(0x7f0000000400)=[{&(0x7f0000000340)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4) ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, &(0x7f0000000000)=0x4) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x2183f, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getgroups(0x1, &(0x7f00000001c0)=[0x0]) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {0x1, 0x5}, [{0x2, 0x7}], {0x4, 0x2}, [{0x8, 0x7, r6}], {0x10, 0x2}, {0x20, 0x7}}, 0x34, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendfile(r3, r4, 0x0, 0x80003) 19:06:28 executing program 3: socket(0x0, 0x0, 0x0) r0 = socket(0x1e, 0x4, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x200, 0x0) write$P9_RATTACH(r1, 0x0, 0x0) 19:06:28 executing program 1: r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) r2 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r3 = memfd_create(&(0x7f0000000140)=',!\x00', 0x0) syz_genetlink_get_family_id$tipc2(0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)={0x70, 0x0, 0xb08, 0x0, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="7f84461bb8d376c8bec4502cae45dde7"}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'eql\x00'}]}]}, 0x70}}, 0x10) pwritev(r3, &(0x7f0000000400)=[{&(0x7f0000000340)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, &(0x7f0000000000)=0x4) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x2183f, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getgroups(0x0, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {}, [], {0x4, 0x2}, [{0x8, 0x7}], {0x10, 0x2}, {0x20, 0x7}}, 0x2c, 0x0) sendfile(r2, r3, 0x0, 0x80003) 19:06:28 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x80045105, &(0x7f00000000c0)) 19:06:28 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f00000000c0)='./file0/file0\x00', 0x0) read$FUSE(r0, &(0x7f0000001000), 0x1000) read$FUSE(r0, 0x0, 0x0) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) write$FUSE_DIRENT(0xffffffffffffffff, 0x0, 0x0) 19:06:29 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x80045105, &(0x7f00000000c0)) 19:06:29 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'gretap0\x00', &(0x7f00000000c0)=@ethtool_sset_info={0x10}}) 19:06:29 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x80045105, &(0x7f00000000c0)) 19:06:29 executing program 1: mkdir(&(0x7f0000508ff6)='./control\x00', 0x0) mount(0x0, &(0x7f0000000080)='./control\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./control\x00', 0x0, 0x424, 0x0) 19:06:30 executing program 0: r0 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_MCAST_BROADCAST(r0, 0x10f, 0x85) gettid() sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, 0x0, 0x4000000) unshare(0x600) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = perf_event_open(&(0x7f0000000580)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x21) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r4, 0xc08c5335, &(0x7f0000000440)={0x803, 0x0, 0x9, 'queue1\x00'}) uname(&(0x7f0000000300)=""/66) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000680)={'syzkaller0\x00', {0x2, 0x0, @empty}}) fcntl$setpipe(r2, 0x407, 0x1) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000400)=0x0) ptrace(0x11, r5) seccomp(0x0, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x7, 0x4, 0x6, 0x8}]}) sysfs$2(0x2, 0x200000000000, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000280)={'bond_slave_0\x00'}) pwrite64(r4, &(0x7f0000000600), 0x0, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r4, 0x4010640d, &(0x7f00000003c0)={0x9, 0xfffffffffffffff6}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5335, &(0x7f00000007c0)={0xce68, 0x7fff, 0x0, 'queue1\x00', 0xffff}) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000000)={'bond_slave_0\x00', {0x2, 0x0, @local}}) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f00000006c0)={0x1, 0x0, @pic={0x0, 0x1, 0x2, 0x100, 0x0, 0x1, 0x800, 0x200, 0x0, 0x10000, 0x8, 0x7, 0x2, 0x400, 0x0, 0x1}}) recvmsg(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x2000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 19:06:30 executing program 3: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000003800)={'vcan0\x00', 0x0}) connect(r0, &(0x7f0000000140)=@hci={0x1f, r1}, 0x67) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x1, 0x800, 0x0, {0x0, 0x7530}, {}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "55ae887930467fae3d43ffa5fa7209934fe0d3e57421f67ed8602d6d741fbc0e84946297e8f536a96450b1533ad7cc6f90959c54483f6d309fc122aeeeef15fc"}}, 0x80}}, 0x0) sendmsg$can_bcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)={0x3, 0x0, 0x0, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "9f81db5b22c8b6c9"}}, 0x48}}, 0x0) 19:06:30 executing program 4: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0x80045105, &(0x7f00000000c0)) 19:06:30 executing program 1: perf_event_open(&(0x7f0000000340)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000040)) syz_open_dev$evdev(0x0, 0x0, 0x0) 19:06:30 executing program 2: r0 = memfd_create(&(0x7f0000000380)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x2) r1 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x100000000000001) r2 = dup2(r1, r0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r4 = memfd_create(&(0x7f0000000140)=',!\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10080020}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0xcc, r5, 0xb08, 0x70bd25, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="7f84461bb8d376c8bec4502cae45dde7"}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'eql\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xa, 0x1}}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x10}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffffffffffffffc}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}]}]}, 0xcc}}, 0x10) pwritev(r4, &(0x7f0000000400)=[{&(0x7f0000000340)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4) ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, &(0x7f0000000000)=0x4) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x2183f, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getgroups(0x1, &(0x7f00000001c0)=[0x0]) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {0x1, 0x5}, [{0x2, 0x7}], {0x4, 0x2}, [{0x8, 0x7, r6}], {0x10, 0x2}, {0x20, 0x7}}, 0x34, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendfile(r3, r4, 0x0, 0x80003) 19:06:30 executing program 5: r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) io_setup(0x3, &(0x7f0000000080)=0x0) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x10, 0x1, 0x0, r0, 0x0}]) 19:06:30 executing program 4: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0x80045105, &(0x7f00000000c0)) 19:06:30 executing program 3: r0 = memfd_create(&(0x7f0000000380)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x04\x00\x00\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x2) r1 = dup2(0xffffffffffffffff, r0) r2 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r3 = memfd_create(&(0x7f0000000140)=',!\x00', 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10080020}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x58, r4, 0xb08, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="7f84461bb8d376c8bec4502cae45dde7"}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_AF={0x8}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}]}]}, 0x58}}, 0x10) pwritev(r3, &(0x7f0000000400)=[{&(0x7f0000000340)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, &(0x7f0000000000)) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x2183f, 0xffffffffffffffff, 0x0) fcntl$setstatus(r2, 0x4, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000180)=0xc) getgroups(0x1, &(0x7f00000001c0)=[0x0]) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000200)={{}, {0x1, 0x5}, [{0x2, 0x7, r5}], {0x4, 0x2}, [{0x8, 0x7, r6}], {0x10, 0x2}, {0x20, 0x7}}, 0x34, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendfile(r2, r3, 0x0, 0x80003) 19:06:30 executing program 5: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000140)='/dev/null\x00', 0x0, 0x0) getgid() close(r0) ioctl$TCGETS(0xffffffffffffffff, 0x5401, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) getsockname(0xffffffffffffffff, 0x0, 0x0) getcwd(0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x0, 0x0, 0x0) 19:06:30 executing program 4: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0x80045105, &(0x7f00000000c0)) 19:06:30 executing program 1: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)=""/49, 0x31}], 0x10000023, &(0x7f00000002c0)=""/77, 0x4d}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) 19:06:30 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCFLSH(r0, 0x540b, 0x1) 19:06:30 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ENABLE(r0, 0x40086432, &(0x7f0000000000)) 19:06:30 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 19:06:30 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x80045105, 0x0) 19:06:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x200000000001, 0x3) r2 = fcntl$dupfd(r1, 0x0, r1) connect$bt_rfcomm(r2, &(0x7f0000000000), 0xa) getpeername$netlink(r2, 0x0, 0x0) [ 209.405394][ T8449] binder: 8448:8449 transaction failed 29189/-22, size 24-8 line 2995 [ 209.456862][ T8455] binder: 8448:8455 transaction failed 29189/-22, size 24-8 line 2995 19:06:30 executing program 2: r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) lseek(r0, 0x0, 0x3) 19:06:30 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x80045105, 0x0) 19:06:30 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x200000000001, 0x3) r2 = fcntl$dupfd(r1, 0x0, r1) connect$bt_rfcomm(r2, &(0x7f0000000000), 0xa) getpeername$netlink(r2, 0x0, 0x0) 19:06:30 executing program 5: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='veth1\x00\x00\x00\x00\xff\xff\xff\xff\xff\xef\x00', 0xb) r2 = dup2(r1, r1) sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB], 0x1}}, 0x44801) sendmsg$FOU_CMD_DEL(r2, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) sendto$inet(r1, &(0x7f0000000000), 0xfffffdef, 0xc0, 0x0, 0x0) ioctl$VIDIOC_DQEVENT(r2, 0x80785659, &(0x7f00000003c0)={0x0, @ctrl={0x0, 0x0, @value64}}) ftruncate(r0, 0x4) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000440)='/dev/sequencer\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) epoll_create1(0x80000) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f0000000480)={0x0, 0xbe, "f8bf9129408c3a5f2a4ae09aa757d4bcc9f458976ea89e1c0a060c51431006d2788b2357516155e3984ca23c3ad7d65dcd96aa4870a067929aa6e38cb187e682b6b5ac3b457985043f012312a5f235cba564d9a095f651621f30fdb69da1f1d5ca443afb7c173337601810ffd73c8bb85c45db4fe3ab1ed8dd93dd438456d513206ae83f7df29ecc7e433f7e0441990076fa9b432cca9aab13047f245f293fb30c6f29dc8eabacbe2d830de05bfd028aa6e6d3028a2decca69df4b196641"}, 0x0) close(0xffffffffffffffff) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f00000000c0)) 19:06:30 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x80045105, 0x0) 19:06:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x200000000001, 0x3) r2 = fcntl$dupfd(r1, 0x0, r1) connect$bt_rfcomm(r2, &(0x7f0000000000), 0xa) getpeername$netlink(r2, 0x0, 0x0) 19:06:31 executing program 1: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000140)={0x0, {{0xa, 0x0, 0x0, @mcast2}}}, 0x108) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x1000000002d, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x4e9) 19:06:31 executing program 3: r0 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'gretap0\x00', &(0x7f00000000c0)=@ethtool_sset_info={0x25}}) 19:06:31 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0x0, 0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000200)={&(0x7f0000000180)='./file0\x00', 0x0, 0x18}, 0x10) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'sit0\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'sit0\x00\x00\xfe\x00\x00\x00\x00,\xc0\xfe\a\x00', 0x141}) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000140)={0x5, &(0x7f0000000000)=[{0x6f, 0x6, 0x7, 0x9}, {0x6, 0xfffffffeffffffff, 0x5, 0xffffffffffff7fff}, {0x7ff, 0x9, 0x6, 0x2000}, {0x2, 0xe774, 0x7, 0x10000}, {0x9, 0x3, 0x2, 0x1ff}]}, 0x10) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x81000008912, &(0x7f0000000100)) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000500)={0x0, 0x2c, &(0x7f00000004c0)=[@in6={0xa, 0x4e21, 0x7ff, @mcast1, 0xd99}, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) bind$bt_hci(r2, &(0x7f0000000280)={0x1f, r3}, 0xc) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={0x0, 0x0, 0x18}, 0x10) connect$l2tp(0xffffffffffffffff, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x3a) getpeername$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000080)=0xa) 19:06:31 executing program 4: creat(&(0x7f00000000c0)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) 19:06:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x200000000001, 0x3) r2 = fcntl$dupfd(r1, 0x0, r1) connect$bt_rfcomm(r2, &(0x7f0000000000), 0xa) getpeername$netlink(r2, 0x0, 0x0) 19:06:31 executing program 5: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='veth1\x00\x00\x00\x00\xff\xff\xff\xff\xff\xef\x00', 0xb) r2 = dup2(r1, r1) sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB], 0x1}}, 0x44801) sendmsg$FOU_CMD_DEL(r2, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) sendto$inet(r1, &(0x7f0000000000), 0xfffffdef, 0xc0, 0x0, 0x0) ioctl$VIDIOC_DQEVENT(r2, 0x80785659, &(0x7f00000003c0)={0x0, @ctrl={0x0, 0x0, @value64}}) ftruncate(r0, 0x4) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000440)='/dev/sequencer\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) epoll_create1(0x80000) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f0000000480)={0x0, 0xbe, "f8bf9129408c3a5f2a4ae09aa757d4bcc9f458976ea89e1c0a060c51431006d2788b2357516155e3984ca23c3ad7d65dcd96aa4870a067929aa6e38cb187e682b6b5ac3b457985043f012312a5f235cba564d9a095f651621f30fdb69da1f1d5ca443afb7c173337601810ffd73c8bb85c45db4fe3ab1ed8dd93dd438456d513206ae83f7df29ecc7e433f7e0441990076fa9b432cca9aab13047f245f293fb30c6f29dc8eabacbe2d830de05bfd028aa6e6d3028a2decca69df4b196641"}, 0x0) close(0xffffffffffffffff) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f00000000c0)) 19:06:31 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0xc0189436, &(0x7f0000000100)={'gretap0\x00', &(0x7f00000000c0)=@ethtool_sset_info}) 19:06:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x200000000001, 0x3) r2 = fcntl$dupfd(r1, 0x0, r1) getpeername$netlink(r2, 0x0, 0x0) 19:06:31 executing program 1: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r0, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "00f40c442848cb166b002ee8dc4da7ae20d7c965d4fab6ad71c03cb2aa506b39b663e1c4c87d263fc05a6a042b6feba7da240eb2ca83e630e3b925b24361dc"}, 0x60) sendmsg$nfc_llcp(r0, &(0x7f0000001680)={&(0x7f0000000080)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "ad5ed1796b069a3bfb3c807b737e695737a8ddc0036b68ebdb46e60062f987274fb736f71ae521434e6c78b24b3d3964d33083080aac5128f56dd92faadb3a"}, 0x60, 0x0}, 0x0) 19:06:31 executing program 4: r0 = memfd_create(0x0, 0x2) r1 = dup2(0xffffffffffffffff, r0) r2 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r3 = memfd_create(&(0x7f0000000140)=',!\x00', 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)={0xc4, r4, 0xb08, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="7f84461bb8d376c8bec4502cae45dde7"}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'eql\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xa, 0x1}}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_AF={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x10}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffffffffffffffc}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}]}]}, 0xc4}}, 0x10) pwritev(r3, &(0x7f0000000400)=[{&(0x7f0000000340)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, &(0x7f0000000000)) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x2183f, 0xffffffffffffffff, 0x0) fcntl$setstatus(r2, 0x4, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000180)=0xc) getgroups(0x1, &(0x7f00000001c0)=[0x0]) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendfile(r2, r3, 0x0, 0x80003) 19:06:31 executing program 3: ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) r1 = dup2(r0, 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, 0x0, 0x44801) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0xfffffdef, 0xc0, 0x0, 0x0) ioctl$VIDIOC_DQEVENT(r1, 0x80785659, &(0x7f00000003c0)={0x0, @ctrl={0x0, 0x0, @value64}}) ftruncate(0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) epoll_create1(0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, 0x0, 0x0) 19:06:31 executing program 1: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='veth1\x00\x00\x00\x00\xff\xff\xff\xff\xff\xef\x00', 0xb) r2 = dup2(r1, r1) sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="b6aafdf6a2c83eb5831c660d8c923460b593a4c06b8ba4569709666e3ee7bf606b856a95415923614fda796cfadfd2f3d4b1de160676c1ffff59bcb6d1011df1adf25edbb4339c8b4e9ef8abbdb0e00a1f3535ae18785c4cafcbe089169c92a92bfbaefba9369027d314"], 0x1}}, 0x44801) sendmsg$FOU_CMD_DEL(r2, &(0x7f00000002c0)={&(0x7f0000000180), 0xc, &(0x7f0000000280)={0x0}}, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) sendto$inet(r1, &(0x7f0000000000), 0xfffffdef, 0xc0, 0x0, 0x0) ioctl$VIDIOC_DQEVENT(r2, 0x80785659, &(0x7f00000003c0)={0x0, @ctrl={0x0, 0x0, @value64}}) ftruncate(r0, 0x4) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f0000000800)=ANY=[]) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) epoll_create1(0x80000) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000480)={0x0, 0x2f, "f8bf9129408c3a5f2a4ae09aa757d4bcc9f458976ea89e1c0a060c51431006d2788b2357516155e3984ca23c3ad7d6"}, 0x0) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f00000000c0)) [ 210.462745][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 210.468780][ C0] protocol 88fb is buggy, dev hsr_slave_1 19:06:31 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = dup2(r1, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x132224) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, 0x0, 0x4004000) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_buf(r1, 0x29, 0x22, &(0x7f00000000c0), 0x377) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x39) fcntl$setstatus(r2, 0x4, 0x42803) 19:06:31 executing program 3: r0 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'gretap0\x00', &(0x7f00000000c0)=@ethtool_sset_info={0x39}}) [ 210.907416][ T8503] device sit0 entered promiscuous mode [ 211.016956][ T8515] device sit0 left promiscuous mode [ 211.262514][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 211.268354][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 211.315406][ T8538] BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.5/8538 [ 211.325090][ T8538] caller is ip6_finish_output+0x335/0xdc0 [ 211.330828][ T8538] CPU: 1 PID: 8538 Comm: syz-executor.5 Not tainted 5.1.0-rc3-next-20190405 #19 [ 211.339849][ T8538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 211.349923][ T8538] Call Trace: [ 211.353239][ T8538] dump_stack+0x172/0x1f0 [ 211.357590][ T8538] __this_cpu_preempt_check+0x246/0x270 [ 211.363147][ T8538] ip6_finish_output+0x335/0xdc0 [ 211.368099][ T8538] ip6_output+0x235/0x7f0 [ 211.372440][ T8538] ? ip6_finish_output+0xdc0/0xdc0 [ 211.377578][ T8538] ? ip6_fragment+0x3980/0x3980 [ 211.382530][ T8538] ip6_xmit+0xe41/0x20c0 [ 211.386888][ T8538] ? ip6_finish_output2+0x2550/0x2550 [ 211.392271][ T8538] ? mark_held_locks+0xf0/0xf0 [ 211.397060][ T8538] ? ip6_setup_cork+0x1870/0x1870 [ 211.402120][ T8538] inet6_csk_xmit+0x2fb/0x5d0 [ 211.406806][ T8538] ? inet6_csk_update_pmtu+0x190/0x190 [ 211.412273][ T8538] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 211.418545][ T8538] ? csum_ipv6_magic+0x20/0x80 [ 211.423335][ T8538] __tcp_transmit_skb+0x1a32/0x3750 [ 211.428552][ T8538] ? tcp_connect+0x1184/0x4280 [ 211.433342][ T8538] ? __tcp_select_window+0x8b0/0x8b0 [ 211.438641][ T8538] ? lockdep_hardirqs_on+0x418/0x5d0 [ 211.443936][ T8538] ? trace_hardirqs_on+0x67/0x230 [ 211.448973][ T8538] ? tcp_rbtree_insert+0x188/0x200 [ 211.454103][ T8538] tcp_connect+0x2e18/0x4280 [ 211.458716][ T8538] ? tcp_push_one+0x110/0x110 [ 211.463404][ T8538] ? secure_tcpv6_ts_off+0x24f/0x360 [ 211.468706][ T8538] ? secure_dccpv6_sequence_number+0x280/0x280 [ 211.474871][ T8538] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 211.481128][ T8538] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 211.487382][ T8538] ? prandom_u32_state+0x13/0x180 [ 211.492433][ T8538] tcp_v6_connect+0x150b/0x20a0 [ 211.497300][ T8538] ? tcp_v6_conn_request+0x2b0/0x2b0 [ 211.502635][ T8538] __inet_stream_connect+0x83f/0xea0 [ 211.507928][ T8538] ? tcp_v6_conn_request+0x2b0/0x2b0 [ 211.513219][ T8538] ? __inet_stream_connect+0x83f/0xea0 [ 211.518689][ T8538] ? mark_held_locks+0xa4/0xf0 [ 211.523465][ T8538] ? inet_dgram_connect+0x2e0/0x2e0 [ 211.528668][ T8538] ? lock_sock_nested+0x9a/0x120 [ 211.533617][ T8538] ? trace_hardirqs_on+0x67/0x230 [ 211.538654][ T8538] ? lock_sock_nested+0x9a/0x120 [ 211.543604][ T8538] ? __local_bh_enable_ip+0x15a/0x270 [ 211.549171][ T8538] inet_stream_connect+0x58/0xa0 [ 211.554124][ T8538] __sys_connect+0x266/0x330 [ 211.558725][ T8538] ? __ia32_sys_accept+0xb0/0xb0 [ 211.563677][ T8538] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 211.569941][ T8538] ? put_timespec64+0xda/0x140 [ 211.574736][ T8538] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 211.580203][ T8538] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 211.585672][ T8538] ? do_syscall_64+0x26/0x610 [ 211.590361][ T8538] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 211.596442][ T8538] ? do_syscall_64+0x26/0x610 [ 211.601146][ T8538] __x64_sys_connect+0x73/0xb0 [ 211.605944][ T8538] do_syscall_64+0x103/0x610 [ 211.608273][ T8500] device sit0 entered promiscuous mode [ 211.619432][ T8538] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 211.619476][ T8538] RIP: 0033:0x4582b9 [ 211.619490][ T8538] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 211.619497][ T8538] RSP: 002b:00007fe41d298c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 211.619509][ T8538] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 211.619517][ T8538] RDX: 000000000000001c RSI: 0000000020000080 RDI: 0000000000000008 [ 211.619525][ T8538] RBP: 000000000073c040 R08: 0000000000000000 R09: 0000000000000000 [ 211.619533][ T8538] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe41d2996d4 [ 211.619552][ T8538] R13: 00000000004be64c R14: 00000000004cf1e0 R15: 00000000ffffffff [ 211.703305][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 211.709116][ C1] protocol 88fb is buggy, dev hsr_slave_1 19:06:33 executing program 2: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$rose(r0, 0x104, 0x2, &(0x7f0000001a80)=0x39, 0xbe) 19:06:33 executing program 3: r0 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x5}, 0x1c) syz_emit_ethernet(0x83, &(0x7f0000000180)={@local, @dev, [], {@ipv6={0x86dd, {0x0, 0x6, "1bfc97", 0x4d, 0x88, 0x0, @dev, @mcast2, {[], @udp={0x0, 0x4e20, 0x4d, 0x0, [], "e29607149378d33e1db1c73936c77aa3f7fac33b042bd368236862531934ecb1c373d6ea51369e92fb96cc7c6fe4e24d1fcafff87429e50b32881721afab69cc3712c37ed0"}}}}}}, 0x0) 19:06:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x200000000001, 0x3) r2 = fcntl$dupfd(r1, 0x0, r1) getpeername$netlink(r2, 0x0, 0x0) 19:06:33 executing program 1: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='veth1\x00\x00\x00\x00\xff\xff\xff\xff\xff\xef\x00', 0xb) r2 = dup2(r1, r1) sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="b6aafdf6a2c83eb5831c660d8c923460b593a4c06b8ba4569709666e3ee7bf606b856a95415923614fda796cfadfd2f3d4b1de160676c1ffff59bcb6d1011df1adf25edbb4339c8b4e9ef8abbdb0e00a1f3535ae18785c4cafcbe089169c92a92bfbaefba9369027d314"], 0x1}}, 0x44801) sendmsg$FOU_CMD_DEL(r2, &(0x7f00000002c0)={&(0x7f0000000180), 0xc, &(0x7f0000000280)={0x0}}, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) sendto$inet(r1, &(0x7f0000000000), 0xfffffdef, 0xc0, 0x0, 0x0) ioctl$VIDIOC_DQEVENT(r2, 0x80785659, &(0x7f00000003c0)={0x0, @ctrl={0x0, 0x0, @value64}}) ftruncate(r0, 0x4) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f0000000800)=ANY=[]) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) epoll_create1(0x80000) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000480)={0x0, 0x2f, "f8bf9129408c3a5f2a4ae09aa757d4bcc9f458976ea89e1c0a060c51431006d2788b2357516155e3984ca23c3ad7d6"}, 0x0) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f00000000c0)) 19:06:33 executing program 4: r0 = memfd_create(0x0, 0x2) r1 = dup2(0xffffffffffffffff, r0) r2 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r3 = memfd_create(&(0x7f0000000140)=',!\x00', 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)={0xc4, r4, 0xb08, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="7f84461bb8d376c8bec4502cae45dde7"}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'eql\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xa, 0x1}}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_AF={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x10}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffffffffffffffc}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}]}]}, 0xc4}}, 0x10) pwritev(r3, &(0x7f0000000400)=[{&(0x7f0000000340)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, &(0x7f0000000000)) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x2183f, 0xffffffffffffffff, 0x0) fcntl$setstatus(r2, 0x4, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000180)=0xc) getgroups(0x1, &(0x7f00000001c0)=[0x0]) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendfile(r2, r3, 0x0, 0x80003) 19:06:33 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_RELEASE(r0, 0x6431) 19:06:33 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x200000000001, 0x3) r2 = fcntl$dupfd(r1, 0x0, r1) getpeername$netlink(r2, 0x0, 0x0) 19:06:33 executing program 2: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fallocate(r0, 0x20, 0x0, 0xc2d0) 19:06:33 executing program 3: r0 = getpid() r1 = gettid() kcmp(r0, r1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff) 19:06:33 executing program 2: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, 0x0) 19:06:34 executing program 5: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$rose(r0, 0x104, 0x4, &(0x7f0000001a80)=0x39, 0xbe) 19:06:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_init_net_socket$bt_l2cap(0x1f, 0x200000000001, 0x3) connect$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000), 0xa) getpeername$netlink(0xffffffffffffffff, 0x0, 0x0) 19:06:34 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, 0x0, 0x4004000) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x22, &(0x7f00000000c0), 0x377) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x39) fcntl$setstatus(r1, 0x4, 0x42803) 19:06:34 executing program 2: mkdir(&(0x7f0000508ff6)='./control\x00', 0x0) mount(0x0, &(0x7f0000000040)='./control\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) syz_mount_image$iso9660(&(0x7f0000000200)='iso9660\x00', &(0x7f00000002c0)='./control\x00', 0x0, 0x0, 0x0, 0x60000, 0x0) 19:06:34 executing program 1: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='veth1\x00\x00\x00\x00\xff\xff\xff\xff\xff\xef\x00', 0xb) r2 = dup2(r1, r1) sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="b6aafdf6a2c83eb5831c660d8c923460b593a4c06b8ba4569709666e3ee7bf606b856a95415923614fda796cfadfd2f3d4b1de160676c1ffff59bcb6d1011df1adf25edbb4339c8b4e9ef8abbdb0e00a1f3535ae18785c4cafcbe089169c92a92bfbaefba9369027d314"], 0x1}}, 0x44801) sendmsg$FOU_CMD_DEL(r2, &(0x7f00000002c0)={&(0x7f0000000180), 0xc, &(0x7f0000000280)={0x0}}, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) sendto$inet(r1, &(0x7f0000000000), 0xfffffdef, 0xc0, 0x0, 0x0) ioctl$VIDIOC_DQEVENT(r2, 0x80785659, &(0x7f00000003c0)={0x0, @ctrl={0x0, 0x0, @value64}}) ftruncate(r0, 0x4) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f0000000800)=ANY=[]) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) epoll_create1(0x80000) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000480)={0x0, 0x2f, "f8bf9129408c3a5f2a4ae09aa757d4bcc9f458976ea89e1c0a060c51431006d2788b2357516155e3984ca23c3ad7d6"}, 0x0) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f00000000c0)) 19:06:34 executing program 4: r0 = memfd_create(0x0, 0x2) r1 = dup2(0xffffffffffffffff, r0) r2 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r3 = memfd_create(&(0x7f0000000140)=',!\x00', 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)={0xc4, r4, 0xb08, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr="7f84461bb8d376c8bec4502cae45dde7"}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'eql\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xa, 0x1}}, @IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_AF={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x10}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffffffffffffffc}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}]}]}, 0xc4}}, 0x10) pwritev(r3, &(0x7f0000000400)=[{&(0x7f0000000340)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, &(0x7f0000000000)) mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x0, 0x2183f, 0xffffffffffffffff, 0x0) fcntl$setstatus(r2, 0x4, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000180)=0xc) getgroups(0x1, &(0x7f00000001c0)=[0x0]) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendfile(r2, r3, 0x0, 0x80003) 19:06:35 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_init_net_socket$bt_l2cap(0x1f, 0x200000000001, 0x3) connect$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000), 0xa) getpeername$netlink(0xffffffffffffffff, 0x0, 0x0) 19:06:35 executing program 5: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x100000000, 0x9, 0x1, 0x0, 0x0, 0x200}]})