[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 37.063812] audit: type=1800 audit(1538776907.439:25): pid=5682 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 37.089974] audit: type=1800 audit(1538776907.439:26): pid=5682 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 37.113203] audit: type=1800 audit(1538776907.439:27): pid=5682 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.55' (ECDSA) to the list of known hosts. 2018/10/05 22:01:56 fuzzer started 2018/10/05 22:01:58 dialing manager at 10.128.0.26:40027 2018/10/05 22:01:59 syscalls: 1 2018/10/05 22:01:59 code coverage: enabled 2018/10/05 22:01:59 comparison tracing: enabled 2018/10/05 22:01:59 setuid sandbox: enabled 2018/10/05 22:01:59 namespace sandbox: enabled 2018/10/05 22:01:59 Android sandbox: /sys/fs/selinux/policy does not exist 2018/10/05 22:01:59 fault injection: enabled 2018/10/05 22:01:59 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/10/05 22:01:59 net packed injection: enabled 2018/10/05 22:01:59 net device setup: enabled 22:03:35 executing program 0: syzkaller login: [ 144.971698] IPVS: ftp: loaded support on port[0] = 21 22:03:35 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @link_local={0x1, 0x80, 0xc2, 0xe80}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev}, @icmp=@parameter_prob={0x3, 0x6, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x184, 0x0, @local, @dev}}}}}}, &(0x7f00000000c0)={0x0, 0x4, [0x0, 0x800]}) [ 145.179187] IPVS: ftp: loaded support on port[0] = 21 22:03:35 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)="2f67726f75702e73746174003c23fb572a1f0294e6f378b41ad54b4d9d9a1f63f8785ad188a7e1c88875e05b18a4cb3a9cd12dcea440d899c22c652b3a471b4a7fa2f3fdf6e034d804e5f0df4b1dee483b157624c59c0100e89e6a357c000000", 0x2761, 0x0) write$cgroup_int(r0, &(0x7f0000000080)=0xee970204, 0x12) close(r0) [ 145.462317] IPVS: ftp: loaded support on port[0] = 21 22:03:36 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)) lstat(&(0x7f0000000600)='./file0\x00', &(0x7f0000000640)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000040)="6bae12ae00b880008ec8f30f2353660f6fea670f0fcfb6ba4200ec64f40f06ba420066b8df1301dc66efbad10466b8ca00000066ef", 0x35}], 0x0, 0x0, &(0x7f0000000000), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000002c0)={{}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x4, 0x3f}}) socketpair$unix(0x1, 0x2000080000000001, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 145.822000] IPVS: ftp: loaded support on port[0] = 21 22:03:36 executing program 4: syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @link_local={0x1, 0x80, 0xc2, 0xe80}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev}, @icmp=@parameter_prob={0x3, 0x6, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, @local, @dev}}}}}}, &(0x7f00000000c0)) [ 146.287037] IPVS: ftp: loaded support on port[0] = 21 [ 146.415694] bridge0: port 1(bridge_slave_0) entered blocking state [ 146.422103] bridge0: port 1(bridge_slave_0) entered disabled state [ 146.445878] device bridge_slave_0 entered promiscuous mode [ 146.463361] bridge0: port 1(bridge_slave_0) entered blocking state [ 146.485019] bridge0: port 1(bridge_slave_0) entered disabled state [ 146.505186] device bridge_slave_0 entered promiscuous mode [ 146.522518] bridge0: port 2(bridge_slave_1) entered blocking state [ 146.545417] bridge0: port 2(bridge_slave_1) entered disabled state [ 146.552645] device bridge_slave_1 entered promiscuous mode [ 146.588111] bridge0: port 2(bridge_slave_1) entered blocking state [ 146.594516] bridge0: port 2(bridge_slave_1) entered disabled state 22:03:37 executing program 5: syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local, @dev}}}}}}, &(0x7f0000000000)) [ 146.630984] device bridge_slave_1 entered promiscuous mode [ 146.698819] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 146.710983] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 146.804652] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 146.826871] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 146.845531] IPVS: ftp: loaded support on port[0] = 21 [ 147.114769] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 147.143455] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 147.183374] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 147.251722] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 147.296669] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.303108] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.315395] device bridge_slave_0 entered promiscuous mode [ 147.430150] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.444681] bridge0: port 2(bridge_slave_1) entered disabled state [ 147.456959] device bridge_slave_1 entered promiscuous mode [ 147.540929] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 147.654985] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 147.771046] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.792178] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.799956] device bridge_slave_0 entered promiscuous mode [ 147.809473] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 147.818339] team0: Port device team_slave_0 added [ 147.844499] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 147.865948] team0: Port device team_slave_0 added [ 147.908438] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.923465] bridge0: port 2(bridge_slave_1) entered disabled state [ 147.936082] device bridge_slave_1 entered promiscuous mode [ 147.955754] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 147.965672] team0: Port device team_slave_1 added [ 147.972940] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 147.987817] team0: Port device team_slave_1 added [ 148.004032] bridge0: port 1(bridge_slave_0) entered blocking state [ 148.025021] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.032294] device bridge_slave_0 entered promiscuous mode [ 148.047810] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 148.056695] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 148.066977] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 148.076697] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 148.084760] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 148.109191] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 148.130175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 148.139966] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 148.158713] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 148.178481] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 148.190391] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 148.200916] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 148.220283] bridge0: port 2(bridge_slave_1) entered blocking state [ 148.235180] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.255043] device bridge_slave_1 entered promiscuous mode [ 148.261164] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 148.269639] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 148.285500] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 148.293082] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 148.320229] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 148.331169] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 148.357173] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 148.365497] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 148.375046] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 148.382762] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 148.409544] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 148.425848] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 148.433728] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 148.444016] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 148.455464] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 148.463229] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 148.501669] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 148.511249] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 148.521859] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 148.535792] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 148.543685] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 148.554083] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 148.693929] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 148.773583] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 148.785709] team0: Port device team_slave_0 added [ 148.809954] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 148.839615] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 148.894100] bridge0: port 1(bridge_slave_0) entered blocking state [ 148.921198] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.928301] device bridge_slave_0 entered promiscuous mode [ 148.938983] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 148.946676] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 148.955543] team0: Port device team_slave_1 added [ 148.964063] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 148.985061] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 149.023022] bridge0: port 2(bridge_slave_1) entered blocking state [ 149.046236] bridge0: port 2(bridge_slave_1) entered disabled state [ 149.066065] device bridge_slave_1 entered promiscuous mode [ 149.074735] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 149.090667] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 149.101170] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 149.131356] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 149.145052] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 149.154432] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 149.176103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 149.195674] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 149.257862] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 149.264722] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 149.273466] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 149.292922] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 149.305401] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 149.319109] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 149.361674] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 149.390616] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 149.399987] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 149.444089] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 149.455580] team0: Port device team_slave_0 added [ 149.490302] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 149.508902] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 149.528536] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 149.550652] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 149.564583] team0: Port device team_slave_1 added [ 149.620215] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 149.635550] team0: Port device team_slave_0 added [ 149.671113] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 149.716666] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 149.733785] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 149.741985] team0: Port device team_slave_1 added [ 149.756826] bridge0: port 2(bridge_slave_1) entered blocking state [ 149.763196] bridge0: port 2(bridge_slave_1) entered forwarding state [ 149.769871] bridge0: port 1(bridge_slave_0) entered blocking state [ 149.776257] bridge0: port 1(bridge_slave_0) entered forwarding state [ 149.788562] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 149.813675] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 149.842194] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 149.857693] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 149.879674] bridge0: port 2(bridge_slave_1) entered blocking state [ 149.886074] bridge0: port 2(bridge_slave_1) entered forwarding state [ 149.892701] bridge0: port 1(bridge_slave_0) entered blocking state [ 149.899099] bridge0: port 1(bridge_slave_0) entered forwarding state [ 149.922964] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 149.931680] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 149.953827] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 149.976172] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 149.995299] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 150.003174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 150.012980] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 150.022866] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 150.043483] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 150.065092] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 150.072782] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 150.085513] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 150.098204] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 150.117422] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 150.139318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 150.150801] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 150.170053] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 150.211549] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 150.245234] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 150.253182] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 150.427256] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 150.434579] team0: Port device team_slave_0 added [ 150.545535] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 150.563723] team0: Port device team_slave_1 added [ 150.685702] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 150.767692] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 150.799244] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.805673] bridge0: port 2(bridge_slave_1) entered forwarding state [ 150.812319] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.818738] bridge0: port 1(bridge_slave_0) entered forwarding state [ 150.829200] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 150.865895] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 150.881769] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 150.905817] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 150.955092] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 150.972543] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 150.993462] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 151.015846] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 151.346660] bridge0: port 2(bridge_slave_1) entered blocking state [ 151.353047] bridge0: port 2(bridge_slave_1) entered forwarding state [ 151.359726] bridge0: port 1(bridge_slave_0) entered blocking state [ 151.366123] bridge0: port 1(bridge_slave_0) entered forwarding state [ 151.381745] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 151.400968] bridge0: port 2(bridge_slave_1) entered blocking state [ 151.407681] bridge0: port 2(bridge_slave_1) entered forwarding state [ 151.414355] bridge0: port 1(bridge_slave_0) entered blocking state [ 151.420751] bridge0: port 1(bridge_slave_0) entered forwarding state [ 151.463549] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 151.964996] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 151.972130] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 152.093554] bridge0: port 2(bridge_slave_1) entered blocking state [ 152.099967] bridge0: port 2(bridge_slave_1) entered forwarding state [ 152.106631] bridge0: port 1(bridge_slave_0) entered blocking state [ 152.112991] bridge0: port 1(bridge_slave_0) entered forwarding state [ 152.125377] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 153.036308] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 153.992271] 8021q: adding VLAN 0 to HW filter on device bond0 [ 154.074826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 154.381184] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 154.399393] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 154.715287] 8021q: adding VLAN 0 to HW filter on device bond0 [ 154.750607] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 154.767797] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 154.774829] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 154.798639] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 154.805071] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 154.815457] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 155.137199] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 155.160984] 8021q: adding VLAN 0 to HW filter on device team0 [ 155.169044] 8021q: adding VLAN 0 to HW filter on device team0 [ 155.305164] 8021q: adding VLAN 0 to HW filter on device bond0 [ 155.393683] 8021q: adding VLAN 0 to HW filter on device bond0 [ 155.525989] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 155.532171] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 155.540594] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 155.667136] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 155.879541] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 155.889124] 8021q: adding VLAN 0 to HW filter on device team0 [ 156.009508] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 156.020942] 8021q: adding VLAN 0 to HW filter on device bond0 [ 156.041019] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 156.065902] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 156.273124] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 156.279309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 156.287891] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 156.300061] 8021q: adding VLAN 0 to HW filter on device team0 [ 156.409588] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 156.675204] 8021q: adding VLAN 0 to HW filter on device team0 [ 156.796033] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 156.802265] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 156.815696] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 157.135226] 8021q: adding VLAN 0 to HW filter on device team0 22:03:47 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000480)={0x0, 0x0}) getresuid(&(0x7f00000004c0), &(0x7f0000000680), &(0x7f00000006c0)=0x0) lstat(&(0x7f0000000700)='./file0\x00', &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000007c0)={r1, r2, r3}, 0xc) r4 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x8003, 0x1fe) ioctl$SCSI_IOCTL_STOP_UNIT(0xffffffffffffffff, 0x6) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000440)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x0, 0x3ef, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x26) r6 = getpgid(0x0) setpriority(0x1, r6, 0x5) ioctl$sock_inet6_SIOCADDRT(r5, 0x89a0, &(0x7f0000000100)={@local, @empty, @loopback, 0x3}) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000580)=ANY=[@ANYBLOB="c67bf167e58ab9f156330b0fe4cb40973091db8817ede93f126297d0c290a3628d0d9064978b206a1f8531318427d3748facd04bc14a22a0e9f39163c056a51f000000c24d1e448acf4ae6e99a3493ea9c3cf0d0636acfc2910500002212342c0d3bd9cce10e4ac8e589e514b8ade04569645e6cb4f6efb1ba85626461e639b9bd7d9757a943cf7fc80aa3fc957b4d6bee74edafebca26d76117c53ba8999717373de39f0d2734c2e2f6a04ab29334f905c846f3e63600b522b9a5eff32970382b2e403cf4efb27b15bee2e5b411e789d114"], &(0x7f00000002c0)=0x1) ioctl$KVM_ENABLE_CAP_CPU(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000500)={0x7b, 0x0, [0x4, 0x0, 0x0, 0x1]}) r7 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$sock_inet6_SIOCDIFADDR(0xffffffffffffffff, 0x8936, &(0x7f0000000280)={@loopback}) getsockopt(r7, 0x4, 0x9, &(0x7f00000003c0)=""/81, &(0x7f0000000240)=0x51) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000001c0), 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bond_slave_0\x00'}) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x0, 0x3ef]}}) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r4, 0x84, 0xf, &(0x7f0000000300)={0x0, @in={{0x2, 0x4e24, @rand_addr}}, 0x0, 0x0, 0x7fffffff, 0x81, 0x80000000}, &(0x7f0000000080)=0x98) syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x0, 0x0) [ 157.452354] hrtimer: interrupt took 23847 ns 22:03:48 executing program 1: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000480)={0x0, 0x0}) getresuid(&(0x7f00000004c0), &(0x7f0000000680), &(0x7f00000006c0)=0x0) lstat(&(0x7f0000000700)='./file0\x00', &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000007c0)={r1, r2, r3}, 0xc) r4 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x8003, 0x1fe) ioctl$SCSI_IOCTL_STOP_UNIT(0xffffffffffffffff, 0x6) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000440)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x0, 0x3ef, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x26) r6 = getpgid(0x0) setpriority(0x1, r6, 0x5) ioctl$sock_inet6_SIOCADDRT(r5, 0x89a0, &(0x7f0000000100)={@local, @empty, @loopback, 0x3}) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000580)=ANY=[@ANYBLOB="c67bf167e58ab9f156330b0fe4cb40973091db8817ede93f126297d0c290a3628d0d9064978b206a1f8531318427d3748facd04bc14a22a0e9f39163c056a51f000000c24d1e448acf4ae6e99a3493ea9c3cf0d0636acfc2910500002212342c0d3bd9cce10e4ac8e589e514b8ade04569645e6cb4f6efb1ba85626461e639b9bd7d9757a943cf7fc80aa3fc957b4d6bee74edafebca26d76117c53ba8999717373de39f0d2734c2e2f6a04ab29334f905c846f3e63600b522b9a5eff32970382b2e403cf4efb27b15bee2e5b411e789d114"], &(0x7f00000002c0)=0x1) ioctl$KVM_ENABLE_CAP_CPU(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000500)={0x7b, 0x0, [0x4, 0x0, 0x0, 0x1]}) r7 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$sock_inet6_SIOCDIFADDR(0xffffffffffffffff, 0x8936, &(0x7f0000000280)={@loopback}) getsockopt(r7, 0x4, 0x9, &(0x7f00000003c0)=""/81, &(0x7f0000000240)=0x51) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000001c0), 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, 0x1c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bond_slave_0\x00'}) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x0, 0x3ef]}}) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r4, 0x84, 0xf, &(0x7f0000000300)={0x0, @in={{0x2, 0x4e24, @rand_addr}}, 0x0, 0x0, 0x7fffffff, 0x81, 0x80000000}, &(0x7f0000000080)=0x98) syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x0, 0x0) 22:03:48 executing program 0: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r0, &(0x7f0000001700)="8a", 0x1, 0x8000, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100)=0x2000, 0x4) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e24, 0x1, @loopback, 0x8}}, 0x4, 0xf8ab}, &(0x7f0000000080)=0x88) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000340)={r2, @in={{0x2, 0x4e20, @broadcast}}, 0x4, 0x6}, 0x88) write$binfmt_elf64(r0, &(0x7f00000016c0)=ANY=[@ANYPTR=&(0x7f00000005c0)=ANY=[@ANYPTR=&(0x7f00000004c0)=ANY=[@ANYRES16], @ANYRES32, @ANYRES64=0x0, @ANYPTR=&(0x7f0000000580)=ANY=[@ANYPTR64, @ANYRESHEX, @ANYPTR64, @ANYRES32=0x0]], @ANYRESDEC, @ANYRES16], 0xffffff84) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0xff9a}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) 22:03:48 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000600)='/dev/hwrng\x00', 0x10000, 0x0) r1 = accept4(r0, &(0x7f0000000300)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000640)=0x80, 0x80000) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000003c0)={0x0, 0xf, 0x0, 0x101}, &(0x7f0000000400)=0x10) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x403e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0x8000000) r2 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000000)={0x0, 0x1, 0x5}) write$P9_RCLUNK(r0, &(0x7f0000000380)={0x7, 0x79, 0x2}, 0x7) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000440)={{{@in=@rand_addr, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@remote}}, &(0x7f0000000540)=0xe8) bind(r1, &(0x7f0000000580)=@ll={0x11, 0x19, r3, 0x1, 0x9, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x80) mq_timedreceive(r2, &(0x7f0000000200)=""/244, 0xfffffff8, 0x0, 0x0) r4 = gettid() timer_create(0x0, &(0x7f0000066000), &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1000000000016) mq_timedsend(r2, &(0x7f0000000040), 0x0, 0x0, &(0x7f00000000c0)={0x77359400}) ioctl$EVIOCGPROP(0xffffffffffffffff, 0xc004743e, &(0x7f0000000000)=""/246) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000001c0)={r4, 0xffffffffffffffff}, 0xc) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) sendmsg$nl_route(r5, &(0x7f0000000e40)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x1c0000c8}, 0xc, &(0x7f0000000e00)={&(0x7f0000000dc0)=@ipv6_deladdr={0x20, 0x15, 0x402, 0x70bd29, 0x25dfdbfb, {0xa, 0x40, 0x400}, [@IFA_FLAGS={0x8, 0x8, 0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x14}, 0x4) 22:03:48 executing program 2: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) fcntl$getown(r0, 0x9) r1 = memfd_create(&(0x7f0000000380)="000000000000000000000000000000768e05f7c155ad7dc6947c573e5a69244e76382c0aa63d575ea3597f8b1728277ef76b30254d7ba92dcf978f1f81dc1b7f8f7b3451dada02ecb4f1ddcc8b5241da8945666e0073c25a6287c64dbea37a", 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r1) dup3(r1, r0, 0x0) 22:03:48 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000001380)='keyring\x00', &(0x7f0000001d80), 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000140), 0x0, 0x0, r0) clock_gettime(0x0, &(0x7f0000001f40)) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000100)) gettid() r1 = socket(0x11, 0x4000000000080002, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000240)={{{@in6=@mcast1, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@loopback}}, &(0x7f00000000c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'ip6_vti0\x00', r2}) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000003dc0)=0x4, 0x4) bind$packet(r1, &(0x7f0000000200)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @local}, 0x14) sendmmsg$inet_sctp(r1, &(0x7f0000871fc8)=[{&(0x7f000086c000)=@in6={0xa, 0x0, 0x2}, 0x1c, &(0x7f0000d1e000), 0x0, &(0x7f0000dda000)}], 0x492492492492510, 0x0) [ 158.425396] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 22:03:48 executing program 4: r0 = socket(0x10, 0x2, 0x0) exit(0xfffffffffffffffc) sendmsg$nl_generic(r0, &(0x7f0000000900)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000580)={0x28, 0x24, 0x217, 0x0, 0x0, {}, [@nested={0xc, 0x0, [@typed={0x8, 0x0, @pid}]}, @typed={0x8, 0x0, @fd}]}, 0x46}}, 0x0) 22:03:49 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="020a040007000000000013002d54036205001a0005cebafc22000000000000001ac600b2000000000000000000000000070000000a000028ecf76b68460943969c5611660a240034"], 0x38}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x20, 0x0) 22:03:49 executing program 3: ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f00000000c0)=0x10d060000) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x800, 0x0) eventfd(0x0) ioctl$int_in(r0, 0x800000c0045002, &(0x7f0000000200)=0x1000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000180)=0x5) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000300), &(0x7f0000000380)=0x8) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44b}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @local}], 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x4e24, 0x4, @mcast2, 0xfffffffffffff000}, 0x1c) readv(r0, &(0x7f00000014c0)=[{&(0x7f0000001500)=""/4096, 0x1000}], 0x1) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x80) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x100, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1000, &(0x7f000000a000/0x1000)=nil}) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000100)) [ 158.727528] netlink: 4 bytes leftover after parsing attributes in process `syz-executor4'. 22:03:49 executing program 3: ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f00000000c0)=0x10d060000) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x800, 0x0) eventfd(0x0) ioctl$int_in(r0, 0x800000c0045002, &(0x7f0000000200)=0x1000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000180)=0x5) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000300), &(0x7f0000000380)=0x8) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44b}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @local}], 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x4e24, 0x4, @mcast2, 0xfffffffffffff000}, 0x1c) readv(r0, &(0x7f00000014c0)=[{&(0x7f0000001500)=""/4096, 0x1000}], 0x1) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x80) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x100, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, 0xffffffffffffffff, 0x0) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000100)) 22:03:49 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/255, 0x443}], 0xc8) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/sequencer2\x00', 0x0, 0x0) timer_create(0x7, &(0x7f0000000700)={0x0, 0x6, 0x1, @thr={&(0x7f0000000580)="9377482846027d7c1fe9199e83938702c6664f8491673ef5d26b3682e5f40810110c837fb65767618706de034ba53c0e84c679029f46a6431c5ae327a0a17616b54fb26c50", &(0x7f0000000600)="2ac240409400b74dd04b8db4a9df12fbec44d717ae287067dd5305b32f4a84dde3ba35bc195612022707b3878264bde67246c1018c87f0e79d5a9bd3efec722f0098f014c3dddb4458e1eaaddb800cab4e244547f8f4e2261cb7c6a5123bca20925a802c352c"}}, &(0x7f0000000740)) ioctl$KVM_PPC_GET_PVINFO(0xffffffffffffffff, 0x4080aea1, &(0x7f0000000380)=""/215) ptrace$peek(0x1, 0x0, &(0x7f0000000180)) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(0xffffffffffffffff, 0x40505331, &(0x7f0000000300)={{0x5}}) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x2) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x8000, 0x0) r2 = dup3(r1, r0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000001c0)={0x10}) write(r0, &(0x7f0000c34fff), 0xffffff0b) 22:03:49 executing program 5: sched_setaffinity(0x0, 0x346, &(0x7f00000000c0)=0x5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) fsetxattr$security_smack_entry(r0, &(0x7f00000002c0)='security.SMACK64IPOUT\x00', &(0x7f0000000700)='security-\x00', 0xa, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x800, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(0xffffffffffffffff, 0x5386, &(0x7f0000000140)) vmsplice(0xffffffffffffffff, &(0x7f00000003c0), 0x0, 0x0) 22:03:49 executing program 3: ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f00000000c0)=0x10d060000) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x800, 0x0) eventfd(0x0) ioctl$int_in(r0, 0x800000c0045002, &(0x7f0000000200)=0x1000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000180)=0x6) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44b}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @local}], 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f0000000280)={0xa, 0x0, 0x4, @mcast2, 0xfffffffffffff000}, 0x1c) readv(r0, &(0x7f00000014c0)=[{&(0x7f0000001500)=""/4096, 0x1000}], 0x1) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x80) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x100, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x11, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x1, 0x1000, &(0x7f000000a000/0x1000)=nil}) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000100)) 22:03:49 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/255, 0x443}], 0xc8) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/sequencer2\x00', 0x0, 0x0) timer_create(0x7, &(0x7f0000000700)={0x0, 0x6, 0x1, @thr={&(0x7f0000000580)="9377482846027d7c1fe9199e83938702c6664f8491673ef5d26b3682e5f40810110c837fb65767618706de034ba53c0e84c679029f46a6431c5ae327a0a17616b54fb26c50", &(0x7f0000000600)="2ac240409400b74dd04b8db4a9df12fbec44d717ae287067dd5305b32f4a84dde3ba35bc195612022707b3878264bde67246c1018c87f0e79d5a9bd3efec722f0098f014c3dddb4458e1eaaddb800cab4e244547f8f4e2261cb7c6a5123bca20925a802c352c"}}, &(0x7f0000000740)) ioctl$KVM_PPC_GET_PVINFO(0xffffffffffffffff, 0x4080aea1, &(0x7f0000000380)=""/215) ptrace$peek(0x1, 0x0, &(0x7f0000000180)) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(0xffffffffffffffff, 0x40505331, &(0x7f0000000300)={{0x5}}) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x2) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x8000, 0x0) r2 = dup3(r1, r0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000001c0)={0x10}) write(r0, &(0x7f0000c34fff), 0xffffff0b) 22:03:49 executing program 2: ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f00000000c0)=0x10d060000) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer\x00', 0x0, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x800, 0x0) eventfd(0x0) ioctl$int_in(r0, 0x800000c0045002, &(0x7f0000000200)=0x1000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000180)=0x4) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000300), &(0x7f0000000380)=0x8) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44b}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x80, @local, 0x100000001}], 0x1c) readv(r0, &(0x7f00000014c0)=[{&(0x7f0000001500)=""/4096, 0x1000}], 0x1) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x80) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x100, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x1, 0x1000, &(0x7f000000a000/0x1000)=nil}) ioctl$SG_SET_RESERVED_SIZE(0xffffffffffffffff, 0x2275, &(0x7f0000000100)) [ 159.477378] netlink: 4 bytes leftover after parsing attributes in process `syz-executor4'. 22:03:51 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001840)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000005500)='/dev/ptmx\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000200)={{{@in=@loopback, @in=@dev}}, {{@in=@broadcast}, 0x0, @in6}}, &(0x7f0000000300)=0xe8) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000040)={0x80, 0x20, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x5}) keyctl$instantiate(0xc, 0x0, &(0x7f0000000cc0)=ANY=[@ANYPTR=&(0x7f0000000c80)=ANY=[]], 0x1, 0x0) syz_open_dev$vcsn(&(0x7f0000000480)='/dev/vcs#\x00', 0x0, 0x0) close(0xffffffffffffffff) pkey_alloc(0x0, 0x0) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000080)) 22:03:51 executing program 2: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000280)={0xffffffffffffffff, &(0x7f0000000340), &(0x7f00000003c0)=""/236}, 0x18) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f00000004c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x100000000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x8, 0x0, 0x0, 0x0, @perf_config_ext}) ioctl$KVM_S390_UCAS_UNMAP(0xffffffffffffffff, 0x4018ae51, &(0x7f0000000340)) sendmsg$key(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000780)={0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_x_sec_ctx={0x1, 0x18, 0x6}]}, 0x18}}, 0x4000000) r2 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000340), 0x10000014c) socket$packet(0x11, 0x3, 0x300) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000001c0)) pselect6(0x40, &(0x7f00000000c0)={0x64}, &(0x7f0000000100)={0x20}, &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r3+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 22:03:51 executing program 1: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000380)={0x0, 0x7ffd, 0x400d}, 0xc) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff4d}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) close(r1) perf_event_open(&(0x7f0000000900)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3b, &(0x7f0000000000)}, 0x0) 22:03:51 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000200), 0xffffffffffffffff) setsockopt$inet6_group_source_req(r1, 0x29, 0x2f, &(0x7f0000000400)={0x7, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000300)={&(0x7f0000000180), 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x14}, 0x14}}, 0x0) 22:03:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/255, 0x443}], 0xc8) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/sequencer2\x00', 0x0, 0x0) timer_create(0x7, &(0x7f0000000700)={0x0, 0x6, 0x1, @thr={&(0x7f0000000580)="9377482846027d7c1fe9199e83938702c6664f8491673ef5d26b3682e5f40810110c837fb65767618706de034ba53c0e84c679029f46a6431c5ae327a0a17616b54fb26c50", &(0x7f0000000600)="2ac240409400b74dd04b8db4a9df12fbec44d717ae287067dd5305b32f4a84dde3ba35bc195612022707b3878264bde67246c1018c87f0e79d5a9bd3efec722f0098f014c3dddb4458e1eaaddb800cab4e244547f8f4e2261cb7c6a5123bca20925a802c352c"}}, &(0x7f0000000740)) ioctl$KVM_PPC_GET_PVINFO(0xffffffffffffffff, 0x4080aea1, &(0x7f0000000380)=""/215) ptrace$peek(0x1, 0x0, &(0x7f0000000180)) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(0xffffffffffffffff, 0x40505331, &(0x7f0000000300)={{0x5}}) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x2) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x8000, 0x0) r2 = dup3(r1, r0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000001c0)={0x10}) write(r0, &(0x7f0000c34fff), 0xffffff0b) 22:03:51 executing program 4: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a600800000000000000068354015002c001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d4c1cbc882b079881", 0x4c}], 0x1}, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) recvmmsg(r0, &(0x7f000000a2c0)=[{{&(0x7f0000002b00)=@un=@abs, 0x80, &(0x7f0000001940)=[{&(0x7f0000000040)=""/120, 0x78}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000001600)=""/220, 0xdc}], 0x3, &(0x7f0000002c40)=""/69, 0x45}}, {{&(0x7f0000002cc0)=@can, 0x80, &(0x7f0000007440)}}, {{&(0x7f00000074c0)=@ethernet={0x0, @dev}, 0x80, &(0x7f0000001480), 0x0, &(0x7f0000007700)=""/200, 0xc8}}, {{0x0, 0x0, &(0x7f0000000480), 0x0, &(0x7f0000007840)=""/149, 0x95}}], 0x4, 0x0, &(0x7f000000a500)={0x0, r1+10000000}) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000001700)=[{{&(0x7f00000001c0)=@l2, 0x80, &(0x7f0000000300), 0x0, &(0x7f0000000340)=""/138, 0x8a}}, {{&(0x7f0000000400)=@nl=@unspec, 0x80, &(0x7f00000004c0), 0x0, &(0x7f0000000500)=""/119, 0x77}}, {{&(0x7f0000000580)=@l2, 0x80, &(0x7f0000001640), 0x0, &(0x7f0000000280)=""/101, 0x65}}], 0x3, 0x0, &(0x7f00000017c0)={0x0, r2+10000000}) [ 160.985473] netlink: 'syz-executor4': attribute type 29 has an invalid length. [ 161.004860] binder: 7475:7479 ioctl 2270 200001c0 returned -22 [ 161.005167] netlink: 'syz-executor4': attribute type 29 has an invalid length. 22:03:51 executing program 2: mq_open(&(0x7f0000000080)='lo.\x00', 0x0, 0x0, &(0x7f0000000100)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) signalfd(0xffffffffffffffff, &(0x7f0000000180), 0x8) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/255, 0x443}], 0xc8) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)) r1 = syz_open_pts(r0, 0x2) socket$pptp(0x18, 0x1, 0x2) dup3(r1, r0, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f00000003c0)) openat$mixer(0xffffffffffffff9c, &(0x7f0000000400)='/dev/mixer\x00', 0x0, 0x0) write(r0, &(0x7f0000000140), 0x0) 22:03:51 executing program 3: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='net/tcp6\x00') getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, &(0x7f0000000400), &(0x7f0000000440)=0x4) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x2, 0x0, 0x0, 0x0, 0x20000000000001ef}, 0x10}}, 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000006c0), 0x0, 0x20000000, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, 0x0, 0x108, 0x70bd26}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x4000) ioctl$sock_inet_SIOCSARP(r0, 0x40096101, &(0x7f0000000300)={{0x2, 0x0, @remote, [0xfe, 0x60000000]}, {0x0, @local}, 0x0, {0x2, 0x0, @loopback}}) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000000)={0x1}) [ 161.036673] binder: 7475:7484 ioctl 2270 200001c0 returned -22 [ 161.048210] netlink: 'syz-executor4': attribute type 29 has an invalid length. 22:03:51 executing program 1: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x4) 22:03:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/255, 0x443}], 0xc8) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/sequencer2\x00', 0x0, 0x0) timer_create(0x7, &(0x7f0000000700)={0x0, 0x6, 0x1, @thr={&(0x7f0000000580)="9377482846027d7c1fe9199e83938702c6664f8491673ef5d26b3682e5f40810110c837fb65767618706de034ba53c0e84c679029f46a6431c5ae327a0a17616b54fb26c50", &(0x7f0000000600)="2ac240409400b74dd04b8db4a9df12fbec44d717ae287067dd5305b32f4a84dde3ba35bc195612022707b3878264bde67246c1018c87f0e79d5a9bd3efec722f0098f014c3dddb4458e1eaaddb800cab4e244547f8f4e2261cb7c6a5123bca20925a802c352c"}}, &(0x7f0000000740)) ioctl$KVM_PPC_GET_PVINFO(0xffffffffffffffff, 0x4080aea1, &(0x7f0000000380)=""/215) ptrace$peek(0x1, 0x0, &(0x7f0000000180)) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(0xffffffffffffffff, 0x40505331, &(0x7f0000000300)={{0x5}}) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x2) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x8000, 0x0) r2 = dup3(r1, r0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000001c0)={0x10}) write(r0, &(0x7f0000c34fff), 0xffffff0b) 22:03:51 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) madvise(&(0x7f000066c000/0x2000)=nil, 0x2000, 0x4) [ 161.152250] QAT: Stopping all acceleration devices. [ 161.176436] QAT: Invalid ioctl 22:03:51 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f00000000c0)) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer\x00', 0x0, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x800, 0x0) eventfd(0x0) ioctl$int_in(r2, 0x800000c0045002, &(0x7f0000000200)=0x1000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000180)=0x5) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000300), &(0x7f0000000380)=0x8) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44b}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet6(r1, &(0x7f0000000280)={0xa, 0x4e24, 0x4, @mcast2, 0xfffffffffffff000}, 0x1c) readv(r2, &(0x7f00000014c0)=[{&(0x7f0000001500)=""/4096, 0x1000}], 0x1) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x80) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x100, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x1, 0x1000, &(0x7f000000a000/0x1000)=nil}) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000100)) [ 161.203623] QAT: Stopping all acceleration devices. [ 161.214014] netlink: 'syz-executor4': attribute type 29 has an invalid length. 22:03:51 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) [ 161.243995] QAT: Invalid ioctl [ 161.248798] netlink: 'syz-executor4': attribute type 29 has an invalid length. [ 161.278974] netlink: 'syz-executor4': attribute type 29 has an invalid length. [ 161.287111] netlink: 'syz-executor4': attribute type 29 has an invalid length. 22:03:51 executing program 1: r0 = socket$kcm(0xa, 0x3, 0x11) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) sendmsg$kcm(r0, &(0x7f00000027c0)={&(0x7f0000000000)=@nl=@unspec={0x2001001000000000}, 0x80, &(0x7f0000000080), 0x0, &(0x7f0000000100)=ANY=[]}, 0x0) 22:03:51 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000a8eff8)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000ac5000), 0x4) sendmmsg$unix(r0, &(0x7f00000bd000), 0x80, 0x0) r1 = memfd_create(&(0x7f0000000080)='dev ', 0x3) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r0, r1, &(0x7f0000000000), 0xffff) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) fcntl$addseals(r1, 0x409, 0x8) write$P9_RWALK(r1, &(0x7f0000003d40)={0x9}, 0x9) 22:03:51 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000040)={0x400000000002f}) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, &(0x7f0000000540)={'syz1\x00'}, 0x45c) write$uinput_user_dev(r0, &(0x7f0000000080)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff8]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) [ 161.300513] netlink: 'syz-executor4': attribute type 29 has an invalid length. [ 161.309795] netlink: 'syz-executor4': attribute type 29 has an invalid length. [ 161.336513] netlink: 'syz-executor4': attribute type 29 has an invalid length. 22:03:51 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x0, 0x0) r0 = socket(0x15, 0x80005, 0x0) getsockopt(r0, 0x114, 0x271b, &(0x7f0000000080)=""/13, &(0x7f000033bffc)=0xd) [ 161.417709] WARNING: CPU: 1 PID: 7533 at mm/slab_common.c:1031 kmalloc_slab+0x56/0x70 [ 161.425736] Kernel panic - not syncing: panic_on_warn set ... [ 161.425736] [ 161.433113] CPU: 1 PID: 7533 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #172 [ 161.440395] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 161.449731] Call Trace: [ 161.452325] dump_stack+0x1c4/0x2b4 [ 161.455951] ? dump_stack_print_info.cold.2+0x52/0x52 [ 161.461136] panic+0x238/0x4e7 [ 161.464313] ? add_taint.cold.5+0x16/0x16 [ 161.468539] ? __warn.cold.8+0x148/0x1ba [ 161.472587] ? kmalloc_slab+0x56/0x70 [ 161.476387] __warn.cold.8+0x163/0x1ba [ 161.480261] ? kmalloc_slab+0x56/0x70 [ 161.484054] report_bug+0x254/0x2d0 [ 161.487680] do_error_trap+0x1fc/0x4d0 [ 161.491573] ? math_error+0x3f0/0x3f0 [ 161.495361] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 161.500903] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 161.505745] ? trace_hardirqs_on_caller+0x310/0x310 [ 161.510747] ? __fget+0x4aa/0x740 [ 161.514188] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 161.519017] do_invalid_op+0x1b/0x20 [ 161.522725] invalid_op+0x14/0x20 [ 161.526162] RIP: 0010:kmalloc_slab+0x56/0x70 [ 161.530563] Code: c5 60 ab 00 89 5d c3 48 85 ff b8 10 00 00 00 74 f4 83 ef 01 c1 ef 03 0f b6 87 80 aa 00 89 eb d8 31 c0 81 e6 00 02 00 00 75 db <0f> 0b 5d c3 48 8b 04 c5 a0 aa 00 89 5d c3 66 90 66 2e 0f 1f 84 00 [ 161.549485] RSP: 0018:ffff88018d4dfad8 EFLAGS: 00010246 [ 161.554846] RAX: 0000000000000000 RBX: 00000000fffffff9 RCX: ffffc90007eae000 [ 161.562104] RDX: 0000000000000038 RSI: 0000000000000000 RDI: 0000003ffffffe60 [ 161.569374] RBP: ffff88018d4dfad8 R08: ffff8801c47a25c0 R09: ffffed0038610649 [ 161.576634] R10: ffff88018d4dfba8 R11: ffff8801c308324f R12: 0000000000000000 [ 161.583903] R13: 0000000000000000 R14: ffff8801c1029280 R15: 00000000006080c0 [ 161.591170] __kmalloc+0x25/0x760 [ 161.594605] ? ksys_dup3+0x680/0x680 [ 161.598321] ? __might_fault+0x12b/0x1e0 [ 161.602388] ? input_mt_init_slots+0xe5/0x4a0 [ 161.606886] input_mt_init_slots+0xe5/0x4a0 [ 161.611201] uinput_ioctl_handler.isra.10+0x2049/0x2540 [ 161.616558] ? uinput_request_submit.part.9+0x2d0/0x2d0 [ 161.621909] ? __fget_light+0x2e9/0x430 [ 161.625868] ? fget_raw+0x20/0x20 [ 161.629307] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 161.634857] ? compat_put_timespec64+0x110/0x280 [ 161.639611] ? compat_get_timespec64+0x2a0/0x2a0 [ 161.644363] ? uinput_ioctl_handler.isra.10+0x2540/0x2540 [ 161.649883] uinput_compat_ioctl+0x6b/0x90 [ 161.654117] __ia32_compat_sys_ioctl+0x20e/0x630 [ 161.658898] ? write_comp_data+0x11/0x70 [ 161.662962] do_fast_syscall_32+0x34d/0xfb2 [ 161.673186] ? do_int80_syscall_32+0x890/0x890 [ 161.677772] ? entry_SYSENTER_compat+0x68/0x7f [ 161.682361] ? trace_hardirqs_off_caller+0xbb/0x310 [ 161.687366] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 161.692190] ? trace_hardirqs_on_caller+0x310/0x310 [ 161.697190] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 161.702204] ? recalc_sigpending_tsk+0x180/0x180 [ 161.706955] ? kasan_check_write+0x14/0x20 [ 161.711186] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 161.716031] entry_SYSENTER_compat+0x70/0x7f [ 161.720425] RIP: 0023:0xf7fd5ca9 [ 161.723777] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 161.742678] RSP: 002b:00000000f5fd10cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036 [ 161.750380] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000005501 [ 161.757656] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 161.764911] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 161.772176] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 161.779428] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 161.787585] Kernel Offset: disabled [ 161.791205] Rebooting in 86400 seconds..