[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 42.632112][ T25] audit: type=1800 audit(1575256744.037:25): pid=7992 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 42.650910][ T25] audit: type=1800 audit(1575256744.037:26): pid=7992 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 42.694659][ T25] audit: type=1800 audit(1575256744.037:27): pid=7992 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.106' (ECDSA) to the list of known hosts. 2019/12/02 03:19:14 fuzzer started 2019/12/02 03:19:16 dialing manager at 10.128.0.26:40069 2019/12/02 03:19:16 syscalls: 2673 2019/12/02 03:19:16 code coverage: enabled 2019/12/02 03:19:16 comparison tracing: enabled 2019/12/02 03:19:16 extra coverage: extra coverage is not supported by the kernel 2019/12/02 03:19:16 setuid sandbox: enabled 2019/12/02 03:19:16 namespace sandbox: enabled 2019/12/02 03:19:16 Android sandbox: /sys/fs/selinux/policy does not exist 2019/12/02 03:19:16 fault injection: enabled 2019/12/02 03:19:16 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/12/02 03:19:16 net packet injection: enabled 2019/12/02 03:19:16 net device setup: enabled 2019/12/02 03:19:16 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2019/12/02 03:19:16 devlink PCI setup: PCI device 0000:00:10.0 is not available 03:21:01 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x6b) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0815b5055e0bcfe87b3071") r1 = socket$inet(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000200)={0x2, 0x1004e20, @loopback}, 0x10) sendto$inet(r1, &(0x7f0000000140)="6812334f6743a747f8bf094356", 0xd, 0x8800, &(0x7f00000000c0)={0x2, 0x4e21, @remote}, 0x10) connect$inet(r1, &(0x7f00000002c0)={0x2, 0x4e20, @empty}, 0x10) sendto$inet(r1, &(0x7f0000000100)='\x00', 0x38, 0x4088, 0x0, 0x0) recvmmsg(r1, &(0x7f00000038c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 03:21:01 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x6b) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0815b5055e0bcfe87b3071") socket$key(0xf, 0x3, 0x2) r1 = socket$inet6(0xa, 0x3, 0x100000001) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000480)={{{@in6, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0x4d6, 0x33}, 0x0, @in=@remote, 0x0, 0x0, 0x0, 0x6}}, 0xe8) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) sendmmsg(r1, &(0x7f0000007e00), 0x400000000000058, 0x0) syzkaller login: [ 159.830740][ T8156] IPVS: ftp: loaded support on port[0] = 21 [ 160.007891][ T8159] IPVS: ftp: loaded support on port[0] = 21 [ 160.019577][ T8156] chnl_net:caif_netlink_parms(): no params data found [ 160.088687][ T8156] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.097695][ T8156] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.106348][ T8156] device bridge_slave_0 entered promiscuous mode 03:21:01 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x6b) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0815b5055e0bcfe87b3071") r1 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg$alg(r1, &(0x7f00000000c0)=[{0x0, 0xff00, 0x0, 0x0, &(0x7f0000002780)=[@op={0x18, 0x29, 0xb}], 0x18}], 0x146, 0x0) [ 160.130538][ T8156] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.139445][ T8156] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.147761][ T8156] device bridge_slave_1 entered promiscuous mode [ 160.206323][ T8156] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 160.258794][ T8156] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 160.280424][ T8159] chnl_net:caif_netlink_parms(): no params data found [ 160.321790][ T8156] team0: Port device team_slave_0 added [ 160.337821][ T8162] IPVS: ftp: loaded support on port[0] = 21 [ 160.353588][ T8156] team0: Port device team_slave_1 added 03:21:01 executing program 3: r0 = socket$inet6(0xa, 0x3, 0x6b) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0815b5055e0bcfe87b3071") r1 = socket$inet(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000200)={0x2, 0x1004e20, @loopback}, 0x10) connect$inet(r1, &(0x7f00000002c0)={0x2, 0x4e20, @empty}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000038c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 160.454739][ T8156] device hsr_slave_0 entered promiscuous mode [ 160.503638][ T8156] device hsr_slave_1 entered promiscuous mode [ 160.544096][ T8159] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.551242][ T8159] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.572605][ T8159] device bridge_slave_0 entered promiscuous mode [ 160.623375][ T8159] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.630965][ T8159] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.662531][ T8159] device bridge_slave_1 entered promiscuous mode 03:21:02 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x6b) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0815b5055e0bcfe87b3071") r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x1, 0xef, 0x209e21, 0x100008000000001, 0x1}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r1, &(0x7f00000000c0), &(0x7f0000000180)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000004c0)={r1, &(0x7f0000000340)=')', 0x0}, 0x20) [ 160.758667][ T8159] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 160.768470][ T8156] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 160.814244][ T8156] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 160.868716][ T8159] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 160.889296][ T8156] netdevsim netdevsim0 netdevsim2: renamed from eth2 03:21:02 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x6b) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0815b5055e0bcfe87b3071") r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00\xdf\xf2\x02x\x1a\x9cu\xa1\x1b\xdaN\x1c\xef\xe9\nJ\x93\xf2\xee\xe8W\xcd\xc4\xadG\x17e\xf1\xd7\xda\xf7\xa1\xcf\x1f\xa4\xd3\xe32\xa0\x8c\xd4\xd0\x9a\xbb\xe15\xf2E`\xc9SX7\x02HG\xbd.p\xf4m\x8a\xd5u\x9c\x8c\xc0\x1b\x11\xd1.C(R\x16B5_\x1cVY,M\x83x\x89\xbe\xfb\xa5\x99\x99s\xea(D\x8d0\xec\x06\x1d\xe4\x9fw\xe7\x06\x11m\xcfL\x10HW\xf3\xf7\xee_\",\a\'\x11;\x85\x8a\x80S\v\x90\xab\x13\xe4\xc93\x96\x16\'\xdc\xecq\xcdQ\x8d\xec\xe0 \x13\xbd\x1a\x1f0\xcf\xe0\n\xeds\x85\xf2\x7f\xf1\xa4\x1fam\xc7\x12\x90\xf1Z\xbf\x15\xf7t+!}B\x15\a\x13\xbf\xa7\x05\xb1M\x89\xd5\xc43\x94\x84,\xeeFw\xc8\xe7\xa9\x9a\xbe\x0f\x80\xb9\xef\xafg2\xd0\x11\x94\b`\x8apREK*\x19zq\xbcRZ\xb2\xfc#*\xdaG5}\xc0y\xb5B\xa1Aa=\xde\xb4W\xdbC\x82f\xbb\xa12\x8b\x96J\xfa.\xf3mekE\xa0\xf2\xcd\x89\xe3\x99\x9c', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0x6db6e559) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000012c0)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00\xdf\xf2\x02x\x1a\x9cu\xa1\x1b\xdaN\x1c\xef\xe9\nJ\x93\xf2\xee\xe8W\xcd\xc4\xadG\x17e\xf1\xd7\xda\xf7\xa1\xcf\x1f\xa4\xd3\xe32\xa0\x8c\xd4\xd0\x9a\xbb\xe15\xf2E`\xc9SX7\x02HG\xbd.p\xf4m\x8a\xd5u\x9c\x8c\xc0\x1b\x11\xd1.C(R\x16B5_\x1cVY,M\x83x\x89\xbe\xfb\xa5\x99\x99s\xea(D\x8d0\xec\x06\x1d\xe4\x9fw\xe7\x06\x11m\xcfL\x10HW\xf3\xf7\xee_\",\a\'\x11;\x85\x8a\x80S\v\x90\xab\x13\xe4\xc93\x96\x16\'\xdc\xecq\xcdQ\x8d\xec\xe0 \x13\xbd\x1a\x1f0\xcf\xe0\n\xeds\x85\xf2\x7f\xf1\xa4\x1fam\xc7\x12\x90\xf1Z\xbf\x15\xf7t+!}B\x15\a\x13\xbf\xa7\x05\xb1M\x89\xd5\xc43\x94\x84,\xeeFw\xc8\xff\x03\x00\x00\x00\x00\x00\x00\xafg2\xd0\x11\x94\b`\x8apREK*\x19zq\xbcRZ\xb2\xfc#*\xdaG5}\xc0y\xb5B\xa1Aa=\xde\xb4W\xdbC\x82f\xbb\xa12\x8b\x96J\xfa.\xf3mekE\xa0\xf2\xcd\x89\xe3\x99\x9c', 0x275a, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_udp_int(r2, 0x11, 0x66, 0x0, &(0x7f0000000100)) [ 160.984603][ T8156] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 161.082057][ T8162] chnl_net:caif_netlink_parms(): no params data found [ 161.092446][ T8164] IPVS: ftp: loaded support on port[0] = 21 [ 161.110018][ T8159] team0: Port device team_slave_0 added [ 161.117871][ T8159] team0: Port device team_slave_1 added [ 161.129643][ T8167] IPVS: ftp: loaded support on port[0] = 21 [ 161.148951][ T8169] IPVS: ftp: loaded support on port[0] = 21 [ 161.166273][ T8162] bridge0: port 1(bridge_slave_0) entered blocking state [ 161.174087][ T8162] bridge0: port 1(bridge_slave_0) entered disabled state [ 161.181964][ T8162] device bridge_slave_0 entered promiscuous mode [ 161.189971][ T8162] bridge0: port 2(bridge_slave_1) entered blocking state [ 161.197418][ T8162] bridge0: port 2(bridge_slave_1) entered disabled state [ 161.205112][ T8162] device bridge_slave_1 entered promiscuous mode [ 161.253714][ T8162] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 161.265191][ T8162] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 161.302834][ T8162] team0: Port device team_slave_0 added [ 161.311667][ T8162] team0: Port device team_slave_1 added [ 161.364175][ T8159] device hsr_slave_0 entered promiscuous mode [ 161.411951][ T8159] device hsr_slave_1 entered promiscuous mode [ 161.451745][ T8159] debugfs: Directory 'hsr0' with parent '/' already present! [ 161.524303][ T8162] device hsr_slave_0 entered promiscuous mode [ 161.551803][ T8162] device hsr_slave_1 entered promiscuous mode [ 161.591603][ T8162] debugfs: Directory 'hsr0' with parent '/' already present! [ 161.619507][ T8162] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 161.704998][ T8162] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 161.764705][ T8162] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 161.825820][ T8162] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 161.930528][ T8164] chnl_net:caif_netlink_parms(): no params data found [ 161.980355][ T8162] bridge0: port 2(bridge_slave_1) entered blocking state [ 161.987600][ T8162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 161.995448][ T8162] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.002666][ T8162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 162.013149][ T8159] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 162.083810][ T8164] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.090927][ T8164] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.098826][ T8164] device bridge_slave_0 entered promiscuous mode [ 162.109150][ T8164] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.116424][ T8164] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.124204][ T8164] device bridge_slave_1 entered promiscuous mode [ 162.142243][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.150741][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.160966][ T8159] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 162.233517][ T8159] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 162.294935][ T8159] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 162.350563][ T8169] chnl_net:caif_netlink_parms(): no params data found [ 162.363187][ T8156] 8021q: adding VLAN 0 to HW filter on device bond0 [ 162.399612][ T8164] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 162.417469][ T8164] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 162.458354][ T8167] chnl_net:caif_netlink_parms(): no params data found [ 162.476649][ T8164] team0: Port device team_slave_0 added [ 162.490154][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 162.499900][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 162.508525][ T8169] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.518550][ T8169] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.529225][ T8169] device bridge_slave_0 entered promiscuous mode [ 162.539319][ T8156] 8021q: adding VLAN 0 to HW filter on device team0 [ 162.550295][ T8164] team0: Port device team_slave_1 added [ 162.566060][ T8169] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.573701][ T8169] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.581953][ T8169] device bridge_slave_1 entered promiscuous mode [ 162.674523][ T8164] device hsr_slave_0 entered promiscuous mode [ 162.721948][ T8164] device hsr_slave_1 entered promiscuous mode [ 162.761706][ T8164] debugfs: Directory 'hsr0' with parent '/' already present! [ 162.771801][ T8169] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 162.781180][ T8167] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.789235][ T8167] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.797083][ T8167] device bridge_slave_0 entered promiscuous mode [ 162.806252][ T8167] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.813902][ T8167] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.821692][ T8167] device bridge_slave_1 entered promiscuous mode [ 162.830567][ T8162] 8021q: adding VLAN 0 to HW filter on device bond0 [ 162.841596][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 162.853317][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 162.865448][ T8170] bridge0: port 1(bridge_slave_0) entered blocking state [ 162.872572][ T8170] bridge0: port 1(bridge_slave_0) entered forwarding state [ 162.883733][ T8169] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 162.910883][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 162.919302][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 162.927180][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 162.934923][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 162.944278][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 162.952777][ T8170] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.959826][ T8170] bridge0: port 2(bridge_slave_1) entered forwarding state [ 162.977046][ T8167] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 163.001242][ T8167] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 163.019639][ T8162] 8021q: adding VLAN 0 to HW filter on device team0 [ 163.030928][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 163.039847][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 163.066599][ T8164] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 163.134183][ T8169] team0: Port device team_slave_0 added [ 163.145053][ T8169] team0: Port device team_slave_1 added [ 163.162329][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 163.170936][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 163.179943][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 163.188615][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 163.197303][ T8172] bridge0: port 1(bridge_slave_0) entered blocking state [ 163.204408][ T8172] bridge0: port 1(bridge_slave_0) entered forwarding state [ 163.212168][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 163.220741][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 163.229320][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 163.237987][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 163.246437][ T8172] bridge0: port 2(bridge_slave_1) entered blocking state [ 163.253616][ T8172] bridge0: port 2(bridge_slave_1) entered forwarding state [ 163.261411][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 163.275988][ T8164] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 163.384589][ T8169] device hsr_slave_0 entered promiscuous mode [ 163.421992][ T8169] device hsr_slave_1 entered promiscuous mode [ 163.461676][ T8169] debugfs: Directory 'hsr0' with parent '/' already present! [ 163.471438][ T8167] team0: Port device team_slave_0 added [ 163.477817][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 163.486359][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 163.497517][ T8164] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 163.555846][ T8164] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 163.605530][ T8167] team0: Port device team_slave_1 added [ 163.618126][ T8156] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 163.630052][ T8156] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 163.638788][ T3834] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 163.647975][ T3834] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 163.656946][ T3834] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 163.690763][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 163.699612][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 163.709155][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 163.717944][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 163.727236][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 163.757000][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 163.770736][ T8162] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 163.782623][ T8162] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 163.822458][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 163.830899][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 163.843251][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 163.852787][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 163.861121][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 163.890025][ T8156] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 163.900747][ T8169] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 163.963370][ T8169] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 164.017536][ T8169] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 164.084906][ T3834] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 164.092673][ T3834] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 164.144492][ T8167] device hsr_slave_0 entered promiscuous mode [ 164.183053][ T8167] device hsr_slave_1 entered promiscuous mode [ 164.241870][ T8167] debugfs: Directory 'hsr0' with parent '/' already present! [ 164.252834][ T8159] 8021q: adding VLAN 0 to HW filter on device bond0 [ 164.272986][ T8162] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 164.280125][ T8169] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 164.329511][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 164.337311][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 164.370545][ T8159] 8021q: adding VLAN 0 to HW filter on device team0 [ 164.396497][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 164.405455][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 164.450159][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 164.460060][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 164.468619][ T30] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.475755][ T30] bridge0: port 1(bridge_slave_0) entered forwarding state [ 164.485565][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 164.507293][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 164.515964][ T30] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.523088][ T30] bridge0: port 2(bridge_slave_1) entered forwarding state [ 164.546719][ T8164] 8021q: adding VLAN 0 to HW filter on device bond0 [ 164.595274][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 164.605699][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 164.619105][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 164.637271][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 164.647295][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 164.656179][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 164.665546][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 164.667064][ T8185] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 164.680500][ T8159] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 164.705829][ T8159] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 164.726745][ T8167] netdevsim netdevsim4 netdevsim0: renamed from eth0 03:21:06 executing program 2: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="48000000140081fb7059ae08060c04000fff00b915648701546fabca1b4e7d06a6bd7c493872f750375ed08a562ad6e74703c48f93b82a02000000461eb886a511008f0000000000", 0x48}], 0x1}, 0x0) [ 164.776099][ T8169] 8021q: adding VLAN 0 to HW filter on device bond0 [ 164.786918][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 164.797245][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 164.810386][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready 03:21:06 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x1, 0xef, 0x209e21, 0x100008000000001, 0x1}, 0x3c) r1 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r0, &(0x7f00000000c0), &(0x7f0000000180)}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f00000000c0), &(0x7f00000000c0)}, 0x20) [ 164.830482][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 164.840804][ T30] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 164.878045][ T8164] 8021q: adding VLAN 0 to HW filter on device team0 [ 164.893246][ T8167] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 164.934103][ T8167] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 164.983864][ T8167] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 165.026140][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 165.034123][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 165.047075][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 165.056227][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 165.064205][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 165.082536][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 165.090987][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 165.099925][ T2991] bridge0: port 1(bridge_slave_0) entered blocking state [ 165.106990][ T2991] bridge0: port 1(bridge_slave_0) entered forwarding state [ 165.114711][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 165.123540][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 165.132241][ T2991] bridge0: port 2(bridge_slave_1) entered blocking state [ 165.139281][ T2991] bridge0: port 2(bridge_slave_1) entered forwarding state [ 165.146940][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 165.155894][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 165.165557][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 03:21:06 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ppoll(&(0x7f0000000140)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 03:21:06 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) accept4$inet6(r1, 0x0, 0x0, 0x0) recvfrom$inet(r0, 0x0, 0x1000001ab, 0x2, 0x0, 0x800e004e9) shutdown(r0, 0x0) [ 165.193301][ T8159] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 165.227176][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 165.261222][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 165.275417][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 165.285023][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 165.293789][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 165.301990][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:21:06 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x26e1, 0x1a0ffffffff) perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x5, 0x5, 0x0, 0x0, 0x0, 0x7fff, 0x5, 0x0, 0x7f, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8ab}, 0x24800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x667a}, 0xffffffffffffffff, 0x1, r0, 0x0) openat$cgroup_int(r0, &(0x7f0000000040)='pids.max\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40086602, 0x400007) ioctl$TUNDETACHFILTER(0xffffffffffffffff, 0x401054d6, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x26e1, 0x1a0ffffffff) perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x5, 0x5, 0x0, 0x0, 0x0, 0x7fff, 0x5, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8ab}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x667a}, 0xffffffffffffffff, 0x1, r2, 0x0) r3 = perf_event_open$cgroup(&(0x7f0000000380)={0x5, 0x70, 0x3, 0xc1, 0x0, 0xf8, 0x0, 0x6, 0x80000, 0xb, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0xfffffffa, 0x1, @perf_bp={&(0x7f00000001c0)}, 0x0, 0x100, 0x6, 0x6, 0xa84a, 0x81, 0x910}, r2, 0xc, 0xffffffffffffffff, 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000008009500f10100000000487591731cba12c07d57d995b61e89a4530f92304f242b416ae9eeefc0e9c60ebab1c176bf9bb4dde984510c82dc2b9381b72b100d0682fd0a0c4906b29e220dc28dac72599456d4c4e6f3fe2d1dee18f638ac947b5e026a3287c84ccc727d6ef3834293812e927c01c7da1322da44c7f2ed1084aa2f56d1cb398dff1db3df9858837458a4ca03767c69cee1b6be484e4c9507af216bd8ed42f7dd5adb8e49f4a94615e49c08c9a208ed88b37ab8d7674c644dca2f"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x222}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r4, 0x18000000000002a0, 0xe80, 0x0, &(0x7f00000000c0)="b9ff03c6630d698cb89e0bf088ca1fffffff0e000000631177fbac14140ce4", 0x0, 0x9}, 0x28) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000280)=r4) perf_event_open$cgroup(&(0x7f0000000300)={0x1, 0x70, 0x8, 0x8, 0x0, 0x7, 0x0, 0x80000000, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x33e, 0x1, @perf_bp={&(0x7f0000000180), 0x8}, 0x1968, 0x3, 0x8000, 0x1, 0x4, 0x4}, 0xffffffffffffffff, 0x5, r3, 0x8) [ 165.310490][ T8170] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 165.352749][ T8169] 8021q: adding VLAN 0 to HW filter on device team0 [ 165.373034][ C0] hrtimer: interrupt took 40951 ns [ 165.391938][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 165.401382][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 165.410372][ T8172] bridge0: port 1(bridge_slave_0) entered blocking state [ 165.417512][ T8172] bridge0: port 1(bridge_slave_0) entered forwarding state [ 165.426204][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 165.438519][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready 03:21:06 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x26e1, 0x1a0ffffffff) perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x5, 0x5, 0x0, 0x0, 0x0, 0x7fff, 0x5, 0x0, 0x7f, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8ab}, 0x24800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x667a}, 0xffffffffffffffff, 0x1, r0, 0x0) openat$cgroup_int(r0, &(0x7f0000000040)='pids.max\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40086602, 0x400007) ioctl$TUNDETACHFILTER(0xffffffffffffffff, 0x401054d6, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x26e1, 0x1a0ffffffff) perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x5, 0x5, 0x0, 0x0, 0x0, 0x7fff, 0x5, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8ab}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x667a}, 0xffffffffffffffff, 0x1, r2, 0x0) r3 = perf_event_open$cgroup(&(0x7f0000000380)={0x5, 0x70, 0x3, 0xc1, 0x0, 0xf8, 0x0, 0x6, 0x80000, 0xb, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0xfffffffa, 0x1, @perf_bp={&(0x7f00000001c0)}, 0x0, 0x100, 0x6, 0x6, 0xa84a, 0x81, 0x910}, r2, 0xc, 0xffffffffffffffff, 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000008009500f10100000000487591731cba12c07d57d995b61e89a4530f92304f242b416ae9eeefc0e9c60ebab1c176bf9bb4dde984510c82dc2b9381b72b100d0682fd0a0c4906b29e220dc28dac72599456d4c4e6f3fe2d1dee18f638ac947b5e026a3287c84ccc727d6ef3834293812e927c01c7da1322da44c7f2ed1084aa2f56d1cb398dff1db3df9858837458a4ca03767c69cee1b6be484e4c9507af216bd8ed42f7dd5adb8e49f4a94615e49c08c9a208ed88b37ab8d7674c644dca2f"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x222}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r4, 0x18000000000002a0, 0xe80, 0x0, &(0x7f00000000c0)="b9ff03c6630d698cb89e0bf088ca1fffffff0e000000631177fbac14140ce4", 0x0, 0x9}, 0x28) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000280)=r4) perf_event_open$cgroup(&(0x7f0000000300)={0x1, 0x70, 0x8, 0x8, 0x0, 0x7, 0x0, 0x80000000, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x33e, 0x1, @perf_bp={&(0x7f0000000180), 0x8}, 0x1968, 0x3, 0x8000, 0x1, 0x4, 0x4}, 0xffffffffffffffff, 0x5, r3, 0x8) [ 165.447508][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 165.464625][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 165.479415][ T8164] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 165.542525][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 165.554908][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 165.575660][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 165.590291][ T8172] bridge0: port 2(bridge_slave_1) entered blocking state [ 165.597438][ T8172] bridge0: port 2(bridge_slave_1) entered forwarding state [ 165.611405][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 165.621297][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 03:21:07 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x26e1, 0x1a0ffffffff) perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x5, 0x5, 0x0, 0x0, 0x0, 0x7fff, 0x5, 0x0, 0x7f, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8ab}, 0x24800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x667a}, 0xffffffffffffffff, 0x1, r0, 0x0) openat$cgroup_int(r0, &(0x7f0000000040)='pids.max\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40086602, 0x400007) ioctl$TUNDETACHFILTER(0xffffffffffffffff, 0x401054d6, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x26e1, 0x1a0ffffffff) perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x5, 0x5, 0x0, 0x0, 0x0, 0x7fff, 0x5, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8ab}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x667a}, 0xffffffffffffffff, 0x1, r2, 0x0) r3 = perf_event_open$cgroup(&(0x7f0000000380)={0x5, 0x70, 0x3, 0xc1, 0x0, 0xf8, 0x0, 0x6, 0x80000, 0xb, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0xfffffffa, 0x1, @perf_bp={&(0x7f00000001c0)}, 0x0, 0x100, 0x6, 0x6, 0xa84a, 0x81, 0x910}, r2, 0xc, 0xffffffffffffffff, 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000008009500f10100000000487591731cba12c07d57d995b61e89a4530f92304f242b416ae9eeefc0e9c60ebab1c176bf9bb4dde984510c82dc2b9381b72b100d0682fd0a0c4906b29e220dc28dac72599456d4c4e6f3fe2d1dee18f638ac947b5e026a3287c84ccc727d6ef3834293812e927c01c7da1322da44c7f2ed1084aa2f56d1cb398dff1db3df9858837458a4ca03767c69cee1b6be484e4c9507af216bd8ed42f7dd5adb8e49f4a94615e49c08c9a208ed88b37ab8d7674c644dca2f"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x222}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r4, 0x18000000000002a0, 0xe80, 0x0, &(0x7f00000000c0)="b9ff03c6630d698cb89e0bf088ca1fffffff0e000000631177fbac14140ce4", 0x0, 0x9}, 0x28) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000280)=r4) perf_event_open$cgroup(&(0x7f0000000300)={0x1, 0x70, 0x8, 0x8, 0x0, 0x7, 0x0, 0x80000000, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x33e, 0x1, @perf_bp={&(0x7f0000000180), 0x8}, 0x1968, 0x3, 0x8000, 0x1, 0x4, 0x4}, 0xffffffffffffffff, 0x5, r3, 0x8) [ 165.636058][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 165.647564][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 165.660472][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 165.669735][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 165.678872][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 165.687821][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 165.712991][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 165.740981][ T8169] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 165.758326][ T8169] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 165.781343][ T8167] 8021q: adding VLAN 0 to HW filter on device bond0 [ 165.795071][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 165.806974][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 165.818595][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 165.828878][ T2991] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 03:21:07 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x4000000000000002) r3 = dup3(r2, r0, 0x0) socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fcntl$dupfd(r5, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TCXONC(r3, 0x540a, 0x0) write$P9_RATTACH(r0, &(0x7f00000001c0)={0x14}, 0xffffffde) fcntl$setstatus(r0, 0x4, 0x40800) ioctl$TCXONC(r3, 0x540a, 0x1) 03:21:07 executing program 2: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0x26c, 0x0, &(0x7f0000000080)="020043d05d25b666cd783f4b231c", 0x0, 0x8e}, 0x28) [ 165.857342][ T8164] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 165.901884][ T8176] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 165.917810][ T8176] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 165.938621][ T8169] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 165.957986][ T8167] 8021q: adding VLAN 0 to HW filter on device team0 [ 165.980974][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 165.995057][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 166.012300][ T3834] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 166.020909][ T3834] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 166.031665][ T3834] bridge0: port 1(bridge_slave_0) entered blocking state [ 166.038875][ T3834] bridge0: port 1(bridge_slave_0) entered forwarding state [ 166.047611][ T3834] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 166.102454][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 166.111006][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 166.139931][ T8172] bridge0: port 2(bridge_slave_1) entered blocking state [ 166.147111][ T8172] bridge0: port 2(bridge_slave_1) entered forwarding state [ 166.157254][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 166.166877][ T8172] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 166.180806][ T8239] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 166.191044][ T8167] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 166.216870][ T8167] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 166.235105][ T8196] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 166.245543][ T8196] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 166.254208][ T8196] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 166.267082][ T8196] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 166.277057][ T8196] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 166.286453][ T8196] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 166.295584][ T8196] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 166.304358][ T8196] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 166.313569][ T8196] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 166.321234][ T8196] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 03:21:07 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x4000000000000002) r3 = dup3(r2, r0, 0x0) socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fcntl$dupfd(r5, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TCXONC(r3, 0x540a, 0x0) write$P9_RATTACH(r0, &(0x7f00000001c0)={0x14}, 0xffffffde) fcntl$setstatus(r0, 0x4, 0x40800) ioctl$TCXONC(r3, 0x540a, 0x1) [ 166.358259][ T8196] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 166.366383][ T8196] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 166.380959][ T8167] 8021q: adding VLAN 0 to HW filter on device batadv0 03:21:08 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x6a, &(0x7f0000000000)={@local, @dev, [], {@ipv4={0x800, {{0x6, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev, {[@ssrr={0x89, 0x3}]}}, @gre}}}}, 0x0) 03:21:08 executing program 5: sendmmsg(0xffffffffffffffff, &(0x7f0000009fc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000003d00)=ANY=[@ANYBLOB="a000000000000000000000e89dd3b6564eefabca4fd73119e640be0128aaf28c2bf53fa54780694ff81c0016c1bd9fdacc1289e2b6b7d7d7430bd974f67b386be919de38b112f6efdddfb86921e47bfa9e44ba2648c04b4a674c56dc734603000000000000001835c8a3eba768eff2ffffffffffffece1b5e8432f610367978990b3673f57106ca7b26571eee0ee29efada12c1900"/160], 0xa0}}], 0x1, 0x20000080) getrlimit(0xf, &(0x7f0000004780)) r0 = socket$netlink(0x10, 0x3, 0x0) pipe2(&(0x7f00000000c0), 0x80000) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_MSCBIT(r1, 0x40045568, 0x3a) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000e00)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_MSCBIT(r2, 0x40045568, 0x3a) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000e00)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_MSCBIT(r3, 0x40045568, 0x3a) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000e00)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_MSCBIT(r4, 0x40045568, 0x3a) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[]}, 0x1, 0x0, 0x0, 0x7d3246052bbcada2}, 0x24048800) open$dir(&(0x7f0000000040)='./file0\x00', 0x791613ca26d29cce, 0x80) clock_gettime(0x2, &(0x7f0000000180)) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r5 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000000)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$unlink(0x9, r5, 0xfffffffffffffffd) 03:21:08 executing program 2: 03:21:08 executing program 0: 03:21:08 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x4000000000000002) r3 = dup3(r2, r0, 0x0) socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fcntl$dupfd(r5, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TCXONC(r3, 0x540a, 0x0) write$P9_RATTACH(r0, &(0x7f00000001c0)={0x14}, 0xffffffde) fcntl$setstatus(r0, 0x4, 0x40800) ioctl$TCXONC(r3, 0x540a, 0x1) 03:21:08 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x4000000000000002) r3 = dup3(r2, r0, 0x0) socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fcntl$dupfd(r5, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TCXONC(r3, 0x540a, 0x0) write$P9_RATTACH(r0, &(0x7f00000001c0)={0x14}, 0xffffffde) fcntl$setstatus(r0, 0x4, 0x40800) ioctl$TCXONC(r3, 0x540a, 0x1) 03:21:08 executing program 2: r0 = timerfd_create(0x0, 0x0) fgetxattr(r0, &(0x7f0000000080)=@known='security.apparmor\x00', 0x0, 0x0) 03:21:08 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x26e1, 0x1a0ffffffff) perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x5, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8ab}, 0x24800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x667a}, 0xffffffffffffffff, 0x1, r1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) ioctl$TUNDETACHFILTER(0xffffffffffffffff, 0x401054d6, 0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x26e1, 0x1a0ffffffff) perf_event_open$cgroup(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x5, 0x5, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x7f, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8ab}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x667a}, 0xffffffffffffffff, 0x1, r2, 0x0) r3 = perf_event_open$cgroup(&(0x7f0000000380)={0x5, 0x70, 0x3, 0xc1, 0x1, 0x0, 0x0, 0x6, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffffffa, 0x0, @perf_bp={0x0}, 0x0, 0x100, 0x6, 0x6, 0xa84a, 0x81, 0x910}, r2, 0xc, 0xffffffffffffffff, 0x1) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000008009500f10100000000487591731cba12c07d57d995b61e89a4530f92304f242b416ae9eeefc0e9c60ebab1c176bf9bb4dde984510c82dc2b9381b72b100d0682fd0a0c4906b29e220dc28dac72599456d4c4e6f3fe2d1dee18f638ac947b5e026a3287c84ccc727d6ef3834293812e927c01c7da1322da44c7f2ed1084aa2f56d1cb398dff1db3df9858837458a4ca03767c69cee1b6be484e4c9507af216bd8ed42f7dd5adb8e49f4a94615e49c08c9a208ed88b37ab8d7674c644dca2f"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x222}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r4, 0x18000000000002a0, 0xe80, 0x0, &(0x7f00000000c0)="b9ff03c6630d698cb89e0bf088ca1fffffff0e000000631177fbac14140ce4", 0x0, 0x9}, 0x28) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000280)=r4) perf_event_open$cgroup(&(0x7f0000000300)={0x1, 0x70, 0x8, 0x8, 0x0, 0x7, 0x0, 0x80000000, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x33e, 0x0, @perf_bp={&(0x7f0000000180), 0x8}, 0x1968, 0x3, 0x8000, 0x1, 0x4, 0x4, 0x4}, r0, 0x5, r3, 0x8) 03:21:08 executing program 4: 03:21:08 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x4000000000000002) r3 = dup3(r2, r0, 0x0) socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fcntl$dupfd(r5, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TCXONC(r3, 0x540a, 0x0) write$P9_RATTACH(r0, &(0x7f00000001c0)={0x14}, 0xffffffde) fcntl$setstatus(r0, 0x4, 0x40800) ioctl$TCXONC(r3, 0x540a, 0x1) 03:21:08 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x4000000000000002) r3 = dup3(r2, r0, 0x0) socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fcntl$dupfd(r5, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TCXONC(r3, 0x540a, 0x0) write$P9_RATTACH(r0, &(0x7f00000001c0)={0x14}, 0xffffffde) fcntl$setstatus(r0, 0x4, 0x40800) ioctl$TCXONC(r3, 0x540a, 0x1) 03:21:08 executing program 2: 03:21:08 executing program 4: 03:21:08 executing program 0: 03:21:08 executing program 2: 03:21:08 executing program 4: 03:21:08 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x4000000000000002) r3 = dup3(r2, r0, 0x0) socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fcntl$dupfd(r5, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TCXONC(r3, 0x540a, 0x0) write$P9_RATTACH(r0, &(0x7f00000001c0)={0x14}, 0xffffffde) fcntl$setstatus(r0, 0x4, 0x40800) ioctl$TCXONC(r3, 0x540a, 0x1) 03:21:08 executing program 5: 03:21:08 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x4000000000000002) r3 = dup3(r2, r0, 0x0) socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fcntl$dupfd(r5, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TCXONC(r3, 0x540a, 0x0) write$P9_RATTACH(r0, &(0x7f00000001c0)={0x14}, 0xffffffde) fcntl$setstatus(r0, 0x4, 0x40800) 03:21:08 executing program 2: 03:21:08 executing program 4: 03:21:08 executing program 0: 03:21:08 executing program 5: 03:21:08 executing program 0: 03:21:08 executing program 0: 03:21:09 executing program 2: 03:21:09 executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x1, 0xef, 0x209e21, 0x100008000000001}, 0x3c) r1 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r0, &(0x7f00000000c0), &(0x7f0000000180)}, 0x20) 03:21:09 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0xfffffffffffffd73}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d91c22def1125d7b1e821039a85ad8b91cea336a1b57f45a0788e3aba045", 0x13}], 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x40, 0x0, 0xfffffffffffffc52}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) fcntl$setownex(0xffffffffffffffff, 0xf, 0x0) 03:21:09 executing program 5: socket$inet6(0xa, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') socket$unix(0x1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x47, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) openat$uhid(0xffffffffffffff9c, &(0x7f0000000d80)='/dev/uhid\x00', 0xbcbd9ebe980348ff, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x5, 0x6, 0x6d, 0x2, 0x0, 0x0}, 0x10) syncfs(0xffffffffffffffff) r2 = msgget$private(0x0, 0x0) msgctl$IPC_SET(r2, 0x1, &(0x7f0000258f88)) msgrcv(r2, &(0x7f0000000180)={0x0, ""/93}, 0x65, 0x0, 0x0) msgctl$MSG_INFO(r2, 0xc, &(0x7f0000000480)=""/4096) writev(0xffffffffffffffff, &(0x7f0000004f40)=[{&(0x7f0000000100)="c83add0656bfe5ac91d8cfdcb924179961a16de5ef69dfb99413a6e7537f24cec1", 0x21}, {&(0x7f0000004d00)="26300b91dbe2a1ae65b477355b66c9cfd93f324ad3412d6492a852fd2a1d903ecf946d1216311be461fd065c8184dc7fbcd770c371b4fd086472df88bd4a853b52b8793ee36cef1a1c5ca6bd610253e5a48c512a157173b5bd067aadbefd5d9a94bd418e8bd8cd477594c8895c92c7f4676354ea0fd268531e8ed9e0cd12774d332fed278485a5746653fe6f01eabd67b79868f353eaa615d60d7c94bf39fae7fdd64368de3ff0608c216cef50e21cb450cf411b17a1fa5c37867731e5148442d7fd81ad", 0xc4}, {&(0x7f0000000140)="2b0ec62b1515b796df18bf83eca247a016d791b2e92514d495af521095847ba5b16a8396d2d84eb078efb51bd7701a0511f598", 0x33}, {&(0x7f0000004e00)="63a445dec719ca15fe286118f15c5e655b64f85475c26e07a73092343c105dd5930f11bd6921ccbb6e22a2114dcdac73ddc0619f840cde4bcb85aa761dcbd64e335609fd60155f308a729ae03aa848332de5bc990b46d4cee9beeec2a9cb5100a6afc1c8183984e364a04ea6d06afd94897678099a5e147355cf55e0ff0fe9ef7774f44f1ae09cfd2f41fa0665bb", 0x8e}, {&(0x7f0000004ec0)="69bf496c4cec0e7c72d856dacaf55270a239e4c1bcf97713e88c1b3b128bcdbf196f80fd91c5ce4e090ccbbb14b107075907599d1ce2ab9f421a9f704a7184c0b39162c29949fd4b24538bbb302f5c4a1d0611acbdc47600789df3cbc6da21634a31f69df7bf7572592e94772aab85a7de1deeefe3c7fe61e4e92afdcb", 0x7d}], 0x5) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1a4, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x80800) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r3, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x3}, 0x10) sendmsg$can_bcm(r3, &(0x7f0000000000)={&(0x7f0000000200), 0x10, &(0x7f00000002c0)={0x0}}, 0x0) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000240)="24000000180007841dfffd946f610500020081001f038b0602000800080006000400ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 03:21:09 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000400)={0x0, 0xefe2f128, &(0x7f0000000000)=[{&(0x7f0000000080)=""/208, 0xd0}], 0xb}, 0x2) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x2a80, 0x0, 0x0, 0x800e00506) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r3, 0x0, 0xffffffa9, 0x0, 0x0, 0x800e00516) shutdown(r2, 0x0) 03:21:09 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x4000000000000002) r3 = dup3(r2, r0, 0x0) socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fcntl$dupfd(r5, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TCXONC(r3, 0x540a, 0x0) write$P9_RATTACH(r0, &(0x7f00000001c0)={0x14}, 0xffffffde) fcntl$setstatus(r0, 0x4, 0x40800) 03:21:09 executing program 2: socket$inet6_tcp(0xa, 0x1, 0x0) ptrace$peekuser(0x3, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') mount(0x0, 0x0, &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000140)='net/sockstat6\x00') creat(0x0, 0x0) io_destroy(0x0) syz_emit_ethernet(0x2a, &(0x7f00000001c0)={@link_local, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, @udp={0x4e21, 0x4e21, 0x8}}}}}, 0x0) getdents(0xffffffffffffffff, &(0x7f00000005c0)=""/223, 0xfe47) 03:21:09 executing program 4: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1, 0xffffffffffffffff, 0x0, [], 0x0, r1, 0xc, 0x1}, 0x3c) 03:21:09 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0xffffffffa0018000, 0x0, &(0x7f0000000000)={&(0x7f0000000500)={0x2, 0x2, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) 03:21:09 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) 03:21:09 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) recvmsg(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) 03:21:09 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0xffffffffa0018000, 0x0, &(0x7f0000000000)={&(0x7f0000000500)={0x2, 0x2, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) 03:21:09 executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000300)={0x4, 0xfffffffd}, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000300)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) 03:21:10 executing program 0: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f00000001c0), 0xfffffef3) fcntl$setpipe(r0, 0x407, 0x0) 03:21:10 executing program 5: socket$inet6(0xa, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') socket$unix(0x1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x47, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) openat$uhid(0xffffffffffffff9c, &(0x7f0000000d80)='/dev/uhid\x00', 0xbcbd9ebe980348ff, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x5, 0x6, 0x6d, 0x2, 0x0, 0x0}, 0x10) syncfs(0xffffffffffffffff) r2 = msgget$private(0x0, 0x0) msgctl$IPC_SET(r2, 0x1, &(0x7f0000258f88)) msgrcv(r2, &(0x7f0000000180)={0x0, ""/93}, 0x65, 0x0, 0x0) msgctl$MSG_INFO(r2, 0xc, &(0x7f0000000480)=""/4096) writev(0xffffffffffffffff, &(0x7f0000004f40)=[{&(0x7f0000000100)="c83add0656bfe5ac91d8cfdcb924179961a16de5ef69dfb99413a6e7537f24cec1", 0x21}, {&(0x7f0000004d00)="26300b91dbe2a1ae65b477355b66c9cfd93f324ad3412d6492a852fd2a1d903ecf946d1216311be461fd065c8184dc7fbcd770c371b4fd086472df88bd4a853b52b8793ee36cef1a1c5ca6bd610253e5a48c512a157173b5bd067aadbefd5d9a94bd418e8bd8cd477594c8895c92c7f4676354ea0fd268531e8ed9e0cd12774d332fed278485a5746653fe6f01eabd67b79868f353eaa615d60d7c94bf39fae7fdd64368de3ff0608c216cef50e21cb450cf411b17a1fa5c37867731e5148442d7fd81ad", 0xc4}, {&(0x7f0000000140)="2b0ec62b1515b796df18bf83eca247a016d791b2e92514d495af521095847ba5b16a8396d2d84eb078efb51bd7701a0511f598", 0x33}, {&(0x7f0000004e00)="63a445dec719ca15fe286118f15c5e655b64f85475c26e07a73092343c105dd5930f11bd6921ccbb6e22a2114dcdac73ddc0619f840cde4bcb85aa761dcbd64e335609fd60155f308a729ae03aa848332de5bc990b46d4cee9beeec2a9cb5100a6afc1c8183984e364a04ea6d06afd94897678099a5e147355cf55e0ff0fe9ef7774f44f1ae09cfd2f41fa0665bb", 0x8e}, {&(0x7f0000004ec0)="69bf496c4cec0e7c72d856dacaf55270a239e4c1bcf97713e88c1b3b128bcdbf196f80fd91c5ce4e090ccbbb14b107075907599d1ce2ab9f421a9f704a7184c0b39162c29949fd4b24538bbb302f5c4a1d0611acbdc47600789df3cbc6da21634a31f69df7bf7572592e94772aab85a7de1deeefe3c7fe61e4e92afdcb", 0x7d}], 0x5) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1a4, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x80800) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r3, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x3}, 0x10) sendmsg$can_bcm(r3, &(0x7f0000000000)={&(0x7f0000000200), 0x10, &(0x7f00000002c0)={0x0}}, 0x0) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000240)="24000000180007841dfffd946f610500020081001f038b0602000800080006000400ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 03:21:10 executing program 1: socket$inet6(0xa, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') socket$unix(0x1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x47, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) openat$uhid(0xffffffffffffff9c, &(0x7f0000000d80)='/dev/uhid\x00', 0xbcbd9ebe980348ff, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x5, 0x6, 0x6d, 0x2, 0x0, 0x0}, 0x10) syncfs(0xffffffffffffffff) r2 = msgget$private(0x0, 0x0) msgctl$IPC_SET(r2, 0x1, &(0x7f0000258f88)) msgrcv(r2, &(0x7f0000000180)={0x0, ""/93}, 0x65, 0x0, 0x0) msgctl$MSG_INFO(r2, 0xc, &(0x7f0000000480)=""/4096) writev(0xffffffffffffffff, &(0x7f0000004f40)=[{&(0x7f0000000100)="c83add0656bfe5ac91d8cfdcb924179961a16de5ef69dfb99413a6e7537f24cec1", 0x21}, {&(0x7f0000004d00)="26300b91dbe2a1ae65b477355b66c9cfd93f324ad3412d6492a852fd2a1d903ecf946d1216311be461fd065c8184dc7fbcd770c371b4fd086472df88bd4a853b52b8793ee36cef1a1c5ca6bd610253e5a48c512a157173b5bd067aadbefd5d9a94bd418e8bd8cd477594c8895c92c7f4676354ea0fd268531e8ed9e0cd12774d332fed278485a5746653fe6f01eabd67b79868f353eaa615d60d7c94bf39fae7fdd64368de3ff0608c216cef50e21cb450cf411b17a1fa5c37867731e5148442d7fd81ad", 0xc4}, {&(0x7f0000000140)="2b0ec62b1515b796df18bf83eca247a016d791b2e92514d495af521095847ba5b16a8396d2d84eb078efb51bd7701a0511f598", 0x33}, {&(0x7f0000004e00)="63a445dec719ca15fe286118f15c5e655b64f85475c26e07a73092343c105dd5930f11bd6921ccbb6e22a2114dcdac73ddc0619f840cde4bcb85aa761dcbd64e335609fd60155f308a729ae03aa848332de5bc990b46d4cee9beeec2a9cb5100a6afc1c8183984e364a04ea6d06afd94897678099a5e147355cf55e0ff0fe9ef7774f44f1ae09cfd2f41fa0665bb", 0x8e}, {&(0x7f0000004ec0)="69bf496c4cec0e7c72d856dacaf55270a239e4c1bcf97713e88c1b3b128bcdbf196f80fd91c5ce4e090ccbbb14b107075907599d1ce2ab9f421a9f704a7184c0b39162c29949fd4b24538bbb302f5c4a1d0611acbdc47600789df3cbc6da21634a31f69df7bf7572592e94772aab85a7de1deeefe3c7fe61e4e92afdcb", 0x7d}], 0x5) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1a4, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x80800) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r3, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x3}, 0x10) sendmsg$can_bcm(r3, &(0x7f0000000000)={&(0x7f0000000200), 0x10, &(0x7f00000002c0)={0x0}}, 0x0) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000240)="24000000180007841dfffd946f610500020081001f038b0602000800080006000400ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 03:21:10 executing program 2: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) syz_open_procfs(0x0, 0x0) syz_open_procfs(0x0, 0x0) syz_open_procfs(0x0, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) fcntl$setpipe(r1, 0x407, 0x0) 03:21:10 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4ecc7aeeb72e0d050feace34b52d9e5f755563698c7e24ab61f0866f15da7f48295eb100000000000000075d2dd15b6210d53eed19bc0080000033270c6a98d91c22def1125d7b1e821039a85ad8b91cea336a1b57f45a0788e3aba04551e4a522", 0xe1}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:21:10 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x4000000000000002) r3 = dup3(r2, r0, 0x0) socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fcntl$dupfd(r5, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TCXONC(r3, 0x540a, 0x0) write$P9_RATTACH(r0, &(0x7f00000001c0)={0x14}, 0xffffffde) fcntl$setstatus(r0, 0x4, 0x40800) 03:21:10 executing program 4: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) fcntl$setpipe(r1, 0x407, 0x0) 03:21:10 executing program 4: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) fcntl$setpipe(r1, 0x407, 0x0) 03:21:10 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000001c0)="6653070000053c07bc3376003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab364bf68e6faa53367f05f4ad61421349f2f11e931e7d62ead5e7cd2157df6b2bcb47fb53455560c8ef00fca4fafa924edfe92175aaa1c4e", 0x81}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 03:21:11 executing program 5: socket$inet6(0xa, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') socket$unix(0x1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x47, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) openat$uhid(0xffffffffffffff9c, &(0x7f0000000d80)='/dev/uhid\x00', 0xbcbd9ebe980348ff, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x5, 0x6, 0x6d, 0x2, 0x0, 0x0}, 0x10) syncfs(0xffffffffffffffff) r2 = msgget$private(0x0, 0x0) msgctl$IPC_SET(r2, 0x1, &(0x7f0000258f88)) msgrcv(r2, &(0x7f0000000180)={0x0, ""/93}, 0x65, 0x0, 0x0) msgctl$MSG_INFO(r2, 0xc, &(0x7f0000000480)=""/4096) writev(0xffffffffffffffff, &(0x7f0000004f40)=[{&(0x7f0000000100)="c83add0656bfe5ac91d8cfdcb924179961a16de5ef69dfb99413a6e7537f24cec1", 0x21}, {&(0x7f0000004d00)="26300b91dbe2a1ae65b477355b66c9cfd93f324ad3412d6492a852fd2a1d903ecf946d1216311be461fd065c8184dc7fbcd770c371b4fd086472df88bd4a853b52b8793ee36cef1a1c5ca6bd610253e5a48c512a157173b5bd067aadbefd5d9a94bd418e8bd8cd477594c8895c92c7f4676354ea0fd268531e8ed9e0cd12774d332fed278485a5746653fe6f01eabd67b79868f353eaa615d60d7c94bf39fae7fdd64368de3ff0608c216cef50e21cb450cf411b17a1fa5c37867731e5148442d7fd81ad", 0xc4}, {&(0x7f0000000140)="2b0ec62b1515b796df18bf83eca247a016d791b2e92514d495af521095847ba5b16a8396d2d84eb078efb51bd7701a0511f598", 0x33}, {&(0x7f0000004e00)="63a445dec719ca15fe286118f15c5e655b64f85475c26e07a73092343c105dd5930f11bd6921ccbb6e22a2114dcdac73ddc0619f840cde4bcb85aa761dcbd64e335609fd60155f308a729ae03aa848332de5bc990b46d4cee9beeec2a9cb5100a6afc1c8183984e364a04ea6d06afd94897678099a5e147355cf55e0ff0fe9ef7774f44f1ae09cfd2f41fa0665bb", 0x8e}, {&(0x7f0000004ec0)="69bf496c4cec0e7c72d856dacaf55270a239e4c1bcf97713e88c1b3b128bcdbf196f80fd91c5ce4e090ccbbb14b107075907599d1ce2ab9f421a9f704a7184c0b39162c29949fd4b24538bbb302f5c4a1d0611acbdc47600789df3cbc6da21634a31f69df7bf7572592e94772aab85a7de1deeefe3c7fe61e4e92afdcb", 0x7d}], 0x5) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1a4, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x80800) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r3, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x3}, 0x10) sendmsg$can_bcm(r3, &(0x7f0000000000)={&(0x7f0000000200), 0x10, &(0x7f00000002c0)={0x0}}, 0x0) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000240)="24000000180007841dfffd946f610500020081001f038b0602000800080006000400ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 03:21:11 executing program 1: socket$inet6(0xa, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') socket$unix(0x1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x47, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) openat$uhid(0xffffffffffffff9c, &(0x7f0000000d80)='/dev/uhid\x00', 0xbcbd9ebe980348ff, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x5, 0x6, 0x6d, 0x2, 0x0, 0x0}, 0x10) syncfs(0xffffffffffffffff) r2 = msgget$private(0x0, 0x0) msgctl$IPC_SET(r2, 0x1, &(0x7f0000258f88)) msgrcv(r2, &(0x7f0000000180)={0x0, ""/93}, 0x65, 0x0, 0x0) msgctl$MSG_INFO(r2, 0xc, &(0x7f0000000480)=""/4096) writev(0xffffffffffffffff, &(0x7f0000004f40)=[{&(0x7f0000000100)="c83add0656bfe5ac91d8cfdcb924179961a16de5ef69dfb99413a6e7537f24cec1", 0x21}, {&(0x7f0000004d00)="26300b91dbe2a1ae65b477355b66c9cfd93f324ad3412d6492a852fd2a1d903ecf946d1216311be461fd065c8184dc7fbcd770c371b4fd086472df88bd4a853b52b8793ee36cef1a1c5ca6bd610253e5a48c512a157173b5bd067aadbefd5d9a94bd418e8bd8cd477594c8895c92c7f4676354ea0fd268531e8ed9e0cd12774d332fed278485a5746653fe6f01eabd67b79868f353eaa615d60d7c94bf39fae7fdd64368de3ff0608c216cef50e21cb450cf411b17a1fa5c37867731e5148442d7fd81ad", 0xc4}, {&(0x7f0000000140)="2b0ec62b1515b796df18bf83eca247a016d791b2e92514d495af521095847ba5b16a8396d2d84eb078efb51bd7701a0511f598", 0x33}, {&(0x7f0000004e00)="63a445dec719ca15fe286118f15c5e655b64f85475c26e07a73092343c105dd5930f11bd6921ccbb6e22a2114dcdac73ddc0619f840cde4bcb85aa761dcbd64e335609fd60155f308a729ae03aa848332de5bc990b46d4cee9beeec2a9cb5100a6afc1c8183984e364a04ea6d06afd94897678099a5e147355cf55e0ff0fe9ef7774f44f1ae09cfd2f41fa0665bb", 0x8e}, {&(0x7f0000004ec0)="69bf496c4cec0e7c72d856dacaf55270a239e4c1bcf97713e88c1b3b128bcdbf196f80fd91c5ce4e090ccbbb14b107075907599d1ce2ab9f421a9f704a7184c0b39162c29949fd4b24538bbb302f5c4a1d0611acbdc47600789df3cbc6da21634a31f69df7bf7572592e94772aab85a7de1deeefe3c7fe61e4e92afdcb", 0x7d}], 0x5) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1a4, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x80800) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r3, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x3}, 0x10) sendmsg$can_bcm(r3, &(0x7f0000000000)={&(0x7f0000000200), 0x10, &(0x7f00000002c0)={0x0}}, 0x0) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000240)="24000000180007841dfffd946f610500020081001f038b0602000800080006000400ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 03:21:11 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/dev_snmp6\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x4000000000000002) r3 = dup3(r2, r0, 0x0) socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = fcntl$dupfd(r5, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TCXONC(r3, 0x540a, 0x0) write$P9_RATTACH(r0, &(0x7f00000001c0)={0x14}, 0xffffffde) ioctl$TCXONC(r3, 0x540a, 0x1) 03:21:11 executing program 4: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) syz_open_procfs(0x0, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) fcntl$setpipe(r1, 0x407, 0x0) [ 170.328264][ T8447] ================================================================== [ 170.336575][ T8447] BUG: KASAN: slab-out-of-bounds in pipe_write+0x579/0x1130 [ 170.343856][ T8447] Write of size 8 at addr ffff8880999c82a8 by task syz-executor.4/8447 [ 170.352082][ T8447] [ 170.354415][ T8447] CPU: 0 PID: 8447 Comm: syz-executor.4 Not tainted 5.4.0-syzkaller #0 [ 170.362645][ T8447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 170.372700][ T8447] Call Trace: [ 170.375992][ T8447] dump_stack+0x1fb/0x318 [ 170.380330][ T8447] print_address_description+0x75/0x5c0 [ 170.386058][ T8447] ? vprintk_default+0x28/0x30 [ 170.390821][ T8447] ? vprintk_func+0x158/0x170 [ 170.395496][ T8447] ? printk+0x62/0x8d [ 170.399477][ T8447] __kasan_report+0x14b/0x1c0 [ 170.404157][ T8447] ? lockdep_hardirqs_on+0x2f1/0x7d0 [ 170.409439][ T8447] ? pipe_write+0x579/0x1130 [ 170.414028][ T8447] kasan_report+0x26/0x50 [ 170.418352][ T8447] __asan_report_store8_noabort+0x17/0x20 [ 170.424079][ T8447] pipe_write+0x579/0x1130 [ 170.428513][ T8447] __vfs_write+0x5a1/0x740 [ 170.432944][ T8447] vfs_write+0x275/0x590 [ 170.437183][ T8447] ksys_write+0x117/0x220 [ 170.441514][ T8447] __x64_sys_write+0x7b/0x90 [ 170.446100][ T8447] do_syscall_64+0xf7/0x1c0 [ 170.450711][ T8447] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 170.456595][ T8447] RIP: 0033:0x45a679 [ 170.460481][ T8447] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 170.480082][ T8447] RSP: 002b:00007fc49e3bcc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 170.488496][ T8447] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a679 [ 170.496470][ T8447] RDX: 00000000fffffef3 RSI: 00000000200001c0 RDI: 0000000000000004 [ 170.504447][ T8447] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 170.512425][ T8447] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc49e3bd6d4 [ 170.520397][ T8447] R13: 00000000004c7830 R14: 00000000004e44b0 R15: 00000000ffffffff [ 170.528465][ T8447] [ 170.530790][ T8447] Allocated by task 8449: [ 170.535374][ T8447] __kasan_kmalloc+0x11c/0x1b0 [ 170.540129][ T8447] kasan_kmalloc+0x9/0x10 [ 170.544541][ T8447] __kmalloc+0x254/0x340 [ 170.548775][ T8447] kcalloc+0x36/0x60 [ 170.552663][ T8447] pipe_fcntl+0x413/0x810 [ 170.556985][ T8447] do_fcntl+0x56d/0x1180 [ 170.561220][ T8447] __se_sys_fcntl+0xde/0x1b0 [ 170.565805][ T8447] __x64_sys_fcntl+0x7b/0x90 [ 170.570389][ T8447] do_syscall_64+0xf7/0x1c0 [ 170.574897][ T8447] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 170.580774][ T8447] [ 170.583090][ T8447] Freed by task 0: [ 170.586798][ T8447] (stack is not available) [ 170.591197][ T8447] [ 170.593520][ T8447] The buggy address belongs to the object at ffff8880999c8280 [ 170.593520][ T8447] which belongs to the cache kmalloc-64(97:syz4) of size 64 [ 170.608175][ T8447] The buggy address is located 40 bytes inside of [ 170.608175][ T8447] 64-byte region [ffff8880999c8280, ffff8880999c82c0) [ 170.621789][ T8447] The buggy address belongs to the page: [ 170.627422][ T8447] page:ffffea0002667200 refcount:1 mapcount:0 mapping:ffff888093d8b540 index:0xffff8880999c8800 [ 170.637838][ T8447] raw: 00fffe0000000200 ffff8880a023a338 ffff8880a023a338 ffff888093d8b540 [ 170.646427][ T8447] raw: ffff8880999c8800 ffff8880999c8000 0000000100000018 0000000000000000 [ 170.655007][ T8447] page dumped because: kasan: bad access detected [ 170.661410][ T8447] [ 170.663726][ T8447] Memory state around the buggy address: [ 170.669350][ T8447] ffff8880999c8180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 170.677410][ T8447] ffff8880999c8200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 170.685465][ T8447] >ffff8880999c8280: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 170.694130][ T8447] ^ [ 170.699493][ T8447] ffff8880999c8300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 170.707546][ T8447] ffff8880999c8380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 170.715599][ T8447] ================================================================== [ 170.723676][ T8447] Disabling lock debugging due to kernel taint [ 170.732882][ T8447] Kernel panic - not syncing: panic_on_warn set ... [ 170.739509][ T8447] CPU: 0 PID: 8447 Comm: syz-executor.4 Tainted: G B 5.4.0-syzkaller #0 [ 170.749123][ T8447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 170.759254][ T8447] Call Trace: [ 170.762539][ T8447] dump_stack+0x1fb/0x318 [ 170.766866][ T8447] panic+0x264/0x7a9 [ 170.770759][ T8447] ? trace_hardirqs_on+0x34/0x80 [ 170.775689][ T8447] __kasan_report+0x1bb/0x1c0 [ 170.780451][ T8447] ? lockdep_hardirqs_on+0x2f1/0x7d0 [ 170.785777][ T8447] ? pipe_write+0x579/0x1130 [ 170.790344][ T8447] kasan_report+0x26/0x50 [ 170.795130][ T8447] __asan_report_store8_noabort+0x17/0x20 [ 170.800907][ T8447] pipe_write+0x579/0x1130 [ 170.805310][ T8447] __vfs_write+0x5a1/0x740 [ 170.809823][ T8447] vfs_write+0x275/0x590 [ 170.814099][ T8447] ksys_write+0x117/0x220 [ 170.818405][ T8447] __x64_sys_write+0x7b/0x90 [ 170.822990][ T8447] do_syscall_64+0xf7/0x1c0 [ 170.827514][ T8447] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 170.833388][ T8447] RIP: 0033:0x45a679 [ 170.837259][ T8447] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 170.856842][ T8447] RSP: 002b:00007fc49e3bcc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 170.865230][ T8447] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a679 [ 170.873177][ T8447] RDX: 00000000fffffef3 RSI: 00000000200001c0 RDI: 0000000000000004 [ 170.881125][ T8447] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 170.889086][ T8447] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc49e3bd6d4 [ 170.897044][ T8447] R13: 00000000004c7830 R14: 00000000004e44b0 R15: 00000000ffffffff [ 170.906599][ T8447] Kernel Offset: disabled [ 170.910923][ T8447] Rebooting in 86400 seconds..