Warning: Permanently added '10.128.0.94' (ECDSA) to the list of known hosts. 2019/12/31 16:40:03 fuzzer started 2019/12/31 16:40:05 dialing manager at 10.128.0.105:41657 2019/12/31 16:40:05 syscalls: 2723 2019/12/31 16:40:05 code coverage: enabled 2019/12/31 16:40:05 comparison tracing: enabled 2019/12/31 16:40:05 extra coverage: enabled 2019/12/31 16:40:05 setuid sandbox: enabled 2019/12/31 16:40:05 namespace sandbox: enabled 2019/12/31 16:40:05 Android sandbox: /sys/fs/selinux/policy does not exist 2019/12/31 16:40:05 fault injection: enabled 2019/12/31 16:40:05 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/12/31 16:40:05 net packet injection: enabled 2019/12/31 16:40:05 net device setup: enabled 2019/12/31 16:40:05 concurrency sanitizer: enabled 2019/12/31 16:40:05 devlink PCI setup: PCI device 0000:00:10.0 is not available 2019/12/31 16:40:06 adding functions to KCSAN blacklist: 'tomoyo_supervisor' 'tick_do_update_jiffies64' 'find_next_bit' 'ep_poll' 'add_timer' '__hrtimer_run_queues' 'generic_write_end' '__ext4_new_inode' '__mark_inode_dirty' 'ext4_free_inodes_count' 16:40:11 executing program 0: r0 = socket(0x10, 0x80002, 0x0) connect$caif(r0, 0x0, 0x0) 16:40:11 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x3b, &(0x7f00000000c0)=[{&(0x7f0000000000)="2e0000002e00815be00f80ecdb4cb9040c4865160800030040000000000004140e000a001500cd5edc2976d153b4", 0x235}], 0x1}, 0x0) syzkaller login: [ 68.256347][ T7931] IPVS: ftp: loaded support on port[0] = 21 [ 68.346109][ T7931] chnl_net:caif_netlink_parms(): no params data found [ 68.407584][ T7931] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.414936][ T7931] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.423825][ T7931] device bridge_slave_0 entered promiscuous mode [ 68.436245][ T7934] IPVS: ftp: loaded support on port[0] = 21 [ 68.443216][ T7931] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.450313][ T7931] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.463050][ T7931] device bridge_slave_1 entered promiscuous mode [ 68.503569][ T7931] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.521502][ T7931] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 16:40:11 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x40000000002, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x28, &(0x7f0000000040)=0x7, 0x168) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='syz_tun\x00', 0x10) sendto$unix(r2, 0x0, 0x0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) recvmmsg(r2, &(0x7f0000000240)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec8}}], 0x4000000000002c5, 0x2, 0x0) [ 68.555836][ T7931] team0: Port device team_slave_0 added [ 68.573671][ T7931] team0: Port device team_slave_1 added [ 68.581937][ T7934] chnl_net:caif_netlink_parms(): no params data found [ 68.663184][ T7931] device hsr_slave_0 entered promiscuous mode [ 68.700885][ T7931] device hsr_slave_1 entered promiscuous mode [ 68.747376][ T7934] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.754893][ T7934] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.762718][ T7934] device bridge_slave_0 entered promiscuous mode [ 68.777130][ T7937] IPVS: ftp: loaded support on port[0] = 21 16:40:11 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) write$P9_RREMOVE(r3, &(0x7f0000000280), 0x1033b) fdatasync(r3) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) [ 68.797625][ T7934] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.809367][ T7934] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.817428][ T7934] device bridge_slave_1 entered promiscuous mode [ 68.860641][ T7931] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 68.902835][ T7931] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 68.982051][ T7931] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 68.985936][ T7939] IPVS: ftp: loaded support on port[0] = 21 [ 69.034631][ T7934] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.048092][ T7931] netdevsim netdevsim0 netdevsim3: renamed from eth3 16:40:12 executing program 4: pipe(&(0x7f00000000c0)={0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10003, 0x0) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200)='/dev/snapshot\x00', 0x242002, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000780)) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) mkdirat(r2, 0x0, 0x108) chroot(&(0x7f0000000000)='./file0\x00') socket(0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x0, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2000000000002) [ 69.111989][ T7934] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.169256][ T7931] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.176362][ T7931] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.183681][ T7931] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.191033][ T7931] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.234622][ T7934] team0: Port device team_slave_0 added [ 69.242908][ T7937] chnl_net:caif_netlink_parms(): no params data found [ 69.268974][ T7934] team0: Port device team_slave_1 added [ 69.286367][ T7943] IPVS: ftp: loaded support on port[0] = 21 [ 69.372602][ T7934] device hsr_slave_0 entered promiscuous mode 16:40:12 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000029000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, &(0x7f00000000c0)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0xffffffffffffffb5}], 0xaaaac44, 0x0, 0x0, 0xfffffe41) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5e]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 69.420900][ T7934] device hsr_slave_1 entered promiscuous mode [ 69.462099][ T7934] debugfs: Directory 'hsr0' with parent '/' already present! [ 69.495478][ T3611] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.513813][ T3611] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.533444][ T7937] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.540519][ T7937] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.552070][ T7937] device bridge_slave_0 entered promiscuous mode [ 69.589212][ T7937] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.596387][ T7937] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.604402][ T7937] device bridge_slave_1 entered promiscuous mode [ 69.622345][ T7937] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.634573][ T7937] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.656048][ T7946] IPVS: ftp: loaded support on port[0] = 21 [ 69.667063][ T7931] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.681809][ T7934] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 69.722590][ T7934] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 69.764757][ T7934] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 69.827750][ T7939] chnl_net:caif_netlink_parms(): no params data found [ 69.836696][ T7934] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 69.883942][ T7937] team0: Port device team_slave_0 added [ 69.913543][ T7937] team0: Port device team_slave_1 added [ 69.936372][ T7939] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.944095][ T7939] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.951902][ T7939] device bridge_slave_0 entered promiscuous mode [ 69.959763][ T7939] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.967113][ T7939] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.974842][ T7939] device bridge_slave_1 entered promiscuous mode [ 69.991805][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 69.999703][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 70.015176][ T7931] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.102601][ T7937] device hsr_slave_0 entered promiscuous mode [ 70.150908][ T7937] device hsr_slave_1 entered promiscuous mode [ 70.200644][ T7937] debugfs: Directory 'hsr0' with parent '/' already present! [ 70.210218][ T7939] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.259840][ T7939] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.286986][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 70.296037][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 70.304864][ T7942] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.311934][ T7942] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.340077][ T7939] team0: Port device team_slave_0 added [ 70.348372][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 70.359446][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 70.368033][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.375094][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.383063][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 70.391821][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 70.412452][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 70.422060][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 70.431469][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 70.439883][ T7943] chnl_net:caif_netlink_parms(): no params data found [ 70.450821][ T7939] team0: Port device team_slave_1 added [ 70.459347][ T7937] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 70.502651][ T7937] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 70.542885][ T7937] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 70.592297][ T7937] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 70.648028][ T7946] chnl_net:caif_netlink_parms(): no params data found [ 70.674542][ T7931] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 70.687756][ T7931] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 70.730450][ T3611] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 70.741910][ T3611] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 70.751795][ T3611] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 70.760159][ T3611] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 70.769237][ T3611] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 70.780032][ T3611] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 70.796577][ T7934] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.862798][ T7939] device hsr_slave_0 entered promiscuous mode [ 70.890910][ T7939] device hsr_slave_1 entered promiscuous mode [ 70.931208][ T7939] debugfs: Directory 'hsr0' with parent '/' already present! [ 70.938886][ T3611] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 70.949914][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 70.959966][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 70.994142][ T7943] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.003874][ T7943] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.011855][ T7943] device bridge_slave_0 entered promiscuous mode [ 71.045426][ T7931] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.053128][ T7943] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.060162][ T7943] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.068117][ T7943] device bridge_slave_1 entered promiscuous mode [ 71.084343][ T7946] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.091658][ T7946] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.099563][ T7946] device bridge_slave_0 entered promiscuous mode [ 71.110042][ T7946] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.117342][ T7946] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.125188][ T7946] device bridge_slave_1 entered promiscuous mode [ 71.136372][ T7939] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 71.183697][ T7939] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 71.223421][ T7939] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 71.254100][ T7939] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 71.304232][ T7943] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.315220][ T7934] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.323710][ T3094] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 71.331664][ T3094] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 71.345221][ T7946] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.359929][ T7937] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.368730][ T7943] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.389296][ T7943] team0: Port device team_slave_0 added [ 71.396159][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.404872][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 71.413611][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.420646][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.429509][ T7946] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.449683][ T7946] team0: Port device team_slave_0 added [ 71.467103][ T7937] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.474955][ T7943] team0: Port device team_slave_1 added [ 71.489611][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 71.497953][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 71.506044][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 71.523945][ T7946] team0: Port device team_slave_1 added [ 71.542728][ T3094] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.551765][ T3094] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.561203][ T3094] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.568254][ T3094] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.602922][ T7943] device hsr_slave_0 entered promiscuous mode [ 71.641001][ T7943] device hsr_slave_1 entered promiscuous mode [ 71.680665][ T7943] debugfs: Directory 'hsr0' with parent '/' already present! [ 71.711016][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 71.719941][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready 16:40:14 executing program 0: r0 = socket(0x10, 0x80002, 0x0) connect$caif(r0, 0x0, 0x0) [ 71.729491][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.736623][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.745493][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 71.757904][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 71.766611][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.773677][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.785878][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 16:40:14 executing program 0: r0 = socket(0x10, 0x80002, 0x0) connect$caif(r0, 0x0, 0x0) [ 71.837943][ T7934] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 71.851930][ T7934] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.865595][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 71.881306][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 71.890431][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 71.911995][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 71.921198][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 71.929916][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 16:40:14 executing program 0: r0 = socket(0x10, 0x80002, 0x0) connect$caif(r0, 0x0, 0x0) [ 71.942147][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 71.953496][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 71.963243][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 71.974759][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 71.983939][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready 16:40:15 executing program 0: getegid() socketpair$unix(0x1, 0x5, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) socketpair$unix(0x1, 0x5, 0x0, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) readlinkat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)=""/204, 0xcc) keyctl$chown(0x4, 0x0, 0x0, r0) syz_open_dev$midi(0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, &(0x7f0000000380), 0x0) r1 = syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, 0x0) clock_gettime(0x0, &(0x7f0000000440)) prctl$PR_GET_CHILD_SUBREAPER(0x25) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$security_evm(&(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000100)=@md5={0x1, "e5bb395f55c063cd645af21b63c76d9d"}, 0x11, 0x0) unshare(0x60020000) [ 71.995424][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.045187][ T7946] device hsr_slave_0 entered promiscuous mode [ 72.090634][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 72.096457][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 72.114464][ T7966] IPVS: ftp: loaded support on port[0] = 21 [ 72.140971][ T7946] device hsr_slave_1 entered promiscuous mode [ 72.170645][ T7946] debugfs: Directory 'hsr0' with parent '/' already present! [ 72.191538][ T7939] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.199804][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 72.208245][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 72.215704][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 72.215728][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 72.227782][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 72.236620][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 72.245392][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 72.253981][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 72.262695][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 72.270092][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 72.290877][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 72.304260][ T7937] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 72.315560][ T7937] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 72.320720][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 72.331911][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 72.344096][ T7943] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 72.407803][ T7943] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 72.440618][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 72.446542][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 72.464432][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 72.473206][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.482278][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 72.490779][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.499098][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 72.507247][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 72.515215][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 72.524914][ T7939] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.541670][ T7943] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 72.580244][ T7943] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 72.590585][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 72.591772][ T7965] IPVS: ftp: loaded support on port[0] = 21 [ 72.596388][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 72.644993][ T7934] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.655348][ T3611] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 72.664442][ T3611] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 72.673173][ T3611] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.680197][ T3611] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.688415][ T7] tipc: TX() has been purged, node left! [ 72.702503][ T7946] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 72.742853][ T7946] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 72.833138][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 72.851058][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 72.860001][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 72.872048][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.879168][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.887532][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 72.896780][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 72.906421][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 72.915409][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 72.924553][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 72.934728][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 72.946121][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 72.955932][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 72.967054][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 72.976725][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 72.988173][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 72.996803][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 73.008412][ T7942] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 73.025426][ T7946] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 73.072248][ T7946] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 73.113643][ T7939] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 73.144656][ T7937] 8021q: adding VLAN 0 to HW filter on device batadv0 16:40:16 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x3b, &(0x7f00000000c0)=[{&(0x7f0000000000)="2e0000002e00815be00f80ecdb4cb9040c4865160800030040000000000004140e000a001500cd5edc2976d153b4", 0x235}], 0x1}, 0x0) [ 73.175634][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 73.184307][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 73.246530][ T7939] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.273109][ T7946] 8021q: adding VLAN 0 to HW filter on device bond0 16:40:16 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x3b, &(0x7f00000000c0)=[{&(0x7f0000000000)="2e0000002e00815be00f80ecdb4cb9040c4865160800030040000000000004140e000a001500cd5edc2976d153b4", 0x235}], 0x1}, 0x0) [ 73.292645][ T7943] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.312012][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 73.325827][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 73.336280][ T7946] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.356136][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 73.389536][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 73.414840][ T7943] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.435312][ T7975] raw_sendmsg: syz-executor.2 forgot to set AF_INET. Fix it! [ 73.448207][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready 16:40:16 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x3b, &(0x7f00000000c0)=[{&(0x7f0000000000)="2e0000002e00815be00f80ecdb4cb9040c4865160800030040000000000004140e000a001500cd5edc2976d153b4", 0x235}], 0x1}, 0x0) [ 73.473308][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.490047][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.497333][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state 16:40:16 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x40000000002, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x28, &(0x7f0000000040)=0x7, 0x168) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='syz_tun\x00', 0x10) sendto$unix(r2, 0x0, 0x0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) recvmmsg(r2, &(0x7f0000000240)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec8}}], 0x4000000000002c5, 0x2, 0x0) [ 73.530472][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 73.564138][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.586453][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.593844][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state 16:40:16 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x40000000002, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x28, &(0x7f0000000040)=0x7, 0x168) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='syz_tun\x00', 0x10) sendto$unix(r2, 0x0, 0x0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) recvmmsg(r2, &(0x7f0000000240)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec8}}], 0x4000000000002c5, 0x2, 0x0) [ 73.689750][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 73.698227][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 73.722261][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 16:40:16 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) write$P9_RREMOVE(r3, &(0x7f0000000280), 0x1033b) fdatasync(r3) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) [ 73.742061][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 73.777611][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 73.786960][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 73.815543][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 73.824878][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 73.843930][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 73.852792][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 73.862403][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 73.871247][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 73.880435][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 73.889329][ T3117] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.896596][ T3117] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.905486][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 73.914325][ T3117] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 73.923573][ T3117] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.930701][ T3117] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.962575][ T7946] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 73.977996][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 73.996212][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 74.004923][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 74.027988][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 74.038409][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 74.064308][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 74.073710][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 74.085912][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 74.095401][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 74.107219][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 74.116519][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 74.125219][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 74.138426][ T7943] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 74.146168][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 74.166080][ T7943] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.173498][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 74.181845][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 74.195993][ T7946] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.203471][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 74.211508][ T7950] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 74.386611][ T8020] mmap: syz-executor.4 (8020) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 74.424420][ T8021] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 74.464104][ C0] hrtimer: interrupt took 33839 ns 16:40:18 executing program 0: getegid() socketpair$unix(0x1, 0x5, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) socketpair$unix(0x1, 0x5, 0x0, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) readlinkat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)=""/204, 0xcc) keyctl$chown(0x4, 0x0, 0x0, r0) syz_open_dev$midi(0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, &(0x7f0000000380), 0x0) r1 = syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, 0x0) clock_gettime(0x0, &(0x7f0000000440)) prctl$PR_GET_CHILD_SUBREAPER(0x25) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$security_evm(&(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000100)=@md5={0x1, "e5bb395f55c063cd645af21b63c76d9d"}, 0x11, 0x0) unshare(0x60020000) 16:40:18 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x40000000002, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x28, &(0x7f0000000040)=0x7, 0x168) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='syz_tun\x00', 0x10) sendto$unix(r2, 0x0, 0x0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) recvmmsg(r2, &(0x7f0000000240)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec8}}], 0x4000000000002c5, 0x2, 0x0) 16:40:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x40000000002, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x28, &(0x7f0000000040)=0x7, 0x168) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='syz_tun\x00', 0x10) sendto$unix(r2, 0x0, 0x0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) recvmmsg(r2, &(0x7f0000000240)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec8}}], 0x4000000000002c5, 0x2, 0x0) 16:40:18 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) write$P9_RREMOVE(r3, &(0x7f0000000280), 0x1033b) fdatasync(r3) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) 16:40:18 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000029000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, &(0x7f00000000c0)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0xffffffffffffffb5}], 0xaaaac44, 0x0, 0x0, 0xfffffe41) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5e]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 16:40:18 executing program 4: pipe(&(0x7f00000000c0)={0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10003, 0x0) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200)='/dev/snapshot\x00', 0x242002, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000780)) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) mkdirat(r2, 0x0, 0x108) chroot(&(0x7f0000000000)='./file0\x00') socket(0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x0, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2000000000002) [ 75.210255][ T8043] IPVS: ftp: loaded support on port[0] = 21 16:40:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x40000000002, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x28, &(0x7f0000000040)=0x7, 0x168) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='syz_tun\x00', 0x10) sendto$unix(r2, 0x0, 0x0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) recvmmsg(r2, &(0x7f0000000240)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec8}}], 0x4000000000002c5, 0x2, 0x0) 16:40:18 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x40000000002, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x28, &(0x7f0000000040)=0x7, 0x168) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='syz_tun\x00', 0x10) sendto$unix(r2, 0x0, 0x0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) recvmmsg(r2, &(0x7f0000000240)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffec8}}], 0x4000000000002c5, 0x2, 0x0) 16:40:18 executing program 3: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x0) write$P9_RREMOVE(r3, &(0x7f0000000280), 0x1033b) fdatasync(r3) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000200)={0x0, r3}) 16:40:18 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10003, 0x0) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200)='/dev/snapshot\x00', 0x242002, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000780)) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) mkdirat(r2, 0x0, 0x108) chroot(&(0x7f0000000000)='./file0\x00') socket(0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x0, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2000000000002) 16:40:18 executing program 0: getegid() socketpair$unix(0x1, 0x5, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) socketpair$unix(0x1, 0x5, 0x0, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) readlinkat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)=""/204, 0xcc) keyctl$chown(0x4, 0x0, 0x0, r0) syz_open_dev$midi(0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, &(0x7f0000000380), 0x0) r1 = syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, 0x0) clock_gettime(0x0, &(0x7f0000000440)) prctl$PR_GET_CHILD_SUBREAPER(0x25) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$security_evm(&(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000100)=@md5={0x1, "e5bb395f55c063cd645af21b63c76d9d"}, 0x11, 0x0) unshare(0x60020000) 16:40:18 executing program 2: pipe(&(0x7f00000000c0)={0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10003, 0x0) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200)='/dev/snapshot\x00', 0x242002, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000780)) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) mkdirat(r2, 0x0, 0x108) chroot(&(0x7f0000000000)='./file0\x00') socket(0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x0, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2000000000002) [ 75.811510][ T21] tipc: TX() has been purged, node left! [ 75.933915][ T8073] IPVS: ftp: loaded support on port[0] = 21 16:40:19 executing program 3: pipe(&(0x7f00000000c0)={0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10003, 0x0) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200)='/dev/snapshot\x00', 0x242002, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000780)) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) mkdirat(r2, 0x0, 0x108) chroot(&(0x7f0000000000)='./file0\x00') socket(0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x0, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2000000000002) 16:40:19 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000029000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, &(0x7f00000000c0)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0xffffffffffffffb5}], 0xaaaac44, 0x0, 0x0, 0xfffffe41) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5e]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 16:40:19 executing program 0: getegid() socketpair$unix(0x1, 0x5, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) socketpair$unix(0x1, 0x5, 0x0, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) readlinkat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)=""/204, 0xcc) keyctl$chown(0x4, 0x0, 0x0, r0) syz_open_dev$midi(0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, &(0x7f0000000380), 0x0) r1 = syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_HW_FREQ_SEEK(r1, 0x40305652, 0x0) clock_gettime(0x0, &(0x7f0000000440)) prctl$PR_GET_CHILD_SUBREAPER(0x25) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$security_evm(&(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000100)=@md5={0x1, "e5bb395f55c063cd645af21b63c76d9d"}, 0x11, 0x0) unshare(0x60020000) [ 76.513102][ T8095] IPVS: ftp: loaded support on port[0] = 21 16:40:19 executing program 4: pipe(&(0x7f00000000c0)={0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10003, 0x0) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200)='/dev/snapshot\x00', 0x242002, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000780)) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) mkdirat(r2, 0x0, 0x108) chroot(&(0x7f0000000000)='./file0\x00') socket(0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x0, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2000000000002) 16:40:19 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000029000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, &(0x7f00000000c0)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0xffffffffffffffb5}], 0xaaaac44, 0x0, 0x0, 0xfffffe41) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc5e]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 16:40:19 executing program 2: pipe(&(0x7f00000000c0)={0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10003, 0x0) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200)='/dev/snapshot\x00', 0x242002, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000780)) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) mkdirat(r2, 0x0, 0x108) chroot(&(0x7f0000000000)='./file0\x00') socket(0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x0, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2000000000002) 16:40:19 executing program 1: pipe(&(0x7f00000000c0)={0xffffffffffffffff}) socket$inet_udp(0x2, 0x2, 0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10003, 0x0) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200)='/dev/snapshot\x00', 0x242002, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000780)) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) mkdirat(r2, 0x0, 0x108) chroot(&(0x7f0000000000)='./file0\x00') socket(0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r3, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x0, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2000000000002) [ 77.326388][ T8118] ================================================================== [ 77.334542][ T8118] BUG: KCSAN: data-race in __rb_insert_augmented / vm_area_dup [ 77.342084][ T8118] [ 77.344426][ T8118] write to 0xffff888126803378 of 8 bytes by task 8117 on cpu 1: [ 77.352069][ T8118] __rb_insert_augmented+0x20b/0x370 [ 77.357373][ T8118] vma_interval_tree_insert+0x196/0x230 [ 77.362932][ T8118] __vma_link_file+0xd9/0x110 [ 77.367628][ T8118] __vma_adjust+0x1ac/0x11d0 [ 77.372231][ T8118] __split_vma+0x338/0x350 [ 77.376681][ T8118] __do_munmap+0xb02/0xb60 [ 77.381109][ T8118] mmap_region+0x165/0xd50 [ 77.385535][ T8118] do_mmap+0x6c8/0xba0 [ 77.389613][ T8118] vm_mmap_pgoff+0x12d/0x190 [ 77.394224][ T8118] ksys_mmap_pgoff+0x2d8/0x420 [ 77.399097][ T8118] __x64_sys_mmap+0x2e/0x40 [ 77.403613][ T8118] do_syscall_64+0xcc/0x3a0 [ 77.408128][ T8118] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 77.414181][ T8118] [ 77.416536][ T8118] read to 0xffff888126803320 of 200 bytes by task 8118 on cpu 0: [ 77.424265][ T8118] vm_area_dup+0x70/0xf0 [ 77.428520][ T8118] __split_vma+0x88/0x350 [ 77.432855][ T8118] __do_munmap+0xb02/0xb60 [ 77.437296][ T8118] mmap_region+0x165/0xd50 [ 77.441730][ T8118] do_mmap+0x6c8/0xba0 [ 77.445819][ T8118] vm_mmap_pgoff+0x12d/0x190 [ 77.450408][ T8118] ksys_mmap_pgoff+0x2d8/0x420 [ 77.455181][ T8118] __x64_sys_mmap+0x2e/0x40 [ 77.459690][ T8118] do_syscall_64+0xcc/0x3a0 [ 77.464198][ T8118] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 77.470076][ T8118] [ 77.472394][ T8118] Reported by Kernel Concurrency Sanitizer on: [ 77.478548][ T8118] CPU: 0 PID: 8118 Comm: modprobe Not tainted 5.5.0-rc1-syzkaller #0 [ 77.486627][ T8118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 77.496686][ T8118] ================================================================== [ 77.504765][ T8118] Kernel panic - not syncing: panic_on_warn set ... [ 77.511360][ T8118] CPU: 0 PID: 8118 Comm: modprobe Not tainted 5.5.0-rc1-syzkaller #0 [ 77.519435][ T8118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 77.529483][ T8118] Call Trace: [ 77.532775][ T8118] dump_stack+0x11d/0x181 [ 77.537105][ T8118] panic+0x210/0x640 [ 77.541002][ T8118] ? vprintk_func+0x8d/0x140 [ 77.545595][ T8118] kcsan_report.cold+0xc/0xd [ 77.551071][ T8118] kcsan_setup_watchpoint+0x3fe/0x460 [ 77.556451][ T8118] ? __rb_rotate_set_parents+0x40/0xf0 [ 77.561918][ T8118] __tsan_read_range+0xc4/0x100 [ 77.566772][ T8118] vm_area_dup+0x70/0xf0 [ 77.571017][ T8118] __split_vma+0x88/0x350 [ 77.575345][ T8118] ? find_vma+0x3e/0x110 [ 77.579587][ T8118] __do_munmap+0xb02/0xb60 [ 77.584010][ T8118] mmap_region+0x165/0xd50 [ 77.588438][ T8118] do_mmap+0x6c8/0xba0 [ 77.592525][ T8118] vm_mmap_pgoff+0x12d/0x190 [ 77.597122][ T8118] ksys_mmap_pgoff+0x2d8/0x420 [ 77.601889][ T8118] ? debug_smp_processor_id+0x43/0x137 [ 77.607367][ T8118] __x64_sys_mmap+0x2e/0x40 [ 77.611887][ T8118] do_syscall_64+0xcc/0x3a0 [ 77.616398][ T8118] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 77.622289][ T8118] RIP: 0033:0x7f3bc723d3ea [ 77.626720][ T8118] Code: 48 8d 3d 81 69 00 00 b2 84 e8 52 ec ff ff f7 d8 89 05 ae ad 20 00 eb c6 90 90 90 90 90 90 90 90 49 89 ca b8 09 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d 8a ad 20 00 31 d2 48 29 c2 89 [ 77.646593][ T8118] RSP: 002b:00007fff07947e38 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 77.655022][ T8118] RAX: ffffffffffffffda RBX: 00007f3bc74459a8 RCX: 00007f3bc723d3ea [ 77.662998][ T8118] RDX: 0000000000000003 RSI: 0000000000005000 RDI: 00007f3bc7007000 [ 77.670985][ T8118] RBP: 00007fff07948190 R08: 0000000000000000 R09: 0000000000183000 [ 77.678959][ T8118] R10: 0000000000000812 R11: 0000000000000206 R12: 00007fff07948278 [ 77.686933][ T8118] R13: 0000000000000002 R14: 00007fff07947eb0 R15: 00007fff07947e80 [ 77.696438][ T8118] Kernel Offset: disabled [ 77.700884][ T8118] Rebooting in 86400 seconds..