[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 13.125706] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 17.513280] random: sshd: uninitialized urandom read (32 bytes read) [ 17.712082] random: sshd: uninitialized urandom read (32 bytes read) [ 18.358783] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.30' (ECDSA) to the list of known hosts. [ 23.857155] random: sshd: uninitialized urandom read (32 bytes read) 2018/08/27 22:58:38 fuzzer started [ 25.146808] random: cc1: uninitialized urandom read (8 bytes read) 2018/08/27 22:58:40 dialing manager at 10.128.0.26:38051 2018/08/27 22:58:41 syscalls: 1 2018/08/27 22:58:41 code coverage: enabled 2018/08/27 22:58:41 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/08/27 22:58:41 setuid sandbox: enabled 2018/08/27 22:58:41 namespace sandbox: enabled 2018/08/27 22:58:41 fault injection: CONFIG_FAULT_INJECTION is not enabled 2018/08/27 22:58:41 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/08/27 22:58:41 net packed injection: enabled 2018/08/27 22:58:41 net device setup: enabled [ 29.303061] random: crng init done 22:59:08 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@remote, 0x800, 0x1}, 0x20) 22:59:08 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/if_inet6\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000380)="6f6f6d5f73636f72655f61646a00605a119bf0a3beaad2f8ce9203080460d060c2a469f1da124d726b7bdc66e5148a62b24f849098b33689e5b143b21fc4158a0826112baa3b4b4ea2313be32159686267386711dac96f9da1765a1f324ce51f43459a9cc4b342bce7188228239f6b557821eec64bc3f9f7e816224f0a8650ea536502000000e6421474f0fdb79bcbbd15cf32c37f502923dbb3dfd0b81c9b501ca6faa5c3c1f8ffffffd7870ab725331f0617a5fbed77741916137923656c8e999efe46e503a44fc609b0ee8271ab88e2cdb51e8901cf022908d46b7db610994f273d5d3199f9200e0f0b57c5bce80e8e0cc6fadc5c7bdae7ada8a52b71cb486f37faf9ef573dc1b978dc5339f7a2316f3b2336fe0ef698d6504ecba2a9eed177a16e8651262a0a2fd8acbfc61b11eb4402a4fd589d5a84fc4fe7860aaa2cfdd7c73e5dbc26722e2b08acd46e234e05281e53d95e241e3e5a43c2640f78189daf0f0d85c15754613c8e77c98355329680c5b3b65dbfef6cf733bd655b047b3581a92232e51eccfdc57567e470d3b7f81fc7f34900eafd8bbac06998d555159d26d4676504f3d4d2baa21098aa18dfd6a504ad") sendfile(r1, r0, &(0x7f0000000040)=0x3, 0x79ffffffffffff) 22:59:08 executing program 7: r0 = syz_open_dev$loop(&(0x7f0000003640)='/dev/loop#\x00', 0x4000000000000000, 0x0) r1 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='9', 0x1}], 0x1, 0x881806) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) read(r0, &(0x7f0000000200)=""/30, 0xfffffe80) 22:59:08 executing program 3: perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x856, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000000040)=@fragment={0x0, 0x0, 0x5}, 0x8) sendto$inet6(r0, &(0x7f0000000100), 0x323, 0x0, &(0x7f0000000180)={0xa, 0x4e23, 0x0, @local}, 0x1c) 22:59:08 executing program 4: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo\x00') fchdir(r1) sendmmsg(r0, &(0x7f0000008600)=[{{0x0, 0x0, &(0x7f0000003140)}}, {{&(0x7f00000072c0)=@un=@file={0x1, './file0\x00'}, 0xa, &(0x7f0000007380), 0x0, &(0x7f0000000600)}}], 0x2, 0x0) 22:59:08 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='/exe\x00\x00\x00\x00\x00\x00') fstat(r0, &(0x7f0000000000)) 22:59:08 executing program 6: r0 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000580)={0x2, 0x4e23}, 0x10) 22:59:08 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000140)='/dev/sg#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BLKTRACETEARDOWN(r0, 0x5386, 0x0) [ 54.305043] IPVS: Creating netns size=2536 id=1 [ 54.355007] IPVS: Creating netns size=2536 id=2 [ 54.399626] IPVS: Creating netns size=2536 id=3 [ 54.446920] IPVS: Creating netns size=2536 id=4 [ 54.505934] IPVS: Creating netns size=2536 id=5 [ 54.573901] IPVS: Creating netns size=2536 id=6 [ 54.656249] IPVS: Creating netns size=2536 id=7 [ 54.732032] IPVS: Creating netns size=2536 id=8 [ 54.987242] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 55.037461] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 55.134922] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 55.200521] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 55.213922] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 55.292619] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 55.335718] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 55.416794] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 55.465561] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 55.516853] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 55.549352] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 55.568891] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 55.597500] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 55.638070] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 55.684935] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 55.707828] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 55.721078] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 55.735243] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 55.769016] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 55.800582] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 55.814779] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 55.879494] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 55.891686] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 55.901405] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 55.911129] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 55.926435] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 55.933659] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 55.944583] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 55.952408] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 55.963026] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 55.976245] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 56.012992] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 56.022929] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.030979] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.040238] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 56.055076] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 56.065306] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 56.074421] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 56.085156] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 56.093616] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 56.111747] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.122634] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.137054] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 56.151546] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 56.163516] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 56.177053] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 56.240027] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 56.255617] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.264851] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.293851] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 56.308669] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 56.332813] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.340460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.353489] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 56.418067] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 56.430696] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 56.441467] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.454475] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.462988] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 56.473501] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 56.492115] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 56.507908] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 56.530098] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.554657] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.573149] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 56.589657] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 56.605492] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 56.621489] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 56.637607] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.645887] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.657030] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 56.671496] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 56.685404] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.692989] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.712497] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 56.737441] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.752638] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.765790] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 56.778375] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 56.798320] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.807912] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.830618] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 56.872218] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 56.884861] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.892440] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.950349] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 56.961506] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.969276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 57.041506] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 57.113341] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 57.176573] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 57.185173] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 57.192736] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 57.230796] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 57.248568] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 57.256639] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 59.215866] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 59.437875] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 59.444073] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 59.455089] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 59.493386] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 59.565251] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 59.723780] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 59.741987] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 59.752464] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 59.768233] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 59.783913] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 59.797970] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 59.808218] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 59.842235] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 59.985203] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 59.998819] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.011373] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.028206] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 60.070075] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 60.099927] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 60.114842] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.121664] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.243440] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 60.254088] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.261765] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.332928] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 60.345141] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.351974] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.373578] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 60.558489] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 60.567380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.574300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 22:59:15 executing program 2: r0 = socket$inet(0x2, 0x2, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000080), &(0x7f0000000100)=0x68) 22:59:15 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x80001, 0x0) bind$inet6(r1, &(0x7f0000402000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f00007a8fff), 0x3a7, 0x20000000, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 22:59:15 executing program 2: r0 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x8c2, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x5}) mq_timedreceive(r0, &(0x7f00000001c0)=""/124, 0x7c, 0x0, &(0x7f0000000240)={0x0, 0x1c9c380}) 22:59:15 executing program 0: r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x0, 0x0) preadv(r0, &(0x7f0000001080), 0x0, 0x0) 22:59:15 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x2000000088) bind(r0, &(0x7f0000000080)=@in={0x2, 0x4e20}, 0x7c) sendto$inet(r0, &(0x7f0000000100)="589d3992ef060177c79b21251eaa09077d49cc1e248948cfb8681da69aeecf5d192e1abf0a78e39bab62f03b1c891eae921dcca39f9202db47675b6752cec3045375e5680f", 0x45, 0x0, &(0x7f0000000280)={0x2, 0x8004e20}, 0x10) recvmmsg(r0, &(0x7f00000004c0)=[{{&(0x7f0000000400)=@ethernet={0x0, @dev}, 0x0, &(0x7f0000000480)}}], 0x6fdaec, 0x22, 0x0) 22:59:15 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f00000000c0)={0x1, 'syz_tun\x00'}, 0x18) 22:59:15 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={"00ac1c3955c306335f00", 0x105}) getgroups(0x2, &(0x7f0000000780)=[0xee00, 0xee01]) ioctl$TUNSETGROUP(r0, 0x400454ce, r1) 22:59:15 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000000)) [ 61.422477] IPVS: sync thread started: state = MASTER, mcast_ifn = syz_tun, syncid = 0, id = 0 22:59:15 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000040)={&(0x7f0000000100)=@ipv6_newaddr={0x40, 0x14, 0x509, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14}, @IFA_LOCAL={0x14, 0x2, @local}]}, 0x40}}, 0x0) 22:59:15 executing program 0: socket$inet6(0xa, 0x803, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f0000000100), 0xd14b, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) recvfrom(r0, &(0x7f0000000140)=""/90, 0xfffffcf3, 0x40010002, 0x0, 0x10019) 22:59:16 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000140)='/dev/sg#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BLKTRACETEARDOWN(r0, 0x5421, 0x0) 22:59:16 executing program 3: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={"6c6f000000000200", 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000080)={r1, 0x3, 0x6, @dev}, 0xba) 22:59:16 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000040)={&(0x7f0000000100)=@ipv6_newaddr={0x40, 0x14, 0x509, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x139, 0xf0ffffffffffff}}, @IFA_LOCAL={0x14, 0x2, @local}]}, 0x40}}, 0x0) [ 61.882637] device lo entered promiscuous mode 22:59:16 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000080)) getsockopt$IPT_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x0, 0x42, &(0x7f0000000000)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000480)=ANY=[], 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, &(0x7f0000000180)={'TPROXY\x00'}, &(0x7f0000000280)=0x1e) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)="62627200127a7befb1aecd9d343c125105380d534d033390f728a1d423f4e7de0e284f4e76cd331830592dd776c542f5279a821f624aa22dc8d441c18a0f716a6df525e17304091496afcbc5bb1fdeb3a2b1669c2de799359c50b894", 0x5c) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) socket(0x0, 0x0, 0x0) 22:59:16 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2, &(0x7f000063a000)=0x2be, 0x4) sendto$inet6(r0, &(0x7f0000f6f000), 0x100003e, 0x20000004, &(0x7f0000b63fe4), 0x1c) 22:59:16 executing program 0: inotify_add_watch(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x200) inotify_rm_watch(0xffffffffffffffff, 0x0) r0 = socket(0x0, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100), 0xa0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) recvmsg(r1, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:16 executing program 6: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x80000000000003, 0x80000000000006) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000800)="b10b", 0x2}], 0x1, &(0x7f0000000200)}, 0x8000) setsockopt$inet6_int(r1, 0x29, 0x7, &(0x7f0000000000), 0x4) sendmsg(r1, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000003b40)}, 0x0) 22:59:16 executing program 5: socket$inet6(0xa, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x11011, r0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x24032, 0xffffffffffffffff, 0x0) 22:59:16 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x803, 0x7) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r2, 0x400454da, &(0x7f0000000240)=r3) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={"7465616d5fff6c6176655f3000", 0x4000000000000001}) 22:59:16 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x856, 0x20000000000402}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) dup3(r1, r0, 0x0) 22:59:16 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000003640)='/dev/loop#\x00', 0x4000000000000000, 0x0) r1 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)}], 0x1, 0x881806) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) read(r0, &(0x7f0000000200)=""/30, 0xfffffe80) [ 61.935369] device lo left promiscuous mode 22:59:16 executing program 6: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSFF(r0, 0x80044584, &(0x7f0000000040)={0x0, 0x0, 0x0, {}, {}, @rumble}) 22:59:16 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4000004000000014}, 0x1c) sendto$inet6(r0, &(0x7f0000000300), 0x0, 0x8008, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r0, &(0x7f0000000780)=[{{&(0x7f0000000280)=@in6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000000500), 0x0, &(0x7f00000007c0)=ANY=[]}}], 0x1, 0x0) 22:59:16 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2, &(0x7f000063a000)=0x2be, 0x4) sendto$inet6(r0, &(0x7f0000f6f000), 0x100003e, 0x20000004, &(0x7f0000b63fe4), 0x1c) 22:59:16 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x803, 0x7) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r2, 0x400454da, &(0x7f0000000240)=r3) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={"7465616d5fff6c6176655f3000", 0x4000000000000001}) 22:59:16 executing program 2: r0 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000580)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) setsockopt$inet_mreqsrc(r0, 0x11a, 0x2, &(0x7f0000000140)={@rand_addr=0x3033300, @multicast2, @loopback}, 0x28) sendmsg(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000005c0)}, 0x0) ppoll(&(0x7f0000000380)=[{r0}], 0x1, &(0x7f0000000300)={0x0, 0x989680}, &(0x7f0000000680), 0x8) 22:59:16 executing program 4: r0 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) close(r0) syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) 22:59:16 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000040), 0x0, 0x20000800, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) sendmsg(r1, &(0x7f0000002980)={&(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000001640)=[{&(0x7f0000000140)="01", 0x1}], 0x1, &(0x7f00000016c0), 0x0, 0x40000}, 0x4000) 22:59:16 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000003640)='/dev/loop#\x00', 0x4000000000000000, 0x0) r1 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)}], 0x1, 0x881806) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) read(r0, &(0x7f0000000200)=""/30, 0xfffffe80) [ 62.307414] blk_update_request: I/O error, dev loop0, sector 0 [ 62.313545] Buffer I/O error on dev loop0, logical block 0, lost async page write [ 62.321422] blk_update_request: I/O error, dev loop0, sector 4 [ 62.327924] Buffer I/O error on dev loop0, logical block 1, lost async page write [ 62.335752] blk_update_request: I/O error, dev loop0, sector 8 [ 62.341760] Buffer I/O error on dev loop0, logical block 2, lost async page write [ 62.349465] blk_update_request: I/O error, dev loop0, sector 12 [ 62.355666] Buffer I/O error on dev loop0, logical block 3, lost async page write [ 62.363400] blk_update_request: I/O error, dev loop0, sector 16 [ 62.369555] Buffer I/O error on dev loop0, logical block 4, lost async page write [ 62.377300] blk_update_request: I/O error, dev loop0, sector 20 [ 62.383358] Buffer I/O error on dev loop0, logical block 5, lost async page write [ 62.391070] blk_update_request: I/O error, dev loop0, sector 24 [ 62.397354] Buffer I/O error on dev loop0, logical block 6, lost async page write [ 62.405092] blk_update_request: I/O error, dev loop0, sector 28 [ 62.411150] Buffer I/O error on dev loop0, logical block 7, lost async page write [ 62.418879] blk_update_request: I/O error, dev loop0, sector 32 [ 62.425339] Buffer I/O error on dev loop0, logical block 8, lost async page write [ 62.432972] blk_update_request: I/O error, dev loop0, sector 36 [ 62.439082] Buffer I/O error on dev loop0, logical block 9, lost async page write [ 62.458755] VFS: Dirty inode writeback failed for block device loop0 (err=-5). 22:59:17 executing program 0: inotify_add_watch(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x200) inotify_rm_watch(0xffffffffffffffff, 0x0) r0 = socket(0x0, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100), 0xa0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) recvmsg(r1, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:17 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='/exe\x00\x00\x00\x00\x00\x00') fchown(r0, 0x0, 0x0) 22:59:17 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000000140)='/dev/sg#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BLKTRACETEARDOWN(r0, 0x2272, 0x0) 22:59:17 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={&(0x7f0000000040), 0xc, &(0x7f0000000240)={&(0x7f0000000380)=@newlink={0x54, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}, @IFLA_ADDRESS={0xc, 0x1, @remote}]}, 0x54}}, 0x0) 22:59:17 executing program 7: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_emit_ethernet(0x2a, &(0x7f0000000240)={@local, @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, @udp={0x0, 0x0, 0x8}}}}}, 0x0) 22:59:17 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x615, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000000300)=[{&(0x7f0000000240)=""/2, 0x2}, {&(0x7f0000000280)=""/23, 0x17}], 0x2, 0x0) 22:59:17 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000040)=0x9, 0x4) sendmmsg(r0, &(0x7f0000000140)=[{{&(0x7f0000000300)=@nfc={0x27, 0x1}, 0x80, &(0x7f0000000080), 0x0, &(0x7f0000000000)}}], 0x1, 0x0) 22:59:17 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) r1 = dup(r0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000780)={0x2, 0x4e23}, 0x10) sendto$inet(r1, &(0x7f0000000200)="96", 0x1, 0x3fff, &(0x7f0000000240)={0x2, 0x0, @loopback}, 0x10) recvmsg(r1, &(0x7f00000006c0)={&(0x7f0000000080)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f0000000580), 0x0, &(0x7f00000005c0)=""/242, 0xf2}, 0x3) 22:59:17 executing program 5: 22:59:17 executing program 6: 22:59:17 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) connect$netlink(r0, &(0x7f0000000080)=@proc={0x10, 0x0, 0x25dfdbfc}, 0xc) sendmsg$nl_route(r0, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f0000001400)=@getlink={0x20, 0x31, 0x201}, 0x20}}, 0x0) capget(&(0x7f0000feaff9), &(0x7f0000fea000)) 22:59:17 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f00000001c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000000)=0x80000000001, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xfffffffffffffedf, 0x0, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10) write$binfmt_elf32(r0, &(0x7f0000000380)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38}, [{}]}, 0x58) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x0, 0x0) dup2(r0, r1) recvfrom(r1, &(0x7f0000000100)=""/162, 0x110c2, 0x4000010a, 0x0, 0xffffffffffffffd5) 22:59:17 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.net/syz1\x00', 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000140)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000001c0), 0x12) 22:59:17 executing program 6: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4000004000000014}, 0x1c) sendto$inet6(r0, &(0x7f0000000300), 0x0, 0x8008, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r0, &(0x7f0000000780)=[{{&(0x7f0000000280)=@in6={0xa, 0x4e24, 0x0, @remote}, 0x80, &(0x7f0000000500), 0x0, &(0x7f0000000300)=ANY=[]}}], 0x1, 0x44000) 22:59:17 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x0, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f00000000c0)='!@proc/$\x00') 22:59:17 executing program 4: socket$l2tp(0x18, 0x1, 0x1) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400)='/dev/rfkill\x00', 0x10000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x615, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) fstat(0xffffffffffffffff, &(0x7f0000000180)) getgroups(0x0, &(0x7f0000000240)) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @broadcast}}, 0x1c) 22:59:17 executing program 0: inotify_add_watch(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x200) inotify_rm_watch(0xffffffffffffffff, 0x0) r0 = socket(0x0, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100), 0xa0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) recvmsg(r1, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:17 executing program 6: 22:59:17 executing program 1: 22:59:17 executing program 3: 22:59:17 executing program 7: 22:59:17 executing program 4: 22:59:17 executing program 2: 22:59:17 executing program 5: 22:59:17 executing program 1: 22:59:17 executing program 7: 22:59:17 executing program 4: 22:59:17 executing program 2: 22:59:18 executing program 1: 22:59:18 executing program 7: 22:59:18 executing program 4: 22:59:18 executing program 2: 22:59:18 executing program 0: inotify_add_watch(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x200) inotify_rm_watch(0xffffffffffffffff, 0x0) r0 = socket(0x0, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100), 0xa0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) recvmsg(r1, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:18 executing program 1: 22:59:18 executing program 6: 22:59:18 executing program 3: 22:59:18 executing program 5: 22:59:18 executing program 2: 22:59:18 executing program 7: 22:59:18 executing program 4: 22:59:18 executing program 6: 22:59:18 executing program 3: 22:59:18 executing program 5: 22:59:18 executing program 2: 22:59:18 executing program 4: 22:59:18 executing program 1: 22:59:18 executing program 5: 22:59:18 executing program 6: 22:59:19 executing program 0: inotify_add_watch(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x200) inotify_rm_watch(0xffffffffffffffff, 0x0) r0 = socket(0x0, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100), 0xa0) r1 = socket$packet(0x11, 0x3, 0x300) recvmsg(r1, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:19 executing program 2: 22:59:19 executing program 4: 22:59:19 executing program 6: 22:59:19 executing program 7: 22:59:19 executing program 3: 22:59:19 executing program 1: 22:59:19 executing program 5: 22:59:19 executing program 6: 22:59:19 executing program 7: 22:59:19 executing program 5: 22:59:19 executing program 3: 22:59:19 executing program 1: 22:59:19 executing program 5: 22:59:19 executing program 1: 22:59:19 executing program 7: 22:59:19 executing program 2: 22:59:19 executing program 6: 22:59:19 executing program 3: 22:59:19 executing program 1: syz_emit_ethernet(0x1, &(0x7f0000000040)=ANY=[@ANYBLOB="10a09c78098024aaaeb99d640f000000001af505b6c06b00c06f280a99559d45f92cde73c9106bbe1eb2ba122148c3433809477e1932731d4b29"], &(0x7f0000000740)) 22:59:19 executing program 0: inotify_add_watch(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x200) inotify_rm_watch(0xffffffffffffffff, 0x0) r0 = socket(0x0, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100), 0xa0) r1 = socket$packet(0x11, 0x3, 0x300) recvmsg(r1, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:19 executing program 4: r0 = openat$cgroup_procs(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) write$binfmt_script(r0, &(0x7f0000000040)={'#! ', './file0'}, 0xb) creat(&(0x7f0000001080)='./file0\x00', 0x0) getresgid(&(0x7f0000001880), &(0x7f00000018c0)=0x0, &(0x7f0000001900)) chown(&(0x7f0000001780)='./file0\x00', 0x0, r1) 22:59:19 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x101000, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000140)) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}) unshare(0x40000000) fcntl$getflags(r0, 0x1) ioctl$TUNGETFEATURES(r2, 0x800454cf, &(0x7f00000000c0)) 22:59:19 executing program 7: r0 = socket$inet6(0xa, 0x80001, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1a, &(0x7f0000000300)={@remote}, &(0x7f0000000180)=0x14) 22:59:19 executing program 6: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$unix(0x1, 0x0, 0x0) unshare(0x200) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/mnt\x00') setns(r1, 0x0) clone(0x70024001, &(0x7f00000028c0), &(0x7f0000002880), &(0x7f0000002980), &(0x7f0000000700)) 22:59:20 executing program 3: 22:59:20 executing program 2: 22:59:20 executing program 7: 22:59:20 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="240000005a001f01000000f9002304000a04f5fe0700039001c9a8000000000000000000", 0x24) [ 65.668313] IPVS: Creating netns size=2536 id=9 22:59:20 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x1, &(0x7f000039a000)=[{0x6}]}, 0x10) 22:59:20 executing program 7: r0 = socket$inet(0x2, 0x2, 0x0) bind(r0, &(0x7f0000000080)=@in={0x2, 0x4e20}, 0x7c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f0000000040), 0xc, &(0x7f0000000940)={&(0x7f0000000800)=@ipv6_delroute={0x28, 0x19, 0x0, 0x0, 0x0, {}, [@RTA_MULTIPATH={0xc}]}, 0x28}}, 0x0) sendto$inet(r0, &(0x7f0000000100)='X', 0x1, 0x0, &(0x7f0000000280)={0x2, 0x8004e20}, 0x10) recvmmsg(r0, &(0x7f00000004c0)=[{{&(0x7f0000000400)=@ethernet={0x0, @dev}, 0x0, &(0x7f0000000480)}}], 0x6fdaec, 0x22, 0x0) 22:59:20 executing program 2: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) socketpair$unix(0x1, 0x20000000000002, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000040), &(0x7f0000000140)}}, &(0x7f0000044000)=0x0) timer_settime(r3, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) r4 = socket$inet(0x2, 0x1, 0x0) mmap(&(0x7f000092d000/0x400000)=nil, 0x400000, 0xfffffffffffffffc, 0x8972, 0xffffffffffffffff, 0x0) bind$inet(r4, &(0x7f0000134000)={0x2, 0x4e23, @broadcast}, 0x10) connect$inet(r4, &(0x7f00000000c0)={0x2, 0x4e23, @loopback}, 0x10) connect$inet(r4, &(0x7f00009322c4)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r4, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000140)={0x2, 0xfff, @local}, 0x10) dup2(r1, r4) tkill(r2, 0x1000200000016) 22:59:20 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000005c0)={&(0x7f0000000040), 0xc, &(0x7f0000000580)={&(0x7f0000000440)=@expire={0xf8, 0x18, 0x1, 0x0, 0x0, {{{@in=@rand_addr, @in=@dev}, {@in6=@ipv4}, @in=@rand_addr}}}, 0xf8}}, 0x0) 22:59:20 executing program 1: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a5c2d0252926285717070") socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_emit_ethernet(0x66, &(0x7f0000000080)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "02290f", 0x30, 0x3a, 0x0, @ipv4={[], [], @rand_addr}, @mcast2, {[], @icmpv6=@pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "9433df", 0x0, 0x0, 0x0, @mcast2, @dev}}}}}}}, 0x0) 22:59:20 executing program 4: r0 = socket(0x2, 0x803, 0xff) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @remote}, 0x10) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="a4d27a6d621b78cf0133f62321202e2f66696c65"], 0x14) 22:59:20 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r1, &(0x7f0000000200), 0xfffffffffffffeb4, 0x2000800e, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback, [0x2, 0x7000028]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='yeah\x00', 0x5) recvfrom(r1, &(0x7f0000f9cf9b)=""/101, 0x6478c8501c739e53, 0x120, 0x0, 0x4f) sendto$inet(r1, &(0x7f0000000040)="89", 0x1, 0x41, &(0x7f00000002c0)={0x2, 0x0, @broadcast}, 0x10) [ 65.798084] IPVS: Creating netns size=2536 id=10 [ 65.883026] IPVS: Creating netns size=2536 id=11 22:59:20 executing program 0: inotify_add_watch(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x200) inotify_rm_watch(0xffffffffffffffff, 0x0) r0 = socket(0x0, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100), 0xa0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) recvmsg(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:20 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x4000000000080}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0xc0605345, &(0x7f0000000180)={0x0, @time}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer2\x00', 0x0, 0x0) 22:59:20 executing program 7: r0 = open(&(0x7f0000000140)='./bus\x00', 0x40, 0x0) close(r0) r1 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r2 = memfd_create(&(0x7f0000000100)="000000008c00000001000000008000", 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r2) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) readv(r1, &(0x7f0000000180)=[{&(0x7f0000001200)=""/4096, 0xfffffe19}], 0x1) 22:59:20 executing program 1: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000040)) keyctl$set_reqkey_keyring(0x5, 0xfffffffffffffffe) request_key(&(0x7f00000000c0)='dns_resolver\x00', &(0x7f0000000140), &(0x7f0000000180)='user\x00', 0x0) 22:59:20 executing program 5: rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xfffffffffffffffe}, 0x0, 0x8) setrlimit(0x1, &(0x7f0000011000)) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000000040)="aa", 0x1}], 0x1) 22:59:20 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a000007000000000000040000000005001a00ff010000000027a3b538072e410d080001e0000002000000000000000000000000000002"], 0x38}}, 0x0) 22:59:20 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) read(r0, &(0x7f0000000d00)=""/4096, 0x1000) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$uinput_user_dev(r0, &(0x7f0000000880)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000]}, 0x45c) 22:59:20 executing program 6: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x102) write$evdev(r0, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) close(r0) 22:59:20 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00007a0000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000616ff8)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(0xffffffffffffffff, &(0x7f0000e4ffc8)={&(0x7f0000beb000)=@abs, 0x6e, &(0x7f000000d000), 0x0, &(0x7f000053c000)}, 0x0) r3 = dup2(r2, r0) close(r1) sendmsg$unix(r3, &(0x7f0000000600)={&(0x7f0000000380)=@abs, 0x6e, &(0x7f0000000540), 0x0, &(0x7f0000000580)=[@rights={0x10, 0x1, 0x1, [r1]}], 0x10}, 0x0) 22:59:20 executing program 0: inotify_add_watch(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x200) inotify_rm_watch(0xffffffffffffffff, 0x0) socket(0x0, 0x1, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) recvmsg(r0, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:20 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x3}, 0x1c) sendmmsg(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f0000000300)="d7729978aad696ac0e2298dd30221395b6245e2af77a5fc5d808b7bcb8965ff2337713fdb0034636bedefe3a46ee7a980c353d07f7aa36aa8b6a7a04b561e9a826dc250be3bea07807d8902708fe2f1ae00b0d35ad3f60e0f16408fc8b5f89c9c358b5b408c30e52c4c0798bf84adc86d6fe5c83162b43f3c41089108d00fc2e2296f12187deeae260f7908031e31d2620fb941216038dda7eee94c002abd65a083281dcb370b64e7b6e33283a1f4ebd97dea274b5b4e301e416b4b47d63b51eb8bd02df056e83daca2b7db28f323d53c8ac780b1929add6cb107ef0c756a914ad5dea6cc0e346bd3d6edb331d58de320ffdd27e083a694cac214bdcd0c793afe422644289b885983dca499c8836d0e1c9665cc3ec66180212ee3243822b7470627a2496d0599da5a5c1ee37e9715187be8789c6d09e661b253f7f463952cb53d5c5628330fa0fd9c138d0c912c10de240edceb6266feb8279e13f7c85b2488254d27176e59f228f5a3c6dabc6f78e61261d0d458ea83a2fb958e8466ac6c730132fad47d65ad375821bcd2c4957ae93994ac0350c93849b59f0a203d63f774e799b85b0d451649b47e328b4ce29b040c7869803f87384aeb6079093f80c53878efe7c3127ec323972f451cc1b0bc6d80626995b3cb349857a561c360314a3031ca4c5cf7fa8419b23522d3673ea489894e650f18416036c4755113ddd4171ea8c5a01e9209bc8fc4ffc890f331de98d097477f4401b95db0479b9fd7e3b7ae4b9b55dc06fdd1be09e59d421a23d8d6630ce36da1c945c944f341c320ee7b80780759981974fd387d68d48c7d5296ea32561bd99d9681bc25116c8c6caf17de555d965798cbd1cf9a412bf6f9e9847ffa7b3fc69f14565fa9812f8264126eac2d83a1abe48d4def80db8932e34e45fd4665036a4f10d045fdffc20838e3300d470be55a4f3ad0c8b73e918ab020559585a87d033f03432550050dfb41358f374997c3aa1c606c5486f309388ded4932a86ea82935c6be0f749fc04decd173ae96ef84821392796a97d0ad74e19213ac3ffb1b6dbd30c83c08ab81330e2494551cb16c204623b647fdb7b7e4c5c2bff09c92eceb79e049dac1204b10772e93ba24a0c537d62c3f66006822b4830bb8f429132c077e91db4e7f01c4a9b774b513ac31b3bf7be62529a022b67398bec1ac80553f4a2bb009b7fa92169188e69d952c589a447515e01588c9ab351fc9bd3464bb19d52e0a4bf2ee8d656419a1309aa79cb4acdc38feb0abc8649e29892ada9496201ea5caff004378cfecc8000383599c8d4679e00e7c697b0c633459b1640c13f747c14df2f866db3659d5d4b88ae2accfdb6d313c48d926dfba5aba2b91991a7c1c84901357fa15776fd4fa605a659333258ed30e0621317284e367babd3332f2d54b4bdc2ef9a200ead8d906fb45e85618b2d37a8cba3b26de259928a0cd76319bb77e6e91b876b0f7659b0b38e084660f6a3d13d10a064d0cc1239c142c9e3679030ab4871b623b82e5cd3bface75601401f2bb8d73a1e53bd85c0e4e621140dbf0dc1cf9aef1468457bfdd6a622063d143d83fdea7c33319d3577f6e2c73d7ee462e73906d14597318c76808cfba8720c30fc855e88bcf8f87f287a3979b0a6666120233a3fd8b957c950992e1ee2e3983a3036c7917f53d4f6eea45d975661add0bac338dd60769025c2806b1a27b9013930d9d4982d220336a54a2f622735effb380e5d9f8a943ccc96649254ac65099d28f942373485abe2af7a6cf790d82466f28fc05f339ab68137501b9189d42101c14936d8b2cb11b3e7e8c93b2fb851bf608da81b8367813a4c0623881104e0c13d2f584b1af4ed4becdb3a788adabc6183c8870ca5439de44c22303a1105a0b7c655c67c8e71d24f9796be5d9e32d54da2ec438f4d4e3507cb11affce4186ffa7240aa156e60c5717a07a0d5f0bddc18db3010ee2d3aa486711a41ef1abbe1a759474088fd8ec7ed1cb911bfbc1f5c29e4e3767bd3586f44d1633d55b4a864c8b4ba2665a6124443e3189e8212849f98d5afe0e8fb97e23ed04169e73b9eb30bd21250d390b1732cf808cb1db77a99a6f95fc1aaee6ebd173f50c4fbacf5f87fe743cae3e86d2ccf7a3faef45596c2b98e2c31cf360106ab1ae41334cbf777254db927712566df529877115b0505e8013147b7e93d50285c3c96139639e58c6484ed1f1617291223f46698cb4ada4ee1f6bdd0afc21843935193346dabe3c8ec42e6db9f35f37a188f2056606865b95e7ab5efe68b3cff62bf4cf544be295f0cf56e90f6fc2fa8c891d7e913159f9056e48dc81624e4b97624080fe735e661ad56ebd074bffa4ddd48b3e32456abeb8df0cafe64412ceb9bacc8a068c1fc3f88e2bb1d94cf90de3028b784526274b526974eaa3aceeb8d411a8a3aa5c027c22296c02c131a99cd5935b308a7651f009a45d8e4956ac23eeaac84037490c4aa952b58e87ea3e7eee59179c975a2135618a32182a39d40367d68a85d90d7edd1f2f055beb0230bf8f44f777b6a9678c831e8859787e8b58ba1d304923914073f19da05dfe40c4186cea66cf83bcb29e1c473e18caaab54f5a88886bb4431547876db39f405356efaf30ebd8ac546cf49ba7c03450e3aeb75b168abb1df3489677ba8b08ea2b19cf0e74b898725fd10e9c09a9e8a135d7d6af5cfb560fb18f660cd853cd9e20a1130a5515f8199c1f148e575def875b75cde9a0078eef429f762b2e2b7468cd5137c83326b253e9a9649e274264b6be30497a9", 0x7bd}], 0x1, &(0x7f0000000140)}}], 0x1, 0x0) 22:59:20 executing program 7: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000000)='cpuset.sched_relax_domain_level\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000200)='cpuset.memory_pressure\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000140)=0x900, 0x1) 22:59:20 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x82) r1 = memfd_create(&(0x7f0000000280)="637090736574232a2f2da4833042f9614f5335", 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r1) sendfile(r0, r0, &(0x7f0000000000), 0x2000005) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) [ 66.622643] input: syz1 as /devices/virtual/input/input4 22:59:21 executing program 5: dup2(0xffffffffffffffff, 0xffffffffffffffff) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x10, 0x0, &(0x7f0000000000)=[@increfs, @release], 0x0, 0x0, &(0x7f0000000040)}) 22:59:21 executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000500)={&(0x7f0000000240), 0xc, &(0x7f00000004c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="440000002000010000000000000000000200000000000000000000001c000000080015000000000008000b000000000008000b00000000000c0014006bc6203e2c04b7e6410bc7246cf01518025395907cd3c4a6bc73fcac892f1aa0d8ca7ec08172fdf7b2c6a7d6be705129642843430389227cd12a2f6c4e5075671f3ecb882237017a6034f5e0", @ANYRES32=0x0, @ANYRES32=0x0], 0x3}}, 0x0) 22:59:21 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz1\x00'}) read(r0, &(0x7f0000000d00)=""/4096, 0x1000) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$uinput_user_dev(r0, &(0x7f0000000880)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000]}, 0x45c) 22:59:21 executing program 1: r0 = socket$inet6(0xa, 0x3, 0xff) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'bond0\x00'}) [ 66.738640] binder: tried to use weak ref as strong ref [ 66.783433] binder: 6364:6368 Release 1 refcount change on invalid ref 0 ret -22 [ 66.788722] input: syz1 as /devices/virtual/input/input6 [ 66.860781] binder: BINDER_SET_CONTEXT_MGR already set [ 66.877124] binder: 6364:6387 ioctl 40046207 0 returned -16 22:59:21 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) 22:59:21 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) syz_emit_ethernet(0x3e, &(0x7f0000000500)={@link_local={0x1, 0x80, 0xc2, 0x3a000000}, @remote, [], {@ipv6={0x86dd, {0x0, 0x6, "093a06", 0x8, 0x3a, 0x0, @remote, @mcast2, {[], @udp={0x0, 0x0, 0x8}}}}}}, &(0x7f0000000100)) 22:59:21 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000418f50)={{0x4000000000080}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0xc0605345, &(0x7f0000000180)={0x0, @time}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer2\x00', 0x0, 0x0) 22:59:21 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r0, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr}, 0x4, 0x1}}, 0x2e) ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f0000000000)) 22:59:21 executing program 3: r0 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000080), 0x0, 0x0, 0xfffffffffffffffb) keyctl$unlink(0x9, r0, 0xfffffffffffffffd) 22:59:21 executing program 5: r0 = syz_open_dev$loop(&(0x7f00000006c0)='/dev/loop#\x00', 0x0, 0x82) r1 = memfd_create(&(0x7f00000000c0)="74086e750000000000000000008c00", 0x0) pwritev(r1, &(0x7f0000000a80)=[{&(0x7f0000000980)="94", 0x1}], 0x1, 0x0) sendfile(r0, r1, &(0x7f0000000080), 0x0) write$P9_RGETLOCK(r1, &(0x7f0000000100)={0x2e8, 0x37, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, '/'}}, 0x1f) fadvise64(r0, 0x0, 0x0, 0x4) 22:59:22 executing program 1: r0 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000340)={0x0, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast1}}}, 0x116) 22:59:22 executing program 6: r0 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x82) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) sendfile(r0, r0, &(0x7f0000000000), 0x2000005) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r2) 22:59:22 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10) 22:59:22 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r1, &(0x7f0000000200), 0xfffffffffffffeb4, 0x2000800e, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback, [0x2, 0x7000028]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='yeah\x00', 0x5) recvfrom(r1, &(0x7f0000f9cf9b)=""/101, 0x6478c8501c739e53, 0x0, 0x0, 0x4f) sendto$inet(0xffffffffffffffff, &(0x7f0000000040)="89", 0x1, 0x0, &(0x7f00000002c0)={0x2, 0x0, @broadcast}, 0x10) 22:59:22 executing program 0: inotify_add_watch(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x200) inotify_rm_watch(0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000100), 0xa0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) recvmsg(r0, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:22 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$VT_OPENQRY(0xffffffffffffffff, 0x5600, &(0x7f0000000400)) fchdir(r0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r1, 0x80045300, &(0x7f0000000000)) fcntl$setstatus(r1, 0x4, 0x6100) truncate(&(0x7f00000000c0)='./bus\x00', 0x800) r2 = open(&(0x7f0000000540)='./bus\x00', 0x0, 0x0) lseek(r1, 0x0, 0x2) sendfile(r1, r2, &(0x7f0000000040), 0x8000fffffffe) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r1, r2, 0x0, 0xa5cc54d) creat(&(0x7f0000000500)='./bus\x00', 0x0) 22:59:22 executing program 5: r0 = memfd_create(&(0x7f0000000240)='\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000027ff3)='/dev/snd/seq\x00', 0x0, 0x20005) dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r0, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @result}], 0xfc95) 22:59:22 executing program 4: pipe(&(0x7f0000000000)) syz_emit_ethernet(0xff27, &(0x7f000000a000)={@broadcast=[0xff, 0xe0], @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x43, 0x0, 0xfec3, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}, @multicast1}, @udp={0x0, 0x883e, 0x8}}}}}, 0x0) 22:59:22 executing program 4: openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x0, 0x0) 22:59:22 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000280)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) 22:59:22 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000140)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x4058534c, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f00000001c0)) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 22:59:22 executing program 6: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x1000000000000101, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000400)="6e65742f69676d700057564a7d28cc41a91731abef08ee621fdb97c8629072635982e90a6bc5b5c52053b328fd991114142cd455c33bf7f343b7bd496789ee01cda6234a4d3f3e967f") preadv(r0, &(0x7f0000000700), 0x31f, 0x0) 22:59:22 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@loopback={0xc0fe}, 0x2f000000, 0x0, 0x2, 0x1}, 0x20) 22:59:22 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6(0xa, 0x1080000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") sendto$inet6(r1, &(0x7f0000000140), 0x10000a, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) 22:59:22 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4000004000000014}, 0x1c) sendto$inet6(r0, &(0x7f0000000300), 0x0, 0x8008, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000000780), 0x0, 0x44000) sendmmsg(r0, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f0000000380)}}], 0x400000000000009, 0x0) 22:59:22 executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bond0\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000000)={r1, 0x1, 0x6}, 0x10) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000040)={r1, 0x1, 0x6, @dev}, 0x10) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f00000000c0)={r1, 0x1, 0x6}, 0x10) 22:59:22 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r1, &(0x7f0000000200), 0xfffffffffffffeb4, 0x2000800e, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback, [0x2, 0x7000028]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='yeah\x00', 0x5) recvfrom(r1, &(0x7f0000f9cf9b)=""/101, 0x6478c8501c739e53, 0x120, 0x0, 0x4f) [ 68.462321] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 22:59:22 executing program 5: socketpair$unix(0x1, 0x800000003, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0xa4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) writev(r1, &(0x7f0000001400)=[{&(0x7f00000013c0)='8', 0x1}], 0x1) sendmsg(r1, &(0x7f0000000700)={&(0x7f0000000100)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000640), 0x0, &(0x7f0000002600)}, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='tunl0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) 22:59:22 executing program 1: lstat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)) 22:59:23 executing program 2: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="40000000190001021d000000000000001d0100002c000200217b266c6f6c6f2e2c4765746e6f64657621285d76626f786e65743123bf5e5b00"], 0x1}}, 0x0) 22:59:23 executing program 1: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x24, &(0x7f0000000140), 0x4) 22:59:23 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$VT_OPENQRY(0xffffffffffffffff, 0x5600, &(0x7f0000000400)) fchdir(r0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r1, 0x80045300, &(0x7f0000000000)) fcntl$setstatus(r1, 0x4, 0x6100) truncate(&(0x7f00000000c0)='./bus\x00', 0x800) r2 = open(&(0x7f0000000540)='./bus\x00', 0x0, 0x0) lseek(r1, 0x0, 0x2) sendfile(r1, r2, &(0x7f0000000040), 0x8000fffffffe) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r1, r2, 0x0, 0xa5cc54d) creat(&(0x7f0000000500)='./bus\x00', 0x0) 22:59:23 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/mcfilter\x00') perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x857, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pread64(r0, &(0x7f0000000180)=""/53, 0x35, 0x41) 22:59:23 executing program 6: syz_open_pts(0xffffffffffffff9c, 0x0) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, &(0x7f0000000000)) r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000880)='/dev/urandom\x00', 0x0, 0x0) pread64(r0, &(0x7f0000000f40)=""/4096, 0x1000, 0x0) 22:59:23 executing program 5: socketpair$unix(0x1, 0x800000003, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0xa4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) writev(r1, &(0x7f0000001400)=[{&(0x7f00000013c0)='8', 0x1}], 0x1) sendmsg(r1, &(0x7f0000000700)={&(0x7f0000000100)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000640), 0x0, &(0x7f0000002600)}, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='tunl0\x00', 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) 22:59:23 executing program 0: inotify_add_watch(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x200) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000100), 0xa0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) recvmsg(r0, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:23 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000140)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x4058534c, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f00000001c0)) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 22:59:23 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000c33f70)={0x1, {{0x2, 0x0, @multicast2}}}, 0x90) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f00000000c0)={0x8000000000000001, {{0x2, 0x0, @multicast1=0xe0000014}}}, 0x84) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000000)={0x100000001, {{0x2, 0x0, @multicast1}}}, 0xffffffffffffff21) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000003c0)={@multicast1, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) 22:59:23 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/mcfilter\x00') perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x857, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pread64(r0, &(0x7f0000000180)=""/53, 0x35, 0x41) 22:59:23 executing program 6: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$VT_OPENQRY(0xffffffffffffffff, 0x5600, &(0x7f0000000400)) fchdir(r0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r1, 0x80045300, &(0x7f0000000000)) fcntl$setstatus(r1, 0x4, 0x6100) truncate(&(0x7f00000000c0)='./bus\x00', 0x800) r2 = open(&(0x7f0000000540)='./bus\x00', 0x0, 0x0) lseek(r1, 0x0, 0x2) sendfile(r1, r2, &(0x7f0000000040), 0x8000fffffffe) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendfile(r1, r2, 0x0, 0xa5cc54d) creat(&(0x7f0000000500)='./bus\x00', 0x0) 22:59:23 executing program 5: mkdir(&(0x7f00000006c0)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000000)={0x4, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x4000200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(&(0x7f00008deff8)='./file0\x00', &(0x7f0000343ff8)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000)) 22:59:23 executing program 2: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vga_arbiter\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f000064e000)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r1, r0, 0x0) 22:59:23 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r1, &(0x7f0000000200), 0xfffffffffffffeb4, 0x2000800e, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback, [0x2, 0x7000028]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='yeah\x00', 0x5) recvfrom(r1, &(0x7f0000f9cf9b)=""/101, 0x6478c8501c739e53, 0x120, 0x0, 0x4f) 22:59:23 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000100)="6370757365742e6d656d6f72795f7370726561645f70616765009144d60683b365196de5669148998d5502913485763742d640401220948a656350f1eb9d5bc8615873e2d59d200cad70a7099b1a7df887", 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x6, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fchown(r1, 0x0, 0x0) 22:59:23 executing program 2: syz_emit_ethernet(0x3e, &(0x7f00000001c0)={@local, @dev, [], {@ipv6={0x86dd, {0x0, 0x6, "50a09c", 0x8, 0xffffff2b, 0x0, @remote, @local, {[], @udp={0x0, 0x0, 0x8}}}}}}, &(0x7f0000000040)) 22:59:23 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socketpair$unix(0x1, 0x20000000000002, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$LOOP_SET_STATUS64(r0, 0x4c02, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "e1d3f877e5eae453e55d7d64d00d4901baed21f7de92a8669b38ccd6260857dbf5ae46354569636517b50f805ae208258dba7d0abe8d208f0f1bcc885c8ba93c", "fe047b3177f4fccbba36f0daa8e7d1c4c4cf144a23173b7605afb988de9bba6df5fdc54d81bf6b05626966c95982fba5a04a004acfe05900", "ee42e3ef1d1772a9432c220303b70b708ad791137e2982fcce5d747a3131995a"}) 22:59:23 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f00000002c0)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000006c0)={@multicast2, @loopback, 0x0, 0x2, [@multicast2, @broadcast]}, 0x18) setsockopt$inet_mreqsrc(r0, 0x0, 0x25, &(0x7f0000000140)={@multicast2, @loopback, @broadcast}, 0xc) 22:59:23 executing program 3: prctl$seccomp(0x16, 0x2, &(0x7f0000000140)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xfffffffffffffff9}]}) creat(&(0x7f0000000380)='./file0\x00', 0x0) [ 69.405912] syz-executor3 (6517) used greatest stack depth: 23672 bytes left 22:59:23 executing program 3: r0 = socket(0x10, 0x3, 0x9) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000440)={{{@in6, @in6=@ipv4={[], [], @remote}}}, {{@in=@multicast2}, 0x0, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x6978eb9b, 0x0, 0x8}}, 0xe8) r1 = syz_open_procfs(0x0, &(0x7f0000000540)="2f657865000000d400042a04000000de91be10eebf00f5e94aae22e89bb36cc7457accc3320c67a90f79805843e901d2da75af1ff9ffffffffff530e72cd57f44277528844209c7ed05b160ef336721bf89686ff472f71dfca5353f6323ddf8006ffc1052d6a80985adc68017065648b35c7d321fc5c0466062fbfad5acbe7ff6cefe53c88c05ab970ceebdfa589098ad40d080deb2488f9e4069682b14483f113cb6979b2f390179a18e26b4088f1f31ed04a0a681f002e007436947475ab073711c98ae3b4259f1a1aff9b09aa66cb90ca43a1dbc6de15abb4ae739f9e8f047cd29ec76b9ef6beb7839f8071aaea4d247e6a9514748c93d0bb01a7c37ca6c856327af81f296d2c2c07c2d63b") sendfile(r0, r1, &(0x7f0000000300), 0xfffffffd) 22:59:23 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip_vs\x00') process_vm_writev(0x0, &(0x7f0000000080), 0x0, &(0x7f0000002f00)=[{&(0x7f0000000280)=""/147, 0x93}], 0x1, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x8f) 22:59:23 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000280)=""/28, 0x58) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f000019ffe9)={0xc1}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r0, 0xc0a85352, &(0x7f00000000c0)={{}, 'port1\x00'}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000000200)={{}, {0x0, r2+30000000}}, &(0x7f0000040000)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r1, 0x13) [ 69.525832] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=257 sclass=netlink_audit_socket pig=6579 comm=syz-executor3 [ 69.555012] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=11048 sclass=netlink_audit_socket pig=6579 comm=syz-executor3 [ 69.571809] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=12792 sclass=netlink_audit_socket pig=6579 comm=syz-executor3 [ 69.589379] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=12543 sclass=netlink_audit_socket pig=6579 comm=syz-executor3 [ 69.604070] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=65535 sclass=netlink_audit_socket pig=6579 comm=syz-executor3 22:59:23 executing program 0: setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000100), 0xa0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) recvmsg(r0, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) [ 69.616570] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=19816 sclass=netlink_audit_socket pig=6579 comm=syz-executor3 [ 69.629083] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=17545 sclass=netlink_audit_socket pig=6579 comm=syz-executor3 [ 69.641571] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=36351 sclass=netlink_audit_socket pig=6579 comm=syz-executor3 [ 69.655390] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=20992 sclass=netlink_audit_socket pig=6579 comm=syz-executor3 [ 69.668136] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=30447 sclass=netlink_audit_socket pig=6579 comm=syz-executor3 22:59:24 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000140)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x4058534c, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f00000001c0)) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 22:59:24 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) request_key(&(0x7f0000000940)="646e735f7265736f6c7665720005083f7605beb89ebb55f56950196fd8b8a6ebddf637ee27ef0fabbbad7523dacb0ab4baaf14787b652566f6eaf50a9d4cff3e30f2d07fd0118cf06573e05f283ef26ec0cc75cf93fe4c95c7185cb70df310c4c08871883fc063c014d46b8b27fd88a01e760bee664a475d69d12e2fc7e3dc680e3bb87b71d301fbf92cadf5537bc8774141ee7d7152d16c9ee500389b527a9b31679b1560e4680fcfd95743ed5305a984645fb4371e5e363f7df35cb72f6d9c953cd2ea3167c037567f7f99399e92ba02db513f40a4d44e072bf5ea9495287934a503a032610a0235c3530cfc99e27a1e10e28ed49beb223bbe910fd417a48e64dbdf97edb9363e6b5853e1323d6f78d0fb80969de2f5fec97acbb11c1ae97f54cf4e3ef9d50e1fbc43cc27e537d18452001232814ac3970ee2938175a91f4e0ca28b803a350dbea3b68d6a71bc65b011a81834b809f86919e4499a53ff8a35993b333b9b2761a44bb4a888a90c078d0b923e28cdbf76aa3fb68394de930dddf27c48926ab9c66951b70ebd4063b510ae453059ff71853bcf5942b5140a111d4a2afbaf612c6415aceb9578cb0d1decc8001f6dfc9d6829dbed2a8dbbc4bc9391960c1bb3fb451d52778143fb3c2f4d17df3c295117e13889037aff061ff283cac330aa03e7d189f01bfd03e68532d5594ef0e4bf1d584c7eacfd53a7ae8ccecc1901c89f4db4a3f1925610f22dac4570169b7f9f4cbf3fa1376f0ce4ab31605a16aff95c1bda1b96b9ded911a38594c3d9b42e7712ac377f377cd30eda00efd15d718e20dba3e76c4850966353c04a178e3b857719f9d81dc0ef8776c46c47d38aad73498289bc0240", &(0x7f0000000140)={0x73, 0x79, 0x7a, 0x3, 0x10000000}, &(0x7f00000004c0)="af2019dcc2380b4623dc8c7a581973a96d57452035fca47b18e7992f4c82e608a92c747d6e80519f2f5a436783ee4e3264245238b946a4a11d39b7873e5f3296185625d49ae13974d13940d0c01a5029b35aec2234864afd4648", 0x0) 22:59:24 executing program 2: r0 = open(&(0x7f0000000140)='./bus\x00', 0x40, 0x0) close(r0) r1 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r2 = memfd_create(&(0x7f0000000100)="000000008c00000001000000008000", 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r2) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) readv(r1, &(0x7f0000000180)=[{&(0x7f0000001200)=""/4096, 0xfffffe19}], 0x1) 22:59:24 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc8070031") fstat(0xffffffffffffff9c, &(0x7f0000000240)) prctl$void(0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f00000001c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="00000000000000000800200000f0ffff180012001000010069703667720000040002000000000000"], 0x1}}, 0x0) 22:59:24 executing program 3: r0 = socket$packet(0x11, 0xa, 0x300) getsockname$packet(r0, &(0x7f0000002540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000002580)=0x14) 22:59:24 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x3}, 0x1c) sendmmsg(r0, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f0000000300)="d7729978aad696ac0e2298dd30221395b6245e2af77a5fc5d808b7bcb8965ff2337713fdb0034636bedefe3a46ee7a980c353d07f7aa36aa8b6a7a04b561e9a826dc250be3bea07807d8902708fe2f1ae00b0d35ad3f60e0f16408fc8b5f89c9c358b5b408c30e52c4c0798bf84adc86d6fe5c83162b43f3c41089108d00fc2e2296f12187deeae260f7908031e31d2620fb941216038dda7eee94c002abd65a083281dcb370b64e7b6e33283a1f4ebd97dea274b5b4e301e416b4b47d63b51eb8bd02df056e83daca2b7db28f323d53c8ac780b1929add6cb107ef0c756a914ad5dea6cc0e346bd3d6edb331d58de320ffdd27e083a694cac214bdcd0c793afe422644289b885983dca499c8836d0e1c9665cc3ec66180212ee3243822b7470627a2496d0599da5a5c1ee37e9715187be8789c6d09e661b253f7f463952cb53d5c5628330fa0fd9c138d0c912c10de240edceb6266feb8279e13f7c85b2488254d27176e59f228f5a3c6dabc6f78e61261d0d458ea83a2fb958e8466ac6c730132fad47d65ad375821bcd2c4957ae93994ac0350c93849b59f0a203d63f774e799b85b0d451649b47e328b4ce29b040c7869803f87384aeb6079093f80c53878efe7c3127ec323972f451cc1b0bc6d80626995b3cb349857a561c360314a3031ca4c5cf7fa8419b23522d3673ea489894e650f18416036c4755113ddd4171ea8c5a01e9209bc8fc4ffc890f331de98d097477f4401b95db0479b9fd7e3b7ae4b9b55dc06fdd1be09e59d421a23d8d6630ce36da1c945c944f341c320ee7b80780759981974fd387d68d48c7d5296ea32561bd99d9681bc25116c8c6caf17de555d965798cbd1cf9a412bf6f9e9847ffa7b3fc69f14565fa9812f8264126eac2d83a1abe48d4def80db8932e34e45fd4665036a4f10d045fdffc20838e3300d470be55a4f3ad0c8b73e918ab020559585a87d033f03432550050dfb41358f374997c3aa1c606c5486f309388ded4932a86ea82935c6be0f749fc04decd173ae96ef84821392796a97d0ad74e19213ac3ffb1b6dbd30c83c08ab81330e2494551cb16c204623b647fdb7b7e4c5c2bff09c92eceb79e049dac1204b10772e93ba24a0c537d62c3f66006822b4830bb8f429132c077e91db4e7f01c4a9b774b513ac31b3bf7be62529a022b67398bec1ac80553f4a2bb009b7fa92169188e69d952c589a447515e01588c9ab351fc9bd3464bb19d52e0a4bf2ee8d656419a1309aa79cb4acdc38feb0abc8649e29892ada9496201ea5caff004378cfecc8000383599c8d4679e00e7c697b0c633459b1640c13f747c14df2f866db3659d5d4b88ae2accfdb6d313c48d926dfba5aba2b91991a7c1c84901357fa15776fd4fa605a659333258ed30e0621317284e367babd3332f2d54b4bdc2ef9a200ead8d906fb45e85618b2d37a8cba3b26de259928a0cd76319bb77e6e91b876b0f7659b0b38e084660f6a3d13d10a064d0cc1239c142c9e3679030ab4871b623b82e5cd3bface75601401f2bb8d73a1e53bd85c0e4e621140dbf0dc1cf9aef1468457bfdd6a622063d143d83fdea7c33319d3577f6e2c73d7ee462e73906d14597318c76808cfba8720c30fc855e88bcf8f87f287a3979b0a6666120233a3fd8b957c950992e1ee2e3983a3036c7917f53d4f6eea45d975661add0bac338dd60769025c2806b1a27b9013930d9d4982d220336a54a2f622735effb380e5d9f8a943ccc96649254ac65099d28f942373485abe2af7a6cf790d82466f28fc05f339ab68137501b9189d42101c14936d8b2cb11b3e7e8c93b2fb851bf608da81b8367813a4c0623881104e0c13d2f584b1af4ed4becdb3a788adabc6183c8870ca5439de44c22303a1105a0b7c655c67c8e71d24f9796be5d9e32d54da2ec438f4d4e3507cb11affce4186ffa7240aa156e60c5717a07a0d5f0bddc18db3010ee2d3aa486711a41ef1abbe1a759474088fd8ec7ed1cb911bfbc1f5c29e4e3767bd3586f44d1633d55b4a864c8b4ba2665a6124443e3189e8212849f98d5afe0e8fb97e23ed04169e73b9eb30bd21250d390b1732cf808cb1db77a99a6f95fc1aaee6ebd173f50c4fbacf5f87fe743cae3e86d2ccf7a3faef45596c2b98e2c31cf360106ab1ae41334cbf777254db927712566df529877115b0505e8013147b7e93d50285c3c96139639e58c6484ed1f1617291223f46698cb4ada4ee1f6bdd0afc21843935193346dabe3c8ec42e6db9f35f37a188f2056606865b95e7ab5efe68b3cff62bf4cf544be295f0cf56e90f6fc2fa8c891d7e913159f9056e48dc81624e4b97624080fe735e661ad56ebd074bffa4ddd48b3e32456abeb8df0cafe64412ceb9bacc8a068c1fc3f88e2bb1d94cf90de3028b784526274b526974eaa3aceeb8d411a8a3aa5c027c22296c02c131a99cd5935b308a7651f009a45d8e4956ac23eeaac84037490c4aa952b58e87ea3e7eee59179c975a2135618a32182a39d40367d68a85d90d7edd1f2f055beb0230bf8f44f777b6a9678c831e8859787e8b58ba1d304923914073f19da05dfe40c4186cea66cf83bcb29e1c473e18caaab54f5a88886bb4431547876db39f405356efaf30ebd8ac546cf49ba7c03450e3aeb75b168abb1df3489677ba8b08ea2b19cf0e74b898725fd10e9c09a9e8a135d7d6af5cfb560fb18f660cd853cd9e20a1130a5515f8199c1f148e575def875b75cde9a0078eef429f762b2e2b7468cd5137c83326b253e9a9649e274264b6be30497a941d8b4686ad16e28674263189a935d0748bb5f2b629c409d52a6af5a4ebe1f3f7476a2236246c75ae18561e22432af5aa3be44bf94ecee8e79a1d3bbd6132bbf49cfce7e1d06db0ad3c98729b5e1841a95072b70157686a6a2d03eba48054ac836b95fb60849849a44385828395be284aa9e224ab3adad39789bb0ce53c958c61e6b67a530c4a8c8083dc57517d8236fe8367a10dbf30d06a30c092b063b1915d721f255bdbdf49674a4746a75193e0d297a06b7e51c8a99c25f9acbf2daf82c7d5f1fc10a89756dadb9b4a13c70a15f5b6781aad566d7578b55ec9bfa4ea5823986cc2c7c89de8bcb517d2d6931746dba56d8565ae355dc68d29dd1c8d5763bcf27afe468faa33f50051c489b8bcd29802bebca07fb2752b52f5887fd5409821057a29412c3499688231b6e549b9c67f3589bf8ce4ed3b724dfeaa20e10cd5c22432605bcd374d14a9636a24cb4435476cd2130f2d32c73597d04551543239fa4d0aceb98d7991d67cee45853165f7f7b3f61c4d609e3ca7229cec3ea78468e08ad13b20e5d43d891611a53b541afe940e7e009b887dd4bea8be062b64e558c1846c752feace6fd5c62bd2d37ff30698d538c88ce85efdd1c0b2b5d2001bb1112bbb31bbe2436649ea144a60c79a89f98769bebeaec4ee84f396460f6321929e616acb2fe4dddb2907f5b2209f541b33fc34b13fcc5445b8e1060b719dfe3dd196b350de0c25efd8df6744f6db9bcc2c5574dacf451ba3dddda1979c505819cdfe02603c068c9ac8f8e1263992efa5be191f164865ba8bf758099d3ca32359ce0e14cc5ef3101b66f6b6cbfb58a9300c74882c09c05b5e9f7950219a7e45d852c2a368c0261fb93b6bc969ee8724a6c5a04fc0f88d875ecc3172832177256d3f51d63c40b9d63c54fd40bf2f69ad2e94d4d6da79efdecbc7a641cf066e100f8b90f66fd109492b01571b496443a68eb9343b7dcc8855388cd9a1c053281c76723ec0a95d2521f3415753365b8028565b0340567c96c5dae004e7097706540c60a001bccaf92b4562615af7b3819a20160612787a50c5480bf9aab625d230a19d5321908d1f15cb9ff037ad6d157ed0c5720231a2a6a5b215d27c2672a66e53921e418573669bf67f7927c56e96765dc03608bfb6a97bf54027c2a", 0xaf8}], 0x1, &(0x7f0000000140)}}], 0x1, 0x0) 22:59:24 executing program 2: r0 = socket$inet6(0xa, 0x80805, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_buf(r1, 0x107, 0xa, &(0x7f0000651000)=""/240, &(0x7f0000ca5ffc)=0xf0) 22:59:24 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = socket$inet6(0xa, 0x803, 0x2000000003) ioctl(r1, 0x1000008912, &(0x7f0000000080)="0aaa2d0252926285717070") setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) 22:59:24 executing program 1: add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200), 0x0, 0x0, 0xfffffffffffffffd) 22:59:24 executing program 6: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) write$cgroup_type(r0, &(0x7f0000000040)='threaded\x00', 0xca3325f3e54ffabc) link(&(0x7f0000000280)='./bus\x00', &(0x7f00000002c0)='./file1\x00') creat(&(0x7f0000000000)='./file1\x00', 0x0) 22:59:24 executing program 3: perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x857, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, &(0x7f0000664fc0)) read(r0, &(0x7f0000000340)=""/4096, 0x1000) 22:59:24 executing program 0: setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000100), 0xa0) r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) recvmsg(r0, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:24 executing program 1: r0 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, "94d4341307ee5d4501d9f99b60ff2618833263db3afce629f579d0956535eb893d885a358beb7c3251f0f29874bc643a28779214cd4d8b975beeff8780d29f6c", "9a65c9632090ff2319a1f977c69149162db3db7768da42b7cb2b14a4b98944a9"}) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r1, 0x80045301, &(0x7f0000000140)) 22:59:24 executing program 3: r0 = socket(0x10, 0x3, 0x9) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000440)={{{@in6, @in6=@ipv4={[], [], @remote}}}, {{@in=@multicast2, 0x0, 0x2b}, 0x0, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x6978eb9b}}, 0xe8) r1 = syz_open_procfs(0x0, &(0x7f0000000540)="2f657865000000d400042a04000000de91be10eebf00f5e94aae22e89bb36cc7457accc3320c67a90f79805843e901d2da75af1ff9ffffffffff530e72cd57f44277528844209c7ed05b160ef336721bf89686ff472f71dfca5353f6323ddf8006ffc1052d6a80985adc68017065648b35c7d321fc5c0466062fbfad5acbe7ff6cefe53c88c05ab970ceebdfa589098ad40d080deb2488f9e4069682b14483f113cb6979b2f390179a18e26b4088f1f31ed04a0a681f002e007436947475ab073711c98ae3b4259f1a1aff9b09aa66cb90ca43a1dbc6de15abb4ae739f9e8f047cd29ec76b9ef6beb7839f8071aaea4d247e6a9514748c93d0bb01a7c37ca6c856327af81f296d2c2c07c2d63b") sendfile(r0, r1, &(0x7f0000000300), 0xfffffffd) 22:59:26 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4000004000000014}, 0x1c) sendto$inet6(r0, &(0x7f0000000300), 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) 22:59:26 executing program 0: setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000100), 0xa0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) recvmsg(r0, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:26 executing program 2: perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x857, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000606ff0)={0x2, 0x4e20, @loopback}, 0x10) sendmmsg(r0, &(0x7f00000010c0)=[{{&(0x7f0000000bc0)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000000d40), 0x2fb, &(0x7f0000000d80)}}], 0x4000000000001b4, 0x40400d4) 22:59:26 executing program 1: r0 = socket(0x40000000002, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0xfcda) setsockopt$inet_int(r0, 0x0, 0x3, &(0x7f0000000000)=0x8000000939, 0x4) sendto$unix(r0, &(0x7f0000000080), 0x7272, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) 22:59:26 executing program 3: clone(0x200, &(0x7f0000000200), &(0x7f0000000000), &(0x7f0000000180), &(0x7f0000000200)) mknod(&(0x7f0000000100)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000400)='./file0\x00', &(0x7f0000000340), &(0x7f0000000240)) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') pread64(r0, &(0x7f00009f3000), 0x352, 0x0) lseek(r0, 0x0, 0x1) open$dir(&(0x7f00000001c0)='./file0\x00', 0x101001, 0x0) 22:59:26 executing program 6: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000080)) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000740)={&(0x7f0000000480), 0xc, &(0x7f0000000700)={&(0x7f00000006c0)=@ipv4_newroute={0x24, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, [@RTA_OIF={0x8}]}, 0x24}}, 0x0) 22:59:26 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000140)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0x4058534c, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f00000001c0)) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 22:59:26 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f00000001c0)={&(0x7f0000000600)=ANY=[]}}, 0x0) 22:59:26 executing program 5: r0 = socket(0x2, 0x3, 0x100000001) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='ip_vti0\x00', 0x10) sendto$inet(r0, &(0x7f0000000000)="75ab", 0x2, 0x0, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) 22:59:26 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000039ff8)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r0, 0x0, r1) dup2(r2, r1) connect$unix(r0, &(0x7f0000000000)=@abs, 0x6e) 22:59:26 executing program 4: 22:59:26 executing program 6: 22:59:26 executing program 5: 22:59:26 executing program 4: 22:59:26 executing program 6: r0 = socket(0xa, 0x2, 0x0) sendto$inet6(r0, &(0x7f0000000180), 0x0, 0x0, &(0x7f0000000280)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) 22:59:26 executing program 5: clone(0x804000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080), &(0x7f0000000140)) 22:59:26 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'ip6gretap0\x00'}) sendmsg$nl_route(r0, &(0x7f00000000c0)={&(0x7f0000000180), 0xc, &(0x7f00000042c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="00000000000000001800120010000100698d3667726574617000000004000200adc4a4dd25cfe6f0aa5e012cad0d3542ccb1cf031b257245c5f189aa7b5830acedbe351b3cefdebc937c7762d7fc2f550c439e24e1aa8e54822b3f44f42ba2a4396bcbcd133bd81929b59231dccf25e7efc25a79dd503576eb3ee3927ca875daa65f26b1dd5a3dac32cc806506cc26000000000000000000000000"], 0x1}}, 0x0) 22:59:27 executing program 0: setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000100), 0xa0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x0, &(0x7f0000000040)=0x100, 0x4) recvmsg(r0, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:27 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000480)='syz_tun\x00', 0x25) sendto$inet6(r0, &(0x7f0000000000), 0x0, 0x200408d6, &(0x7f00000011c0)={0xa, 0x0, 0x0, @remote}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000080)={0x1, 0x7}, 0x8) close(r0) 22:59:27 executing program 1: 22:59:27 executing program 6: 22:59:27 executing program 2: 22:59:27 executing program 7: 22:59:27 executing program 5: clone(0x804000, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080), &(0x7f0000000140)) 22:59:27 executing program 3: 22:59:27 executing program 6: 22:59:27 executing program 2: 22:59:27 executing program 1: 22:59:27 executing program 3: 22:59:27 executing program 6: 22:59:27 executing program 4: 22:59:27 executing program 2: 22:59:27 executing program 1: 22:59:28 executing program 0: setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000100), 0xa0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000040), 0x4) recvmsg(r0, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:28 executing program 7: 22:59:28 executing program 1: 22:59:28 executing program 4: 22:59:28 executing program 2: 22:59:28 executing program 3: 22:59:28 executing program 6: 22:59:28 executing program 5: 22:59:28 executing program 1: 22:59:28 executing program 2: 22:59:28 executing program 3: 22:59:28 executing program 6: 22:59:28 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) close(r0) 22:59:28 executing program 6: 22:59:28 executing program 4: 22:59:28 executing program 2: 22:59:29 executing program 0: setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000100), 0xa0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000040)=0x100, 0x4) recvmsg(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180)=@can, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000400)=""/50, 0x32}, 0x0) 22:59:29 executing program 3: 22:59:29 executing program 6: 22:59:29 executing program 7: 22:59:29 executing program 1: 22:59:29 executing program 5: 22:59:29 executing program 2: 22:59:29 executing program 4: 22:59:29 executing program 7: 22:59:29 executing program 1: 22:59:29 executing program 5: 22:59:29 executing program 2: 22:59:29 executing program 4: 22:59:29 executing program 7: 22:59:29 executing program 2: 22:59:29 executing program 5: 22:59:29 executing program 7: 22:59:29 executing program 6: 22:59:29 executing program 4: 22:59:29 executing program 2: 22:59:29 executing program 5: 22:59:29 executing program 3: 22:59:29 executing program 1: 22:59:29 executing program 0: 22:59:29 executing program 0: 22:59:29 executing program 4: 22:59:29 executing program 1: 22:59:29 executing program 2: 22:59:29 executing program 5: 22:59:29 executing program 3: 22:59:29 executing program 4: 22:59:29 executing program 7: 22:59:29 executing program 0: 22:59:29 executing program 6: 22:59:29 executing program 1: 22:59:29 executing program 0: 22:59:29 executing program 3: 22:59:29 executing program 6: 22:59:29 executing program 7: 22:59:29 executing program 5: 22:59:29 executing program 4: 22:59:29 executing program 1: 22:59:29 executing program 3: 22:59:29 executing program 2: 22:59:29 executing program 7: 22:59:29 executing program 0: 22:59:29 executing program 5: 22:59:29 executing program 3: 22:59:29 executing program 2: 22:59:29 executing program 6: 22:59:29 executing program 1: 22:59:29 executing program 7: 22:59:29 executing program 4: 22:59:29 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = epoll_create1(0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) poll(&(0x7f00000000c0)=[{r1, 0xffffffffffbffbfd}], 0x1, 0x7be2) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000000)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r2, &(0x7f0000000180)={0x80000005}) 22:59:29 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000280)='/exe\x00\x00\x00\t\x00\x00') ioctl(r0, 0x1, &(0x7f0000000080)) 22:59:29 executing program 0: 22:59:29 executing program 1: 22:59:29 executing program 3: 22:59:29 executing program 5: 22:59:29 executing program 4: 22:59:29 executing program 7: 22:59:29 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f00000000c0)={0x1, 'syz_tun\x00'}, 0x18) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000040)={0x1, 'ip_vti0\x00'}, 0x18) 22:59:29 executing program 1: socket$inet(0x2, 0x0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@link_local, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0xe805, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x4, 0x0, @empty, @broadcast}, @udp={0x0, 0x0, 0x28}}}}}, &(0x7f0000000380)) 22:59:29 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f000099e000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r1, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008005, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback}, 0x10) recvfrom$inet(r1, &(0x7f0000000200)=""/179, 0xffffffffffffff98, 0x2, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x178) 22:59:29 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000140)='/dev/sg#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BLKTRACETEARDOWN(r0, 0x227a, 0x0) 22:59:29 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000000)='cpuset.sched_relax_domain_level\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000200)='cpuset.memory_pressure\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f0000000140), 0x1) 22:59:29 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) bind(r0, &(0x7f0000000080)=@in={0x2, 0x4e20}, 0x7c) sendto$inet(r0, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000280)={0x2, 0x8004e20}, 0x10) recvmmsg(r0, &(0x7f00000004c0)=[{{&(0x7f0000000400)=@ethernet={0x0, @dev}, 0x0, &(0x7f0000000480)}}], 0x6fdaec, 0x22, 0x0) 22:59:29 executing program 7: r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a5c2d0252926285717070") r1 = socket$inet6(0xa, 0x20100000000002, 0x0) sendto$inet6(r1, &(0x7f0000000040), 0xf32, 0x400806e, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @remote}, 0x1c) write$binfmt_script(r1, &(0x7f0000000080)={'#! ', './file0'}, 0xb) 22:59:29 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x400000000001e, &(0x7f0000000040)=0x1, 0x72) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @remote}, 0x10) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f00000000c0)={0x0, 0x7530}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000280)='team0\x00', 0x10) write$cgroup_int(r0, &(0x7f00000001c0), 0xfffffd5e) [ 75.637070] IPVS: stopping master sync thread 6912 ... 22:59:30 executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x61, &(0x7f0000000040)={'filter\x00', 0x4}, 0x68) 22:59:30 executing program 2: r0 = socket$inet6(0x10, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000240)={'syz_tun\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="3b00000002000000f901000000000000b325c4"]}) 22:59:30 executing program 7: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1}) 22:59:30 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) 22:59:30 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) ioctl$fiemap(r0, 0xc020660b, &(0x7f0000000040)={0x0, 0x7bb9, 0xb, 0x0, 0x304}) [ 75.637632] IPVS: sync thread started: state = MASTER, mcast_ifn = syz_tun, syncid = 0, id = 0 [ 75.671759] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x1 22:59:30 executing program 6: pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r1 = socket$netlink(0x10, 0x3, 0xf) fsync(r0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) bind$netlink(r1, &(0x7f0000514ff4), 0xc) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) 22:59:30 executing program 7: sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x5) 22:59:30 executing program 3: socket$unix(0x1, 0x0, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, &(0x7f0000000000), &(0x7f0000000040)=0xc) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x311042, 0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000bc0)) 22:59:30 executing program 2: 22:59:30 executing program 0: clone(0x200, &(0x7f0000000180), &(0x7f0000000300), &(0x7f00000000c0), &(0x7f00000003c0)) execve(&(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), &(0x7f0000000500)) seccomp(0x4000000000000001, 0x1, &(0x7f0000028ff0)={0x1, &(0x7f00000b3000)=[{0x6}]}) creat(&(0x7f0000000140)='./file0\x00', 0x0) [ 75.747804] IPVS: stopping master sync thread 6939 ... [ 75.747849] IPVS: sync thread started: state = MASTER, mcast_ifn = syz_tun, syncid = 0, id = 0 22:59:30 executing program 4: pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000300)={"310100", {0x2, 0x0, @broadcast}}) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000016) 22:59:30 executing program 7: request_key(&(0x7f0000000180)='logon\x00', &(0x7f00000001c0), &(0x7f0000000200)='nr0\x00', 0xffffffffffffffff) 22:59:30 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000140)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc0305302, &(0x7f0000000240)) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f00000001c0)) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 22:59:30 executing program 5: perf_event_open(&(0x7f0000000040)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt(r0, 0x8000000ff, 0x7, &(0x7f0000000000), 0x0) 22:59:30 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)) r2 = gettid() timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00000000c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) syz_open_pts(r0, 0x0) tkill(r2, 0x1000000000016) 22:59:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) ftruncate(r0, 0x280080) sendfile(r0, r0, &(0x7f0000d83ff8), 0x2008000fffffffe) ftruncate(r0, 0x100000001) 22:59:30 executing program 6: perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x6, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000100)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r0, &(0x7f0000000080)="a8", 0x1) sendfile(r0, r0, &(0x7f0000317000), 0xff8) 22:59:30 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") sendmmsg(r1, &(0x7f0000005fc0), 0x80000000000006a, 0x0) 22:59:30 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000fb6000)=""/28, 0x3f0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000140)={0xbf}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc04c5349, &(0x7f0000000240)) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r1, 0x1000000000014) 22:59:30 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) socketpair$unix(0x1, 0x20000000000002, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000040), &(0x7f0000000140)}}, &(0x7f0000044000)=0x0) timer_settime(r3, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) r4 = socket$inet(0x2, 0x1, 0x0) mmap(&(0x7f000092d000/0x400000)=nil, 0x400000, 0xfffffffffffffffc, 0x8972, 0xffffffffffffffff, 0x0) bind$inet(r4, &(0x7f0000134000)={0x2, 0x4e23, @broadcast}, 0x10) connect$inet(r4, &(0x7f00000000c0)={0x2, 0x4e23, @loopback}, 0x10) connect$inet(r4, &(0x7f00009322c4)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r4, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000140)={0x2, 0xfff, @local}, 0x10) dup2(r1, r4) tkill(r2, 0x1000200000016) [ 76.518936] ================================================================== [ 76.526374] BUG: KASAN: slab-out-of-bounds in ip6_xmit+0x1838/0x1b80 [ 76.532885] Read of size 8 at addr ffff8801d80e2b58 by task syz-executor0/6993 [ 76.540249] [ 76.541891] CPU: 1 PID: 6993 Comm: syz-executor0 Not tainted 4.9.124-g09eb2ba #35 [ 76.549516] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 76.558889] ffff8801cc28f530 ffffffff81eb95e9 ffffea0007603880 ffff8801d80e2b58 22:59:30 executing program 5: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) fcntl$setflags(r0, 0x2, 0x0) 22:59:30 executing program 5: perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x857, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x802, 0x0) write(r0, &(0x7f0000000140)="fc00000049000700ab092500090007000aab0700000000001d00369321000100ff0100000005d0000000000000039815fa2c1ec28656aaa79bb94b46fe000000bc00020000000000000000272f2e117c22ebc205214000000000008934d07302ade01720d7d5bbc91a3e3280772c05defd5a32e280fc83ab82f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48a99c03f080548deac270e33429fd3000175e63fb8d38a873cf1587c3b41", 0xfc) 22:59:30 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x0, 0x0) ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f00000001c0)={0x0, 0x33, "fac1e279c2ca03394965fa166f9a68e337e8ead47c818519b42c79edf33fc093b54b282310ae001bc81db0883e9e635795ef3a"}) [ 76.566963] 0000000000000000 ffff8801d80e2b58 0000000000000040 ffff8801cc28f568 [ 76.575029] ffffffff8156c35e ffff8801d80e2b58 0000000000000008 0000000000000000 [ 76.583114] Call Trace: [ 76.585707] [] dump_stack+0xc1/0x128 [ 76.591082] [] print_address_description+0x6c/0x234 [ 76.597765] [] kasan_report.cold.6+0x242/0x2fe [ 76.604016] [] ? ip6_xmit+0x1838/0x1b80 [ 76.609668] [] __asan_report_load8_noabort+0x14/0x20 22:59:30 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) poll(&(0x7f00000000c0), 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x200000002, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) vmsplice(r0, &(0x7f0000002640)=[{&(0x7f00000025c0)}], 0x1, 0x0) 22:59:30 executing program 5: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) socketpair$unix(0x1, 0x20000000000002, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigtimedwait(&(0x7f0000061000)={0xfffffffffffffffd}, &(0x7f0000039ff0), &(0x7f0000039ff0)={0x77359400, 0xffff}, 0x8) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000040), &(0x7f0000000140)}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) r3 = socket$inet(0x2, 0x1, 0x0) mmap(&(0x7f000092d000/0x400000)=nil, 0x400000, 0xfffffffffffffffc, 0x8972, 0xffffffffffffffff, 0x0) bind$inet(r3, &(0x7f0000134000)={0x2, 0x4e23, @broadcast}, 0x10) connect$inet(r3, &(0x7f00000000c0)={0x2, 0x4e23, @loopback}, 0x10) connect$inet(r3, &(0x7f00009322c4)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r3, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000140)={0x2, 0xfff, @local}, 0x10) dup2(r1, r3) tkill(r2, 0x1000200000016) [ 76.616439] [] ip6_xmit+0x1838/0x1b80 [ 76.621902] [] ? kasan_slab_free+0x72/0xc0 [ 76.627826] [] ? kfree+0xfb/0x310 [ 76.632977] [] ? skb_free_head+0x8b/0xb0 [ 76.638712] [] ? pskb_expand_head+0x45f/0x930 [ 76.644885] [] ? ip6_finish_output2+0x1d00/0x1d00 [ 76.651398] [] ? trace_hardirqs_on+0x10/0x10 [ 76.657479] [] ? __lock_is_held+0xa2/0xf0 [ 76.663296] [] ? ipv4_dst_check+0x111/0x160 [ 76.669279] [] ? __sk_dst_check+0x114/0x240 [ 76.675271] [] inet6_csk_xmit+0x27c/0x4d0 [ 76.681099] [] ? inet6_csk_xmit+0xff/0x4d0 [ 76.687008] [] ? inet6_csk_update_pmtu+0x160/0x160 [ 76.693604] [] ? check_preemption_disabled+0x3b/0x170 [ 76.700467] [] l2tp_xmit_skb+0xc45/0xf30 [ 76.706202] [] pppol2tp_sendmsg+0x4e0/0x790 [ 76.712197] [] ? selinux_socket_sendmsg+0x3f/0x50 [ 76.718712] [] ? pppol2tp_release+0x2e0/0x2e0 [ 76.724876] [] sock_sendmsg+0xcc/0x110 [ 76.730434] [] ___sys_sendmsg+0x47a/0x840 [ 76.736259] [] ? copy_msghdr_from_user+0x560/0x560 [ 76.742858] [] ? check_preemption_disabled+0x3b/0x170 [ 76.749716] [] ? __fget+0x20a/0x3b0 [ 76.755008] [] ? __fget+0x231/0x3b0 [ 76.760296] [] ? __fget+0x47/0x3b0 [ 76.765482] [] ? __fget_light+0x169/0x1f0 [ 76.771264] [] ? __fdget+0x18/0x20 [ 76.776446] [] __sys_sendmmsg+0x23c/0x3d0 [ 76.782252] [] ? SyS_sendmsg+0x50/0x50 [ 76.787807] [] ? compat_sock_ioctl+0x188/0x1360 [ 76.794128] [] ? selinux_file_ioctl+0x10a/0x550 [ 76.800457] [] ? compat_SyS_futex+0x1e1/0x2f0 [ 76.806608] [] ? compat_SyS_get_robust_list+0x310/0x310 [ 76.813626] [] ? fput+0xd2/0x140 [ 76.818644] [] compat_SyS_sendmmsg+0x32/0x40 [ 76.824722] [] ? compat_SyS_sendmsg+0x40/0x40 [ 76.830879] [] do_fast_syscall_32+0x2f7/0x870 [ 76.837033] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 76.843696] [] entry_SYSENTER_compat+0x90/0xa2 [ 76.849915] [ 76.851527] Allocated by task 0: [ 76.854881] (stack is not available) [ 76.858586] [ 76.860203] Freed by task 0: [ 76.863195] (stack is not available) [ 76.866882] [ 76.868500] The buggy address belongs to the object at ffff8801d80e2b40 [ 76.868500] which belongs to the cache ip_dst_cache of size 216 [ 76.881240] The buggy address is located 24 bytes inside of [ 76.881240] 216-byte region [ffff8801d80e2b40, ffff8801d80e2c18) [ 76.893013] The buggy address belongs to the page: [ 76.897935] page:ffffea0007603880 count:1 mapcount:0 mapping: (null) index:0x0 [ 76.906198] flags: 0x8000000000000080(slab) [ 76.910502] page dumped because: kasan: bad access detected [ 76.916210] [ 76.917828] Memory state around the buggy address: [ 76.922755] ffff8801d80e2a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 76.930109] ffff8801d80e2a80: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 76.937456] >ffff8801d80e2b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.944804] ^ [ 76.951024] ffff8801d80e2b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 76.958382] ffff8801d80e2c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc 22:59:31 executing program 6: perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x6, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000100)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r0, &(0x7f0000000080)="a8", 0x1) sendfile(r0, r0, &(0x7f0000317000), 0xff8) 22:59:31 executing program 2: r0 = socket$inet6(0xa, 0x202000000802, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f68000)={@loopback, 0x0, 0x0, 0xff, 0x1, 0x0, 0xa4ffffff}, 0x20) 22:59:31 executing program 2: r0 = socket$inet6(0xa, 0x202000000802, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f68000)={@loopback, 0x0, 0x0, 0xff, 0x1, 0x0, 0xa4ffffff}, 0x20) [ 76.965741] ================================================================== [ 76.973085] Disabling lock debugging due to kernel taint [ 76.978643] Kernel panic - not syncing: panic_on_warn set ... [ 76.978643] [ 76.986016] CPU: 1 PID: 6993 Comm: syz-executor0 Tainted: G B 4.9.124-g09eb2ba #35 [ 76.994852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 77.004218] ffff8801cc28f490 ffffffff81eb95e9 ffffffff843c828b 00000000ffffffff [ 77.012387] 0000000000000000 0000000000000001 0000000000000040 ffff8801cc28f550 [ 77.020483] ffffffff81423eb5 0000000041b58ab3 ffffffff843bb8e8 ffffffff81423cf6 [ 77.028560] Call Trace: [ 77.031157] [] dump_stack+0xc1/0x128 [ 77.036562] [] panic+0x1bf/0x3bc [ 77.041625] [] ? add_taint.cold.6+0x16/0x16 [ 77.047629] [] kasan_end_report+0x47/0x4f [ 77.053425] [] kasan_report.cold.6+0x76/0x2fe [ 77.059588] [] ? ip6_xmit+0x1838/0x1b80 [ 77.065231] [] __asan_report_load8_noabort+0x14/0x20 [ 77.072000] [] ip6_xmit+0x1838/0x1b80 [ 77.077466] [] ? kasan_slab_free+0x72/0xc0 [ 77.083388] [] ? kfree+0xfb/0x310 [ 77.088507] [] ? skb_free_head+0x8b/0xb0 [ 77.094233] [] ? pskb_expand_head+0x45f/0x930 [ 77.100400] [] ? ip6_finish_output2+0x1d00/0x1d00 [ 77.106906] [] ? trace_hardirqs_on+0x10/0x10 [ 77.112983] [] ? __lock_is_held+0xa2/0xf0 [ 77.118800] [] ? ipv4_dst_check+0x111/0x160 [ 77.124785] [] ? __sk_dst_check+0x114/0x240 [ 77.130770] [] inet6_csk_xmit+0x27c/0x4d0 [ 77.136591] [] ? inet6_csk_xmit+0xff/0x4d0 [ 77.142491] [] ? inet6_csk_update_pmtu+0x160/0x160 [ 77.149085] [] ? check_preemption_disabled+0x3b/0x170 [ 77.155929] [] l2tp_xmit_skb+0xc45/0xf30 [ 77.161638] [] pppol2tp_sendmsg+0x4e0/0x790 [ 77.167611] [] ? selinux_socket_sendmsg+0x3f/0x50 [ 77.174102] [] ? pppol2tp_release+0x2e0/0x2e0 [ 77.180249] [] sock_sendmsg+0xcc/0x110 [ 77.185786] [] ___sys_sendmsg+0x47a/0x840 [ 77.191584] [] ? copy_msghdr_from_user+0x560/0x560 [ 77.198166] [] ? check_preemption_disabled+0x3b/0x170 [ 77.205002] [] ? __fget+0x20a/0x3b0 [ 77.210285] [] ? __fget+0x231/0x3b0 [ 77.215559] [] ? __fget+0x47/0x3b0 [ 77.220741] [] ? __fget_light+0x169/0x1f0 [ 77.226532] [] ? __fdget+0x18/0x20 [ 77.231724] [] __sys_sendmmsg+0x23c/0x3d0 [ 77.237520] [] ? SyS_sendmsg+0x50/0x50 [ 77.243046] [] ? compat_sock_ioctl+0x188/0x1360 [ 77.249359] [] ? selinux_file_ioctl+0x10a/0x550 [ 77.255681] [] ? compat_SyS_futex+0x1e1/0x2f0 [ 77.261825] [] ? compat_SyS_get_robust_list+0x310/0x310 [ 77.269210] [] ? fput+0xd2/0x140 [ 77.274213] [] compat_SyS_sendmmsg+0x32/0x40 [ 77.280265] [] ? compat_SyS_sendmsg+0x40/0x40 [ 77.286404] [] do_fast_syscall_32+0x2f7/0x870 [ 77.292544] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 77.299229] [] entry_SYSENTER_compat+0x90/0xa2 [ 77.305844] Dumping ftrace buffer: [ 77.309380] (ftrace buffer empty) [ 77.313069] Kernel Offset: disabled [ 77.316678] Rebooting in 86400 seconds..