[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 40.842935][ T26] audit: type=1800 audit(1554687392.554:25): pid=7930 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 40.864530][ T26] audit: type=1800 audit(1554687392.554:26): pid=7930 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 40.902726][ T26] audit: type=1800 audit(1554687392.564:27): pid=7930 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.69' (ECDSA) to the list of known hosts. 2019/04/08 01:36:51 fuzzer started 2019/04/08 01:36:55 dialing manager at 10.128.0.26:34543 2019/04/08 01:36:55 syscalls: 2408 2019/04/08 01:36:55 code coverage: enabled 2019/04/08 01:36:55 comparison tracing: enabled 2019/04/08 01:36:55 extra coverage: extra coverage is not supported by the kernel 2019/04/08 01:36:55 setuid sandbox: enabled 2019/04/08 01:36:55 namespace sandbox: enabled 2019/04/08 01:36:55 Android sandbox: /sys/fs/selinux/policy does not exist 2019/04/08 01:36:55 fault injection: enabled 2019/04/08 01:36:55 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/04/08 01:36:55 net packet injection: enabled 2019/04/08 01:36:55 net device setup: enabled 01:39:17 executing program 0: syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') syzkaller login: [ 206.048470][ T8092] IPVS: ftp: loaded support on port[0] = 21 01:39:17 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x3f00000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r0, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000, 0x0, 0x8f360300]}, @empty, @loopback}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) setsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) write$P9_RREADLINK(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0x0) getsockopt$inet6_opts(r0, 0x29, 0x3f, &(0x7f0000000180)=""/4096, &(0x7f0000000000)=0x1000) [ 206.186253][ T8092] chnl_net:caif_netlink_parms(): no params data found [ 206.298925][ T8092] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.306862][ T8092] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.315379][ T8092] device bridge_slave_0 entered promiscuous mode [ 206.325578][ T8092] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.332932][ T8092] bridge0: port 2(bridge_slave_1) entered disabled state [ 206.341089][ T8092] device bridge_slave_1 entered promiscuous mode [ 206.368768][ T8095] IPVS: ftp: loaded support on port[0] = 21 [ 206.377075][ T8092] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 206.387652][ T8092] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 206.445583][ T8092] team0: Port device team_slave_0 added [ 206.464234][ T8092] team0: Port device team_slave_1 added 01:39:18 executing program 2: r0 = socket$inet6(0xa, 0x3, 0xbb) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet(0x10, 0x0, 0x0) sendmsg(0xffffffffffffffff, 0x0, 0x0) write$apparmor_exec(0xffffffffffffffff, 0x0, 0xfdd7) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1, 0x6}, 0x1c) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1a) ioctl$EVIOCGREP(0xffffffffffffffff, 0x80084503, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmmsg(r0, &(0x7f00000092c0), 0x41e, 0x0) [ 206.533096][ T8092] device hsr_slave_0 entered promiscuous mode [ 206.580342][ T8092] device hsr_slave_1 entered promiscuous mode 01:39:18 executing program 3: r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video36\x00', 0x2, 0x0) ioctl$VIDIOC_G_CROP(r0, 0xc014563b, &(0x7f0000000040)={0xf}) [ 206.684620][ T8092] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.692182][ T8092] bridge0: port 2(bridge_slave_1) entered forwarding state [ 206.700448][ T8092] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.707862][ T8092] bridge0: port 1(bridge_slave_0) entered forwarding state [ 206.723566][ T8097] IPVS: ftp: loaded support on port[0] = 21 [ 206.888409][ T8095] chnl_net:caif_netlink_parms(): no params data found [ 206.958179][ T8092] 8021q: adding VLAN 0 to HW filter on device bond0 01:39:18 executing program 4: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000001080)={0x0, 'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xb}, 0x120) write$UHID_GET_REPORT_REPLY(r0, &(0x7f0000000040), 0xa) [ 207.028547][ T8092] 8021q: adding VLAN 0 to HW filter on device team0 [ 207.049385][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 207.064940][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.092367][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.112596][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 207.155236][ T8101] IPVS: ftp: loaded support on port[0] = 21 [ 207.195236][ T8095] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.210116][ T8095] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.218434][ T8095] device bridge_slave_0 entered promiscuous mode [ 207.243221][ T8095] bridge0: port 2(bridge_slave_1) entered blocking state [ 207.256195][ T8095] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.264735][ T8095] device bridge_slave_1 entered promiscuous mode [ 207.276101][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 207.285221][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.292681][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 207.361382][ T8097] chnl_net:caif_netlink_parms(): no params data found [ 207.362959][ T8105] IPVS: ftp: loaded support on port[0] = 21 [ 207.394376][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 01:39:19 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="b7d9288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000002480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000026c0)=[{0x10}], 0x10}}], 0x1, 0x800) [ 207.404963][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 207.414597][ T3484] bridge0: port 2(bridge_slave_1) entered blocking state [ 207.421945][ T3484] bridge0: port 2(bridge_slave_1) entered forwarding state [ 207.446733][ T8095] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 207.457958][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 207.471599][ T8095] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 207.491650][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 207.505365][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 207.514636][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 207.568859][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 207.578618][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 207.588057][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 207.625461][ T8097] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.633259][ T8097] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.641721][ T8097] device bridge_slave_0 entered promiscuous mode [ 207.657182][ T8092] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 207.668040][ T8092] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 207.702024][ T8097] bridge0: port 2(bridge_slave_1) entered blocking state [ 207.709171][ T8097] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.718422][ T8097] device bridge_slave_1 entered promiscuous mode [ 207.735095][ T2990] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 207.744512][ T2990] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 207.753768][ T2990] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 207.762580][ T2990] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 207.771982][ T2990] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 207.782997][ T8095] team0: Port device team_slave_0 added [ 207.790868][ T8095] team0: Port device team_slave_1 added [ 207.827867][ T8097] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 207.855756][ T8108] IPVS: ftp: loaded support on port[0] = 21 [ 207.913214][ T8095] device hsr_slave_0 entered promiscuous mode [ 207.950439][ T8095] device hsr_slave_1 entered promiscuous mode [ 208.021784][ T8097] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 208.046081][ T8092] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 208.077862][ T8097] team0: Port device team_slave_0 added [ 208.086541][ T8097] team0: Port device team_slave_1 added [ 208.188425][ T8101] chnl_net:caif_netlink_parms(): no params data found 01:39:19 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='sysfs\x00*\x86OK\xc0\v\xce\x1b\xdb cr\x13\xb1\xe8\x94\xd1 q_\x9d\xc1\x12[\x04,r&\xeb\x016\xd9bN\xa1\xd23t\xa6`\xfeZ\xc1sr/\xd3g\xad\"\xe8U0%\xa2\xe8\xbe\v\xc5QCy\xafr\x13\xd3+\x8d]\x06\xdc\x8f\xbf,\x84\x9e\xd9\xcd\xef\xc7K\x03\xdf\xa9\xcbZ\x90\xb2\x8bK$\xd7\x86,=f\xfc\xa51g\xd5BB5CZ=\xbbv\xbc}0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000280)=ANY=[@ANYRES64], 0x8) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet(0x2, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) splice(r2, 0x0, r4, 0x0, 0x8100000, 0x0) splice(r0, 0x0, r3, 0x0, 0x7, 0x0) [ 208.694835][ T8101] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 208.736012][ T8108] chnl_net:caif_netlink_parms(): no params data found [ 208.747099][ T8101] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 208.775109][ T8101] team0: Port device team_slave_0 added 01:39:20 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000780)='/dev/sg#\x00', 0x0, 0x80000000042) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) ioctl$SG_IO(0xffffffffffffffff, 0x2285, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) msgget$private(0x0, 0x201) [ 208.786346][ T8105] bridge0: port 1(bridge_slave_0) entered blocking state [ 208.794949][ T8105] bridge0: port 1(bridge_slave_0) entered disabled state [ 208.809128][ T8105] device bridge_slave_0 entered promiscuous mode [ 208.832672][ T8095] 8021q: adding VLAN 0 to HW filter on device bond0 [ 208.859271][ T8101] team0: Port device team_slave_1 added [ 208.866184][ T8133] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 208.866586][ T8105] bridge0: port 2(bridge_slave_1) entered blocking state [ 208.884141][ T8105] bridge0: port 2(bridge_slave_1) entered disabled state [ 208.884166][ T8133] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 208.892670][ T8105] device bridge_slave_1 entered promiscuous mode [ 208.922849][ T8133] program syz-executor.0 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 208.933534][ T8133] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 01:39:20 executing program 0: dup2(0xffffffffffffffff, 0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x246) mbind(&(0x7f0000005000/0x3000)=nil, 0x3000, 0x0, &(0x7f0000000000), 0x81, 0x2fd94dcf4f75d0b3) 01:39:20 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000080)=ANY=[@ANYBLOB="827ce39f"]) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000028000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 208.984754][ T8095] 8021q: adding VLAN 0 to HW filter on device team0 [ 209.043224][ T8101] device hsr_slave_0 entered promiscuous mode [ 209.053569][ T8142] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. [ 209.100400][ T8101] device hsr_slave_1 entered promiscuous mode [ 209.135960][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 209.144435][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 209.189059][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 209.198032][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 209.207072][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.214197][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 209.222568][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 209.231493][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready 01:39:21 executing program 0: move_pages(0x0, 0x1, &(0x7f0000000100)=[&(0x7f000002c000/0x4000)=nil], &(0x7f0000000140)=[0x1], 0x0, 0x0) [ 209.240077][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.247194][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 209.265908][ T8105] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 209.278229][ T8097] 8021q: adding VLAN 0 to HW filter on device bond0 [ 209.312215][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 209.322557][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 209.333569][ T8108] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.341424][ T8108] bridge0: port 1(bridge_slave_0) entered disabled state [ 209.349533][ T8108] device bridge_slave_0 entered promiscuous mode [ 209.371075][ T8105] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 209.400940][ T8097] 8021q: adding VLAN 0 to HW filter on device team0 [ 209.413326][ T8108] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.421123][ T8108] bridge0: port 2(bridge_slave_1) entered disabled state [ 209.429466][ T8108] device bridge_slave_1 entered promiscuous mode [ 209.444248][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 209.453203][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 209.461348][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 209.468981][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 209.477720][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 209.486875][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 209.529212][ T8105] team0: Port device team_slave_0 added [ 209.537767][ T8105] team0: Port device team_slave_1 added [ 209.551740][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 209.560867][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 209.569413][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 209.580742][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 209.589268][ T8098] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.596459][ T8098] bridge0: port 1(bridge_slave_0) entered forwarding state [ 209.606884][ T8108] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 209.644183][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 209.655151][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 209.663982][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 209.672534][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 209.681804][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 209.690387][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 209.699101][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 209.708224][ T8098] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.715399][ T8098] bridge0: port 2(bridge_slave_1) entered forwarding state [ 209.723391][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 209.736943][ T8108] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 209.801864][ T8105] device hsr_slave_0 entered promiscuous mode [ 209.870254][ T8105] device hsr_slave_1 entered promiscuous mode [ 209.932428][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 209.941471][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 209.950662][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 209.959150][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 209.967972][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 209.978027][ T8108] team0: Port device team_slave_0 added [ 209.991793][ T8095] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 210.004843][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 210.018610][ T8108] team0: Port device team_slave_1 added [ 210.038432][ T8101] 8021q: adding VLAN 0 to HW filter on device bond0 [ 210.093286][ T8108] device hsr_slave_0 entered promiscuous mode [ 210.130357][ T8108] device hsr_slave_1 entered promiscuous mode [ 210.184237][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 210.192883][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 210.204743][ T8097] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 210.216760][ T8097] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 210.253220][ T8106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 210.262319][ T8106] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 210.276860][ T8095] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 210.302140][ T8101] 8021q: adding VLAN 0 to HW filter on device team0 [ 210.309922][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 210.317803][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 210.395947][ T8097] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 210.404111][ T2990] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 210.414639][ T2990] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 210.423477][ T2990] bridge0: port 1(bridge_slave_0) entered blocking state [ 210.430630][ T2990] bridge0: port 1(bridge_slave_0) entered forwarding state [ 210.438731][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 210.452988][ T8108] 8021q: adding VLAN 0 to HW filter on device bond0 [ 210.481314][ T8105] 8021q: adding VLAN 0 to HW filter on device bond0 [ 210.510325][ T8106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 210.519105][ T8106] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 210.537953][ T8106] bridge0: port 2(bridge_slave_1) entered blocking state [ 210.545216][ T8106] bridge0: port 2(bridge_slave_1) entered forwarding state [ 210.590221][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 210.599108][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 210.617749][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 210.627115][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 210.645004][ T8105] 8021q: adding VLAN 0 to HW filter on device team0 [ 210.748427][ T8108] 8021q: adding VLAN 0 to HW filter on device team0 [ 210.755838][ T2990] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 210.763856][ T2990] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 210.771722][ T2990] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 210.779452][ T2990] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 210.787798][ T2990] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 210.795817][ T2990] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 210.805111][ T2990] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 210.833595][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready 01:39:22 executing program 1: r0 = socket$inet6(0xa, 0x80803, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in=@initdev, 0x0, 0x32}, 0x0, @in6=@rand_addr="d113f9fe64d89e007ba35a6b99bc5d09"}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) 01:39:22 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/\x00\x00z0\x00\x906\xa3\x95A\x1c\xf5\xee\x8aj\xdf\n\xcb\xf0\xce\xd9,Fj\xbd\xad\x89!\xf9\x00\x9f\x80\xd5\x01)c)\xaa\xba\x92\xe1\xd6\xa6\x0fTA\x16jwl\x1a\x92% \x1dY\xed\x87b_\xc4\x97r\xf68u\xf4~g\x1b\xf3g\x0e\x167F\xce\x93\xef\xe1\x91\x81\xe3\xc7*\xdb\x84\x82$\xaa\x8f\xd6 \x98\x81\f\xf4R\x99\xb2\x87#E\xccGc\xf2\x0fs\xed\xff\xc7\xed>Zy\x92\t\xcd\xc8\fN4\x1fn\x99\xd3P!\xb2gR\xdb\xd1\x95`\xadf\xdb($B\x95\xd1\xef\x15\x9ek\b\xc7\x17u<\xcb\xec\xde\x92 \xf1\x01X!y\x8e\f\x1eo\x84o\x12\x1b\x17\xb3\xd7%Mw\xb9[\v\x19B\n\x87l\x9b\xacn\x86tt\xeb\xb7\xf9r\x82\x16\xac\x12\xc9\x00'/265, 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000500)='cgroup.procs\x00', 0x2, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001b40)='./cgroup/syz1\x00', 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000080), 0x12) write$cgroup_pid(r2, &(0x7f0000000100), 0x12) [ 210.846097][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 210.856773][ T22] bridge0: port 1(bridge_slave_0) entered blocking state [ 210.864139][ T22] bridge0: port 1(bridge_slave_0) entered forwarding state [ 210.882177][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 210.893462][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 210.902613][ T22] bridge0: port 2(bridge_slave_1) entered blocking state [ 210.909712][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state [ 210.924945][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 210.935496][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 210.948852][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 210.965087][ T8101] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 210.978863][ T8101] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 211.001232][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 211.009328][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 211.018023][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 211.026598][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 211.035861][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 211.048699][ T22] bridge0: port 1(bridge_slave_0) entered blocking state [ 211.055862][ T22] bridge0: port 1(bridge_slave_0) entered forwarding state [ 211.064529][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 211.074106][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 211.083497][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 211.092551][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 211.103566][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 211.112475][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 211.121067][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 211.157730][ T8105] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 211.178317][ T8105] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 211.193248][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 211.202519][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 211.212342][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 211.221320][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 211.230815][ T3484] bridge0: port 2(bridge_slave_1) entered blocking state [ 211.237924][ T3484] bridge0: port 2(bridge_slave_1) entered forwarding state [ 211.245904][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 211.254643][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 211.263611][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 211.272201][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 211.280850][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 211.289403][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 211.298819][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 211.307485][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 211.322987][ T8108] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 211.334223][ T8108] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 211.361880][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 211.370218][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 211.378624][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 211.387647][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 211.396799][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 211.406749][ T3484] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 211.426285][ T8101] 8021q: adding VLAN 0 to HW filter on device batadv0 01:39:23 executing program 3: r0 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000040)={0x11, 0x400000000200004, r1}, 0x14) syz_emit_ethernet(0x1, &(0x7f0000000200)=ANY=[@ANYBLOB="ffffffffffffdfcfd60b3184000d0000000000000000b9d9db23e2f278157b40872d55b401ca8b4dcb48bf299ae7c9f7d3c2f5162b5daf515be08908e3d28573e87f4ff74059aab04c45d2c13b04f3703e5d05e74f6b"], 0x0) [ 211.492574][ T8105] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 211.518767][ T8108] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 211.711131][ T2990] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 211.721320][ T2990] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 211.735500][ T2990] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 211.747032][ T8098] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 211.759897][ T8098] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 211.767382][ T8098] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 211.778897][ T2990] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 211.787735][ T2990] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 211.795705][ T8098] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 211.803262][ T2990] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 211.811702][ T8098] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 211.819470][ T8098] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 211.827398][ T2990] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 211.835567][ T8098] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 211.843162][ T2990] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 211.851790][ T8098] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 211.859245][ T8098] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 211.866857][ T2990] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 211.874451][ T2990] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 211.882016][ T8098] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 211.889446][ T8098] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 211.896940][ T2990] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 01:39:23 executing program 4: 01:39:23 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x2, 0x11) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) socket$kcm(0xa, 0x2, 0x11) socket$kcm(0x2, 0x2000000003, 0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000003980)) sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8946, &(0x7f00000001c0)='veth0\x00') write$cgroup_subtree(r0, 0x0, 0xfffffffffffffd9b) [ 211.907058][ T2990] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz1 [ 211.917991][ T8098] hid-generic 0000:0000:0000.0002: hidraw1: HID v0.00 Device [syz1] on syz1 01:39:23 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(0x0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000ac0)=""/100, 0x64}], 0x1, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/255, 0x443}], 0x1000000000000110) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x0, 0x20000000000000}) r1 = syz_open_pts(r0, 0x2) dup3(r1, r0, 0x0) write(r0, &(0x7f0000c34fff), 0xffffff0b) 01:39:23 executing program 0: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x3, 0x100081) write$P9_RATTACH(0xffffffffffffffff, 0x0, 0x0) chown(0x0, 0x0, 0x0) r1 = memfd_create(&(0x7f0000000380)='\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00v\x8e\x05\xf7\xc1U\xad}\xc6\x94|W>Zi$Nv8,\n\xa6=W^\xa3Y\x7f\x8b\x17(\'~\xf7k0TM{\xa9-\xcf\x97\x8f\x1f\x81\xdc\x1b\x7f\x8f{4Q\xda\xda\x02\xec\xb4\xf1\xdd\xcc\x8bRA\xda\x89Efn\x00s\xc2Zb\x01\x00M\xbe\xa3z\xab\xd3\xeb\x98\x88\xc4\xc6)A\x9fP\x93zhH\xe0\xd2\x81\xdb\xeeV\x8cM\xe9\xa06\xc2o\x19\"\xf6Iq\xd4\xdf\x97\xfb\xab\x04\xe8\xceI8\xb3\x1d\xcf%\x9bK\xc6\t\x01\xe1\x86a\xfa\xb8\xfb)\x88\xcd+\xc2`\xc2\xf5r5>k\xb0\xa0\x02\xfc\x16MO\x18\x9b\x06\x80b\xd1\x01\x00\x00\x00\x00\x00\x00\x00@\f\fL\xa5{Tk\x940\x17.\xa56.\xe0\x14\x1b=\xf0j\xd25\xe8\x15\xd8\x9e\xea\xd3\xd9G4\t\xc0\x9c.\'\xa9R3z$\xf2\x01\x88\xc0\x13\x12<\xc01j3\xd8\xb4CE7s\xe4\xa0\x9e\xdd\x801\x12M\xee\x13\xce\x9cu(\x8f.\xc83\xc7\xe6j\xf5\xb1\x9a\x00\x00\x00\x00\x00\x00\x00', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f00000001c0)='\'', 0x1}], 0x1, 0x81806) sendfile(r0, r1, 0x0, 0x20000102000004) 01:39:23 executing program 3: 01:39:23 executing program 5: 01:39:23 executing program 3: 01:39:23 executing program 5: 01:39:23 executing program 0: [ 212.052547][ C1] hrtimer: interrupt took 31290 ns 01:39:23 executing program 4: 01:39:23 executing program 0: 01:39:23 executing program 3: 01:39:23 executing program 5: 01:39:24 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x2, 0x11) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) socket$kcm(0xa, 0x2, 0x11) socket$kcm(0x2, 0x2000000003, 0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000003980)) sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8946, &(0x7f00000001c0)='veth0\x00') write$cgroup_subtree(r0, 0x0, 0xfffffffffffffd9b) 01:39:24 executing program 4: 01:39:24 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(0x0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000ac0)=""/100, 0x64}], 0x1, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/255, 0x443}], 0x1000000000000110) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x0, 0x20000000000000}) r1 = syz_open_pts(r0, 0x2) dup3(r1, r0, 0x0) write(r0, &(0x7f0000c34fff), 0xffffff0b) 01:39:24 executing program 0: 01:39:24 executing program 5: 01:39:24 executing program 4: 01:39:24 executing program 3: 01:39:24 executing program 4: 01:39:24 executing program 0: 01:39:24 executing program 5: 01:39:24 executing program 3: 01:39:24 executing program 5: 01:39:24 executing program 2: 01:39:24 executing program 0: 01:39:24 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(0x0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000ac0)=""/100, 0x64}], 0x1, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/255, 0x443}], 0x1000000000000110) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x0, 0x20000000000000}) r1 = syz_open_pts(r0, 0x2) dup3(r1, r0, 0x0) write(r0, &(0x7f0000c34fff), 0xffffff0b) 01:39:24 executing program 4: 01:39:24 executing program 3: 01:39:24 executing program 2: 01:39:24 executing program 0: 01:39:24 executing program 5: 01:39:24 executing program 4: 01:39:24 executing program 3: 01:39:24 executing program 2: 01:39:24 executing program 5: 01:39:24 executing program 4: 01:39:24 executing program 0: 01:39:25 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(0x0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000ac0)=""/100, 0x64}], 0x1, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000200)=""/255, 0x443}], 0x1000000000000110) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x0, 0x20000000000000}) r1 = syz_open_pts(r0, 0x2) dup3(r1, r0, 0x0) write(r0, &(0x7f0000c34fff), 0xffffff0b) 01:39:25 executing program 3: 01:39:25 executing program 2: 01:39:25 executing program 5: 01:39:25 executing program 4: 01:39:25 executing program 0: 01:39:25 executing program 3: 01:39:25 executing program 2: 01:39:25 executing program 0: 01:39:25 executing program 3: 01:39:25 executing program 4: 01:39:25 executing program 5: 01:39:25 executing program 1: 01:39:25 executing program 2: 01:39:25 executing program 3: 01:39:25 executing program 5: 01:39:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0xfffffd51, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x2c, 0x0, 0x0}) 01:39:25 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x8000, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_dev$mouse(&(0x7f00000001c0)='/dev/input/mouse#\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(0xffffffffffffffff, 0x800443d2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='smaps_rollup\x00') mprotect(&(0x7f0000104000/0x3000)=nil, 0x3000, 0x2) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, 0x0) pread64(r3, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0) dup2(r0, r4) prctl$PR_SET_FP_MODE(0x2d, 0x0) 01:39:25 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 01:39:25 executing program 3: mkdir(&(0x7f0000000700)='./file1\x00', 0x0) r0 = creat(&(0x7f0000000340)='./file1/file0\x00', 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000040)) geteuid() getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000200)={{{@in=@broadcast, @in6=@empty}}, {{@in6=@dev}, 0x0, @in6=@mcast1}}, &(0x7f00000000c0)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000500)={{{@in6=@initdev, @in6=@mcast2}}, {{@in=@multicast2}, 0x0, @in=@broadcast}}, &(0x7f0000000100)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, 0x0, 0x0) getgid() lstat(&(0x7f00000006c0)='./file1/file0\x00', &(0x7f0000000840)) getpid() getresgid(&(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) fstat(r0, &(0x7f0000000980)) setxattr$system_posix_acl(&(0x7f0000000000)='./file1/file0\x00', &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000b00)=ANY=[@ANYBLOB="10000200000000002000000000"], 0x1, 0x3) mkdir(&(0x7f00000003c0)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='overlay\x00', 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1\x00']) chdir(&(0x7f0000000300)='./file0\x00') link(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='./file1\x00') 01:39:25 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x802, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000240)={'team0\x00\xfd\xff\xff\xff\xc0\x00\x03\x00\x02\xff', 0x4bfd}) [ 213.933242][ T8328] binder: 8325:8328 ioctl c0306201 0 returned -14 [ 213.975871][ T8328] binder: 8325:8328 Release 1 refcount change on invalid ref 1 ret -22 [ 213.987112][ T8333] QAT: Invalid ioctl 01:39:25 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 214.025846][ T8328] binder: 8325:8328 unknown command 0 [ 214.063478][ T8328] binder: 8325:8328 ioctl c0306201 20000100 returned -22 01:39:26 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000001000)=[{0x0, 0xfffffffffffffe4c}], 0x1, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$EVIOCGREP(r0, 0x4010744d, &(0x7f0000001000)=""/174) 01:39:26 executing program 0: inotify_init1(0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) io_setup(0x5f4a, &(0x7f0000000080)) [ 214.326338][ T8342] QAT: Invalid ioctl 01:39:26 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:26 executing program 4: r0 = socket$netlink(0x10, 0x3, 0xa) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@bridge_delneigh={0x1c, 0x1c}, 0x1c}}, 0x0) 01:39:26 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:26 executing program 4: r0 = socket$kcm(0x10, 0x100000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000200)="2e0000001c00810ee00f80ecdb4cb9f207c804a00c00000078000afb0a0002001208da1b40d805000300c50083b8", 0x2e}], 0x1}, 0x0) 01:39:26 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:26 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:26 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:26 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0x8}, 0x2c) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10421, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) [ 215.091956][ T8338] device team0 entered promiscuous mode [ 215.112993][ T8338] device team_slave_0 entered promiscuous mode [ 215.137959][ T8338] device team_slave_1 entered promiscuous mode [ 215.172312][ T8338] 8021q: adding VLAN 0 to HW filter on device team0 [ 215.336433][ T8370] device team0 left promiscuous mode [ 215.342022][ T8370] device team_slave_0 left promiscuous mode [ 215.348062][ T8370] device team_slave_1 left promiscuous mode 01:39:27 executing program 1: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000000240)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b078d81", 0x4c}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x118, &(0x7f0000000240), 0x0, 0x0, 0x26085d6cce6967cc}}], 0x4000056, 0x3a, &(0x7f0000000200)={0x77359400}) 01:39:27 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 215.461012][ T8374] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.4'. [ 215.476559][ T8374] ip6gretap0: FDB only supports static addresses [ 215.563507][ T8399] netlink: 'syz-executor.1': attribute type 29 has an invalid length. [ 215.632751][ T8399] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 215.667261][ T8399] netlink: 'syz-executor.1': attribute type 29 has an invalid length. [ 215.687371][ T8399] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 215.712858][ T8404] netlink: 'syz-executor.1': attribute type 29 has an invalid length. [ 215.725114][ T8404] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 215.734784][ T8404] netlink: 'syz-executor.1': attribute type 29 has an invalid length. [ 215.743113][ T8404] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 215.752648][ T8404] netlink: 'syz-executor.1': attribute type 29 has an invalid length. [ 215.760917][ T8404] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 215.770897][ T8404] netlink: 'syz-executor.1': attribute type 29 has an invalid length. [ 215.779079][ T8404] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 215.788593][ T8404] netlink: 'syz-executor.1': attribute type 29 has an invalid length. [ 215.796915][ T8404] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 215.806502][ T8404] netlink: 'syz-executor.1': attribute type 29 has an invalid length. [ 215.814734][ T8404] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 215.824490][ T8404] netlink: 'syz-executor.1': attribute type 29 has an invalid length. 01:39:27 executing program 2: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000498000)={0x0, 0x0, &(0x7f00008b7ff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2400000002010100000000003f2c11b91e61434810000100038ad141114dfb"], 0x1f}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x246) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0x0, 0xfffd}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x30, 0x0, 0x0, 0x117) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 01:39:27 executing program 4: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000200)={0x0, 0x5, 0x3}) 01:39:27 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}}}, 0x48) 01:39:27 executing program 0: mkdir(&(0x7f0000000700)='./file1\x00', 0x0) r0 = creat(&(0x7f0000000340)='./file1/file0\x00', 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000040)) geteuid() getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000200)={{{@in=@broadcast, @in6=@empty}}, {{@in6=@dev}, 0x0, @in6=@mcast1}}, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, 0x0, 0x0) getgid() lstat(&(0x7f00000006c0)='./file1/file0\x00', 0x0) getpid() getresgid(0x0, 0x0, 0x0) fstat(r0, 0x0) setxattr$system_posix_acl(&(0x7f0000000000)='./file1/file0\x00', &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000b00)=ANY=[@ANYBLOB], 0x1, 0x3) mkdir(&(0x7f00000003c0)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='overlay\x00', 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1\x00']) chdir(&(0x7f0000000300)='./file0\x00') link(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='./file1\x00') 01:39:27 executing program 3: geteuid() getgid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() pkey_mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x300000a, 0xffffffffffffffff) r0 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000600)={0x2, 0x4e23, @multicast2}, 0x10) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000003c0)='tls\x00', 0x1b5) setsockopt$inet_mreqsrc(r0, 0x11a, 0x2, &(0x7f0000000140)={@rand_addr=0x3033300, @multicast2, @loopback}, 0x28) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 215.832726][ T8404] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 215.842227][ T8404] netlink: 'syz-executor.1': attribute type 29 has an invalid length. 01:39:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresgid(0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$FITRIM(r0, 0xc0185879, &(0x7f00000001c0)={0x0, 0x100000001}) 01:39:27 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}}}, 0x48) [ 216.045945][ T8411] tls_set_device_offload_rx: netdev lo with no TLS offload [ 216.214165][ T8419] kvm: emulating exchange as write [ 216.236282][ T8419] *** Guest State *** [ 216.251640][ T8419] CR0: actual=0x0000000080000031, shadow=0x00000000e0000011, gh_mask=fffffffffffffff7 01:39:28 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}}}, 0x48) [ 216.282938][ T8419] CR4: actual=0x0000000000002060, shadow=0x0000000000000020, gh_mask=ffffffffffffe871 [ 216.328060][ T8419] CR3 = 0x0000000000002000 [ 216.358981][ T8419] RSP = 0x0000000000000f80 RIP = 0x000000000000001f [ 216.397350][ T8419] RFLAGS=0x00000286 DR7 = 0x0000000000000400 [ 216.448155][ T8419] Sysenter RSP=0000000000000f80 CS:RIP=0050:0000000000002810 [ 216.483262][ T8419] CS: sel=0x0050, attr=0x0209b, limit=0x0000ffff, base=0x0000000000000000 01:39:28 executing program 3: geteuid() getgid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() pkey_mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x300000a, 0xffffffffffffffff) r0 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000600)={0x2, 0x4e23, @multicast2}, 0x10) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000003c0)='tls\x00', 0x1b5) setsockopt$inet_mreqsrc(r0, 0x11a, 0x2, &(0x7f0000000140)={@rand_addr=0x3033300, @multicast2, @loopback}, 0x28) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 01:39:28 executing program 5: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r0, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r0}}, 0x48) [ 216.527626][ T8419] DS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 216.584980][ T8419] SS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 216.630286][ T8419] ES: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 216.675508][ T8419] FS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 216.730427][ T8419] GS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 216.778987][ T8419] GDTR: limit=0x000007ff, base=0x0000000000001000 [ 216.827928][ T8419] LDTR: sel=0x0008, attr=0x04082, limit=0x000007ff, base=0x0000000000001800 [ 216.892146][ T8419] IDTR: limit=0x000001ff, base=0x0000000000003800 [ 216.931998][ T8419] TR: sel=0x00d8, attr=0x0008b, limit=0x000001ff, base=0x0000000000003a00 [ 216.949935][ T8419] EFER = 0x0000000000000501 PAT = 0x0007040600070406 [ 216.989553][ T8419] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 [ 217.007150][ T8419] Interruptibility = 00000001 ActivityState = 00000000 [ 217.017738][ T8419] *** Host State *** [ 217.028415][ T8419] RIP = 0xffffffff811b4aa0 RSP = 0xffff88805bdf78e0 [ 217.035866][ T8419] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 217.052448][ T8419] FSBase=00007f8c18fd2700 GSBase=ffff8880ae800000 TRBase=fffffe0000033000 [ 217.077630][ T8419] GDTBase=fffffe0000031000 IDTBase=fffffe0000000000 [ 217.098563][ T8419] CR0=0000000080050033 CR3=0000000097d5e000 CR4=00000000001426f0 [ 217.118596][ T8419] Sysenter RSP=fffffe0000032200 CS:RIP=0010:ffffffff87201360 [ 217.128970][ T8419] EFER = 0x0000000000000d01 PAT = 0x0407050600070106 [ 217.144049][ T8419] *** Control State *** [ 217.148493][ T8419] PinBased=0000003f CPUBased=b5986dfa SecondaryExec=000000ca [ 217.159130][ T8419] EntryControls=0000d3ff ExitControls=002fefff [ 217.172794][ T8419] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 [ 217.184384][ T8419] VMEntry: intr_info=80000202 errcode=00000000 ilen=00000000 [ 217.195675][ T8419] VMExit: intr_info=00000000 errcode=00000000 ilen=00000003 [ 217.207490][ T8419] reason=80000021 qualification=0000000000000003 [ 217.223470][ T8419] IDTVectoring: info=00000000 errcode=00000000 [ 217.233539][ T8419] TSC Offset = 0xffffff89f00f9075 [ 217.238884][ T8419] EPT pointer = 0x00000000a911a01e 01:39:31 executing program 1: mkdir(&(0x7f0000000700)='./file1\x00', 0x0) r0 = creat(&(0x7f0000000340)='./file1/file0\x00', 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000040)) geteuid() getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000200)={{{@in=@broadcast, @in6=@empty}}, {{@in6=@dev}, 0x0, @in6=@mcast1}}, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, 0x0, 0x0) getgid() lstat(&(0x7f00000006c0)='./file1/file0\x00', 0x0) getpid() getresgid(0x0, 0x0, 0x0) fstat(r0, 0x0) setxattr$system_posix_acl(&(0x7f0000000000)='./file1/file0\x00', &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000b00)=ANY=[@ANYBLOB], 0x1, 0x3) mkdir(&(0x7f00000003c0)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='overlay\x00', 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1\x00']) chdir(&(0x7f0000000300)='./file0\x00') link(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='./file1\x00') 01:39:31 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) 01:39:31 executing program 5: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r0, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r0}}, 0x48) 01:39:31 executing program 3: geteuid() getgid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() pkey_mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x300000a, 0xffffffffffffffff) r0 = socket$inet(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000600)={0x2, 0x4e23, @multicast2}, 0x10) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e23}, 0x10) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000003c0)='tls\x00', 0x1b5) setsockopt$inet_mreqsrc(r0, 0x11a, 0x2, &(0x7f0000000140)={@rand_addr=0x3033300, @multicast2, @loopback}, 0x28) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 01:39:31 executing program 2: socketpair$unix(0x1, 0x20000000000005, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000006c0)=@updpolicy={0xc4, 0x19, 0x121, 0x0, 0x0, {{@in=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@policy_type={0xc}]}, 0xc4}}, 0x0) 01:39:31 executing program 0: mkdir(&(0x7f0000000700)='./file1\x00', 0x0) r0 = creat(&(0x7f0000000340)='./file1/file0\x00', 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000040)) geteuid() getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000200)={{{@in=@broadcast, @in6=@empty}}, {{@in6=@dev}, 0x0, @in6=@mcast1}}, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, 0x0, 0x0) getgid() lstat(&(0x7f00000006c0)='./file1/file0\x00', 0x0) getpid() getresgid(0x0, 0x0, 0x0) fstat(r0, 0x0) setxattr$system_posix_acl(&(0x7f0000000000)='./file1/file0\x00', &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000b00)=ANY=[@ANYBLOB], 0x1, 0x3) mkdir(&(0x7f00000003c0)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='overlay\x00', 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1\x00']) chdir(&(0x7f0000000300)='./file0\x00') link(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='./file1\x00') [ 219.515714][ T8458] binder: 8457:8458 transaction failed 29189/-22, size 0-0 line 2995 [ 219.547904][ T8458] binder: undelivered TRANSACTION_ERROR: 29189 01:39:31 executing program 5: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r0, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r0}}, 0x48) 01:39:31 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r0, r1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x10000014c) futex(0x0, 0x0, 0x2, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) eventfd2(0x0, 0x80000) fcntl$getownex(r2, 0x10, &(0x7f00000001c0)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 219.608451][ T8466] tls_set_device_offload_rx: netdev lo with no TLS offload 01:39:31 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000000c0)=0x9) read(r0, &(0x7f0000000040)=""/11, 0xb) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000180)) 01:39:31 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$FITRIM(r0, 0x6612, 0x0) 01:39:31 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:31 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 219.923847][ T8469] overlayfs: failed to resolve './file1': -2 01:39:31 executing program 1: 01:39:31 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$FITRIM(r0, 0x6612, 0x0) 01:39:31 executing program 4: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="11634840"], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 01:39:31 executing program 0: r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$FITRIM(r0, 0xc0185879, &(0x7f00000001c0)={0x0, 0x100000001}) 01:39:31 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 220.152393][ T8505] binder: 8503:8505 transaction failed 29189/-22, size 0-0 line 2995 01:39:31 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:31 executing program 0: [ 220.231532][ T8510] binder: 8503:8510 transaction failed 29189/-22, size 0-0 line 2995 [ 220.347747][ T8148] binder: undelivered TRANSACTION_ERROR: 29189 [ 220.363123][ T8148] binder: undelivered TRANSACTION_ERROR: 29189 01:39:32 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r0, r1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x10000014c) futex(0x0, 0x0, 0x2, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) eventfd2(0x0, 0x80000) fcntl$getownex(r2, 0x10, &(0x7f00000001c0)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 01:39:32 executing program 3: 01:39:32 executing program 1: 01:39:32 executing program 0: 01:39:32 executing program 4: 01:39:32 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:32 executing program 1: 01:39:32 executing program 3: 01:39:32 executing program 4: 01:39:32 executing program 0: 01:39:32 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:32 executing program 3: 01:39:32 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) dup3(r0, r1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x10000014c) futex(0x0, 0x0, 0x2, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) eventfd2(0x0, 0x80000) fcntl$getownex(r2, 0x10, &(0x7f00000001c0)) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 01:39:32 executing program 1: 01:39:32 executing program 0: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000180)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(r0, 0xc028aa03, &(0x7f00000a0fe0)={{&(0x7f00005e3000/0x800000)=nil, 0x730000}, 0x200000}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000140)={&(0x7f00000ed000/0x2000)=nil, &(0x7f0000936000/0x1000)=nil, 0x2000}) 01:39:32 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x246) syz_genetlink_get_family_id$SEG6(&(0x7f0000000040)='SEG6\x00') ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0x0, 0xfffd}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x30, 0x0, 0x0, 0x117) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 01:39:32 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}}}, 0x48) 01:39:32 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000ad7000)={0x1, &(0x7f0000acbff8)=[{0x6}]}, 0x10) sendto$inet6(r1, 0x0, 0x0, 0x200408d4, &(0x7f0000000380)={0xa, 0x0, 0x0, @loopback}, 0x1c) poll(&(0x7f0000000000)=[{r1}], 0x1, 0x200) 01:39:32 executing program 1: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)) ppoll(&(0x7f0000000080)=[{r0}], 0x1, 0x0, 0x0, 0x0) 01:39:33 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}}}, 0x48) 01:39:33 executing program 1: write$P9_RLERROR(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="1782796340e2ff017300003a95904a362923d127a8eefab47cc7090000000000000000b0c5689de66f1881fed0f202c04a"], 0x31) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x246) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0x0, 0xfffd}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x30, 0x0, 0x0, 0x117) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 221.372556][ T8570] check_preemption_disabled: 3 callbacks suppressed [ 221.372583][ T8570] BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.3/8570 [ 221.389101][ T8570] caller is ip6_finish_output+0x335/0xdc0 [ 221.394964][ T8570] CPU: 1 PID: 8570 Comm: syz-executor.3 Not tainted 5.1.0-rc3-next-20190405 #19 [ 221.404010][ T8570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 221.414094][ T8570] Call Trace: [ 221.414145][ T8570] dump_stack+0x172/0x1f0 [ 221.414172][ T8570] __this_cpu_preempt_check+0x246/0x270 [ 221.414197][ T8570] ip6_finish_output+0x335/0xdc0 [ 221.414231][ T8570] ip6_output+0x235/0x7f0 [ 221.414257][ T8570] ? ip6_finish_output+0xdc0/0xdc0 [ 221.414285][ T8570] ? ip6_fragment+0x3980/0x3980 [ 221.421976][ T8570] ip6_xmit+0xe41/0x20c0 [ 221.422007][ T8570] ? ip6_finish_output2+0x2550/0x2550 [ 221.422026][ T8570] ? mark_held_locks+0xf0/0xf0 [ 221.422047][ T8570] ? ip6_setup_cork+0x1870/0x1870 [ 221.422081][ T8570] inet6_csk_xmit+0x2fb/0x5d0 [ 221.422106][ T8570] ? inet6_csk_update_pmtu+0x190/0x190 [ 221.476613][ T8570] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 221.482891][ T8570] ? csum_ipv6_magic+0x20/0x80 [ 221.487693][ T8570] __tcp_transmit_skb+0x1a32/0x3750 [ 221.492962][ T8570] ? __tcp_select_window+0x8b0/0x8b0 [ 221.498293][ T8570] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 221.504580][ T8570] ? tcp_fastopen_no_cookie+0xe0/0x190 [ 221.510248][ T8570] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 221.516525][ T8570] tcp_connect+0x1e47/0x4280 [ 221.521163][ T8570] ? tcp_push_one+0x110/0x110 [ 221.525895][ T8570] ? secure_tcpv6_ts_off+0x24f/0x360 [ 221.531236][ T8570] ? secure_dccpv6_sequence_number+0x280/0x280 [ 221.537419][ T8570] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 221.543708][ T8570] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 221.549983][ T8570] ? prandom_u32_state+0x13/0x180 [ 221.555053][ T8570] tcp_v6_connect+0x150b/0x20a0 [ 221.559944][ T8570] ? tcp_sendmsg_locked+0x2170/0x37f0 [ 221.565369][ T8570] ? tcp_v6_conn_request+0x2b0/0x2b0 [ 221.570691][ T8570] ? find_held_lock+0x35/0x130 [ 221.575497][ T8570] ? find_held_lock+0x35/0x130 [ 221.580308][ T8570] ? fs_reclaim_acquire.part.0+0x30/0x30 [ 221.585986][ T8570] __inet_stream_connect+0x83f/0xea0 [ 221.591307][ T8570] ? tcp_v6_conn_request+0x2b0/0x2b0 [ 221.596622][ T8570] ? __inet_stream_connect+0x83f/0xea0 [ 221.602129][ T8570] ? inet_dgram_connect+0x2e0/0x2e0 [ 221.607374][ T8570] ? tcp_sendmsg_locked+0x2170/0x37f0 [ 221.612780][ T8570] ? rcu_read_lock_sched_held+0x110/0x130 [ 221.618536][ T8570] ? kmem_cache_alloc_trace+0x354/0x760 [ 221.624111][ T8570] ? __lock_acquire+0x548/0x3fb0 [ 221.629073][ T8570] ? do_raw_spin_lock+0x20e/0x2e0 [ 221.634127][ T8570] ? rwlock_bug.part.0+0x90/0x90 [ 221.639100][ T8570] tcp_sendmsg_locked+0x231f/0x37f0 [ 221.644340][ T8570] ? mark_held_locks+0xf0/0xf0 [ 221.649139][ T8570] ? mark_held_locks+0xa4/0xf0 [ 221.653936][ T8570] ? tcp_sendpage+0x60/0x60 [ 221.658471][ T8570] ? lock_sock_nested+0x9a/0x120 [ 221.663446][ T8570] ? trace_hardirqs_on+0x67/0x230 [ 221.668509][ T8570] ? lock_sock_nested+0x9a/0x120 [ 221.673486][ T8570] ? __local_bh_enable_ip+0x15a/0x270 [ 221.678892][ T8570] tcp_sendmsg+0x30/0x50 [ 221.683161][ T8570] inet_sendmsg+0x147/0x5e0 [ 221.687695][ T8570] ? ipip_gro_receive+0x100/0x100 [ 221.692746][ T8570] sock_sendmsg+0xdd/0x130 [ 221.697308][ T8570] __sys_sendto+0x262/0x380 [ 221.701860][ T8570] ? __ia32_sys_getpeername+0xb0/0xb0 [ 221.707307][ T8570] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 221.713598][ T8570] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 221.719083][ T8570] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 221.724572][ T8570] ? do_syscall_64+0x26/0x610 [ 221.729287][ T8570] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 221.735408][ T8570] __x64_sys_sendto+0xe1/0x1a0 [ 221.740214][ T8570] do_syscall_64+0x103/0x610 [ 221.744843][ T8570] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 221.750751][ T8570] RIP: 0033:0x4582b9 [ 221.754664][ T8570] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 221.774287][ T8570] RSP: 002b:00007f80f2fb1c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 221.782732][ T8570] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000004582b9 [ 221.790720][ T8570] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 221.798716][ T8570] RBP: 000000000073bfa0 R08: 0000000020000380 R09: 000000000000001c [ 221.806714][ T8570] R10: 00000000200408d4 R11: 0000000000000246 R12: 00007f80f2fb26d4 [ 221.814707][ T8570] R13: 00000000004c59b6 R14: 00000000004d9d10 R15: 00000000ffffffff 01:39:33 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}}}, 0x48) 01:39:33 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}}}, 0x48) [ 222.121512][ T8570] BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.3/8570 [ 222.131076][ T8570] caller is ip6_finish_output+0x335/0xdc0 [ 222.136843][ T8570] CPU: 0 PID: 8570 Comm: syz-executor.3 Not tainted 5.1.0-rc3-next-20190405 #19 [ 222.145889][ T8570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 222.155977][ T8570] Call Trace: [ 222.159344][ T8570] dump_stack+0x172/0x1f0 [ 222.163746][ T8570] __this_cpu_preempt_check+0x246/0x270 [ 222.169355][ T8570] ip6_finish_output+0x335/0xdc0 [ 222.174376][ T8570] ip6_output+0x235/0x7f0 [ 222.178762][ T8570] ? ip6_finish_output+0xdc0/0xdc0 [ 222.183937][ T8570] ? ip6_fragment+0x3980/0x3980 [ 222.188840][ T8570] ip6_xmit+0xe41/0x20c0 [ 222.193155][ T8570] ? ip6_finish_output2+0x2550/0x2550 [ 222.198584][ T8570] ? mark_held_locks+0xf0/0xf0 [ 222.203397][ T8570] ? ip6_setup_cork+0x1870/0x1870 [ 222.208483][ T8570] inet6_csk_xmit+0x2fb/0x5d0 [ 222.213214][ T8570] ? inet6_csk_update_pmtu+0x190/0x190 [ 222.218725][ T8570] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 222.218752][ T8570] ? csum_ipv6_magic+0x20/0x80 [ 222.218779][ T8570] __tcp_transmit_skb+0x1a32/0x3750 [ 222.218808][ T8570] ? __tcp_select_window+0x8b0/0x8b0 [ 222.218827][ T8570] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 222.218853][ T8570] ? tcp_fastopen_no_cookie+0xe0/0x190 [ 222.229928][ T8570] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 222.229949][ T8570] tcp_connect+0x1e47/0x4280 [ 222.229976][ T8570] ? tcp_push_one+0x110/0x110 [ 222.229993][ T8570] ? secure_tcpv6_ts_off+0x24f/0x360 [ 222.230011][ T8570] ? secure_dccpv6_sequence_number+0x280/0x280 [ 222.230025][ T8570] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 222.230037][ T8570] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 222.230052][ T8570] ? prandom_u32_state+0x13/0x180 [ 222.230071][ T8570] tcp_v6_connect+0x150b/0x20a0 [ 222.230087][ T8570] ? tcp_sendmsg_locked+0x2170/0x37f0 [ 222.230111][ T8570] ? tcp_v6_conn_request+0x2b0/0x2b0 [ 222.312500][ T8570] ? find_held_lock+0x35/0x130 [ 222.312521][ T8570] ? fs_reclaim_acquire.part.0+0x30/0x30 [ 222.312543][ T8570] __inet_stream_connect+0x83f/0xea0 [ 222.312559][ T8570] ? tcp_v6_conn_request+0x2b0/0x2b0 [ 222.312575][ T8570] ? __inet_stream_connect+0x83f/0xea0 [ 222.312599][ T8570] ? inet_dgram_connect+0x2e0/0x2e0 [ 222.312616][ T8570] ? tcp_sendmsg_locked+0x2170/0x37f0 [ 222.312641][ T8570] ? rcu_read_lock_sched_held+0x110/0x130 [ 222.323093][ T8570] ? kmem_cache_alloc_trace+0x354/0x760 [ 222.323109][ T8570] ? __lock_acquire+0x548/0x3fb0 [ 222.323135][ T8570] tcp_sendmsg_locked+0x231f/0x37f0 [ 222.323155][ T8570] ? mark_held_locks+0xf0/0xf0 [ 222.323175][ T8570] ? mark_held_locks+0xa4/0xf0 [ 222.323192][ T8570] ? tcp_sendpage+0x60/0x60 [ 222.323208][ T8570] ? lock_sock_nested+0x9a/0x120 [ 222.323223][ T8570] ? trace_hardirqs_on+0x67/0x230 [ 222.323236][ T8570] ? lock_sock_nested+0x9a/0x120 [ 222.323253][ T8570] ? __local_bh_enable_ip+0x15a/0x270 [ 222.323277][ T8570] tcp_sendmsg+0x30/0x50 [ 222.355716][ T8570] inet_sendmsg+0x147/0x5e0 [ 222.355733][ T8570] ? ipip_gro_receive+0x100/0x100 01:39:34 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x246) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0x0, 0xfffd}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x30, 0x0, 0x0, 0x117) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(0xffffffffffffffff, 0x4010ae74, &(0x7f00000000c0)={0x5, 0xe878, 0x4}) 01:39:34 executing program 0: sendmmsg(0xffffffffffffffff, &(0x7f0000007e00)=[{{&(0x7f00000004c0)=@in6={0xa, 0x4e22, 0x0, @mcast2}, 0x80, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1400000000000000290000003e00000000000000d0e60263398e049a1ea0ae1b98ef9f5a83be26e6ab54c38e3cb2064833e15bfcf11daef968f200351ea4aa6aef965c212244f785d10b821d37c5685eea4f7af90e72644b64c5025af9632cbc48cdcfce84bf9eecabee6f7d8abae960d6eac69b1b58deb38a"], 0x79}}], 0x1, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(r0, &(0x7f0000007e00), 0x136a88c83115ab7, 0x0) 01:39:34 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}}}, 0x48) [ 222.355752][ T8570] sock_sendmsg+0xdd/0x130 [ 222.355771][ T8570] __sys_sendto+0x262/0x380 [ 222.355791][ T8570] ? __ia32_sys_getpeername+0xb0/0xb0 [ 222.355834][ T8570] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 222.385656][ T8570] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 222.385674][ T8570] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 222.385690][ T8570] ? do_syscall_64+0x26/0x610 [ 222.385715][ T8570] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 222.385738][ T8570] __x64_sys_sendto+0xe1/0x1a0 [ 222.385758][ T8570] do_syscall_64+0x103/0x610 [ 222.385783][ T8570] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 222.466964][ T8570] RIP: 0033:0x4582b9 [ 222.466981][ T8570] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 222.466988][ T8570] RSP: 002b:00007f80f2fb1c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 222.467002][ T8570] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000004582b9 01:39:34 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0xffffffffffffffd1, 0x20000001, &(0x7f0000b63fe4), 0x1c) [ 222.467011][ T8570] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 222.467020][ T8570] RBP: 000000000073bfa0 R08: 0000000020000380 R09: 000000000000001c [ 222.467029][ T8570] R10: 00000000200408d4 R11: 0000000000000246 R12: 00007f80f2fb26d4 [ 222.467038][ T8570] R13: 00000000004c59b6 R14: 00000000004d9d10 R15: 00000000ffffffff 01:39:34 executing program 4: r0 = socket$kcm(0x29, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e6, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cgroup.events\x00', 0x0, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000500)='cpuacct.usage_user\x00', 0x0, 0x0) write$cgroup_int(r2, &(0x7f0000000580)=0x7, 0x12) r3 = openat$cgroup_ro(r1, &(0x7f0000000800)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000100)={r2}) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f0000000340)) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)={&(0x7f0000000200)='./file0\x00', 0x0, 0x10}, 0x10) close(r4) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000380)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x80, &(0x7f0000000980), 0x0, &(0x7f0000000400), 0xfffffffffffffddd, 0x20000001}, 0x0) r5 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)='cpuset.mems\x00', 0x2, 0x0) write$cgroup_subtree(r5, &(0x7f0000000700)=ANY=[@ANYBLOB="4448d69e8b23f0782015d7c422980baf0ecc31d5383ead9885a9b3fbfa33b1e85ae25204edd101467ea7dc5502a341ee7e98b610428fd0c51fd5b971000f590689fedbf2594f7abbb7717deafc9027228a3696bf49718f56b581c6aa957646232ed33b2ecf89a3f3355513fba6225f7c38ffffff7f61519275e8e3ef2bcd3ba36ab2a556c3934a05b68e86d5db6495530a5b12421aa62586d67d9137a08cdddadc1c23c15f045f0034941dad64176caae8bb8b2e1efdb1799189f55d3c4035abdb264015230c"], 0xc6) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe9\xdc\x00', 0x200091}) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f0000000440)={r3}) socketpair(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') ioctl$TUNSETVNETLE(r6, 0x400454dc, &(0x7f0000000040)) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x8d4, 0x20}, 0x2c) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xd, 0x2c, &(0x7f0000000840)=ANY=[@ANYBLOB="182a008d3def38283e688551b7d0487082c500850300000000100042000031000000d0c7c1e33385a7d4126017b72bd50e2e7481a7e0aace406d1550e116e68ca7bfa1f7b477abc2961e4561017df1acfec8198846f05e36dd3c6592d903c6de13f677f09854941022000000000000df426daf425342f769350860bfc9bd7095f302d585814a3b3c675c09d8436895936b5b804273ed9ccc09e7f8493480fbc1b8802b86ab00a545d48a77be91b07695d3d01b4bc82e269b17cac7162272b1c32e805dd9f6a66b8939e84d66f1f404594f37d90102bf5821cb1c271b25e80600282a487acfd6dc447fc055b441e510b63caaa681290f95c7477a2448c3b40a469481431b1fcd75fcf16696bab04820e51900c1c15e07dc74d582d95dfe22199d61533391fa83fa202c4d4210572d47c838fb4d340d71c0f48022f9612ce4fa3ca2d816846e30f06e1bf2ab3ed59391028a617d77eefb1d935cd46175e76be208"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) close(r8) socketpair(0x2000800000001, 0x40000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMUNATTACH(r9, 0x5452, &(0x7f0000000000)={r6}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000400)={r7, 0x28, &(0x7f0000000140)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000480)={r11, 0x2e, 0x18}, 0xc) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_int(r10, &(0x7f00000000c0), 0x10000019d) close(r9) 01:39:34 executing program 0: shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) 01:39:34 executing program 1: ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000140)={0x0, 0x0, 0x9, {0x0, 0x1c9c380}}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$caif_stream(0x25, 0x1, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000280)={0x0, @reserved}) r1 = socket(0x11, 0x802, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='security.ima\x00', 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000240)={'team0\x00\xfd\xff\xff\xff\xc0\x00\x03\x00\x02\xff', 0x4bfd}) 01:39:34 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}}}, 0x48) [ 222.683906][ T8619] BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.3/8619 [ 222.693510][ T8619] caller is ip6_finish_output+0x335/0xdc0 [ 222.699277][ T8619] CPU: 0 PID: 8619 Comm: syz-executor.3 Not tainted 5.1.0-rc3-next-20190405 #19 [ 222.708353][ T8619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 222.718452][ T8619] Call Trace: [ 222.718497][ T8619] dump_stack+0x172/0x1f0 [ 222.726246][ T8619] __this_cpu_preempt_check+0x246/0x270 [ 222.726268][ T8619] ip6_finish_output+0x335/0xdc0 [ 222.726314][ T8619] ip6_output+0x235/0x7f0 [ 222.741188][ T8619] ? ip6_finish_output+0xdc0/0xdc0 [ 222.746357][ T8619] ? ip6_fragment+0x3980/0x3980 [ 222.751253][ T8619] ip6_xmit+0xe41/0x20c0 [ 222.755561][ T8619] ? ip6_finish_output2+0x2550/0x2550 [ 222.760973][ T8619] ? mark_held_locks+0xf0/0xf0 [ 222.765777][ T8619] ? ip6_setup_cork+0x1870/0x1870 [ 222.770861][ T8619] inet6_csk_xmit+0x2fb/0x5d0 [ 222.775597][ T8619] ? inet6_csk_update_pmtu+0x190/0x190 [ 222.781128][ T8619] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 222.787412][ T8619] ? csum_ipv6_magic+0x20/0x80 [ 222.792222][ T8619] __tcp_transmit_skb+0x1a32/0x3750 [ 222.797467][ T8619] ? __tcp_select_window+0x8b0/0x8b0 [ 222.802802][ T8619] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 222.809080][ T8619] ? tcp_fastopen_no_cookie+0xe0/0x190 [ 222.814590][ T8619] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 222.820870][ T8619] tcp_connect+0x1e47/0x4280 [ 222.825512][ T8619] ? tcp_push_one+0x110/0x110 [ 222.830231][ T8619] ? secure_tcpv6_ts_off+0x24f/0x360 [ 222.835557][ T8619] ? secure_dccpv6_sequence_number+0x280/0x280 [ 222.841745][ T8619] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 222.848027][ T8619] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 222.854315][ T8619] ? prandom_u32_state+0x13/0x180 [ 222.859382][ T8619] tcp_v6_connect+0x150b/0x20a0 [ 222.864275][ T8619] ? tcp_sendmsg_locked+0x2170/0x37f0 [ 222.869709][ T8619] ? tcp_v6_conn_request+0x2b0/0x2b0 [ 222.875037][ T8619] ? __switch_to_asm+0x34/0x70 [ 222.879830][ T8619] ? __switch_to_asm+0x40/0x70 [ 222.884640][ T8619] ? find_held_lock+0x35/0x130 [ 222.889456][ T8619] ? fs_reclaim_acquire.part.0+0x30/0x30 [ 222.895132][ T8619] __inet_stream_connect+0x83f/0xea0 [ 222.900466][ T8619] ? tcp_v6_conn_request+0x2b0/0x2b0 [ 222.905791][ T8619] ? __inet_stream_connect+0x83f/0xea0 [ 222.911312][ T8619] ? inet_dgram_connect+0x2e0/0x2e0 [ 222.916559][ T8619] ? tcp_sendmsg_locked+0x2170/0x37f0 [ 222.921992][ T8619] ? rcu_read_lock_sched_held+0x110/0x130 [ 222.927775][ T8619] ? kmem_cache_alloc_trace+0x354/0x760 [ 222.933377][ T8619] ? __lock_acquire+0x548/0x3fb0 [ 222.938383][ T8619] tcp_sendmsg_locked+0x231f/0x37f0 [ 222.943624][ T8619] ? mark_held_locks+0xf0/0xf0 [ 222.948433][ T8619] ? mark_held_locks+0xa4/0xf0 [ 222.953243][ T8619] ? tcp_sendpage+0x60/0x60 [ 222.957782][ T8619] ? lock_sock_nested+0x9a/0x120 [ 222.962761][ T8619] ? trace_hardirqs_on+0x67/0x230 [ 222.967817][ T8619] ? lock_sock_nested+0x9a/0x120 [ 222.972813][ T8619] ? __local_bh_enable_ip+0x15a/0x270 [ 222.978228][ T8619] tcp_sendmsg+0x30/0x50 [ 222.982507][ T8619] inet_sendmsg+0x147/0x5e0 [ 222.987041][ T8619] ? ipip_gro_receive+0x100/0x100 [ 222.992104][ T8619] sock_sendmsg+0xdd/0x130 [ 222.996569][ T8619] __sys_sendto+0x262/0x380 [ 223.001126][ T8619] ? __ia32_sys_getpeername+0xb0/0xb0 [ 223.006556][ T8619] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 223.012864][ T8619] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 223.018372][ T8619] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 223.023870][ T8619] ? do_syscall_64+0x26/0x610 [ 223.028581][ T8619] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 223.034685][ T8619] __x64_sys_sendto+0xe1/0x1a0 [ 223.039505][ T8619] do_syscall_64+0x103/0x610 [ 223.048320][ T8619] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 223.054249][ T8619] RIP: 0033:0x4582b9 [ 223.058188][ T8619] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 01:39:34 executing program 0: ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000140)={0x0, 0x0, 0x9, {0x0, 0x1c9c380}, 0xffffffff}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$caif_stream(0x25, 0x1, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000280)={0x0, @reserved}) r1 = socket(0x11, 0x802, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='security.ima\x00', 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000240)={'team0\x00\xfd\xff\xff\xff\xc0\x00\x03\x00\x02\xff', 0x4bfd}) [ 223.077832][ T8619] RSP: 002b:00007f80f2fd2c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 223.086277][ T8619] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000004582b9 [ 223.094294][ T8619] RDX: ffffffffffffffd1 RSI: 0000000000000000 RDI: 0000000000000004 [ 223.102306][ T8619] RBP: 000000000073bf00 R08: 0000000020b63fe4 R09: 000000000000001c [ 223.110308][ T8619] R10: 0000000020000001 R11: 0000000000000246 R12: 00007f80f2fd36d4 [ 223.118305][ T8619] R13: 00000000004c59b6 R14: 00000000004d9d10 R15: 00000000ffffffff 01:39:34 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 223.259339][ T8629] device team0 entered promiscuous mode [ 223.270802][ T8629] device team_slave_0 entered promiscuous mode 01:39:35 executing program 2: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) socket$rxrpc(0x21, 0x2, 0x2) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) epoll_create1(0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200), 0x0) [ 223.308346][ T8629] device team_slave_1 entered promiscuous mode 01:39:35 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 223.424742][ T8629] 8021q: adding VLAN 0 to HW filter on device team0 01:39:35 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000001300)='/dev/btrfs-control\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 01:39:35 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:35 executing program 2: r0 = socket$inet6(0xa, 0x2000000080803, 0x2) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0x4d2, 0x32}, 0x0, @in6, 0x0, 0x0, 0x0, 0x8464}}, 0xe8) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) 01:39:35 executing program 2: r0 = socket$kcm(0xa, 0x3, 0x11) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x8980, &(0x7f00000000c0)) [ 224.010676][ T8643] device team0 entered promiscuous mode [ 224.016330][ T8643] device team_slave_0 entered promiscuous mode [ 224.050004][ T8643] device team_slave_1 entered promiscuous mode [ 224.057751][ T8643] 8021q: adding VLAN 0 to HW filter on device team0 01:39:35 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:35 executing program 3: r0 = socket$kcm(0x10, 0x100000003, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000200)="2e0000001c00810ee00f80ecdb4cb9f207c804a00c000000880025fb0a0002001208da1b40d805000300c50083b8", 0x2e}], 0x1}, 0x0) [ 224.119603][ T8654] device team0 left promiscuous mode [ 224.145152][ T8654] device team_slave_0 left promiscuous mode [ 224.152636][ T8654] device team_slave_1 left promiscuous mode [ 224.300780][ T8653] device team0 entered promiscuous mode [ 224.306408][ T8653] device team_slave_0 entered promiscuous mode [ 224.329964][ T8653] device team_slave_1 entered promiscuous mode [ 224.337398][ T8653] 8021q: adding VLAN 0 to HW filter on device team0 01:39:36 executing program 1: ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000140)={0x0, 0x0, 0x9, {0x0, 0x1c9c380}}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$caif_stream(0x25, 0x1, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000280)={0x0, @reserved}) r1 = socket(0x11, 0x802, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='security.ima\x00', 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000240)={'team0\x00\xfd\xff\xff\xff\xc0\x00\x03\x00\x02\xff', 0x4bfd}) 01:39:36 executing program 2: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, 0x0) r1 = socket$kcm(0xa, 0x3, 0x11) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001940)={0xffffffffffffffff, 0x0, 0x0}, 0x10) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x541b, &(0x7f00000000c0)) [ 224.347633][ T8643] device team0 left promiscuous mode [ 224.354948][ T8643] device team_slave_0 left promiscuous mode [ 224.368000][ T8643] device team_slave_1 left promiscuous mode [ 224.516945][ T8677] __nla_parse: 23 callbacks suppressed [ 224.516962][ T8677] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.3'. [ 224.539652][ T8672] device team0 entered promiscuous mode [ 224.549962][ T8672] device team_slave_0 entered promiscuous mode [ 224.557837][ T8672] device team_slave_1 entered promiscuous mode [ 224.573679][ T8672] 8021q: adding VLAN 0 to HW filter on device team0 [ 224.597116][ T8685] device team0 left promiscuous mode 01:39:36 executing program 0: ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000140)={0x0, 0x0, 0x9, {0x0, 0x1c9c380}, 0xffffffff}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$caif_stream(0x25, 0x1, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000280)={0x0, @reserved}) r1 = socket(0x11, 0x802, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='security.ima\x00', 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000240)={'team0\x00\xfd\xff\xff\xff\xc0\x00\x03\x00\x02\xff', 0x4bfd}) 01:39:36 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:36 executing program 4: r0 = socket$kcm(0x29, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e6, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cgroup.events\x00', 0x0, 0x0) r2 = openat$cgroup_ro(r0, &(0x7f0000000500)='cpuacct.usage_user\x00', 0x0, 0x0) write$cgroup_int(r2, &(0x7f0000000580)=0x7, 0x12) r3 = openat$cgroup_ro(r1, &(0x7f0000000800)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000100)={r2}) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNGETSNDBUF(r1, 0x800454d3, &(0x7f0000000340)) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)={&(0x7f0000000200)='./file0\x00', 0x0, 0x10}, 0x10) close(r4) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000380)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x80, &(0x7f0000000980), 0x0, &(0x7f0000000400), 0xfffffffffffffddd, 0x20000001}, 0x0) r5 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)='cpuset.mems\x00', 0x2, 0x0) write$cgroup_subtree(r5, &(0x7f0000000700)=ANY=[@ANYBLOB="4448d69e8b23f0782015d7c422980baf0ecc31d5383ead9885a9b3fbfa33b1e85ae25204edd101467ea7dc5502a341ee7e98b610428fd0c51fd5b971000f590689fedbf2594f7abbb7717deafc9027228a3696bf49718f56b581c6aa957646232ed33b2ecf89a3f3355513fba6225f7c38ffffff7f61519275e8e3ef2bcd3ba36ab2a556c3934a05b68e86d5db6495530a5b12421aa62586d67d9137a08cdddadc1c23c15f045f0034941dad64176caae8bb8b2e1efdb1799189f55d3c4035abdb264015230c"], 0xc6) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe9\xdc\x00', 0x200091}) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f0000000440)={r3}) socketpair(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') ioctl$TUNSETVNETLE(r6, 0x400454dc, &(0x7f0000000040)) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x8d4, 0x20}, 0x2c) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xd, 0x2c, &(0x7f0000000840)=ANY=[@ANYBLOB="182a008d3def38283e688551b7d0487082c500850300000000100042000031000000d0c7c1e33385a7d4126017b72bd50e2e7481a7e0aace406d1550e116e68ca7bfa1f7b477abc2961e4561017df1acfec8198846f05e36dd3c6592d903c6de13f677f09854941022000000000000df426daf425342f769350860bfc9bd7095f302d585814a3b3c675c09d8436895936b5b804273ed9ccc09e7f8493480fbc1b8802b86ab00a545d48a77be91b07695d3d01b4bc82e269b17cac7162272b1c32e805dd9f6a66b8939e84d66f1f404594f37d90102bf5821cb1c271b25e80600282a487acfd6dc447fc055b441e510b63caaa681290f95c7477a2448c3b40a469481431b1fcd75fcf16696bab04820e51900c1c15e07dc74d582d95dfe22199d61533391fa83fa202c4d4210572d47c838fb4d340d71c0f48022f9612ce4fa3ca2d816846e30f06e1bf2ab3ed59391028a617d77eefb1d935cd46175e76be208"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) close(r8) socketpair(0x2000800000001, 0x40000000000001, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMUNATTACH(r9, 0x5452, &(0x7f0000000000)={r6}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000400)={r7, 0x28, &(0x7f0000000140)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000480)={r11, 0x2e, 0x18}, 0xc) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_int(r10, &(0x7f00000000c0), 0x10000019d) close(r9) 01:39:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 01:39:36 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x802, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) ioctl$KVM_NMI(r1, 0xae9a) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000240)={'team0\x00\xfd\xff\xff\xff\xc0\x00\x03\x00\x02\xff', 0x4bfd}) [ 224.623216][ T8685] device team_slave_0 left promiscuous mode [ 224.634547][ T8685] device team_slave_1 left promiscuous mode [ 224.690451][ T8695] binder_alloc: binder_alloc_mmap_handler: 8690 20001000-20004000 already mapped failed -16 01:39:36 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 224.748343][ T8691] binder_alloc: 8690: binder_alloc_buf, no vma [ 224.766941][ T8702] binder: BINDER_SET_CONTEXT_MGR already set [ 224.776672][ T8691] binder: 8690:8691 transaction failed 29189/-3, size 0-0 line 3148 [ 224.788347][ T8702] binder: 8690:8702 ioctl 40046207 0 returned -16 [ 224.798819][ T2990] binder: release 8690:8691 transaction 6 out, still active 01:39:36 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x41, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) dup3(0xffffffffffffffff, r1, 0x0) set_mempolicy(0x8002, &(0x7f0000000040)=0x1000000005, 0x6) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 224.842713][ T2990] binder: undelivered TRANSACTION_COMPLETE [ 224.875774][ T2990] binder: undelivered TRANSACTION_ERROR: 29189 01:39:36 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 224.907652][ T2990] binder: send failed reply for transaction 6, target dead 01:39:36 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:36 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 225.420647][ T8687] device team0 entered promiscuous mode [ 225.426295][ T8687] device team_slave_0 entered promiscuous mode [ 225.449223][ T8687] device team_slave_1 entered promiscuous mode [ 225.471459][ T8687] 8021q: adding VLAN 0 to HW filter on device team0 01:39:37 executing program 1: ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000140)={0x0, 0x0, 0x9, {0x0, 0x1c9c380}}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$caif_stream(0x25, 0x1, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000280)={0x0, @reserved}) r1 = socket(0x11, 0x802, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='security.ima\x00', 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000240)={'team0\x00\xfd\xff\xff\xff\xc0\x00\x03\x00\x02\xff', 0x4bfd}) 01:39:37 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={0x0, r1}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 225.681390][ T8703] device team0 entered promiscuous mode [ 225.687007][ T8703] device team_slave_0 entered promiscuous mode [ 225.711048][ T8703] device team_slave_1 entered promiscuous mode [ 225.732339][ T8703] 8021q: adding VLAN 0 to HW filter on device team0 [ 225.828866][ T8701] device team0 left promiscuous mode [ 225.834505][ T8701] device team_slave_0 left promiscuous mode [ 225.841552][ T8701] device team_slave_1 left promiscuous mode [ 225.920470][ T8705] device team0 entered promiscuous mode [ 225.930071][ T8705] device team_slave_0 entered promiscuous mode [ 225.950108][ T8705] device team_slave_1 entered promiscuous mode [ 225.962088][ T8705] 8021q: adding VLAN 0 to HW filter on device team0 01:39:37 executing program 0: ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000140)={0x0, 0x0, 0x9, {0x0, 0x1c9c380}, 0xffffffff}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$caif_stream(0x25, 0x1, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000280)={0x0, @reserved}) r1 = socket(0x11, 0x802, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='security.ima\x00', 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000240)={'team0\x00\xfd\xff\xff\xff\xc0\x00\x03\x00\x02\xff', 0x4bfd}) 01:39:37 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={0x0, r1}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:37 executing program 4: getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 226.004536][ T8729] device team0 left promiscuous mode [ 226.011962][ T8729] device team_slave_0 left promiscuous mode [ 226.018107][ T8729] device team_slave_1 left promiscuous mode [ 226.061393][ T8745] binder: 8744:8745 ERROR: BC_REGISTER_LOOPER called without request 01:39:37 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={0x0, r1}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 226.199475][ T8736] device team0 left promiscuous mode [ 226.212915][ T8736] device team_slave_0 left promiscuous mode [ 226.226239][ T8736] device team_slave_1 left promiscuous mode 01:39:38 executing program 3: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$EVIOCGREP(r0, 0x4010744d, 0x0) 01:39:38 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 226.500034][ T8738] device team0 entered promiscuous mode [ 226.505690][ T8738] device team_slave_0 entered promiscuous mode [ 226.540061][ T8738] device team_slave_1 entered promiscuous mode [ 226.548148][ T8738] 8021q: adding VLAN 0 to HW filter on device team0 01:39:38 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000001000)=[{&(0x7f0000000080)="ea08", 0x2}], 0x1, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$EVIOCGREP(r0, 0x4010744d, &(0x7f0000001000)=""/174) 01:39:38 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 226.582920][ T8750] device team0 left promiscuous mode [ 226.588578][ T8750] device team_slave_0 left promiscuous mode [ 226.597016][ T8750] device team_slave_1 left promiscuous mode 01:39:38 executing program 1: ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000140)={0x0, 0x0, 0x9, {0x0, 0x1c9c380}}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$caif_stream(0x25, 0x1, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000280)={0x0, @reserved}) r1 = socket(0x11, 0x802, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='security.ima\x00', 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000240)={'team0\x00\xfd\xff\xff\xff\xc0\x00\x03\x00\x02\xff', 0x4bfd}) 01:39:38 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:38 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 226.863792][ T8782] binder_alloc: binder_alloc_mmap_handler: 8744 20001000-20004000 already mapped failed -16 01:39:38 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) [ 226.907733][ T8786] binder: BINDER_SET_CONTEXT_MGR already set [ 226.927158][ T8786] binder: 8744:8786 ioctl 40046207 0 returned -16 [ 227.061322][ T8753] device team0 entered promiscuous mode [ 227.066952][ T8753] device team_slave_0 entered promiscuous mode [ 227.112329][ T8753] device team_slave_1 entered promiscuous mode [ 227.131724][ T8753] 8021q: adding VLAN 0 to HW filter on device team0 [ 227.162581][ T8774] device team0 left promiscuous mode [ 227.168232][ T8774] device team_slave_0 left promiscuous mode [ 227.175641][ T8774] device team_slave_1 left promiscuous mode 01:39:38 executing program 0: ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000140)={0x0, 0x0, 0x9, {0x0, 0x1c9c380}, 0xffffffff}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$caif_stream(0x25, 0x1, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000280)={0x0, @reserved}) r1 = socket(0x11, 0x802, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='security.ima\x00', 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000240)={'team0\x00\xfd\xff\xff\xff\xc0\x00\x03\x00\x02\xff', 0x4bfd}) 01:39:38 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f128291a41d88b070") r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='hugetl\x04\x00\x00\x00\x00\x00\x00\x00age_ir_Z\xa2\xf4es\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0xffffff6a) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgpoup.events\x00>\xa5^\x10\xa8)\x9ds\xeemr\xda\x86\xf4\xdb\xed/\x19\xb5*H\xa9\x0ea\x87)\x89L\x91\x8aI\x85\xeb\x8fo,1h\x1f\x98\x87 \xc1u<\x87\xf1=\x03a\xb8%\xfe/J\xc4\xad\x9e\xdb\xd5^\xeb\xfe\f\xee$\x0f\xf8\x94\xa1J\xe0\xeb\xe6\xc8A\xb4\x9b\xed\xc1D\x02\xa1R\x88\x15\xb5\xafr5\xf0\xef\xce\xe6\xb1\xcb\xa8r\x81a\xd6\x1a\x1a\xb8\xa9\x17\xc2\xb5', 0x275a, 0x0) write$cgroup_int(r2, &(0x7f0000000380), 0x10076) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000001300)={0x2880008, r1, 0x809}) mmap(&(0x7f0000000000/0xda6000)=nil, 0xda6000, 0x0, 0x64031, 0xffffffffffffffff, 0x0) 01:39:38 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}, r1}}, 0x48) 01:39:39 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, 0x0, 0x0) [ 227.640531][ T8779] device team0 entered promiscuous mode [ 227.646167][ T8779] device team_slave_0 entered promiscuous mode [ 227.670061][ T8779] device team_slave_1 entered promiscuous mode [ 227.679294][ T8779] 8021q: adding VLAN 0 to HW filter on device team0 [ 227.714635][ T8800] device team0 left promiscuous mode [ 227.730256][ T8800] device team_slave_0 left promiscuous mode [ 227.768971][ T8800] device team_slave_1 left promiscuous mode [ 228.009271][ T8804] device team0 entered promiscuous mode [ 228.029906][ T8804] device team_slave_0 entered promiscuous mode [ 228.036266][ T8804] device team_slave_1 entered promiscuous mode [ 228.045752][ T8804] 8021q: adding VLAN 0 to HW filter on device team0 01:39:39 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x48f, &(0x7f0000000040)={0x6, @local, 0x0, 0x0, 'wrr\x00'}, 0x2c) 01:39:39 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, 0x0, 0x0) 01:39:39 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket$inet(0x2, 0x3, 0x1) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) syz_emit_ethernet(0x570, &(0x7f0000000200)={@broadcast, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x223}, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x3, 0x4, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local={0xac, 0x223}, @dev, {[@timestamp={0x8, 0x40, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1]}, {}, {[@loopback]}, {[@broadcast]}, {[@multicast1]}, {[@dev]}]}]}}}}}}}, 0x0) 01:39:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000240)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x9}}, 0x10) 01:39:39 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000080)={0x0, 'veth0_to_bridge\x00'}, 0x18) 01:39:39 executing program 0: ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000140)={0x0, 0x0, 0x9, {0x0, 0x1c9c380}, 0xffffffff}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$caif_stream(0x25, 0x1, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000280)={0x0, @reserved}) r1 = socket(0x11, 0x802, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='security.ima\x00', 0x0, 0x0, 0x0) 01:39:40 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, 0x0, 0x0) 01:39:40 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 01:39:40 executing program 4: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) write$FUSE_NOTIFY_POLL(r0, &(0x7f0000000400)={0x18}, 0x18) 01:39:40 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'rfc3686(c%r-aes-aesni)\x00'}, 0x58) [ 228.369121][ T8834] device team0 left promiscuous mode [ 228.380710][ T8834] device team_slave_0 left promiscuous mode [ 228.401795][ T8834] device team_slave_1 left promiscuous mode 01:39:40 executing program 3: syz_execute_func(&(0x7f00000001c0)="410f01f9c4e27d19e664ff0941c3d9ff470f41a48f54093d1166420fe2e33e0f1110c442019dcc0f18dc") clone(0x84007bf7, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) mknod(&(0x7f00000000c0)='./file0\x00', 0x1142, 0x0) execve(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) ptrace(0x10, r0) r1 = creat(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$EVIOCSKEYCODE(r1, 0x40084504, 0x0) ptrace(0x11, r0) 01:39:40 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}}}, 0x48) 01:39:40 executing program 4: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x201, 0x0) flock(r0, 0x5) fcntl$lock(r0, 0x9, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000300010005}) flock(r0, 0x1) 01:39:40 executing program 4: r0 = open(&(0x7f0000000480)='./file0\x00', 0x80000000000206, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) fcntl$lock(r1, 0x8, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x100000001}) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x201, 0x0) flock(r0, 0x200000002) fcntl$lock(r2, 0x9, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000300010005}) 01:39:40 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}}}, 0x48) 01:39:40 executing program 2: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x8) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) ftruncate(r1, 0x8003f1) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$inet_buf(r2, 0x0, 0x25, 0x0, &(0x7f0000000100)) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f00000000c0)) ioctl$FICLONE(r1, 0x40049409, r1) ioctl$FS_IOC_FIEMAP(r2, 0xc020660b, &(0x7f0000000500)=ANY=[@ANYBLOB="000000000000000001ffff"]) 01:39:40 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000001240)="2e0000002a00815fe45ac187185095cf1200b0eba0b4d65cdbaa98cbb30007fff00000000000000051894d5d1dac", 0x2e}], 0x1}, 0x0) socket$kcm(0x29, 0x0, 0x0) [ 229.004825][ T26] audit: type=1804 audit(1554687580.704:31): pid=8878 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir222203305/syzkaller.g4CZ5Z/26/bus" dev="sda1" ino=16657 res=1 01:39:41 executing program 0: ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000140)={0x0, 0x0, 0x9, {0x0, 0x1c9c380}, 0xffffffff}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$caif_stream(0x25, 0x1, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000280)={0x0, @reserved}) r1 = socket(0x11, 0x802, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='security.ima\x00', 0x0, 0x0, 0x0) 01:39:41 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000140)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000100), r1, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="00000000000000000000000000000001"}, {0xa, 0x0, 0x0, @dev}}}, 0x48) [ 229.242408][ T8849] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 229.273163][ T8849] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 229.381512][ T8849] device team0 left promiscuous mode [ 229.422281][ T8849] device team_slave_0 left promiscuous mode [ 229.450284][ T8849] device team_slave_1 left promiscuous mode [ 229.521331][ T8849] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 229.550396][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 229.610344][ T8893] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 01:39:41 executing program 1: lstat(0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) getpid() perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000980)='net/ptype\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) 01:39:41 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000280)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r1, 0x0, 0x0) 01:39:41 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x6, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000100)=0x20) write$P9_RWSTAT(r1, &(0x7f00000000c0)={0x7}, 0x7) 01:39:41 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000100)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000000000002560b700fff0ffff04040000000000000a00000006"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000000)={0x10000000000000af, 0x0, [{0x390}]}) [ 229.732691][ T26] audit: type=1804 audit(1554687581.404:32): pid=8882 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir222203305/syzkaller.g4CZ5Z/26/bus" dev="sda1" ino=16657 res=1 01:39:41 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="b7d9288a911993f0265df5cf1cdd8b55", 0x10) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000100)=ANY=[@ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYRES32=0x0]], 0xfffffede) recvmmsg(r1, &(0x7f0000008cc0)=[{{0x0, 0xfffffffffffffe06, &(0x7f0000003a40)=[{&(0x7f00000002c0)=""/4096, 0x10}], 0x1, 0x0, 0x5c}}], 0x1, 0x0, 0x0) 01:39:41 executing program 0: ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000140)={0x0, 0x0, 0x9, {0x0, 0x1c9c380}, 0xffffffff}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$caif_stream(0x25, 0x1, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000280)={0x0, @reserved}) r1 = socket(0x11, 0x802, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='security.ima\x00', 0x0, 0x0, 0x0) [ 229.779002][ T8878] syz-executor.2 (8878) used greatest stack depth: 22520 bytes left [ 229.847707][ T26] audit: type=1804 audit(1554687581.474:33): pid=8908 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir222203305/syzkaller.g4CZ5Z/26/bus" dev="sda1" ino=16657 res=1 01:39:41 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) process_vm_writev(0x0, &(0x7f00000003c0)=[{&(0x7f0000000380)=""/21, 0x15}], 0x1, &(0x7f00000005c0)=[{&(0x7f0000000400)=""/7, 0x7}], 0x1, 0x0) 01:39:41 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$int_out(r0, 0x208140008000451b, 0x0) 01:39:41 executing program 3: socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) write$FUSE_GETXATTR(0xffffffffffffffff, &(0x7f0000000200)={0x18, 0x0, 0x0, {0x3ff}}, 0x18) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000000)={r0, &(0x7f0000000400)}, 0x10) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000003c0)=[@textreal={0x8, &(0x7f0000000240)="ba4300b00bee0f017edaf02114650f1ea7f07f0f20e06635040000000f22e03e0fc72dbaf80c66b80fb2578d66efbafc0cb001ee0fc75ba2f40f3805800060", 0x3f}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000140)={0xfff}) memfd_create(&(0x7f0000000080)='/dev/hwrng\x00', 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 01:39:41 executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000001000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x1000000000c}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0xc1105517, &(0x7f0000001000)) 01:39:41 executing program 0: ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000140)={0x0, 0x0, 0x9, {0x0, 0x1c9c380}, 0xffffffff}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$caif_stream(0x25, 0x1, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000280)={0x0, @reserved}) r1 = socket(0x11, 0x802, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000240)={'team0\x00\xfd\xff\xff\xff\xc0\x00\x03\x00\x02\xff', 0x4bfd}) 01:39:41 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000100)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000000000002560b700fff0ffff04040000000000000a00000006"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000000)={0x10000000000000af, 0x0, [{0x390}]}) 01:39:41 executing program 1: clone(0x200, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mknod(&(0x7f00000000c0)='./file0\x00', 0x103c, 0x0) execve(&(0x7f00000015c0)='./file0\x00', 0x0, 0x0) timer_create(0x0, &(0x7f0000000040)={0x0, 0x12}, &(0x7f0000000200)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) r1 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000280)='/proc/thread-self/attr/current\x00', 0x2, 0x0) write$apparmor_current(r1, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1000000000016) [ 230.191625][ T8944] device team0 entered promiscuous mode 01:39:41 executing program 2: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) socket$packet(0x11, 0x2, 0x300) r3 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x6, 0x2) write$sndseq(r3, &(0x7f0000000100)=[{0x101, 0x80000000, 0x8, 0x8, @time, {0x65, 0xffffffffffffff01}, {0x3ff, 0x1000}, @raw8={"fc3ee0f37ac4c60155d5a1af"}}, {0x800, 0x6, 0xcc, 0xba5, @tick=0x5, {0x1000, 0x4}, {0x7fff, 0x5}, @time=@time={0x77359400}}, {0x8000, 0x4, 0xba, 0x3ff, @time={0x0, 0x1c9c380}, {0x8467, 0xffff}, {0xfffffffffffffff7, 0x1}, @note={0x6, 0x4295, 0x8, 0x1, 0x800}}], 0x90) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000f40), &(0x7f0000000400)=0xffffffffffffffd8) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) syz_open_dev$cec(&(0x7f0000000300)='/dev/cec#\x00', 0x3, 0x2) r4 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0xfffffffffffffffd, 0x0) ioctl$VIDIOC_S_CROP(r4, 0x4014563c, 0x0) socket$inet(0x2, 0xe, 0x0) shmget(0x3, 0x4000, 0x80, &(0x7f0000ffc000/0x4000)=nil) ioctl$sock_FIOSETOWN(r4, 0x8901, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001fff, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) rt_sigtimedwait(&(0x7f0000000040), 0x0, &(0x7f0000000180)={0x0, 0x1c9c380}, 0x8) getpeername$tipc(0xffffffffffffffff, &(0x7f00000001c0)=@id, &(0x7f0000000280)=0x10) r5 = getpid() rt_tgsigqueueinfo(r5, r5, 0x16, &(0x7f0000000100)={0x11, 0x6}) ptrace(0x10, r5) ptrace$pokeuser(0x6, r5, 0x388, 0xfffffffffffffffe) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f0000000340)={0x0, @in6={{0xa, 0x4e20, 0x5ae81890, @mcast2, 0x1}}}, &(0x7f00000002c0)=0x84) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) ioctl$PPPIOCSNPMODE(r0, 0x4008744b, 0x0) r6 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r6, 0x0, 0x2000000000a, 0x0) 01:39:41 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$caif_stream(0x25, 0x1, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket(0x11, 0x802, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) lsetxattr$security_ima(&(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='security.ima\x00', 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000240)={'team0\x00\xfd\xff\xff\xff\xc0\x00\x03\x00\x02\xff', 0x4bfd}) [ 230.237213][ T8944] device team_slave_0 entered promiscuous mode [ 230.274663][ T8944] device team_slave_1 entered promiscuous mode [ 230.329928][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 230.336123][ C1] protocol 88fb is buggy, dev hsr_slave_1 01:39:42 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000100)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000000000002560b700fff0ffff04040000000000000a00000006"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000000)={0x10000000000000af, 0x0, [{0x390}]}) 01:39:42 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) shmctl$SHM_LOCK(0x0, 0xb) keyctl$describe(0x6, 0x0, 0x0, 0x0) [ 230.512795][ T8944] 8021q: adding VLAN 0 to HW filter on device team0 01:39:42 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000040)=0x3) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) read(r0, &(0x7f0000000280)=""/11, 0xfe17) r2 = syz_open_pts(r0, 0x0) dup3(r2, r0, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) 01:39:42 executing program 0: ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(0xffffffffffffffff, 0x402c5342, &(0x7f0000000140)={0x0, 0x0, 0x9, {0x0, 0x1c9c380}, 0xffffffff}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$caif_stream(0x25, 0x1, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000280)={0x0, @reserved}) r1 = socket(0x11, 0x802, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x2000, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'team0\x00\n\x00L\xff\xff\xff\xc3`\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000240)={'team0\x00\xfd\xff\xff\xff\xc0\x00\x03\x00\x02\xff', 0x4bfd}) 01:39:42 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000100)=ANY=[@ANYBLOB="050000000000000000000040050000a90000000000fa0000000000400003000001000000000000002560b700fff0ffff04040000000000000a00000006"]) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000000)={0x10000000000000af, 0x0, [{0x390}]}) [ 230.729893][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 230.735827][ C1] protocol 88fb is buggy, dev hsr_slave_1 01:39:42 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000000)={0x10000000000000af, 0x0, [{0x390}]}) 01:39:42 executing program 2: r0 = socket$rxrpc(0x21, 0x2, 0x2) sendto$rxrpc(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 01:39:43 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0xc008ae88, &(0x7f0000000000)={0x10000000000000af, 0x0, [{0x390}]}) 01:39:43 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)