[   33.834362] audit: type=1800 audit(1547147610.455:27): pid=7450 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0
[   33.861642] audit: type=1800 audit(1547147610.455:28): pid=7450 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[   34.662406] audit: type=1800 audit(1547147611.315:29): pid=7450 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0
[   34.686661] audit: type=1800 audit(1547147611.315:30): pid=7450 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.10.11' (ECDSA) to the list of known hosts.
2019/01/10 19:13:38 fuzzer started
2019/01/10 19:13:41 dialing manager at 10.128.0.26:41043
2019/01/10 19:13:41 syscalls: 1
2019/01/10 19:13:41 code coverage: enabled
2019/01/10 19:13:41 comparison tracing: enabled
2019/01/10 19:13:41 setuid sandbox: enabled
2019/01/10 19:13:41 namespace sandbox: enabled
2019/01/10 19:13:41 Android sandbox: /sys/fs/selinux/policy does not exist
2019/01/10 19:13:41 fault injection: enabled
2019/01/10 19:13:41 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2019/01/10 19:13:41 net packet injection: enabled
2019/01/10 19:13:41 net device setup: enabled
19:15:31 executing program 0:
gettid()
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x140, 0x0)
setsockopt(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
timer_create(0x0, 0x0, 0x0)
shutdown(0xffffffffffffffff, 0x0)
read$eventfd(r0, 0x0, 0x0)

syzkaller login: [  155.202849] IPVS: ftp: loaded support on port[0] = 21
19:15:31 executing program 1:
dup2(0xffffffffffffff9c, 0xffffffffffffff9c)
write$eventfd(0xffffffffffffffff, 0x0, 0x0)
gettid()
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x140, 0x0)
setsockopt(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
timer_create(0x0, 0x0, 0x0)
shutdown(0xffffffffffffffff, 0x0)
read$eventfd(r0, 0x0, 0x366)

[  155.329566] chnl_net:caif_netlink_parms(): no params data found
[  155.393130] bridge0: port 1(bridge_slave_0) entered blocking state
[  155.401490] bridge0: port 1(bridge_slave_0) entered disabled state
[  155.409895] device bridge_slave_0 entered promiscuous mode
[  155.425947] bridge0: port 2(bridge_slave_1) entered blocking state
[  155.432373] bridge0: port 2(bridge_slave_1) entered disabled state
[  155.440072] device bridge_slave_1 entered promiscuous mode
[  155.471653] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  155.483244] IPVS: ftp: loaded support on port[0] = 21
[  155.495582] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  155.522324] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  155.530968] team0: Port device team_slave_0 added
[  155.538283] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  155.546150] team0: Port device team_slave_1 added
19:15:32 executing program 2:

[  155.568264] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  155.578015] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  155.686613] device hsr_slave_0 entered promiscuous mode
[  155.709687] IPVS: ftp: loaded support on port[0] = 21
[  155.724029] device hsr_slave_1 entered promiscuous mode
[  155.757605] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  155.766493] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
19:15:32 executing program 3:

[  155.887129] bridge0: port 2(bridge_slave_1) entered blocking state
[  155.893684] bridge0: port 2(bridge_slave_1) entered forwarding state
[  155.900782] bridge0: port 1(bridge_slave_0) entered blocking state
[  155.907190] bridge0: port 1(bridge_slave_0) entered forwarding state
[  155.920035] chnl_net:caif_netlink_parms(): no params data found
[  156.019658] IPVS: ftp: loaded support on port[0] = 21
[  156.038138] bridge0: port 1(bridge_slave_0) entered blocking state
[  156.047146] bridge0: port 1(bridge_slave_0) entered disabled state
[  156.054916] device bridge_slave_0 entered promiscuous mode
[  156.062668] bridge0: port 2(bridge_slave_1) entered blocking state
[  156.071518] bridge0: port 2(bridge_slave_1) entered disabled state
[  156.079418] device bridge_slave_1 entered promiscuous mode
19:15:32 executing program 4:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000000280)={0x2, 0x3, @broadcast}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fb, &(0x7f00000002c0)={0x2, 0x3, @loopback}, 0x10)
sendto$inet(r0, &(0x7f00000005c0)="1a8c443d3a568c81cc096aa87ddab0f1f182da383fd71795f41053261e63b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81940d8831eb71596cdf17e160c992140c9dc81362f019f017", 0x82, 0x0, 0x0, 0x0)
recvfrom(r0, &(0x7f0000000480)=""/239, 0xfffffddf, 0x0, 0x0, 0x2b)
close(r0)

[  156.140915] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  156.151322] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  156.229683] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready
[  156.255494] 8021q: adding VLAN 0 to HW filter on device bond0
[  156.284331] chnl_net:caif_netlink_parms(): no params data found
[  156.293300] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  156.316391] team0: Port device team_slave_0 added
[  156.333147] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
19:15:33 executing program 5:
r0 = socket(0x10, 0x20000000802, 0x0)
write(r0, &(0x7f0000000040)="240000001a0025f00f18000400edfc0e80fdffffff040000000000000800020000000000", 0x24)

[  156.366624] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  156.378345] team0: Port device team_slave_1 added
[  156.385746] bridge0: port 1(bridge_slave_0) entered disabled state
[  156.392975] bridge0: port 2(bridge_slave_1) entered disabled state
[  156.409317] IPVS: ftp: loaded support on port[0] = 21
[  156.425992] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[  156.451735] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  156.463827] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  156.488765] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  156.510448] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  156.522496] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  156.564236] IPVS: ftp: loaded support on port[0] = 21
[  156.573069] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  156.579883] 8021q: adding VLAN 0 to HW filter on device team0
[  156.607750] bridge0: port 1(bridge_slave_0) entered blocking state
[  156.614854] bridge0: port 1(bridge_slave_0) entered disabled state
[  156.621806] device bridge_slave_0 entered promiscuous mode
[  156.632161] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  156.686411] device hsr_slave_0 entered promiscuous mode
[  156.724703] device hsr_slave_1 entered promiscuous mode
[  156.775992] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  156.783050] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  156.792733] bridge0: port 2(bridge_slave_1) entered blocking state
[  156.799518] bridge0: port 2(bridge_slave_1) entered disabled state
[  156.807334] device bridge_slave_1 entered promiscuous mode
[  156.821831] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  156.829763] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  156.837925] bridge0: port 1(bridge_slave_0) entered blocking state
[  156.844323] bridge0: port 1(bridge_slave_0) entered forwarding state
[  156.852930] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  156.871563] chnl_net:caif_netlink_parms(): no params data found
[  156.896954] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  156.905078] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  156.912618] bridge0: port 2(bridge_slave_1) entered blocking state
[  156.918994] bridge0: port 2(bridge_slave_1) entered forwarding state
[  156.928912] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  156.943721] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  156.962853] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  156.972647] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  156.986336] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  157.007877] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  157.018454] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  157.030529] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  157.057326] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  157.065251] team0: Port device team_slave_0 added
[  157.071130] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  157.078440] team0: Port device team_slave_1 added
[  157.084672] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  157.092462] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  157.100443] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  157.112170] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  157.120729] bridge0: port 1(bridge_slave_0) entered blocking state
[  157.127209] bridge0: port 1(bridge_slave_0) entered disabled state
[  157.135109] device bridge_slave_0 entered promiscuous mode
[  157.142009] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  157.149481] bridge0: port 2(bridge_slave_1) entered blocking state
[  157.155951] bridge0: port 2(bridge_slave_1) entered disabled state
[  157.162857] device bridge_slave_1 entered promiscuous mode
[  157.182170] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  157.190320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  157.198232] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  157.208646] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  157.216007] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  157.226531] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  157.237082] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  157.256163] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  157.263322] team0: Port device team_slave_0 added
[  157.269479] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  157.277457] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  157.285240] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  157.292660] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  157.357557] device hsr_slave_0 entered promiscuous mode
[  157.423712] device hsr_slave_1 entered promiscuous mode
[  157.474188] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  157.481127] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  157.490136] team0: Port device team_slave_1 added
[  157.497304] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  157.503331] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  157.520197] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  157.528502] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  157.585892] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  157.596763] chnl_net:caif_netlink_parms(): no params data found
[  157.676156] device hsr_slave_0 entered promiscuous mode
[  157.714094] device hsr_slave_1 entered promiscuous mode
[  157.774479] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  157.781584] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  157.810444] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  157.822981] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  157.841921] bridge0: port 1(bridge_slave_0) entered blocking state
[  157.849371] bridge0: port 1(bridge_slave_0) entered disabled state
[  157.856970] device bridge_slave_0 entered promiscuous mode
[  157.865462] bridge0: port 2(bridge_slave_1) entered blocking state
[  157.871804] bridge0: port 2(bridge_slave_1) entered disabled state
[  157.879044] device bridge_slave_1 entered promiscuous mode
[  157.891679] 8021q: adding VLAN 0 to HW filter on device batadv0
[  157.902984] chnl_net:caif_netlink_parms(): no params data found
[  157.961394] 8021q: adding VLAN 0 to HW filter on device bond0
[  157.973187] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  157.989117] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  158.008257] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  158.017514] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  158.049586] bridge0: port 1(bridge_slave_0) entered blocking state
19:15:34 executing program 0:
perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x85a, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
lstat(0x0, 0x0)
r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2)
write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES16, @ANYRES64=r0], 0xfed3)
ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f0000000000))

[  158.067565] bridge0: port 1(bridge_slave_0) entered disabled state
[  158.078103] device bridge_slave_0 entered promiscuous mode
[  158.091680] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  158.118381] bridge0: port 2(bridge_slave_1) entered blocking state
[  158.126684] bridge0: port 2(bridge_slave_1) entered disabled state
[  158.138757] device bridge_slave_1 entered promiscuous mode
[  158.149215] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
19:15:34 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000180)="0adc1f023c123f3188a070")
r1 = socket$tipc(0x1e, 0x2, 0x0)
ioctl$SIOCGETLINKNAME(r1, 0x89e0, 0x0)

[  158.162573] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  158.173096] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  158.185938] 8021q: adding VLAN 0 to HW filter on device team0
[  158.204284] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  158.211951] team0: Port device team_slave_0 added
[  158.217835] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  158.225364] team0: Port device team_slave_1 added
[  158.230767] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  158.249969] bond0: Enslaving bond_slave_0 as an active interface with an up link
19:15:34 executing program 0:
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000000))
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58)
r1 = accept4(r0, 0x0, 0x0, 0x0)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ad56b6c50400aeb995298992ea5600c2", 0x10)
ioctl$int_in(r1, 0x5452, &(0x7f0000000100)=0x1)
sendmmsg$unix(r1, &(0x7f0000001300)=[{&(0x7f0000000980)=@file={0x0, './file0/file0\x00'}, 0x6e, &(0x7f0000000dc0), 0x2e1, &(0x7f0000000e40)}], 0x8d9, 0x7ffff000)

[  158.265669] 8021q: adding VLAN 0 to HW filter on device bond0
[  158.272738] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  158.288470] bond0: Enslaving bond_slave_1 as an active interface with an up link
19:15:35 executing program 0:
perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x85a, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2)
write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES16, @ANYRES64=r0], 0xfed3)
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0})
keyctl$join(0x1, 0x0)
ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, 0x0)

[  158.325828] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  158.344128] team0: Port device team_slave_0 added
[  158.350582] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  158.365794] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  158.375647] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  158.394563] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  158.402728] team0: Port device team_slave_1 added
[  158.419106] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
19:15:35 executing program 0:
r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0)
ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f00000001c0)=0x1)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={<r1=>0xffffffffffffffff})
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001000)={{0x100000001}})
ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f000001cfb0)={0x0, 0x1, 0x0, 0x0, 0xf})
ioctl$SNDRV_TIMER_IOCTL_START(r2, 0x54a0)
readv(r0, &(0x7f0000000140)=[{&(0x7f0000000080)=""/117, 0x75}], 0x1)

[  158.432089] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  158.441073] bridge0: port 1(bridge_slave_0) entered blocking state
[  158.447482] bridge0: port 1(bridge_slave_0) entered forwarding state
[  158.463829] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  158.473338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
19:15:35 executing program 0:
syz_execute_func(&(0x7f0000000080)="3666440f50f564ff0941c366440f56c9c4c27d794e0066420fe2e3f347aac442019dccd3196f")
r0 = socket$inet(0x2, 0x1, 0x0)
r1 = dup(r0)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10)
connect$inet(r0, &(0x7f0000000780)={0x2, 0x4e23}, 0x10)
sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f0000000500)={&(0x7f0000000300), 0xc, &(0x7f00000004c0)={0x0}}, 0x24000000)

[  158.488510] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
19:15:35 executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c)
listen(r0, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c)
r2 = accept4(r0, 0x0, 0x0, 0x0)
close(r1)
sendto$inet6(r2, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0)

[  158.538700] device hsr_slave_0 entered promiscuous mode
[  158.563569] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[  158.613852] device hsr_slave_1 entered promiscuous mode
[  158.653932] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  158.660820] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  158.671176] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  158.679032] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  158.691055] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  158.699803] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  158.707773] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  158.715465] bridge0: port 2(bridge_slave_1) entered blocking state
[  158.721799] bridge0: port 2(bridge_slave_1) entered forwarding state
[  158.730944] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  158.750477] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  158.758013] 8021q: adding VLAN 0 to HW filter on device team0
[  158.766118] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  158.825337] device hsr_slave_0 entered promiscuous mode
[  158.863805] device hsr_slave_1 entered promiscuous mode
[  158.904297] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  158.911696] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  158.920644] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  158.933320] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  158.947732] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  158.956872] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  158.965578] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  158.973265] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  158.981433] bridge0: port 1(bridge_slave_0) entered blocking state
[  158.987829] bridge0: port 1(bridge_slave_0) entered forwarding state
[  158.995341] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  159.007392] 8021q: adding VLAN 0 to HW filter on device bond0
[  159.022015] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  159.030997] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  159.039477] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  159.051073] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  159.058282] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  159.066709] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  159.074634] bridge0: port 2(bridge_slave_1) entered blocking state
[  159.080961] bridge0: port 2(bridge_slave_1) entered forwarding state
[  159.088079] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  159.096114] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  159.103721] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  159.111341] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  159.119012] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  159.129627] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  159.141544] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  159.150463] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  159.158637] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  159.167373] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  159.176393] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  159.185662] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  159.196887] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  159.205054] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  159.212793] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  159.223978] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  159.229984] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  159.237545] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  159.245449] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  159.252844] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  159.260435] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  159.267392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  159.275600] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  159.285295] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  159.292964] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  159.307144] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  159.318507] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  159.325625] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  159.333228] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  159.344106] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  159.350189] 8021q: adding VLAN 0 to HW filter on device team0
[  159.364702] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  159.375094] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  159.394609] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  159.402897] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  159.410423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  159.418108] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  159.425785] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  159.433230] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  159.441033] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  159.448921] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  159.456511] bridge0: port 1(bridge_slave_0) entered blocking state
[  159.462831] bridge0: port 1(bridge_slave_0) entered forwarding state
[  159.471667] 8021q: adding VLAN 0 to HW filter on device bond0
[  159.480379] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  159.489624] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  159.496914] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  159.504694] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  159.512193] bridge0: port 2(bridge_slave_1) entered blocking state
[  159.518577] bridge0: port 2(bridge_slave_1) entered forwarding state
[  159.529515] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  159.536005] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  159.548370] 8021q: adding VLAN 0 to HW filter on device batadv0
[  159.557367] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  159.567584] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  159.577775] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  159.587632] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  159.597264] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  159.605275] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  159.612233] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  159.624080] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  159.630164] 8021q: adding VLAN 0 to HW filter on device team0
[  159.640917] 8021q: adding VLAN 0 to HW filter on device batadv0
[  159.651277] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  159.661151] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  159.671238] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  159.679444] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  159.690645] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  159.699996] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
19:15:36 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0af51f023c123f3188a070")
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00'], 0x1}}, 0x0)

[  159.720789] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  159.729932] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  159.745442] bridge0: port 1(bridge_slave_0) entered blocking state
[  159.751802] bridge0: port 1(bridge_slave_0) entered forwarding state
[  159.770205] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  159.791096] 8021q: adding VLAN 0 to HW filter on device bond0
[  159.802053] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  159.811313] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
19:15:36 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f023c123f3188a070")
r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_retries\x00', 0x2, 0x0)
r2 = dup(r1)
r3 = open(&(0x7f0000000140)='./file0\x00', 0x20141042, 0x0)
read(r2, &(0x7f0000000900)=""/4096, 0x1000)
ftruncate(r3, 0x80080)
sendfile(r2, r3, 0x0, 0x200800100000001)

[  159.820036] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  159.830400] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  159.851817] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  159.862543] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  159.870756] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  159.887838] bridge0: port 2(bridge_slave_1) entered blocking state
[  159.894226] bridge0: port 2(bridge_slave_1) entered forwarding state
[  159.912696] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  159.921412] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  159.935121] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  159.960016] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  159.973393] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  159.983380] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  159.991219] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  159.999070] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  160.006751] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  160.016953] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  160.025019] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  160.036392] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  160.046197] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  160.053281] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  160.075900] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  160.081968] 8021q: adding VLAN 0 to HW filter on device team0
[  160.098765] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  160.109210] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  160.117294] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  160.127516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  160.136118] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  160.144448] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  160.162306] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  160.170266] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  160.184133] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  160.191895] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  160.200508] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  160.208796] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  160.216726] bridge0: port 1(bridge_slave_0) entered blocking state
[  160.223048] bridge0: port 1(bridge_slave_0) entered forwarding state
[  160.230331] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  160.242783] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  160.250589] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  160.258335] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  160.268638] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  160.276971] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  160.285116] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  160.291984] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  160.300314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  160.308360] bridge0: port 2(bridge_slave_1) entered blocking state
[  160.314750] bridge0: port 2(bridge_slave_1) entered forwarding state
[  160.321562] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  160.329181] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  160.338719] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  160.347670] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  160.354492] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  160.361458] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  160.373048] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  160.389000] 8021q: adding VLAN 0 to HW filter on device batadv0
[  160.395606] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  160.406378] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  160.420333] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  160.427798] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  160.435965] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  160.444765] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  160.452392] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  160.460191] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  160.470543] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  160.479929] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  160.489643] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  160.497611] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  160.511350] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  160.526516] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
19:15:37 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
getpgrp(0xffffffffffffffff)
syz_open_procfs(0x0, 0x0)
madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, &(0x7f00000019c0)=""/4096, 0x1000}, 0x0)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0)
r2 = openat$cgroup_int(r1, &(0x7f0000000040)='memory.high\x00', 0x2, 0x0)
writev(r2, &(0x7f0000000700), 0x100000000000010b)

[  160.535317] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  160.559600] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  160.580718] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  160.617535] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details.
[  160.622376] 8021q: adding VLAN 0 to HW filter on device batadv0
[  160.649912] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  160.688133] 8021q: adding VLAN 0 to HW filter on device batadv0
19:15:37 executing program 1:
r0 = open(&(0x7f0000000000)='./file1\x00', 0x400043, 0x0)
keyctl$set_reqkey_keyring(0xe, 0x0)
close(r0)
recvfrom$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180))
prctl$PR_SET_MM_AUXV(0x23, 0xc, 0x0, 0xfffffee0)
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000240)=<r1=>0x0)
ptrace$pokeuser(0x6, r1, 0x101, 0x5)
setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f0000000040)={0x0, {{0x2, 0x4e20, @loopback}}}, 0x88)
getpeername$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev}, &(0x7f0000000140)=0x10)

19:15:37 executing program 5:
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x2, 0x88)
ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, 0x0)
ioctl$IOC_PR_REGISTER(0xffffffffffffffff, 0x401870c8, 0x0)
ioctl$BLKRESETZONE(0xffffffffffffffff, 0x40101283, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c)
recvmmsg(r0, &(0x7f0000000200), 0x2ab, 0x0, 0x0)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24}, 0x1c)
ioctl$DRM_IOCTL_GET_CAP(0xffffffffffffffff, 0xc010640c, &(0x7f0000000100)={0x0, 0x6})
sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0)
lsetxattr$security_smack_entry(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000200)='security.SMACK64IPIN\x00', &(0x7f0000000240)='\x00', 0x1, 0x3)
fcntl$getown(0xffffffffffffffff, 0x9)

19:15:37 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000140)={'bridge0\x00\x00\x00\x00\x80\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="07000000000000000090700000000000000046"]})

19:15:37 executing program 2:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb, 0x40, 0xa9, 0xa37, 0x1}, 0x2c)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000002800000850000000000000095"], 0x0}, 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0xc, 0x4, &(0x7f0000000040)=@raw=[@map={0x18, 0x2, 0x1, 0x0, r0}, @call={0x85, 0x0, 0x0, 0x28}], &(0x7f0000000140)='GPL\x00', 0x41, 0xffc4, &(0x7f00000004c0)=""/167}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r1, 0x0, 0xe, 0x0, &(0x7f00000003c0)="d7dbb23bab31f7d84ff4dfb4c7fc", 0x0, 0x3f00}, 0x28)

19:15:37 executing program 4:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
getpgrp(0xffffffffffffffff)
syz_open_procfs(0x0, &(0x7f0000dec000)='smaps\x00')
madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setattr(0x0, &(0x7f00000000c0)={0x30, 0x6, 0x0, 0x0, 0x0, 0x3, 0x1, 0x9}, 0x0)
ioctl$VIDIOC_TRY_ENCODER_CMD(r0, 0xc028564e, &(0x7f0000000000)={0x2, 0x1, [0x7, 0x3, 0x7ff, 0x9, 0x7ff, 0x3, 0x2, 0x100000000]})
recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, &(0x7f00000019c0)=""/4096, 0x1000}, 0x0)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0)
r2 = openat$cgroup_int(r1, &(0x7f0000000040)='memory.high\x00', 0x2, 0x0)
write$P9_RMKDIR(0xffffffffffffffff, 0x0, 0x0)
writev(r2, &(0x7f0000000700), 0x100000000000010b)

19:15:37 executing program 3:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
seccomp(0x1, 0x0, &(0x7f0000007ff0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x50000}]})
syz_execute_func(&(0x7f0000000380)="0faef24029450ff3440f1157f191c4c2f9174c4641642e3e2ef00fb3670054aa400f34dd39470f0f880f0000009a67640f71f6452b61fdc441e5671b0f38f6a3df00000040008fcd78a30000d45ec31e0ff7c6")

19:15:37 executing program 0:
r0 = socket$inet6(0xa, 0x80002, 0x0)
connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast1, 0x4}, 0x1c)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
connect(0xffffffffffffffff, 0x0, 0x0)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0)
fchdir(r1)
mkdir(&(0x7f0000000140)='./file0\x00', 0x102)
syz_open_dev$binder(0x0, 0x0, 0x802)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0)
r2 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$midi(&(0x7f0000000500)='/dev/midi#\x00', 0x0, 0x200000)
r4 = syz_open_dev$vcsn(0x0, 0x0, 0x20000)
ioctl$EVIOCGKEYCODE(r3, 0x80084504, &(0x7f0000000180)=""/7)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='vmnet1security@systemem1:\x00', r4}, 0x10)
getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000080), &(0x7f0000000480)=0x4)
getuid()
rmdir(&(0x7f0000001540)='./file0/file0\x00')
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, r2, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r6 = syz_open_dev$dspn(&(0x7f0000000380)='/dev/dsp#\x00', 0xffffffffffff9223, 0x98003)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
ppoll(&(0x7f00000001c0)=[{r5}], 0x2000000000000127, &(0x7f0000000240)={0x77359400}, &(0x7f0000001340), 0x8)
umount2(&(0x7f0000000340)='./file0\x00', 0x0)
r7 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0)
r8 = openat$cgroup_procs(r7, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0)
rmdir(&(0x7f0000000400)='./file0\x00')
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000004c0)={<r9=>0x0, r6, 0x0, 0x1a, &(0x7f0000000280)='vmnet1security@systemem1:\x00'}, 0x30)
write$cgroup_pid(r8, &(0x7f00000000c0)=r9, 0xffffff57)

19:15:37 executing program 2:
lsetxattr$security_selinux(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)='system_u:object_r:fonts_cache_t:s0\x00', 0x23, 0x1)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, 0x0)
pipe(0x0)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, 0x0)
ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000400))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000040)='status\x00')
recvmmsg(0xffffffffffffffff, &(0x7f0000002480)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000b80)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x80, 0x0, 0x0, &(0x7f0000000d40)=""/107, 0x6b}, 0x1000}], 0x2, 0x0, 0x0)
preadv(r0, &(0x7f00000017c0), 0x1a1, 0x0)
fcntl$getownex(r0, 0x10, &(0x7f0000000140))
getresuid(0x0, &(0x7f00000001c0), 0x0)
fstat(0xffffffffffffffff, 0x0)
setsockopt$sock_cred(r0, 0x1, 0x11, 0x0, 0x0)

19:15:37 executing program 1:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x2, 0x0)
sendmmsg(r0, &(0x7f0000000080)=[{{&(0x7f0000000140)=@in6={0xa, 0x4e22, 0x0, @mcast2}, 0x80, 0x0}}], 0x1, 0x0)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$EVIOCGKEYCODE(0xffffffffffffffff, 0x80084504, 0x0)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[])
write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0)

[  161.127780] hrtimer: interrupt took 27753 ns
19:15:37 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000dec000)='smaps\x00')
madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sched_setattr(0x0, &(0x7f00000000c0)={0x30, 0x6, 0x1, 0x3, 0x6, 0x3, 0x1, 0x9}, 0x0)
ioctl$VIDIOC_TRY_ENCODER_CMD(r0, 0xc028564e, &(0x7f0000000000)={0x2, 0x1, [0x7, 0x3, 0x7ff, 0x9, 0x7ff, 0x3, 0x2, 0x100000000]})
recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, &(0x7f00000019c0)=""/4096, 0x1000}, 0x0)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0)
r3 = openat$cgroup_int(r2, &(0x7f0000000040)='memory.high\x00', 0x2, 0x0)
write$P9_RMKDIR(r1, &(0x7f0000000140)={0x14, 0x49, 0x2, {0x10, 0x0, 0x5}}, 0x14)
writev(r3, &(0x7f0000000700), 0x100000000000010b)

[  161.313277] syz-executor4 (7719) used greatest stack depth: 18312 bytes left
19:15:38 executing program 4:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
getsockopt$IP_VS_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x481, 0x0, 0x0)
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0)
write$P9_RWRITE(0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0)
pipe2$9p(0x0, 0x0)
dup3(r0, r1, 0x0)
r2 = getpgrp(0xffffffffffffffff)
ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r2, 0x0, &(0x7f0000000280)=""/218)
write$P9_RCLUNK(0xffffffffffffffff, 0x0, 0x0)
fstat(0xffffffffffffffff, 0x0)
timer_settime(0x0, 0x0, 0x0, 0x0)
openat$random(0xffffffffffffff9c, 0x0, 0x2, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, 0x0, 0x0)
ioctl$TIOCLINUX5(0xffffffffffffffff, 0x541c, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0)
setsockopt$inet6_MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f0000000100)={{0xa, 0x0, 0x0, @mcast1}, {0xa, 0x0, 0x0, @remote}, 0x1ff, [0x0, 0x0, 0xfff, 0x0, 0x0, 0x5]}, 0x5c)

19:15:38 executing program 0:
r0 = socket$inet6(0xa, 0x80002, 0x0)
connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast1, 0x4}, 0x1c)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
connect(0xffffffffffffffff, 0x0, 0x0)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0)
fchdir(r1)
mkdir(&(0x7f0000000140)='./file0\x00', 0x102)
syz_open_dev$binder(0x0, 0x0, 0x802)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0)
r2 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$midi(&(0x7f0000000500)='/dev/midi#\x00', 0x0, 0x200000)
r4 = syz_open_dev$vcsn(0x0, 0x0, 0x20000)
ioctl$EVIOCGKEYCODE(r3, 0x80084504, &(0x7f0000000180)=""/7)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='vmnet1security@systemem1:\x00', r4}, 0x10)
getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000080), &(0x7f0000000480)=0x4)
getuid()
rmdir(&(0x7f0000001540)='./file0/file0\x00')
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, r2, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r6 = syz_open_dev$dspn(&(0x7f0000000380)='/dev/dsp#\x00', 0xffffffffffff9223, 0x98003)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
ppoll(&(0x7f00000001c0)=[{r5}], 0x2000000000000127, &(0x7f0000000240)={0x77359400}, &(0x7f0000001340), 0x8)
umount2(&(0x7f0000000340)='./file0\x00', 0x0)
r7 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0)
r8 = openat$cgroup_procs(r7, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0)
rmdir(&(0x7f0000000400)='./file0\x00')
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000004c0)={<r9=>0x0, r6, 0x0, 0x1a, &(0x7f0000000280)='vmnet1security@systemem1:\x00'}, 0x30)
write$cgroup_pid(r8, &(0x7f00000000c0)=r9, 0xffffff57)

19:15:38 executing program 4:
r0 = socket$inet6(0xa, 0x80002, 0x0)
connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast1, 0x4}, 0x1c)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
connect(0xffffffffffffffff, 0x0, 0x0)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0)
fchdir(r1)
mkdir(&(0x7f0000000140)='./file0\x00', 0x102)
syz_open_dev$binder(0x0, 0x0, 0x802)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, 0x0)
r2 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$midi(&(0x7f0000000500)='/dev/midi#\x00', 0x0, 0x200000)
r4 = syz_open_dev$vcsn(0x0, 0x0, 0x20000)
ioctl$EVIOCGKEYCODE(r3, 0x80084504, &(0x7f0000000180)=""/7)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='vmnet1security@systemem1:\x00', r4}, 0x10)
getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000080), &(0x7f0000000480)=0x4)
getuid()
rmdir(&(0x7f0000001540)='./file0/file0\x00')
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, r2, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r6 = syz_open_dev$dspn(&(0x7f0000000380)='/dev/dsp#\x00', 0xffffffffffff9223, 0x98003)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
ppoll(&(0x7f00000001c0)=[{r5}], 0x2000000000000127, &(0x7f0000000240)={0x77359400}, &(0x7f0000001340), 0x8)
umount2(&(0x7f0000000340)='./file0\x00', 0x0)
r7 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0)
r8 = openat$cgroup_procs(r7, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0)
rmdir(&(0x7f0000000400)='./file0\x00')
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000004c0)={<r9=>0x0, r6, 0x0, 0x1a, &(0x7f0000000280)='vmnet1security@systemem1:\x00'}, 0x30)
write$cgroup_pid(r8, &(0x7f00000000c0)=r9, 0xffffff57)

[  161.953500] BUG: unable to handle kernel paging request at fffffbffffffffff
[  161.960638] #PF error: [PROT] [WRITE]
[  161.962750] PANIC: double fault, error_code: 0x0
[  161.964430] PGD 21ffee067 P4D 21ffee067 PUD 21ffed067 PMD a985067 PTE 800000000a988161
[  161.969222] PANIC: double fault, error_code: 0x0
[  161.977208] Oops: 0003 [#1] PREEMPT SMP KASAN
[  161.981940] PANIC: double fault, error_code: 0x0
[  161.986411] CPU: 1 PID: 7629 Comm: syz-executor5 Not tainted 5.0.0-rc1+ #18
[  161.991135] PANIC: double fault, error_code: 0x0
[  161.998228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  162.002970] PANIC: double fault, error_code: 0x0
[  162.012310] RIP: 0010:memset_erms+0x9/0x10
[  162.017029] PANIC: double fault, error_code: 0x0
[  162.021241] Code: c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 <f3> aa 4c 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01
[  162.025967] PANIC: double fault, error_code: 0x0
[  162.044876] RSP: 0018:ffff8880ae707138 EFLAGS: 00010287
[  162.049606] PANIC: double fault, error_code: 0x0
[  162.054943] RAX: 0000000000000000 RBX: dffffc00000000ff RCX: e000000000000100
[  162.059674] PANIC: double fault, error_code: 0x0
[  162.066936] RDX: e000000000000100 RSI: 0000000000000000 RDI: fffffbffffffffff
[  162.071663] PANIC: double fault, error_code: 0x0
[  162.078918] RBP: ffff8880ae707150 R08: 0000000000000002 R09: fffffbffffffffff
[  162.083694] PANIC: double fault, error_code: 0x0
[  162.090898] R10: ffff888062aea400 R11: 0000000000000000 R12: 0000000000000800
[  162.095645] PANIC: double fault, error_code: 0x0
[  162.102990] R13: ffffffffffffffff R14: 00000000000007fe R15: ffff88812c3f0c40
[  162.107830] PANIC: double fault, error_code: 0x0
[  162.115077] FS:  0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000
[  162.119801] PANIC: double fault, error_code: 0x0
[  162.127998] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
[  162.132724] PANIC: double fault, error_code: 0x0
[  162.138579] CR2: fffffbffffffffff CR3: 0000000062aac000 CR4: 00000000001406e0
[  162.143309] PANIC: double fault, error_code: 0x0
[  162.150553] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  162.155283] PANIC: double fault, error_code: 0x0
[  162.162529] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  162.167255] PANIC: double fault, error_code: 0x0
[  162.174493] Call Trace:
[  162.179227] PANIC: double fault, error_code: 0x0
[  162.181782]  <IRQ>
[  162.186515] PANIC: double fault, error_code: 0x0
[  162.188650]  ? kasan_unpoison_shadow+0x35/0x50
[  162.193381] PANIC: double fault, error_code: 0x0
[  162.198049]  __kasan_kmalloc.constprop.0+0x4c/0xe0
[  162.202772] PANIC: double fault, error_code: 0x0
[  162.207682]  kasan_slab_alloc+0xf/0x20
[  162.212417] PANIC: double fault, error_code: 0x0
[  162.216285]  kmem_cache_alloc_node_trace+0x13c/0x720
[  162.221037] PANIC: double fault, error_code: 0x0
[  162.226118]  __kmalloc_node_track_caller+0x3d/0x70
[  162.230884] PANIC: double fault, error_code: 0x0
[  162.235750]  __kmalloc_reserve.isra.0+0x40/0xe0
[  162.240575] PANIC: double fault, error_code: 0x0
[  162.245220]  __alloc_skb+0x12d/0x730
[  162.249946] PANIC: double fault, error_code: 0x0
[  162.253635]  ? __lock_acquire+0x572/0x4a30
[  162.258361] PANIC: double fault, error_code: 0x0
[  162.262575]  ? skb_scrub_packet+0x440/0x440
[  162.267300] PANIC: double fault, error_code: 0x0
[  162.271597]  ? add_lock_to_list.isra.0+0x450/0x450
[  162.276328] PANIC: double fault, error_code: 0x0
[  162.281237]  ? mark_held_locks+0x100/0x100
[  162.285963] PANIC: double fault, error_code: 0x0
[  162.290174]  alloc_skb_with_frags+0x13a/0x770
[  162.290187]  ? print_usage_bug+0xd0/0xd0
[  162.294922] PANIC: double fault, error_code: 0x0
[  162.299394]  ? skb_complete_wifi_ack+0x1b0/0x1b0
[  162.303423] PANIC: double fault, error_code: 0x0
[  162.308160]  sock_alloc_send_pskb+0x8c9/0xad0
[  162.312885] PANIC: double fault, error_code: 0x0
[  162.317621]  ? do_raw_spin_trylock+0x270/0x270
[  162.322086] PANIC: double fault, error_code: 0x0
[  162.326827]  ? find_held_lock+0x35/0x120
[  162.331494] PANIC: double fault, error_code: 0x0
[  162.336228]  ? debug_object_activate+0x2b0/0x550
[  162.340259] PANIC: double fault, error_code: 0x0
[  162.344990]  ? sock_wmalloc+0x1f0/0x1f0
[  162.349714] PANIC: double fault, error_code: 0x0
[  162.354447]  ? __lock_acquire+0x572/0x4a30
[  162.358434] PANIC: double fault, error_code: 0x0
[  162.363127]  ? print_usage_bug+0xd0/0xd0
[  162.367345] PANIC: double fault, error_code: 0x0
[  162.372069]  ? add_timer+0x615/0x1470
[  162.376100] PANIC: double fault, error_code: 0x0
[  162.380837]  sock_alloc_send_skb+0x32/0x40
[  162.384607] PANIC: double fault, error_code: 0x0
[  162.389339]  mld_newpack+0x215/0x870
[  162.393542] PANIC: double fault, error_code: 0x0