[ 43.201021][ T26] audit: type=1800 audit(1576147729.608:21): pid=7463 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="bootlogs" dev="sda1" ino=2452 res=0 [ 43.252271][ T26] audit: type=1800 audit(1576147729.618:22): pid=7463 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="motd" dev="sda1" ino=2480 res=0 [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 44.537225][ T7537] sshd (7537) used greatest stack depth: 10128 bytes left [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.199' (ECDSA) to the list of known hosts. 2019/12/12 10:49:00 fuzzer started 2019/12/12 10:49:02 dialing manager at 10.128.0.105:39821 2019/12/12 10:49:02 syscalls: 2689 2019/12/12 10:49:02 code coverage: enabled 2019/12/12 10:49:02 comparison tracing: enabled 2019/12/12 10:49:02 extra coverage: extra coverage is not supported by the kernel 2019/12/12 10:49:02 setuid sandbox: enabled 2019/12/12 10:49:02 namespace sandbox: enabled 2019/12/12 10:49:02 Android sandbox: /sys/fs/selinux/policy does not exist 2019/12/12 10:49:02 fault injection: enabled 2019/12/12 10:49:02 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/12/12 10:49:02 net packet injection: enabled 2019/12/12 10:49:02 net device setup: enabled 2019/12/12 10:49:02 concurrency sanitizer: enabled 2019/12/12 10:49:02 devlink PCI setup: PCI device 0000:00:10.0 is not available syzkaller login: [ 64.538784][ T7631] KCSAN: could not find function: 'poll_schedule_timeout' 2019/12/12 10:49:12 adding functions to KCSAN blacklist: '__hrtimer_run_queues' 'add_timer' 'run_timer_softirq' 'echo_char' 'pcpu_alloc' 'futex_wait_queue_me' 'mod_timer' '__snd_rawmidi_transmit_ack' 'copy_process' 'virtqueue_enable_cb_delayed' 'ext4_free_inodes_count' 'page_counter_try_charge' 'do_nanosleep' 'kauditd_thread' 'do_syslog' 'ext4_mark_iloc_dirty' 'timer_clear_idle' 'mem_cgroup_select_victim_node' '__splice_from_pipe' 'tick_sched_do_timer' 'dd_has_work' 'commit_echoes' 'sixpack_receive_buf' 'wbt_issue' 'tcp_add_backlog' 'tick_do_update_jiffies64' 'process_srcu' 'generic_write_end' 'tick_nohz_idle_stop_tick' 'find_get_pages_range_tag' '__remove_hrtimer' 'ext4_itable_unused_count' 'lruvec_lru_size' 'generic_permission' 'dput' 'vm_area_dup' 'pipe_wait' 'filemap_fault' 'generic_fillattr' 'd_instantiate_new' 'xas_clear_mark' 'blk_mq_get_request' 'audit_log_start' 'do_signal_stop' 'sit_tunnel_xmit' 'kcm_rcv_strparser' 'pipe_poll' 'taskstats_exit' 'do_exit' 'find_alive_thread' 'blk_mq_sched_dispatch_requests' 'file_update_time' 'ext4_free_inode' 'tomoyo_supervisor' '__ext4_new_inode' 'wbt_done' '__mark_inode_dirty' 'find_next_bit' 'pid_update_inode' 'ext4_has_free_clusters' 'poll_schedule_timeout' 'xas_find_marked' 'ep_poll' 'rcu_gp_fqs_check_wake' 'n_tty_receive_buf_common' 'ext4_nonda_switch' 'blk_mq_dispatch_rq_list' 'ktime_get_real_seconds' '__filemap_fdatawrite_range' 'do_fcntl' 'list_lru_count_one' 'rcu_gp_fqs_loop' 10:51:18 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x60000008, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='\x00\xc3\t\xbb\x0f\xac\x03,') getdents64(r0, &(0x7f0000000df0)=""/528, 0xfe06) r1 = gettid() tkill(r1, 0x3f) 10:51:19 executing program 1: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2a939, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r1, 0x0) mount(0x0, &(0x7f0000001600)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) syz_open_dev$mice(0x0, 0x0, 0x0) r2 = socket$caif_stream(0x25, 0x1, 0x3) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f00000004c0)=0x80, 0x4) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000000080), 0x4) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f00000002c0)=0x14) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f00000001c0)=0x400, 0x4) bind$xdp(r3, &(0x7f0000000900)={0x2c, 0x2}, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'ip6tnl0\x00'}) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x420000, 0x0) ioctl$TIOCGISO7816(0xffffffffffffffff, 0x80285442, 0x0) open(0x0, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000300), 0x12) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x4400, 0x0) r5 = socket(0x10, 0x1, 0x6) accept$unix(r5, &(0x7f00000016c0), 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)) socket$packet(0x11, 0x2, 0x300) [ 192.748333][ T7635] IPVS: ftp: loaded support on port[0] = 21 [ 192.862830][ T7635] chnl_net:caif_netlink_parms(): no params data found [ 192.901987][ T7635] bridge0: port 1(bridge_slave_0) entered blocking state [ 192.932275][ T7635] bridge0: port 1(bridge_slave_0) entered disabled state [ 192.940171][ T7635] device bridge_slave_0 entered promiscuous mode [ 192.975532][ T7635] bridge0: port 2(bridge_slave_1) entered blocking state [ 192.983096][ T7635] bridge0: port 2(bridge_slave_1) entered disabled state [ 192.990938][ T7635] device bridge_slave_1 entered promiscuous mode [ 193.008093][ T7635] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link 10:51:19 executing program 2: bpf$MAP_CREATE(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129cde3}], 0x6e, &(0x7f00000001c0)=""/17, 0x10036, 0x7301}, 0x3f00) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) [ 193.018786][ T7635] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 193.038013][ T7635] team0: Port device team_slave_0 added [ 193.041474][ T7639] IPVS: ftp: loaded support on port[0] = 21 [ 193.044749][ T7635] team0: Port device team_slave_1 added [ 193.124698][ T7635] device hsr_slave_0 entered promiscuous mode [ 193.193210][ T7635] device hsr_slave_1 entered promiscuous mode [ 193.274863][ T7641] IPVS: ftp: loaded support on port[0] = 21 [ 193.372588][ T7635] bridge0: port 2(bridge_slave_1) entered blocking state [ 193.379654][ T7635] bridge0: port 2(bridge_slave_1) entered forwarding state [ 193.386984][ T7635] bridge0: port 1(bridge_slave_0) entered blocking state [ 193.394142][ T7635] bridge0: port 1(bridge_slave_0) entered forwarding state 10:51:19 executing program 3: pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) [ 193.515637][ T7639] chnl_net:caif_netlink_parms(): no params data found [ 193.773148][ T7635] 8021q: adding VLAN 0 to HW filter on device bond0 [ 193.780400][ T7641] chnl_net:caif_netlink_parms(): no params data found [ 193.794229][ T7639] bridge0: port 1(bridge_slave_0) entered blocking state [ 193.801380][ T7639] bridge0: port 1(bridge_slave_0) entered disabled state [ 193.844071][ T7639] device bridge_slave_0 entered promiscuous mode [ 193.896545][ T17] bridge0: port 1(bridge_slave_0) entered disabled state [ 193.932762][ T17] bridge0: port 2(bridge_slave_1) entered disabled state [ 193.952715][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 193.999261][ T7639] bridge0: port 2(bridge_slave_1) entered blocking state [ 194.012337][ T7639] bridge0: port 2(bridge_slave_1) entered disabled state [ 194.020321][ T7639] device bridge_slave_1 entered promiscuous mode [ 194.083860][ T7635] 8021q: adding VLAN 0 to HW filter on device team0 [ 194.086648][ T7669] IPVS: ftp: loaded support on port[0] = 21 [ 194.126630][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 194.142737][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 194.152410][ T7639] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 194.162027][ T7641] bridge0: port 1(bridge_slave_0) entered blocking state [ 194.182339][ T7641] bridge0: port 1(bridge_slave_0) entered disabled state [ 194.213578][ T7641] device bridge_slave_0 entered promiscuous mode [ 194.248300][ T7639] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 194.288071][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 194.302699][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 194.311058][ T2615] bridge0: port 1(bridge_slave_0) entered blocking state [ 194.318157][ T2615] bridge0: port 1(bridge_slave_0) entered forwarding state [ 194.373168][ T7641] bridge0: port 2(bridge_slave_1) entered blocking state [ 194.380255][ T7641] bridge0: port 2(bridge_slave_1) entered disabled state [ 194.422991][ T7641] device bridge_slave_1 entered promiscuous mode 10:51:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x10032, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000480)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000300)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0xf, &(0x7f0000013ff4)=@assoc_value, &(0x7f0000002000)=0xff0a) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = dup2(r0, r2) dup3(r5, r1, 0x0) [ 194.493058][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 194.501917][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 194.542494][ T7668] bridge0: port 2(bridge_slave_1) entered blocking state [ 194.549740][ T7668] bridge0: port 2(bridge_slave_1) entered forwarding state [ 194.599068][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 194.633181][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 194.664532][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 194.696037][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 194.724757][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 194.763217][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 194.785647][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 194.809839][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 194.833941][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 194.856187][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 194.888879][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 194.905214][ T7641] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 194.920220][ T7639] team0: Port device team_slave_0 added [ 194.928764][ T7639] team0: Port device team_slave_1 added [ 194.939248][ T7641] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 10:51:21 executing program 5: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)={0x20, 0x16, 0x821, 0x0, 0x0, {0xa}, [@nested={0xc, 0x0, [@typed={0x8, 0xa, @ipv4=@multicast1}]}]}, 0x20}}, 0x0) [ 195.024324][ T7639] device hsr_slave_0 entered promiscuous mode [ 195.112597][ T7639] device hsr_slave_1 entered promiscuous mode [ 195.182415][ T7639] debugfs: Directory 'hsr0' with parent '/' already present! [ 195.209517][ T7680] IPVS: ftp: loaded support on port[0] = 21 [ 195.210031][ T7684] IPVS: ftp: loaded support on port[0] = 21 [ 195.297299][ T7641] team0: Port device team_slave_0 added [ 195.331209][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 195.344967][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 195.396863][ T7635] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 195.416074][ T7641] team0: Port device team_slave_1 added [ 195.476988][ T7669] chnl_net:caif_netlink_parms(): no params data found [ 195.672323][ T7669] bridge0: port 1(bridge_slave_0) entered blocking state [ 195.679612][ T7669] bridge0: port 1(bridge_slave_0) entered disabled state [ 195.693202][ T7669] device bridge_slave_0 entered promiscuous mode [ 195.764774][ T7641] device hsr_slave_0 entered promiscuous mode [ 195.792541][ T7641] device hsr_slave_1 entered promiscuous mode [ 195.832342][ T7641] debugfs: Directory 'hsr0' with parent '/' already present! [ 195.852486][ T7669] bridge0: port 2(bridge_slave_1) entered blocking state [ 195.859605][ T7669] bridge0: port 2(bridge_slave_1) entered disabled state [ 195.883925][ T7669] device bridge_slave_1 entered promiscuous mode [ 195.914021][ T7680] chnl_net:caif_netlink_parms(): no params data found [ 196.098737][ T7680] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.152352][ T7680] bridge0: port 1(bridge_slave_0) entered disabled state [ 196.187014][ T7680] device bridge_slave_0 entered promiscuous mode [ 196.223792][ C1] hrtimer: interrupt took 24821 ns [ 196.237304][ T7669] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 196.275905][ T7680] bridge0: port 2(bridge_slave_1) entered blocking state [ 196.296413][ T7680] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.352394][ T7680] device bridge_slave_1 entered promiscuous mode [ 196.398555][ T7684] chnl_net:caif_netlink_parms(): no params data found [ 196.439360][ T7669] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 196.566759][ T7680] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 196.654665][ T7639] 8021q: adding VLAN 0 to HW filter on device bond0 [ 196.700238][ T7680] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 10:51:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x60000008, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='\x00\xc3\t\xbb\x0f\xac\x03,') getdents64(r0, &(0x7f0000000df0)=""/528, 0xfe06) r1 = gettid() tkill(r1, 0x3f) [ 196.757754][ T7669] team0: Port device team_slave_0 added [ 196.835012][ T7684] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.842085][ T7684] bridge0: port 1(bridge_slave_0) entered disabled state [ 196.896084][ T7684] device bridge_slave_0 entered promiscuous mode [ 196.945946][ T7639] 8021q: adding VLAN 0 to HW filter on device team0 [ 196.993497][ T7669] team0: Port device team_slave_1 added 10:51:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x60000008, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='\x00\xc3\t\xbb\x0f\xac\x03,') getdents64(r0, &(0x7f0000000df0)=""/528, 0xfe06) r1 = gettid() tkill(r1, 0x3f) [ 197.055003][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 197.076407][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 197.180844][ T7684] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.191173][ T7684] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.226150][ T7684] device bridge_slave_1 entered promiscuous mode [ 197.272377][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 197.280976][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 197.370651][ T7638] bridge0: port 1(bridge_slave_0) entered blocking state [ 197.379758][ T7638] bridge0: port 1(bridge_slave_0) entered forwarding state [ 197.482757][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 197.491699][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 197.572480][ T7638] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.579567][ T7638] bridge0: port 2(bridge_slave_1) entered forwarding state [ 197.642897][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 197.689585][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 197.723397][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 197.752769][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 197.761524][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 197.792856][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 197.802322][ T7680] team0: Port device team_slave_0 added 10:51:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x60000008, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='\x00\xc3\t\xbb\x0f\xac\x03,') getdents64(r0, &(0x7f0000000df0)=""/528, 0xfe06) r1 = gettid() tkill(r1, 0x3f) [ 197.825759][ T7639] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 197.837032][ T7639] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 197.924399][ T7669] device hsr_slave_0 entered promiscuous mode 10:51:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x60000008, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='\x00\xc3\t\xbb\x0f\xac\x03,') getdents64(r0, &(0x7f0000000df0)=""/528, 0xfe06) r1 = gettid() tkill(r1, 0x3f) [ 197.995746][ T7669] device hsr_slave_1 entered promiscuous mode [ 198.022295][ T7669] debugfs: Directory 'hsr0' with parent '/' already present! [ 198.048949][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 198.075557][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 198.123247][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 198.152167][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 198.168381][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 198.190573][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 198.211969][ T7680] team0: Port device team_slave_1 added 10:51:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x60000008, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='\x00\xc3\t\xbb\x0f\xac\x03,') getdents64(r0, &(0x7f0000000df0)=""/528, 0xfe06) r1 = gettid() tkill(r1, 0x3f) [ 198.226089][ T7641] 8021q: adding VLAN 0 to HW filter on device bond0 [ 198.294317][ T7684] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 198.366380][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 198.378670][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 198.435864][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 10:51:24 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x60000008, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='\x00\xc3\t\xbb\x0f\xac\x03,') getdents64(r0, &(0x7f0000000df0)=""/528, 0xfe06) r1 = gettid() tkill(r1, 0x3f) [ 198.478987][ T7639] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 198.500490][ T7641] 8021q: adding VLAN 0 to HW filter on device team0 [ 198.539195][ T7684] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 198.583439][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 198.605737][ T7638] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 198.684297][ T7680] device hsr_slave_0 entered promiscuous mode [ 198.712696][ T7680] device hsr_slave_1 entered promiscuous mode [ 198.772789][ T7680] debugfs: Directory 'hsr0' with parent '/' already present! [ 198.803451][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 198.829314][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 198.860267][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 198.867366][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 198.892925][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 198.921946][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 198.936869][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 198.944608][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 198.975585][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 198.996455][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 199.016843][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 199.042916][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 199.076103][ T7641] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 199.117018][ T7641] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 199.148688][ T7684] team0: Port device team_slave_0 added [ 199.169642][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 199.186634][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 199.213323][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 199.246479][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 199.273304][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 199.319686][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 199.341692][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 199.364680][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 199.400041][ T7641] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 199.428913][ T7684] team0: Port device team_slave_1 added 10:51:25 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000011000)={0x1, 0x8, 0x6d, 0x8000000000000002, 0x0, 0x0}, 0x3c) r0 = bpf$MAP_CREATE(0x2, &(0x7f0000000000)={0x3, 0x0, 0x77fffb, 0x0, 0x820005, 0x0}, 0x2c) r1 = bpf$MAP_CREATE(0x2, &(0x7f0000000000)={0x3, 0x0, 0x77fffb, 0x0, 0x820005, 0x0}, 0x2c) syz_emit_ethernet(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x2, &(0x7f0000000040)={0x3, 0x0, 0x403618, 0x0, 0x20820000, r1}, 0x2c) bpf$MAP_CREATE(0x2, &(0x7f0000000040)={0x3, 0x0, 0x403618, 0x0, 0x20820000, r0}, 0x2c) [ 199.453743][ T7670] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 199.462111][ T7670] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 199.516270][ T7670] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 199.716351][ T7669] 8021q: adding VLAN 0 to HW filter on device bond0 [ 199.848609][ T7684] device hsr_slave_0 entered promiscuous mode [ 199.922613][ T7684] device hsr_slave_1 entered promiscuous mode [ 199.952823][ T7684] debugfs: Directory 'hsr0' with parent '/' already present! [ 199.975566][ T7669] 8021q: adding VLAN 0 to HW filter on device team0 [ 200.102801][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 200.110633][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 200.195968][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 200.222915][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 200.311991][ T2615] bridge0: port 1(bridge_slave_0) entered blocking state [ 200.319391][ T2615] bridge0: port 1(bridge_slave_0) entered forwarding state [ 200.422005][ T7680] 8021q: adding VLAN 0 to HW filter on device bond0 [ 200.480858][ T7672] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 200.504064][ T7672] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 200.560221][ T7672] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 200.612280][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 200.620562][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 200.621506][ T7672] bridge0: port 2(bridge_slave_1) entered blocking state [ 200.633897][ T7672] bridge0: port 2(bridge_slave_1) entered forwarding state [ 200.767009][ T7672] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 200.851420][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 200.942370][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 200.950944][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 201.106406][ T7680] 8021q: adding VLAN 0 to HW filter on device team0 [ 201.179235][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 201.215970][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 201.261184][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 201.327930][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 201.396166][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 201.504442][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 201.571502][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 201.639810][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 201.698347][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 201.754481][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready 10:51:28 executing program 1: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2a939, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r1, 0x0) mount(0x0, &(0x7f0000001600)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) syz_open_dev$mice(0x0, 0x0, 0x0) r2 = socket$caif_stream(0x25, 0x1, 0x3) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f00000004c0)=0x80, 0x4) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000000080), 0x4) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f00000002c0)=0x14) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f00000001c0)=0x400, 0x4) bind$xdp(r3, &(0x7f0000000900)={0x2c, 0x2}, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'ip6tnl0\x00'}) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x420000, 0x0) ioctl$TIOCGISO7816(0xffffffffffffffff, 0x80285442, 0x0) open(0x0, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000300), 0x12) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x4400, 0x0) r5 = socket(0x10, 0x1, 0x6) accept$unix(r5, &(0x7f00000016c0), 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)) socket$packet(0x11, 0x2, 0x300) [ 201.822775][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready 10:51:28 executing program 2: bpf$MAP_CREATE(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129cde3}], 0x6e, &(0x7f00000001c0)=""/17, 0x10036, 0x7301}, 0x3f00) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) [ 201.895047][ T2615] bridge0: port 1(bridge_slave_0) entered blocking state [ 201.902144][ T2615] bridge0: port 1(bridge_slave_0) entered forwarding state [ 202.000252][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 202.046163][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 202.097508][ T2615] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.104611][ T2615] bridge0: port 2(bridge_slave_1) entered forwarding state [ 202.190353][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 202.274780][ T7669] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 202.353860][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 202.361922][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 202.402258][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 202.410680][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 202.443431][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 202.451945][ T2615] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 202.509518][ T7669] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 202.522390][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 202.528204][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 202.566923][ T7684] 8021q: adding VLAN 0 to HW filter on device bond0 [ 202.592851][ T7672] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 202.606755][ T7672] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 202.629721][ T7672] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 202.643299][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 202.649073][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 202.682048][ T7672] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 202.692243][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 202.698036][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 202.719257][ T7672] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 202.770851][ T7684] 8021q: adding VLAN 0 to HW filter on device team0 [ 202.831145][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 202.855135][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 202.879209][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 202.928370][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 202.953004][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 202.972720][ T7668] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 203.016581][ T7680] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 203.062302][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 203.071108][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 203.102651][ T7805] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.109720][ T7805] bridge0: port 1(bridge_slave_0) entered forwarding state [ 203.132851][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 203.141656][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 203.176051][ T7805] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.184697][ T7805] bridge0: port 2(bridge_slave_1) entered forwarding state [ 203.197051][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 203.216626][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 203.226087][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 203.238174][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 203.247794][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 203.261341][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 203.279382][ T7684] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 203.290575][ T7684] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 203.309275][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 203.318757][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 203.327524][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 203.338374][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 203.346795][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 203.358207][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 203.366896][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 203.374715][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 203.386069][ T7680] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 203.401029][ T7805] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 203.415271][ T7684] 8021q: adding VLAN 0 to HW filter on device batadv0 10:51:29 executing program 3: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2a939, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r1, 0x0) mount(0x0, &(0x7f0000001600)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) syz_open_dev$mice(0x0, 0x0, 0x0) r2 = socket$caif_stream(0x25, 0x1, 0x3) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f00000004c0)=0x80, 0x4) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000000080), 0x4) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f00000002c0)=0x14) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f00000001c0)=0x400, 0x4) bind$xdp(r3, &(0x7f0000000900)={0x2c, 0x2}, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'ip6tnl0\x00'}) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x420000, 0x0) ioctl$TIOCGISO7816(0xffffffffffffffff, 0x80285442, 0x0) open(0x0, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000300), 0x12) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x4400, 0x0) r5 = socket(0x10, 0x1, 0x6) accept$unix(r5, &(0x7f00000016c0), 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)) socket$packet(0x11, 0x2, 0x300) [ 203.432800][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 203.454991][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 10:51:30 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) creat(&(0x7f0000000080)='./bus/file0\x00', 0x0) unlink(&(0x7f00000000c0)='./bus/file0\x00') 10:51:30 executing program 0: mkdir(&(0x7f0000000b40)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) rename(&(0x7f0000000000)='./file1\x00', &(0x7f0000000200)='./file0\x00') mkdir(&(0x7f0000000040)='./bus/file0\x00', 0x0) 10:51:30 executing program 2: bpf$MAP_CREATE(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129cde3}], 0x6e, &(0x7f00000001c0)=""/17, 0x10036, 0x7301}, 0x3f00) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) 10:51:30 executing program 1: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2a939, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r1, 0x0) mount(0x0, &(0x7f0000001600)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) syz_open_dev$mice(0x0, 0x0, 0x0) r2 = socket$caif_stream(0x25, 0x1, 0x3) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f00000004c0)=0x80, 0x4) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000000080), 0x4) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f00000002c0)=0x14) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f00000001c0)=0x400, 0x4) bind$xdp(r3, &(0x7f0000000900)={0x2c, 0x2}, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'ip6tnl0\x00'}) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x420000, 0x0) ioctl$TIOCGISO7816(0xffffffffffffffff, 0x80285442, 0x0) open(0x0, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000300), 0x12) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x4400, 0x0) r5 = socket(0x10, 0x1, 0x6) accept$unix(r5, &(0x7f00000016c0), 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)) socket$packet(0x11, 0x2, 0x300) 10:51:30 executing program 5: r0 = socket$kcm(0x2b, 0x8000000000001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0xa, 0x3, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x23, &(0x7f0000000280), 0xa8) close(r1) 10:51:30 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x9) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2}) [ 203.927480][ T7956] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 203.951531][ T7952] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. 10:51:30 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) creat(&(0x7f0000000080)='./bus/file0\x00', 0x0) unlink(&(0x7f00000000c0)='./bus/file0\x00') 10:51:30 executing program 0: mkdir(&(0x7f0000000b40)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) rename(&(0x7f0000000000)='./file1\x00', &(0x7f0000000200)='./file0\x00') mkdir(&(0x7f0000000040)='./bus/file0\x00', 0x0) [ 204.231330][ T7963] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. 10:51:31 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) creat(&(0x7f0000000080)='./bus/file0\x00', 0x0) unlink(&(0x7f00000000c0)='./bus/file0\x00') 10:51:31 executing program 5: mkdir(&(0x7f0000000b40)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) rename(&(0x7f0000000000)='./file1\x00', &(0x7f0000000200)='./file0\x00') mkdir(&(0x7f0000000040)='./bus/file0\x00', 0x0) 10:51:31 executing program 3: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2a939, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r1, 0x0) mount(0x0, &(0x7f0000001600)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) syz_open_dev$mice(0x0, 0x0, 0x0) r2 = socket$caif_stream(0x25, 0x1, 0x3) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f00000004c0)=0x80, 0x4) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000000080), 0x4) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f00000002c0)=0x14) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f00000001c0)=0x400, 0x4) bind$xdp(r3, &(0x7f0000000900)={0x2c, 0x2}, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'ip6tnl0\x00'}) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x420000, 0x0) ioctl$TIOCGISO7816(0xffffffffffffffff, 0x80285442, 0x0) open(0x0, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000300), 0x12) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x4400, 0x0) r5 = socket(0x10, 0x1, 0x6) accept$unix(r5, &(0x7f00000016c0), 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)) socket$packet(0x11, 0x2, 0x300) [ 204.735558][ T7931] syz-executor.3 (7931) used greatest stack depth: 9832 bytes left 10:51:31 executing program 2: bpf$MAP_CREATE(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x203, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129cde3}], 0x6e, &(0x7f00000001c0)=""/17, 0x10036, 0x7301}, 0x3f00) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) 10:51:31 executing program 0: mkdir(&(0x7f0000000b40)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) rename(&(0x7f0000000000)='./file1\x00', &(0x7f0000000200)='./file0\x00') mkdir(&(0x7f0000000040)='./bus/file0\x00', 0x0) 10:51:31 executing program 5: mkdir(&(0x7f0000000b40)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) rename(&(0x7f0000000000)='./file1\x00', &(0x7f0000000200)='./file0\x00') mkdir(&(0x7f0000000040)='./bus/file0\x00', 0x0) 10:51:31 executing program 1: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2a939, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r1, 0x0) mount(0x0, &(0x7f0000001600)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) syz_open_dev$mice(0x0, 0x0, 0x0) r2 = socket$caif_stream(0x25, 0x1, 0x3) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r3, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f00000004c0)=0x80, 0x4) setsockopt$XDP_TX_RING(r3, 0x11b, 0x3, &(0x7f0000000080), 0x4) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100), &(0x7f00000002c0)=0x14) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f00000001c0)=0x400, 0x4) bind$xdp(r3, &(0x7f0000000900)={0x2c, 0x2}, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'ip6tnl0\x00'}) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x420000, 0x0) ioctl$TIOCGISO7816(0xffffffffffffffff, 0x80285442, 0x0) open(0x0, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000300), 0x12) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x4400, 0x0) r5 = socket(0x10, 0x1, 0x6) accept$unix(r5, &(0x7f00000016c0), 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000400)=""/4096, 0x3ffc00}], 0x1, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)) socket$packet(0x11, 0x2, 0x300) 10:51:31 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) creat(&(0x7f0000000080)='./bus/file0\x00', 0x0) unlink(&(0x7f00000000c0)='./bus/file0\x00') 10:51:31 executing program 0: mkdir(&(0x7f0000000b40)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) rename(&(0x7f0000000000)='./file1\x00', &(0x7f0000000200)='./file0\x00') mkdir(&(0x7f0000000040)='./bus/file0\x00', 0x0) 10:51:31 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) creat(&(0x7f0000000080)='./bus/file0\x00', 0x0) unlink(&(0x7f00000000c0)='./bus/file0\x00') 10:51:31 executing program 5: mkdir(&(0x7f0000000b40)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './bus'}}, {@workdir={'workdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) rename(&(0x7f0000000000)='./file1\x00', &(0x7f0000000200)='./file0\x00') mkdir(&(0x7f0000000040)='./bus/file0\x00', 0x0) 10:51:32 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) creat(&(0x7f0000000080)='./bus/file0\x00', 0x0) unlink(&(0x7f00000000c0)='./bus/file0\x00') 10:51:32 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) creat(&(0x7f0000000080)='./bus/file0\x00', 0x0) unlink(&(0x7f00000000c0)='./bus/file0\x00') 10:51:32 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42800) setreuid(0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=@framed={{0xffffffb7, 0x0, 0x0, 0x0, 0x0, 0x4e, 0xffffffa0}, [@ldst={0x7, 0x7, 0x0, 0x4901}], {0x95, 0xe0040000000000}}, &(0x7f0000003ff6)='OPL\x00', 0x1, 0xff06, &(0x7f000000cf3d)=""/195}, 0x48) bind$alg(0xffffffffffffffff, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) socket$alg(0x26, 0x5, 0x0) socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) [ 205.812515][ C1] net_ratelimit: 8 callbacks suppressed [ 205.812553][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 205.824263][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 205.972245][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 205.978111][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 206.462684][ T7983] ================================================================== [ 206.470881][ T7983] BUG: KCSAN: data-race in exit_signals / mm_update_next_owner [ 206.478424][ T7983] [ 206.480754][ T7983] read to 0xffff8881217db124 of 4 bytes by task 7997 on cpu 0: [ 206.488386][ T7983] mm_update_next_owner+0x29f/0x460 [ 206.493756][ T7983] do_exit+0x4c1/0x18f0 [ 206.497914][ T7983] do_group_exit+0xb4/0x1c0 [ 206.502688][ T7983] __x64_sys_exit_group+0x2e/0x30 [ 206.507809][ T7983] do_syscall_64+0xcc/0x370 [ 206.512315][ T7983] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 206.518224][ T7983] [ 206.520551][ T7983] write to 0xffff8881217db124 of 4 bytes by task 7983 on cpu 1: [ 206.528269][ T7983] exit_signals+0x13b/0x490 [ 206.532773][ T7983] do_exit+0x18b/0x18f0 [ 206.536935][ T7983] do_group_exit+0xb4/0x1c0 [ 206.541430][ T7983] __x64_sys_exit_group+0x2e/0x30 [ 206.547063][ T7983] do_syscall_64+0xcc/0x370 [ 206.551567][ T7983] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 206.559656][ T7983] [ 206.562069][ T7983] Reported by Kernel Concurrency Sanitizer on: [ 206.568313][ T7983] CPU: 1 PID: 7983 Comm: syz-executor.3 Not tainted 5.4.0-syzkaller #0 [ 206.576660][ T7983] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 206.586837][ T7983] ================================================================== [ 206.594899][ T7983] Kernel panic - not syncing: panic_on_warn set ... [ 206.601737][ T7983] CPU: 1 PID: 7983 Comm: syz-executor.3 Not tainted 5.4.0-syzkaller #0 [ 206.609959][ T7983] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 206.620107][ T7983] Call Trace: [ 206.626801][ T7983] dump_stack+0x11d/0x181 [ 206.631119][ T7983] panic+0x210/0x640 [ 206.635793][ T7983] ? debug_smp_processor_id.cold+0x5f/0x6f [ 206.641801][ T7983] ? vprintk_func+0x8d/0x140 [ 206.646402][ T7983] kcsan_report.cold+0xc/0xd [ 206.651685][ T7983] kcsan_setup_watchpoint+0x3fe/0x460 [ 206.657407][ T7983] __tsan_unaligned_write4+0xc4/0x100 [ 206.662828][ T7983] exit_signals+0x13b/0x490 [ 206.667321][ T7983] do_exit+0x18b/0x18f0 [ 206.671604][ T7983] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 206.677480][ T7983] ? __read_once_size+0x41/0xe0 [ 206.682506][ T7983] ? zap_other_threads+0x114/0x140 [ 206.687840][ T7983] do_group_exit+0xb4/0x1c0 [ 206.692462][ T7983] __x64_sys_exit_group+0x2e/0x30 [ 206.697474][ T7983] do_syscall_64+0xcc/0x370 [ 206.702062][ T7983] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 206.708066][ T7983] RIP: 0033:0x45a909 [ 206.711949][ T7983] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 206.733571][ T7983] RSP: 002b:00007ffcef467258 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 206.741967][ T7983] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 000000000045a909 [ 206.749922][ T7983] RDX: 00000000004144a1 RSI: fffffffffffffff7 RDI: 0000000000000000 [ 206.757963][ T7983] RBP: 0000000000000000 R08: 00000000cced732b R09: 00007ffcef4672b0 [ 206.767065][ T7983] R10: ffffffff81313db4 R11: 0000000000000246 R12: 0000000000000000 [ 206.775030][ T7983] R13: 00007ffcef4672b0 R14: 0000000000000000 R15: 00007ffcef4672c0 [ 206.783000][ T7983] ? kthread_blkcg+0x24/0xc0 [ 206.789362][ T7983] Kernel Offset: disabled [ 206.793711][ T7983] Rebooting in 86400 seconds..