[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 41.660674][ T26] audit: type=1800 audit(1554585027.395:25): pid=7949 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 41.700404][ T26] audit: type=1800 audit(1554585027.395:26): pid=7949 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 41.733481][ T26] audit: type=1800 audit(1554585027.395:27): pid=7949 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.52' (ECDSA) to the list of known hosts. 2019/04/06 21:10:37 fuzzer started 2019/04/06 21:10:40 dialing manager at 10.128.0.26:34543 2019/04/06 21:10:41 syscalls: 2408 2019/04/06 21:10:41 code coverage: enabled 2019/04/06 21:10:41 comparison tracing: enabled 2019/04/06 21:10:41 extra coverage: extra coverage is not supported by the kernel 2019/04/06 21:10:41 setuid sandbox: enabled 2019/04/06 21:10:41 namespace sandbox: enabled 2019/04/06 21:10:41 Android sandbox: /sys/fs/selinux/policy does not exist 2019/04/06 21:10:41 fault injection: enabled 2019/04/06 21:10:41 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/04/06 21:10:41 net packet injection: enabled 2019/04/06 21:10:41 net device setup: enabled 21:12:45 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/dev\x00') preadv(r1, &(0x7f00000001c0)=[{&(0x7f0000001840)=""/4096, 0xfffffe4d}], 0x1, 0x0) syzkaller login: [ 180.005854][ T8113] IPVS: ftp: loaded support on port[0] = 21 21:12:45 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) ioctl$TCGETA(r2, 0x5405, &(0x7f0000000040)) [ 180.114499][ T8113] chnl_net:caif_netlink_parms(): no params data found [ 180.204560][ T8113] bridge0: port 1(bridge_slave_0) entered blocking state [ 180.212496][ T8113] bridge0: port 1(bridge_slave_0) entered disabled state [ 180.240360][ T8113] device bridge_slave_0 entered promiscuous mode [ 180.250532][ T8113] bridge0: port 2(bridge_slave_1) entered blocking state [ 180.257676][ T8113] bridge0: port 2(bridge_slave_1) entered disabled state [ 180.266485][ T8113] device bridge_slave_1 entered promiscuous mode [ 180.294615][ T8113] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 180.305312][ T8113] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 180.333801][ T8116] IPVS: ftp: loaded support on port[0] = 21 [ 180.334182][ T8113] team0: Port device team_slave_0 added [ 180.347405][ T8113] team0: Port device team_slave_1 added 21:12:46 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) r2 = socket(0xa, 0x400000001, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f00000001c0)={0x6, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_mreqn(r1, 0x0, 0x18, &(0x7f0000000080)={@loopback, @initdev}, 0xc) [ 180.481894][ T8113] device hsr_slave_0 entered promiscuous mode 21:12:46 executing program 3: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x0) keyctl$join(0x1, &(0x7f00000001c0)={'syz'}) [ 180.529286][ T8113] device hsr_slave_1 entered promiscuous mode [ 180.605824][ T8118] IPVS: ftp: loaded support on port[0] = 21 [ 180.617167][ T8113] bridge0: port 2(bridge_slave_1) entered blocking state [ 180.624508][ T8113] bridge0: port 2(bridge_slave_1) entered forwarding state [ 180.632391][ T8113] bridge0: port 1(bridge_slave_0) entered blocking state [ 180.639549][ T8113] bridge0: port 1(bridge_slave_0) entered forwarding state [ 180.754365][ T8122] IPVS: ftp: loaded support on port[0] = 21 [ 180.785528][ T8116] chnl_net:caif_netlink_parms(): no params data found [ 180.883910][ T8113] 8021q: adding VLAN 0 to HW filter on device bond0 21:12:46 executing program 4: r0 = socket$inet(0x2, 0x3, 0xd6) setsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000180)={@dev, @multicast1}, 0xc) [ 180.945873][ T8118] chnl_net:caif_netlink_parms(): no params data found [ 180.956590][ T8116] bridge0: port 1(bridge_slave_0) entered blocking state [ 180.964664][ T8116] bridge0: port 1(bridge_slave_0) entered disabled state [ 180.973278][ T8116] device bridge_slave_0 entered promiscuous mode [ 180.981455][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 180.995797][ T2923] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.005274][ T2923] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.030550][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 181.072337][ T8113] 8021q: adding VLAN 0 to HW filter on device team0 [ 181.084857][ T8116] bridge0: port 2(bridge_slave_1) entered blocking state [ 181.093697][ T8116] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.109893][ T8116] device bridge_slave_1 entered promiscuous mode [ 181.169028][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 181.177601][ T2923] bridge0: port 1(bridge_slave_0) entered blocking state [ 181.184743][ T2923] bridge0: port 1(bridge_slave_0) entered forwarding state [ 181.201096][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 181.210161][ T2923] bridge0: port 2(bridge_slave_1) entered blocking state [ 181.217247][ T2923] bridge0: port 2(bridge_slave_1) entered forwarding state 21:12:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)={0x2c, r1, 0x211, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x18, 0x1, [@TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'eth', 0x3a, 'ip6_vti0\x00'}}]}]}, 0x2c}}, 0x0) [ 181.270882][ T8127] IPVS: ftp: loaded support on port[0] = 21 [ 181.307646][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 181.322187][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 181.332027][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 181.343807][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 181.353610][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 181.365345][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 181.374135][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 181.384928][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 181.394332][ T8116] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 181.404505][ T8116] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 181.439421][ T8118] bridge0: port 1(bridge_slave_0) entered blocking state [ 181.446633][ T8118] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.454723][ T8118] device bridge_slave_0 entered promiscuous mode [ 181.462535][ T8118] bridge0: port 2(bridge_slave_1) entered blocking state [ 181.469759][ T8118] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.477455][ T8118] device bridge_slave_1 entered promiscuous mode [ 181.516991][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 181.525410][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 181.547309][ T8113] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 181.556917][ T8122] chnl_net:caif_netlink_parms(): no params data found [ 181.567852][ T8130] IPVS: ftp: loaded support on port[0] = 21 [ 181.581783][ T8118] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 181.593992][ T8118] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 181.604112][ T8116] team0: Port device team_slave_0 added [ 181.611354][ T8116] team0: Port device team_slave_1 added [ 181.642945][ T8118] team0: Port device team_slave_0 added [ 181.652151][ T8118] team0: Port device team_slave_1 added [ 181.742653][ T8116] device hsr_slave_0 entered promiscuous mode [ 181.799530][ T8116] device hsr_slave_1 entered promiscuous mode [ 181.866409][ T8113] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 181.973487][ T8118] device hsr_slave_0 entered promiscuous mode [ 182.029310][ T8118] device hsr_slave_1 entered promiscuous mode [ 182.113506][ T8122] bridge0: port 1(bridge_slave_0) entered blocking state [ 182.122078][ T8122] bridge0: port 1(bridge_slave_0) entered disabled state [ 182.140405][ T8122] device bridge_slave_0 entered promiscuous mode 21:12:48 executing program 0: seccomp(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{0x20}, {0x6, 0x0, 0x0, 0xffffff7f7ffffffe}]}) [ 182.213039][ T8122] bridge0: port 2(bridge_slave_1) entered blocking state [ 182.221155][ T8122] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.228954][ T8122] device bridge_slave_1 entered promiscuous mode 21:12:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r1 = gettid() process_vm_writev(r1, &(0x7f0000c22000)=[{&(0x7f000034afa4)=""/1, 0x1f80}], 0xb, &(0x7f0000c22fa0)=[{&(0x7f0000000080)=""/1, 0x2034afa5}], 0x1, 0x0) close(r0) [ 182.298013][ T8127] chnl_net:caif_netlink_parms(): no params data found [ 182.316873][ T8122] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 182.333090][ T8122] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 182.383570][ T8122] team0: Port device team_slave_0 added [ 182.394288][ T8122] team0: Port device team_slave_1 added [ 182.403564][ C0] hrtimer: interrupt took 58376 ns [ 182.407977][ T8116] 8021q: adding VLAN 0 to HW filter on device bond0 [ 182.457501][ T8116] 8021q: adding VLAN 0 to HW filter on device team0 21:12:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r1 = gettid() process_vm_writev(r1, &(0x7f0000c22000)=[{&(0x7f000034afa4)=""/1, 0x1f80}], 0xb, &(0x7f0000c22fa0)=[{&(0x7f0000000080)=""/1, 0x2034afa5}], 0x1, 0x0) close(r0) [ 182.523850][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 182.536578][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 182.621878][ T8122] device hsr_slave_0 entered promiscuous mode [ 182.641880][ T8122] device hsr_slave_1 entered promiscuous mode 21:12:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r1 = gettid() process_vm_writev(r1, &(0x7f0000c22000)=[{&(0x7f000034afa4)=""/1, 0x1f80}], 0xb, &(0x7f0000c22fa0)=[{&(0x7f0000000080)=""/1, 0x2034afa5}], 0x1, 0x0) close(r0) [ 182.692597][ T8118] 8021q: adding VLAN 0 to HW filter on device bond0 [ 182.716965][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 182.726072][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 182.743564][ T265] bridge0: port 1(bridge_slave_0) entered blocking state [ 182.750772][ T265] bridge0: port 1(bridge_slave_0) entered forwarding state [ 182.760095][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 182.768807][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 182.777749][ T265] bridge0: port 2(bridge_slave_1) entered blocking state [ 182.784882][ T265] bridge0: port 2(bridge_slave_1) entered forwarding state [ 182.797781][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 182.806773][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 182.818304][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 182.827138][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 182.836161][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 182.845145][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 182.862202][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 182.871182][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 182.886493][ T8130] chnl_net:caif_netlink_parms(): no params data found [ 182.897240][ T8127] bridge0: port 1(bridge_slave_0) entered blocking state [ 182.904539][ T8127] bridge0: port 1(bridge_slave_0) entered disabled state [ 182.913152][ T8127] device bridge_slave_0 entered promiscuous mode [ 182.924506][ T8127] bridge0: port 2(bridge_slave_1) entered blocking state [ 182.931775][ T8127] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.940248][ T8127] device bridge_slave_1 entered promiscuous mode 21:12:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r1 = gettid() process_vm_writev(r1, &(0x7f0000c22000)=[{&(0x7f000034afa4)=""/1, 0x1f80}], 0xb, &(0x7f0000c22fa0)=[{&(0x7f0000000080)=""/1, 0x2034afa5}], 0x1, 0x0) close(r0) [ 182.956654][ T8118] 8021q: adding VLAN 0 to HW filter on device team0 [ 183.003995][ T8116] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 183.021663][ T8116] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 183.047147][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 183.061405][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 183.071778][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 183.086692][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 183.095801][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 183.104378][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 183.113843][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 21:12:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r1 = gettid() process_vm_writev(r1, &(0x7f0000c22000)=[{&(0x7f000034afa4)=""/1, 0x1f80}], 0xb, &(0x7f0000c22fa0)=[{&(0x7f0000000080)=""/1, 0x2034afa5}], 0x1, 0x0) close(r0) [ 183.155982][ T8127] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 183.226908][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 183.236092][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 183.245071][ T265] bridge0: port 1(bridge_slave_0) entered blocking state [ 183.252207][ T265] bridge0: port 1(bridge_slave_0) entered forwarding state [ 183.259998][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 183.268736][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 183.277413][ T265] bridge0: port 2(bridge_slave_1) entered blocking state [ 183.284521][ T265] bridge0: port 2(bridge_slave_1) entered forwarding state [ 183.293936][ T8127] bond0: Enslaving bond_slave_1 as an active interface with an up link 21:12:49 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r1 = gettid() process_vm_writev(r1, &(0x7f0000c22000)=[{&(0x7f000034afa4)=""/1, 0x1f80}], 0xb, &(0x7f0000c22fa0)=[{&(0x7f0000000080)=""/1, 0x2034afa5}], 0x1, 0x0) close(r0) [ 183.324088][ T8130] bridge0: port 1(bridge_slave_0) entered blocking state [ 183.333223][ T8130] bridge0: port 1(bridge_slave_0) entered disabled state [ 183.345190][ T8130] device bridge_slave_0 entered promiscuous mode [ 183.357183][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 183.365736][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 183.375688][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 183.411037][ T8130] bridge0: port 2(bridge_slave_1) entered blocking state [ 183.418152][ T8130] bridge0: port 2(bridge_slave_1) entered disabled state [ 183.458499][ T8130] device bridge_slave_1 entered promiscuous mode [ 183.479995][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 183.489786][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 183.498738][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 183.508112][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 183.517704][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 183.527017][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 183.540733][ T8116] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 183.549620][ T8127] team0: Port device team_slave_0 added [ 183.560176][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 183.571349][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 183.579776][ T8120] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 183.600912][ T8118] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 183.620616][ T8127] team0: Port device team_slave_1 added [ 183.643617][ T8130] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 183.654793][ T8130] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 183.704108][ T8122] 8021q: adding VLAN 0 to HW filter on device bond0 [ 183.752230][ T8127] device hsr_slave_0 entered promiscuous mode [ 183.799235][ T8127] device hsr_slave_1 entered promiscuous mode [ 183.850308][ T8118] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 183.860689][ T8130] team0: Port device team_slave_0 added [ 183.868111][ T8130] team0: Port device team_slave_1 added [ 183.888338][ T8122] 8021q: adding VLAN 0 to HW filter on device team0 21:12:49 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@mcast2, 0x81}) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x800000d) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xd, &(0x7f00000005c0)=ANY=[@ANYBLOB="0500db44c7450000bf7ce676b30007000008000000b4d63a8fe5feaf65060000ffffffff2d020000000000e556b35eb800650404000100000004040000850000001f000001b700e414000000722d000000000000000000000000000000965aece501d56f56a04f3f7b754965"], 0x0}, 0x48) socket$inet6(0xa, 0x2, 0xfd9) ioctl(r1, 0x10001, &(0x7f0000000100)="153f6234488dd25d766070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket(0xa, 0x3, 0x8) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000500)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f00000002c0)=r5) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x4}) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @remote, 0x4e24, 0x0, 'lblcr\x00', 0x1e, 0x0, 0x13}, {@remote, 0x4e21, 0x7, 0xff, 0x7f, 0x2}}, 0x44) r6 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02\x05\x00\x00\x00\xac', 0x0) write$binfmt_misc(r2, &(0x7f0000000c40)=ANY=[], 0x0) close(r0) dup3(r2, r6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[]}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_sa={0x0, 0x1, 0x4d2, 0x2, 0x6, 0x3, 0x0, 0x20000000}]}, 0xfffffffffffffecf}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff00000000000000000006000000000000000000800000000000e00000010b00000000000000000035000000000000000000000000ff00000000030006000000000002000004000000bb000000000000000003000500000000000200423b000000000000004000000000"], 0x80}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmmsg(r7, &(0x7f0000000180), 0x400000000000117, 0x0) r8 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x1, 0x2) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) futimesat(r8, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000480)={{r9, r10/1000+30000}, {0x77359400}}) listen(r6, 0xfffffffffffffefc) [ 183.904883][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 183.924012][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 183.975421][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 183.987395][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 183.996518][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 184.003696][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 184.013328][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 184.025584][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 184.035865][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 184.043135][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 184.054262][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 184.102034][ T8130] device hsr_slave_0 entered promiscuous mode [ 184.129342][ T8130] device hsr_slave_1 entered promiscuous mode [ 184.172010][ T8174] bridge0: port 3(gretap0) entered blocking state [ 184.179903][ T8174] bridge0: port 3(gretap0) entered disabled state [ 184.195645][ T8174] device gretap0 entered promiscuous mode [ 184.204880][ T8174] bridge0: port 3(gretap0) entered blocking state [ 184.211970][ T8174] bridge0: port 3(gretap0) entered forwarding state [ 184.234800][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 21:12:50 executing program 2: syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) [ 184.276525][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 184.288443][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 184.319860][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 184.328611][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 184.341564][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 184.351362][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 184.408182][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 184.417433][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 184.440558][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 184.449941][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 184.468101][ T8127] 8021q: adding VLAN 0 to HW filter on device bond0 [ 184.480331][ T8122] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 184.507296][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 184.515284][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 184.525342][ T8127] 8021q: adding VLAN 0 to HW filter on device team0 [ 184.547563][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 184.560692][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 184.570477][ T2923] bridge0: port 1(bridge_slave_0) entered blocking state [ 184.577539][ T2923] bridge0: port 1(bridge_slave_0) entered forwarding state [ 184.599314][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 184.607236][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 184.616060][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 184.624901][ T2923] bridge0: port 2(bridge_slave_1) entered blocking state [ 184.632030][ T2923] bridge0: port 2(bridge_slave_1) entered forwarding state [ 184.640376][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 184.649184][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 184.657655][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 184.666623][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 184.675158][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 184.683609][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 184.693005][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 184.704076][ T8130] 8021q: adding VLAN 0 to HW filter on device bond0 [ 184.717546][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 184.727416][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 184.735953][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 184.744633][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 184.755075][ T8122] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 184.775589][ T8130] 8021q: adding VLAN 0 to HW filter on device team0 [ 184.791892][ T8127] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 184.800058][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 184.807826][ T265] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 184.834456][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 184.843514][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 184.852329][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 184.859469][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 184.867454][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 184.876298][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 184.885368][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 184.892481][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 184.900967][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 184.909811][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 184.918495][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 184.927288][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 184.936221][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 184.944717][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 184.967904][ T8130] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network 21:12:50 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@mcast2, 0x81}) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x800000d) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xd, &(0x7f00000005c0)=ANY=[@ANYBLOB="0500db44c7450000bf7ce676b30007000008000000b4d63a8fe5feaf65060000ffffffff2d020000000000e556b35eb800650404000100000004040000850000001f000001b700e414000000722d000000000000000000000000000000965aece501d56f56a04f3f7b754965"], 0x0}, 0x48) socket$inet6(0xa, 0x2, 0xfd9) ioctl(r1, 0x10001, &(0x7f0000000100)="153f6234488dd25d766070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket(0xa, 0x3, 0x8) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000500)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f00000002c0)=r5) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x4}) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @remote, 0x4e24, 0x0, 'lblcr\x00', 0x1e, 0x0, 0x13}, {@remote, 0x4e21, 0x7, 0xff, 0x7f, 0x2}}, 0x44) r6 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02\x05\x00\x00\x00\xac', 0x0) write$binfmt_misc(r2, &(0x7f0000000c40)=ANY=[], 0x0) close(r0) dup3(r2, r6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[]}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_sa={0x0, 0x1, 0x4d2, 0x2, 0x6, 0x3, 0x0, 0x20000000}]}, 0xfffffffffffffecf}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff00000000000000000006000000000000000000800000000000e00000010b00000000000000000035000000000000000000000000ff00000000030006000000000002000004000000bb000000000000000003000500000000000200423b000000000000004000000000"], 0x80}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmmsg(r7, &(0x7f0000000180), 0x400000000000117, 0x0) r8 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x1, 0x2) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) futimesat(r8, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000480)={{r9, r10/1000+30000}, {0x77359400}}) listen(r6, 0xfffffffffffffefc) [ 185.004002][ T8130] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 185.028537][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 185.061115][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 185.077012][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 185.089052][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 185.098413][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 185.106920][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 185.115848][ T2923] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 185.131594][ T8194] bridge0: port 3(gretap0) entered blocking state [ 185.140056][ T8194] bridge0: port 3(gretap0) entered disabled state [ 185.166007][ T8194] device gretap0 entered promiscuous mode [ 185.175166][ T8194] bridge0: port 3(gretap0) entered blocking state [ 185.182274][ T8194] bridge0: port 3(gretap0) entered forwarding state [ 185.210964][ T8127] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 185.250384][ T8130] 8021q: adding VLAN 0 to HW filter on device batadv0 21:12:51 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@mcast2, 0x81}) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x800000d) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xd, &(0x7f00000005c0)=ANY=[@ANYBLOB="0500db44c7450000bf7ce676b30007000008000000b4d63a8fe5feaf65060000ffffffff2d020000000000e556b35eb800650404000100000004040000850000001f000001b700e414000000722d000000000000000000000000000000965aece501d56f56a04f3f7b754965"], 0x0}, 0x48) socket$inet6(0xa, 0x2, 0xfd9) ioctl(r1, 0x10001, &(0x7f0000000100)="153f6234488dd25d766070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket(0xa, 0x3, 0x8) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000500)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f00000002c0)=r5) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x4}) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @remote, 0x4e24, 0x0, 'lblcr\x00', 0x1e, 0x0, 0x13}, {@remote, 0x4e21, 0x7, 0xff, 0x7f, 0x2}}, 0x44) r6 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02\x05\x00\x00\x00\xac', 0x0) write$binfmt_misc(r2, &(0x7f0000000c40)=ANY=[], 0x0) close(r0) dup3(r2, r6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[]}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_sa={0x0, 0x1, 0x4d2, 0x2, 0x6, 0x3, 0x0, 0x20000000}]}, 0xfffffffffffffecf}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff00000000000000000006000000000000000000800000000000e00000010b00000000000000000035000000000000000000000000ff00000000030006000000000002000004000000bb000000000000000003000500000000000200423b000000000000004000000000"], 0x80}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmmsg(r7, &(0x7f0000000180), 0x400000000000117, 0x0) r8 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x1, 0x2) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) futimesat(r8, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000480)={{r9, r10/1000+30000}, {0x77359400}}) listen(r6, 0xfffffffffffffefc) 21:12:51 executing program 5: syz_mount_image$hfs(&(0x7f0000002a40)='hfs\x00', &(0x7f0000002a80)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000003e00)={[{@codepage={'codepage', 0x3d, 'cp936'}}]}) 21:12:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r1 = gettid() process_vm_writev(r1, &(0x7f0000c22000)=[{&(0x7f000034afa4)=""/1, 0x1f80}], 0xb, &(0x7f0000c22fa0)=[{&(0x7f0000000080)=""/1, 0x2034afa5}], 0x1, 0x0) close(r0) 21:12:51 executing program 2: syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) 21:12:51 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@mcast2, 0x81}) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x800000d) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xd, &(0x7f00000005c0)=ANY=[@ANYBLOB="0500db44c7450000bf7ce676b30007000008000000b4d63a8fe5feaf65060000ffffffff2d020000000000e556b35eb800650404000100000004040000850000001f000001b700e414000000722d000000000000000000000000000000965aece501d56f56a04f3f7b754965"], 0x0}, 0x48) socket$inet6(0xa, 0x2, 0xfd9) ioctl(r1, 0x10001, &(0x7f0000000100)="153f6234488dd25d766070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket(0xa, 0x3, 0x8) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000500)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f00000002c0)=r5) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x4}) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @remote, 0x4e24, 0x0, 'lblcr\x00', 0x1e, 0x0, 0x13}, {@remote, 0x4e21, 0x7, 0xff, 0x7f, 0x2}}, 0x44) r6 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02\x05\x00\x00\x00\xac', 0x0) write$binfmt_misc(r2, &(0x7f0000000c40)=ANY=[], 0x0) close(r0) dup3(r2, r6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[]}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_sa={0x0, 0x1, 0x4d2, 0x2, 0x6, 0x3, 0x0, 0x20000000}]}, 0xfffffffffffffecf}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff00000000000000000006000000000000000000800000000000e00000010b00000000000000000035000000000000000000000000ff00000000030006000000000002000004000000bb000000000000000003000500000000000200423b000000000000004000000000"], 0x80}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmmsg(r7, &(0x7f0000000180), 0x400000000000117, 0x0) r8 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x1, 0x2) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) futimesat(r8, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000480)={{r9, r10/1000+30000}, {0x77359400}}) listen(r6, 0xfffffffffffffefc) 21:12:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@mcast2, 0x81}) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x800000d) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xd, &(0x7f00000005c0)=ANY=[@ANYBLOB="0500db44c7450000bf7ce676b30007000008000000b4d63a8fe5feaf65060000ffffffff2d020000000000e556b35eb800650404000100000004040000850000001f000001b700e414000000722d000000000000000000000000000000965aece501d56f56a04f3f7b754965"], 0x0}, 0x48) socket$inet6(0xa, 0x2, 0xfd9) ioctl(r1, 0x10001, &(0x7f0000000100)="153f6234488dd25d766070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket(0xa, 0x3, 0x8) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000500)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f00000002c0)=r5) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x4}) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @remote, 0x4e24, 0x0, 'lblcr\x00', 0x1e, 0x0, 0x13}, {@remote, 0x4e21, 0x7, 0xff, 0x7f, 0x2}}, 0x44) r6 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02\x05\x00\x00\x00\xac', 0x0) write$binfmt_misc(r2, &(0x7f0000000c40)=ANY=[], 0x0) close(r0) dup3(r2, r6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[]}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_sa={0x0, 0x1, 0x4d2, 0x2, 0x6, 0x3, 0x0, 0x20000000}]}, 0xfffffffffffffecf}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff00000000000000000006000000000000000000800000000000e00000010b00000000000000000035000000000000000000000000ff00000000030006000000000002000004000000bb000000000000000003000500000000000200423b000000000000004000000000"], 0x80}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmmsg(r7, &(0x7f0000000180), 0x400000000000117, 0x0) r8 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x1, 0x2) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) futimesat(r8, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000480)={{r9, r10/1000+30000}, {0x77359400}}) listen(r6, 0xfffffffffffffefc) [ 185.391194][ T8205] Started in network mode [ 185.396639][ T8205] Own node identity , cluster identity 4711 [ 185.403251][ T8205] Failed to obtain node identity [ 185.408362][ T8205] Enabling of bearer rejected, failed to enable media 21:12:51 executing program 2: syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) [ 185.614246][ T8220] hfs: can't find a HFS filesystem on dev loop5 [ 185.632455][ T8217] bridge0: port 3(gretap0) entered blocking state 21:12:51 executing program 2: syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) [ 185.715605][ T8217] bridge0: port 3(gretap0) entered disabled state 21:12:51 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@mcast2, 0x81}) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x800000d) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xd, &(0x7f00000005c0)=ANY=[@ANYBLOB="0500db44c7450000bf7ce676b30007000008000000b4d63a8fe5feaf65060000ffffffff2d020000000000e556b35eb800650404000100000004040000850000001f000001b700e414000000722d000000000000000000000000000000965aece501d56f56a04f3f7b754965"], 0x0}, 0x48) socket$inet6(0xa, 0x2, 0xfd9) ioctl(r1, 0x10001, &(0x7f0000000100)="153f6234488dd25d766070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket(0xa, 0x3, 0x8) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000500)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f00000002c0)=r5) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x4}) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @remote, 0x4e24, 0x0, 'lblcr\x00', 0x1e, 0x0, 0x13}, {@remote, 0x4e21, 0x7, 0xff, 0x7f, 0x2}}, 0x44) r6 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02\x05\x00\x00\x00\xac', 0x0) write$binfmt_misc(r2, &(0x7f0000000c40)=ANY=[], 0x0) close(r0) dup3(r2, r6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[]}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_sa={0x0, 0x1, 0x4d2, 0x2, 0x6, 0x3, 0x0, 0x20000000}]}, 0xfffffffffffffecf}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff00000000000000000006000000000000000000800000000000e00000010b00000000000000000035000000000000000000000000ff00000000030006000000000002000004000000bb000000000000000003000500000000000200423b000000000000004000000000"], 0x80}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmmsg(r7, &(0x7f0000000180), 0x400000000000117, 0x0) r8 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x1, 0x2) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) futimesat(r8, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000480)={{r9, r10/1000+30000}, {0x77359400}}) listen(r6, 0xfffffffffffffefc) [ 185.807020][ T8220] hfs: can't find a HFS filesystem on dev loop5 21:12:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@mcast2, 0x81}) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x800000d) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xd, &(0x7f00000005c0)=ANY=[@ANYBLOB="0500db44c7450000bf7ce676b30007000008000000b4d63a8fe5feaf65060000ffffffff2d020000000000e556b35eb800650404000100000004040000850000001f000001b700e414000000722d000000000000000000000000000000965aece501d56f56a04f3f7b754965"], 0x0}, 0x48) socket$inet6(0xa, 0x2, 0xfd9) ioctl(r1, 0x10001, &(0x7f0000000100)="153f6234488dd25d766070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket(0xa, 0x3, 0x8) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000500)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f00000002c0)=r5) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x4}) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @remote, 0x4e24, 0x0, 'lblcr\x00', 0x1e, 0x0, 0x13}, {@remote, 0x4e21, 0x7, 0xff, 0x7f, 0x2}}, 0x44) r6 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02\x05\x00\x00\x00\xac', 0x0) write$binfmt_misc(r2, &(0x7f0000000c40)=ANY=[], 0x0) close(r0) dup3(r2, r6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[]}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_sa={0x0, 0x1, 0x4d2, 0x2, 0x6, 0x3, 0x0, 0x20000000}]}, 0xfffffffffffffecf}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff00000000000000000006000000000000000000800000000000e00000010b00000000000000000035000000000000000000000000ff00000000030006000000000002000004000000bb000000000000000003000500000000000200423b000000000000004000000000"], 0x80}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmmsg(r7, &(0x7f0000000180), 0x400000000000117, 0x0) r8 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x1, 0x2) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) futimesat(r8, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000480)={{r9, r10/1000+30000}, {0x77359400}}) listen(r6, 0xfffffffffffffefc) 21:12:51 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x3) write$binfmt_misc(r1, &(0x7f0000000c40)=ANY=[@ANYRES32], 0xff67) sendfile(r0, r1, &(0x7f0000000040), 0x9) fcntl$addseals(r1, 0x409, 0x8) [ 185.903454][ T8217] device gretap0 entered promiscuous mode 21:12:51 executing program 5: r0 = socket$inet_tcp(0x2, 0x3, 0x6) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f0000000500)={&(0x7f0000000080)=@in={0x2, 0x0, @multicast1}, 0x80, 0x0}, 0x8000) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev}, 0x10) write$binfmt_misc(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="04000000"], 0x4) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4001000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)=@del={0xe0, 0x11, 0x20, 0x70bd25, 0x25dfdbfe, {{'xchacha20-neon\x00'}, [], [], 0x2400, 0x400}}, 0xe0}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000014) [ 185.989883][ T8217] bridge0: port 3(gretap0) entered blocking state [ 185.997081][ T8217] bridge0: port 3(gretap0) entered forwarding state [ 186.098102][ T8247] check_preemption_disabled: 3 callbacks suppressed [ 186.098146][ T8247] BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.5/8247 [ 186.106349][ T8247] caller is sk_mc_loop+0x1d/0x210 [ 186.120998][ T8247] CPU: 0 PID: 8247 Comm: syz-executor.5 Not tainted 5.1.0-rc3-next-20190405 #19 [ 186.130138][ T8247] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 186.143066][ T8247] Call Trace: [ 186.143095][ T8247] dump_stack+0x172/0x1f0 [ 186.143127][ T8247] __this_cpu_preempt_check+0x246/0x270 [ 186.143155][ T8247] sk_mc_loop+0x1d/0x210 [ 186.160557][ T8247] ip_mc_output+0x2ef/0xf70 [ 186.165070][ T8247] ? __ip_queue_xmit+0x1bf0/0x1bf0 [ 186.170185][ T8247] ? __ip_queue_xmit+0x1bf0/0x1bf0 [ 186.175317][ T8247] ip_local_out+0xc4/0x1b0 [ 186.179756][ T8247] ip_send_skb+0x42/0xf0 [ 186.184005][ T8247] ip_push_pending_frames+0x64/0x80 [ 186.189226][ T8247] raw_sendmsg+0x1e6d/0x2f20 [ 186.193840][ T8247] ? compat_raw_getsockopt+0x100/0x100 [ 186.199313][ T8247] ? __switch_to_asm+0x40/0x70 [ 186.204086][ T8247] ? __schedule+0x81f/0x1cc0 [ 186.208687][ T8247] ? ___might_sleep+0x163/0x280 [ 186.213567][ T8247] ? ___might_sleep+0x163/0x280 [ 186.219441][ T8247] ? __might_sleep+0x95/0x190 [ 186.224129][ T8247] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 186.229770][ T8247] ? aa_sk_perm+0x288/0x880 [ 186.234292][ T8247] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 186.239950][ T8247] inet_sendmsg+0x147/0x5e0 [ 186.244472][ T8247] ? compat_raw_getsockopt+0x100/0x100 [ 186.249948][ T8247] ? inet_sendmsg+0x147/0x5e0 [ 186.254647][ T8247] ? ipip_gro_receive+0x100/0x100 [ 186.259699][ T8247] sock_sendmsg+0xdd/0x130 [ 186.264139][ T8247] sock_write_iter+0x27c/0x3e0 [ 186.268924][ T8247] ? sock_sendmsg+0x130/0x130 [ 186.273626][ T8247] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 186.279874][ T8247] ? iov_iter_init+0xee/0x220 [ 186.284573][ T8247] new_sync_write+0x4c7/0x760 [ 186.289295][ T8247] ? default_llseek+0x2e0/0x2e0 [ 186.294539][ T8247] ? common_file_perm+0xe7/0x720 [ 186.299501][ T8247] ? common_file_perm+0x238/0x720 [ 186.304528][ T8247] ? __fget+0x381/0x550 [ 186.308690][ T8247] ? apparmor_file_permission+0x25/0x30 [ 186.314259][ T8247] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 186.320522][ T8247] ? security_file_permission+0x94/0x380 [ 186.326173][ T8247] __vfs_write+0xe4/0x110 [ 186.330512][ T8247] vfs_write+0x20c/0x580 [ 186.334788][ T8247] ksys_write+0xea/0x1f0 [ 186.339061][ T8247] ? __ia32_sys_read+0xb0/0xb0 [ 186.344654][ T8247] __x64_sys_write+0x73/0xb0 [ 186.349294][ T8247] do_syscall_64+0x103/0x610 [ 186.353912][ T8247] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 186.359834][ T8247] RIP: 0033:0x4582b9 [ 186.363756][ T8247] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 186.383374][ T8247] RSP: 002b:00007f736c26dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 186.391809][ T8247] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 186.399810][ T8247] RDX: 0000000000000004 RSI: 0000000020000100 RDI: 0000000000000003 [ 186.407981][ T8247] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 186.415977][ T8247] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f736c26e6d4 [ 186.423968][ T8247] R13: 00000000004c7a29 R14: 00000000004ddad8 R15: 00000000ffffffff 21:12:52 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@mcast2, 0x81}) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x800000d) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xd, &(0x7f00000005c0)=ANY=[@ANYBLOB="0500db44c7450000bf7ce676b30007000008000000b4d63a8fe5feaf65060000ffffffff2d020000000000e556b35eb800650404000100000004040000850000001f000001b700e414000000722d000000000000000000000000000000965aece501d56f56a04f3f7b754965"], 0x0}, 0x48) socket$inet6(0xa, 0x2, 0xfd9) ioctl(r1, 0x10001, &(0x7f0000000100)="153f6234488dd25d766070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket(0xa, 0x3, 0x8) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000500)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f00000002c0)=r5) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x4}) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @remote, 0x4e24, 0x0, 'lblcr\x00', 0x1e, 0x0, 0x13}, {@remote, 0x4e21, 0x7, 0xff, 0x7f, 0x2}}, 0x44) r6 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02\x05\x00\x00\x00\xac', 0x0) write$binfmt_misc(r2, &(0x7f0000000c40)=ANY=[], 0x0) close(r0) dup3(r2, r6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[]}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_sa={0x0, 0x1, 0x4d2, 0x2, 0x6, 0x3, 0x0, 0x20000000}]}, 0xfffffffffffffecf}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff00000000000000000006000000000000000000800000000000e00000010b00000000000000000035000000000000000000000000ff00000000030006000000000002000004000000bb000000000000000003000500000000000200423b000000000000004000000000"], 0x80}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmmsg(r7, &(0x7f0000000180), 0x400000000000117, 0x0) r8 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x1, 0x2) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) futimesat(r8, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000480)={{r9, r10/1000+30000}, {0x77359400}}) listen(r6, 0xfffffffffffffefc) 21:12:52 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x40085112, &(0x7f00000000c0)={{0x7fffffff}, {0x4}}) 21:12:52 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@mcast2, 0x81}) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x800000d) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xd, &(0x7f00000005c0)=ANY=[@ANYBLOB="0500db44c7450000bf7ce676b30007000008000000b4d63a8fe5feaf65060000ffffffff2d020000000000e556b35eb800650404000100000004040000850000001f000001b700e414000000722d000000000000000000000000000000965aece501d56f56a04f3f7b754965"], 0x0}, 0x48) socket$inet6(0xa, 0x2, 0xfd9) ioctl(r1, 0x10001, &(0x7f0000000100)="153f6234488dd25d766070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket(0xa, 0x3, 0x8) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000500)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f00000002c0)=r5) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x4}) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @remote, 0x4e24, 0x0, 'lblcr\x00', 0x1e, 0x0, 0x13}, {@remote, 0x4e21, 0x7, 0xff, 0x7f, 0x2}}, 0x44) r6 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02\x05\x00\x00\x00\xac', 0x0) write$binfmt_misc(r2, &(0x7f0000000c40)=ANY=[], 0x0) close(r0) dup3(r2, r6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[]}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_sa={0x0, 0x1, 0x4d2, 0x2, 0x6, 0x3, 0x0, 0x20000000}]}, 0xfffffffffffffecf}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff00000000000000000006000000000000000000800000000000e00000010b00000000000000000035000000000000000000000000ff00000000030006000000000002000004000000bb000000000000000003000500000000000200423b000000000000004000000000"], 0x80}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmmsg(r7, &(0x7f0000000180), 0x400000000000117, 0x0) r8 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x1, 0x2) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) futimesat(r8, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000480)={{r9, r10/1000+30000}, {0x77359400}}) listen(r6, 0xfffffffffffffefc) 21:12:52 executing program 5: r0 = socket$inet_tcp(0x2, 0x3, 0x6) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f0000000500)={&(0x7f0000000080)=@in={0x2, 0x0, @multicast1}, 0x80, 0x0}, 0x8000) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev}, 0x10) write$binfmt_misc(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="04000000"], 0x4) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4001000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)=@del={0xe0, 0x11, 0x20, 0x70bd25, 0x25dfdbfe, {{'xchacha20-neon\x00'}, [], [], 0x2400, 0x400}}, 0xe0}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000014) 21:12:52 executing program 0: syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x3) perf_event_open(&(0x7f000025c000)={0x1000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0x0) r0 = openat$rfkill(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r0, 0x0, 0x0) r1 = memfd_create(&(0x7f0000000180)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\x10\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f\xf3\xc8\xbf\xdd~w\xa6\xbdZ\xe5\xa7\xda\xeb\x03\x98\xfe\xd9,\xa6\'\xb6q\x82\v\xcde7\x19K\xdc\"b\xf5\x8aY\\P\xf2\xcf\xdb\xdc~\xf1}K\x9d%\x1e\xe7\xe1\x12\xc3x\xa2\x19\xf3}\xfe\x8fW\xf9\x13\x1f$\xea\f3b\x1c\xcf\xcf\xb9\x9a\x8d\xa0CS\n\xfc\t\x8b\xe3EP\xc8\xa9o\xde\xf7\x17\xa95\xb125\xdb\x8f\xc2\x03a\x01\xfd\x8b\xad\xea\xb2+\xb3Z0x0) io_submit(r2, 0x1, &(0x7f0000000740)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0}]) [ 186.719878][ T8265] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.3'. [ 186.737552][ T8267] BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.5/8267 [ 186.749825][ T8267] caller is sk_mc_loop+0x1d/0x210 [ 186.755086][ T8267] CPU: 0 PID: 8267 Comm: syz-executor.5 Not tainted 5.1.0-rc3-next-20190405 #19 [ 186.764120][ T8267] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 186.774210][ T8267] Call Trace: [ 186.777515][ T8267] dump_stack+0x172/0x1f0 [ 186.781878][ T8267] __this_cpu_preempt_check+0x246/0x270 [ 186.787461][ T8267] sk_mc_loop+0x1d/0x210 [ 186.791742][ T8267] ip_mc_output+0x2ef/0xf70 [ 186.796275][ T8267] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 186.801774][ T8267] ? __ip_queue_xmit+0x1bf0/0x1bf0 [ 186.806902][ T8267] ? retint_kernel+0x2d/0x2d [ 186.811513][ T8267] ? ip_local_out+0x4b/0x1b0 [ 186.816122][ T8267] ip_local_out+0xc4/0x1b0 21:12:52 executing program 3: r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000002c0)={@multicast2, @local, 0x0, 0x1, [@loopback]}, 0x14) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast2, @local, 0x1, 0x1, [@loopback]}, 0x14) [ 186.820550][ T8267] ip_send_skb+0x42/0xf0 [ 186.824804][ T8267] ip_push_pending_frames+0x64/0x80 [ 186.830012][ T8267] raw_sendmsg+0x1e6d/0x2f20 [ 186.830040][ T8267] ? compat_raw_getsockopt+0x100/0x100 [ 186.830056][ T8267] ? __switch_to_asm+0x40/0x70 [ 186.830079][ T8267] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 186.830097][ T8267] ? trace_hardirqs_on_caller+0x6a/0x220 [ 186.830114][ T8267] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 186.830140][ T8267] ? ___might_sleep+0x163/0x280 [ 186.840221][ T8267] ? __might_sleep+0x95/0x190 [ 186.840243][ T8267] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 186.840259][ T8267] ? aa_sk_perm+0x288/0x880 [ 186.840276][ T8267] ? retint_kernel+0x2d/0x2d [ 186.840298][ T8267] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 186.840316][ T8267] inet_sendmsg+0x147/0x5e0 [ 186.840330][ T8267] ? compat_raw_getsockopt+0x100/0x100 [ 186.840342][ T8267] ? inet_sendmsg+0x147/0x5e0 [ 186.840363][ T8267] ? ipip_gro_receive+0x100/0x100 [ 186.910978][ T8267] sock_sendmsg+0xdd/0x130 [ 186.915411][ T8267] sock_write_iter+0x27c/0x3e0 [ 186.920193][ T8267] ? sock_sendmsg+0x130/0x130 [ 186.924905][ T8267] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 186.931154][ T8267] ? iov_iter_init+0xee/0x220 [ 186.935857][ T8267] new_sync_write+0x4c7/0x760 [ 186.940566][ T8267] ? default_llseek+0x2e0/0x2e0 [ 186.945442][ T8267] ? common_file_perm+0x238/0x720 [ 186.950496][ T8267] ? __fget+0x381/0x550 [ 186.954684][ T8267] ? apparmor_file_permission+0x25/0x30 [ 186.960268][ T8267] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 186.966534][ T8267] ? security_file_permission+0x94/0x380 [ 186.972196][ T8267] __vfs_write+0xe4/0x110 [ 186.976544][ T8267] vfs_write+0x20c/0x580 [ 186.980828][ T8267] ksys_write+0xea/0x1f0 [ 186.985465][ T8267] ? __ia32_sys_read+0xb0/0xb0 [ 186.990275][ T8267] ? do_syscall_64+0x26/0x610 [ 186.994984][ T8267] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 187.001085][ T8267] ? do_syscall_64+0x26/0x610 [ 187.005820][ T8267] __x64_sys_write+0x73/0xb0 [ 187.010457][ T8267] do_syscall_64+0x103/0x610 [ 187.015103][ T8267] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 187.021012][ T8267] RIP: 0033:0x4582b9 [ 187.024918][ T8267] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 187.044537][ T8267] RSP: 002b:00007f736c26dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 187.052976][ T8267] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 187.060977][ T8267] RDX: 0000000000000004 RSI: 0000000020000100 RDI: 0000000000000003 [ 187.068958][ T8267] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 187.076939][ T8267] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f736c26e6d4 [ 187.084923][ T8267] R13: 00000000004c7a29 R14: 00000000004ddad8 R15: 00000000ffffffff 21:12:52 executing program 3: r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000002c0)={@multicast2, @local, 0x0, 0x1, [@loopback]}, 0x14) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast2, @local, 0x1, 0x1, [@loopback]}, 0x14) 21:12:52 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) io_setup(0x82, &(0x7f0000000040)=0x0) io_submit(r2, 0x1, &(0x7f0000000740)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0}]) 21:12:52 executing program 3: r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000002c0)={@multicast2, @local, 0x0, 0x1, [@loopback]}, 0x14) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast2, @local, 0x1, 0x1, [@loopback]}, 0x14) 21:12:53 executing program 5: r0 = socket$inet_tcp(0x2, 0x3, 0x6) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xe}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f0000000500)={&(0x7f0000000080)=@in={0x2, 0x0, @multicast1}, 0x80, 0x0}, 0x8000) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @dev}, 0x10) write$binfmt_misc(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="04000000"], 0x4) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4001000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)=@del={0xe0, 0x11, 0x20, 0x70bd25, 0x25dfdbfe, {{'xchacha20-neon\x00'}, [], [], 0x2400, 0x400}}, 0xe0}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000014) 21:12:53 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@mcast2, 0x81}) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x800000d) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0xd, &(0x7f00000005c0)=ANY=[@ANYBLOB="0500db44c7450000bf7ce676b30007000008000000b4d63a8fe5feaf65060000ffffffff2d020000000000e556b35eb800650404000100000004040000850000001f000001b700e414000000722d000000000000000000000000000000965aece501d56f56a04f3f7b754965"], 0x0}, 0x48) socket$inet6(0xa, 0x2, 0xfd9) ioctl(r1, 0x10001, &(0x7f0000000100)="153f6234488dd25d766070") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket(0xa, 0x3, 0x8) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000400)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000500)=0x0) ioctl$sock_FIOSETOWN(r3, 0x8901, &(0x7f00000002c0)=r5) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x4}) setsockopt$IP_VS_SO_SET_DELDEST(r4, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @remote, 0x4e24, 0x0, 'lblcr\x00', 0x1e, 0x0, 0x13}, {@remote, 0x4e21, 0x7, 0xff, 0x7f, 0x2}}, 0x44) r6 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02\x05\x00\x00\x00\xac', 0x0) write$binfmt_misc(r2, &(0x7f0000000c40)=ANY=[], 0x0) close(r0) dup3(r2, r6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[]}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_sa={0x0, 0x1, 0x4d2, 0x2, 0x6, 0x3, 0x0, 0x20000000}]}, 0xfffffffffffffecf}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff00000000000000000006000000000000000000800000000000e00000010b00000000000000000035000000000000000000000000ff00000000030006000000000002000004000000bb000000000000000003000500000000000200423b000000000000004000000000"], 0x80}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmmsg(r7, &(0x7f0000000180), 0x400000000000117, 0x0) r8 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x1, 0x2) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) futimesat(r8, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000480)={{r9, r10/1000+30000}, {0x77359400}}) listen(r6, 0xfffffffffffffefc) 21:12:53 executing program 1: r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000002c0)={@multicast2, @local, 0x0, 0x1, [@loopback]}, 0x14) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast2, @local, 0x1, 0x1, [@loopback]}, 0x14) [ 187.435936][ T8300] BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.5/8300 [ 187.452674][ T8300] caller is sk_mc_loop+0x1d/0x210 [ 187.458109][ T8300] CPU: 1 PID: 8300 Comm: syz-executor.5 Not tainted 5.1.0-rc3-next-20190405 #19 [ 187.467167][ T8300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 187.477260][ T8300] Call Trace: [ 187.480612][ T8300] dump_stack+0x172/0x1f0 [ 187.484985][ T8300] __this_cpu_preempt_check+0x246/0x270 [ 187.490576][ T8300] sk_mc_loop+0x1d/0x210 [ 187.494848][ T8300] ip_mc_output+0x2ef/0xf70 [ 187.499419][ T8300] ? __ip_queue_xmit+0x1bf0/0x1bf0 [ 187.504597][ T8300] ? ip_append_data.part.0+0x170/0x170 [ 187.510091][ T8300] ? dst_release+0x62/0xb0 [ 187.514544][ T8300] ? __ip_make_skb+0xf93/0x1820 [ 187.519442][ T8300] ip_local_out+0xc4/0x1b0 [ 187.523889][ T8300] ip_send_skb+0x42/0xf0 [ 187.528159][ T8300] ip_push_pending_frames+0x64/0x80 [ 187.533386][ T8300] raw_sendmsg+0x1e6d/0x2f20 [ 187.538028][ T8300] ? compat_raw_getsockopt+0x100/0x100 [ 187.543522][ T8300] ? __switch_to_asm+0x40/0x70 [ 187.548332][ T8300] ? __schedule+0x81f/0x1cc0 [ 187.552973][ T8300] ? ___might_sleep+0x163/0x280 [ 187.557881][ T8300] ? ___might_sleep+0x163/0x280 [ 187.562787][ T8300] ? __might_sleep+0x95/0x190 [ 187.567501][ T8300] ? debug_lockdep_rcu_enabled+0x71/0xa0 [ 187.573151][ T8300] ? aa_sk_perm+0x288/0x880 [ 187.577680][ T8300] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 187.583243][ T8300] inet_sendmsg+0x147/0x5e0 [ 187.587781][ T8300] ? compat_raw_getsockopt+0x100/0x100 [ 187.593289][ T8300] ? inet_sendmsg+0x147/0x5e0 [ 187.597992][ T8300] ? ipip_gro_receive+0x100/0x100 [ 187.603044][ T8300] sock_sendmsg+0xdd/0x130 [ 187.607480][ T8300] sock_write_iter+0x27c/0x3e0 [ 187.612289][ T8300] ? sock_sendmsg+0x130/0x130 [ 187.617031][ T8300] ? aa_path_link+0x460/0x460 [ 187.621734][ T8300] ? find_held_lock+0x35/0x130 [ 187.626522][ T8300] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 187.632794][ T8300] ? iov_iter_init+0xee/0x220 [ 187.637498][ T8300] new_sync_write+0x4c7/0x760 [ 187.642200][ T8300] ? default_llseek+0x2e0/0x2e0 [ 187.647078][ T8300] ? common_file_perm+0x238/0x720 [ 187.652140][ T8300] ? __fget+0x381/0x550 [ 187.656325][ T8300] ? apparmor_file_permission+0x25/0x30 [ 187.661905][ T8300] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 187.668170][ T8300] ? security_file_permission+0x94/0x380 [ 187.673815][ T8300] __vfs_write+0xe4/0x110 [ 187.678158][ T8300] vfs_write+0x20c/0x580 [ 187.682412][ T8300] ksys_write+0xea/0x1f0 [ 187.686668][ T8300] ? __ia32_sys_read+0xb0/0xb0 [ 187.691444][ T8300] ? do_syscall_64+0x26/0x610 [ 187.696124][ T8300] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 187.702208][ T8300] ? do_syscall_64+0x26/0x610 [ 187.706903][ T8300] __x64_sys_write+0x73/0xb0 [ 187.711503][ T8300] do_syscall_64+0x103/0x610 [ 187.716122][ T8300] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 187.722032][ T8300] RIP: 0033:0x4582b9 [ 187.725941][ T8300] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 187.745569][ T8300] RSP: 002b:00007f736c26dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 187.754013][ T8300] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 187.762002][ T8300] RDX: 0000000000000004 RSI: 0000000020000100 RDI: 0000000000000003 [ 187.770000][ T8300] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 187.777980][ T8300] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f736c26e6d4 21:12:53 executing program 3: r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000002c0)={@multicast2, @local, 0x0, 0x1, [@loopback]}, 0x14) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast2, @local, 0x1, 0x1, [@loopback]}, 0x14) 21:12:53 executing program 1: r0 = socket$inet(0x2, 0x3, 0x19) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000002c0)={@multicast2, @local, 0x0, 0x1, [@loopback]}, 0x14) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000180)={@multicast2, @local, 0x1, 0x1, [@loopback]}, 0x14) [ 187.785966][ T8300] R13: 00000000004c7a29 R14: 00000000004ddad8 R15: 00000000ffffffff 21:12:53 executing program 0: syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x3) perf_event_open(&(0x7f000025c000)={0x1000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0x0) r0 = openat$rfkill(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r0, 0x0, 0x0) r1 = memfd_create(&(0x7f0000000180)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\x10\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f\xf3\xc8\xbf\xdd~w\xa6\xbdZ\xe5\xa7\xda\xeb\x03\x98\xfe\xd9,\xa6\'\xb6q\x82\v\xcde7\x19K\xdc\"b\xf5\x8aY\\P\xf2\xcf\xdb\xdc~\xf1}K\x9d%\x1e\xe7\xe1\x12\xc3x\xa2\x19\xf3}\xfe\x8fW\xf9\x13\x1f$\xea\f3b\x1c\xcf\xcf\xb9\x9a\x8d\xa0CS\n\xfc\t\x8b\xe3EP\xc8\xa9o\xde\xf7\x17\xa95\xb125\xdb\x8f\xc2\x03a\x01\xfd\x8b\xad\xea\xb2+\xb3Z0x0) io_submit(r2, 0x1, &(0x7f0000000740)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0}]) 21:12:53 executing program 1: syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x3) perf_event_open(&(0x7f000025c000)={0x1000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0x0) r0 = openat$rfkill(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r0, 0x0, 0x0) r1 = memfd_create(&(0x7f0000000180)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\x10\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f\xf3\xc8\xbf\xdd~w\xa6\xbdZ\xe5\xa7\xda\xeb\x03\x98\xfe\xd9,\xa6\'\xb6q\x82\v\xcde7\x19K\xdc\"b\xf5\x8aY\\P\xf2\xcf\xdb\xdc~\xf1}K\x9d%\x1e\xe7\xe1\x12\xc3x\xa2\x19\xf3}\xfe\x8fW\xf9\x13\x1f$\xea\f3b\x1c\xcf\xcf\xb9\x9a\x8d\xa0CS\n\xfc\t\x8b\xe3EP\xc8\xa9o\xde\xf7\x17\xa95\xb125\xdb\x8f\xc2\x03a\x01\xfd\x8b\xad\xea\xb2+\xb3Z 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 188.497777][ T8339] RSP: 002b:00007f736c26dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 188.506217][ T8339] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 188.514240][ T8339] RDX: 0000000000000004 RSI: 0000000020000100 RDI: 0000000000000003 [ 188.522280][ T8339] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 188.530283][ T8339] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f736c26e6d4 [ 188.538286][ T8339] R13: 00000000004c7a29 R14: 00000000004ddad8 R15: 00000000ffffffff 21:12:54 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) io_setup(0x82, &(0x7f0000000040)=0x0) io_submit(r2, 0x1, &(0x7f0000000740)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0}]) 21:12:54 executing program 4: syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x3) perf_event_open(&(0x7f000025c000)={0x1000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0x0) r0 = openat$rfkill(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r0, 0x0, 0x0) r1 = memfd_create(&(0x7f0000000180)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\x10\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f\xf3\xc8\xbf\xdd~w\xa6\xbdZ\xe5\xa7\xda\xeb\x03\x98\xfe\xd9,\xa6\'\xb6q\x82\v\xcde7\x19K\xdc\"b\xf5\x8aY\\P\xf2\xcf\xdb\xdc~\xf1}K\x9d%\x1e\xe7\xe1\x12\xc3x\xa2\x19\xf3}\xfe\x8fW\xf9\x13\x1f$\xea\f3b\x1c\xcf\xcf\xb9\x9a\x8d\xa0CS\n\xfc\t\x8b\xe3EP\xc8\xa9o\xde\xf7\x17\xa95\xb125\xdb\x8f\xc2\x03a\x01\xfd\x8b\xad\xea\xb2+\xb3Z\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f\xf3\xc8\xbf\xdd~w\xa6\xbdZ\xe5\xa7\xda\xeb\x03\x98\xfe\xd9,\xa6\'\xb6q\x82\v\xcde7\x19K\xdc\"b\xf5\x8aY\\P\xf2\xcf\xdb\xdc~\xf1}K\x9d%\x1e\xe7\xe1\x12\xc3x\xa2\x19\xf3}\xfe\x8fW\xf9\x13\x1f$\xea\f3b\x1c\xcf\xcf\xb9\x9a\x8d\xa0CS\n\xfc\t\x8b\xe3EP\xc8\xa9o\xde\xf7\x17\xa95\xb125\xdb\x8f\xc2\x03a\x01\xfd\x8b\xad\xea\xb2+\xb3Z\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f\xf3\xc8\xbf\xdd~w\xa6\xbdZ\xe5\xa7\xda\xeb\x03\x98\xfe\xd9,\xa6\'\xb6q\x82\v\xcde7\x19K\xdc\"b\xf5\x8aY\\P\xf2\xcf\xdb\xdc~\xf1}K\x9d%\x1e\xe7\xe1\x12\xc3x\xa2\x19\xf3}\xfe\x8fW\xf9\x13\x1f$\xea\f3b\x1c\xcf\xcf\xb9\x9a\x8d\xa0CS\n\xfc\t\x8b\xe3EP\xc8\xa9o\xde\xf7\x17\xa95\xb125\xdb\x8f\xc2\x03a\x01\xfd\x8b\xad\xea\xb2+\xb3Z\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f\xf3\xc8\xbf\xdd~w\xa6\xbdZ\xe5\xa7\xda\xeb\x03\x98\xfe\xd9,\xa6\'\xb6q\x82\v\xcde7\x19K\xdc\"b\xf5\x8aY\\P\xf2\xcf\xdb\xdc~\xf1}K\x9d%\x1e\xe7\xe1\x12\xc3x\xa2\x19\xf3}\xfe\x8fW\xf9\x13\x1f$\xea\f3b\x1c\xcf\xcf\xb9\x9a\x8d\xa0CS\n\xfc\t\x8b\xe3EP\xc8\xa9o\xde\xf7\x17\xa95\xb125\xdb\x8f\xc2\x03a\x01\xfd\x8b\xad\xea\xb2+\xb3Z\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f\xf3\xc8\xbf\xdd~w\xa6\xbdZ\xe5\xa7\xda\xeb\x03\x98\xfe\xd9,\xa6\'\xb6q\x82\v\xcde7\x19K\xdc\"b\xf5\x8aY\\P\xf2\xcf\xdb\xdc~\xf1}K\x9d%\x1e\xe7\xe1\x12\xc3x\xa2\x19\xf3}\xfe\x8fW\xf9\x13\x1f$\xea\f3b\x1c\xcf\xcf\xb9\x9a\x8d\xa0CS\n\xfc\t\x8b\xe3EP\xc8\xa9o\xde\xf7\x17\xa95\xb125\xdb\x8f\xc2\x03a\x01\xfd\x8b\xad\xea\xb2+\xb3Z\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f\xf3\xc8\xbf\xdd~w\xa6\xbdZ\xe5\xa7\xda\xeb\x03\x98\xfe\xd9,\xa6\'\xb6q\x82\v\xcde7\x19K\xdc\"b\xf5\x8aY\\P\xf2\xcf\xdb\xdc~\xf1}K\x9d%\x1e\xe7\xe1\x12\xc3x\xa2\x19\xf3}\xfe\x8fW\xf9\x13\x1f$\xea\f3b\x1c\xcf\xcf\xb9\x9a\x8d\xa0CS\n\xfc\t\x8b\xe3EP\xc8\xa9o\xde\xf7\x17\xa95\xb125\xdb\x8f\xc2\x03a\x01\xfd\x8b\xad\xea\xb2+\xb3Z0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@newlink={0x34, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, '\nond\x00'}, {0x4}}}]}, 0x34}}, 0x0) [ 189.355642][ T26] audit: type=1804 audit(1554585175.085:33): pid=8327 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir279838966/syzkaller.ew0n32/9/bus" dev="sda1" ino=16543 res=1 21:12:55 executing program 3: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(r0, 0x0, 0x0, 0x1000f4) open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) mlockall(0x1) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r0, 0x0, 0x0}, 0x10) lseek(r0, 0x0, 0x4) 21:12:55 executing program 5: syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x3) perf_event_open(&(0x7f000025c000)={0x1000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0x0) r0 = openat$rfkill(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r0, 0x0, 0x0) r1 = memfd_create(&(0x7f0000000180)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\x10\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f\xf3\xc8\xbf\xdd~w\xa6\xbdZ\xe5\xa7\xda\xeb\x03\x98\xfe\xd9,\xa6\'\xb6q\x82\v\xcde7\x19K\xdc\"b\xf5\x8aY\\P\xf2\xcf\xdb\xdc~\xf1}K\x9d%\x1e\xe7\xe1\x12\xc3x\xa2\x19\xf3}\xfe\x8fW\xf9\x13\x1f$\xea\f3b\x1c\xcf\xcf\xb9\x9a\x8d\xa0CS\n\xfc\t\x8b\xe3EP\xc8\xa9o\xde\xf7\x17\xa95\xb125\xdb\x8f\xc2\x03a\x01\xfd\x8b\xad\xea\xb2+\xb3Z\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f\xf3\xc8\xbf\xdd~w\xa6\xbdZ\xe5\xa7\xda\xeb\x03\x98\xfe\xd9,\xa6\'\xb6q\x82\v\xcde7\x19K\xdc\"b\xf5\x8aY\\P\xf2\xcf\xdb\xdc~\xf1}K\x9d%\x1e\xe7\xe1\x12\xc3x\xa2\x19\xf3}\xfe\x8fW\xf9\x13\x1f$\xea\f3b\x1c\xcf\xcf\xb9\x9a\x8d\xa0CS\n\xfc\t\x8b\xe3EP\xc8\xa9o\xde\xf7\x17\xa95\xb125\xdb\x8f\xc2\x03a\x01\xfd\x8b\xad\xea\xb2+\xb3Z\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f\xf3\xc8\xbf\xdd~w\xa6\xbdZ\xe5\xa7\xda\xeb\x03\x98\xfe\xd9,\xa6\'\xb6q\x82\v\xcde7\x19K\xdc\"b\xf5\x8aY\\P\xf2\xcf\xdb\xdc~\xf1}K\x9d%\x1e\xe7\xe1\x12\xc3x\xa2\x19\xf3}\xfe\x8fW\xf9\x13\x1f$\xea\f3b\x1c\xcf\xcf\xb9\x9a\x8d\xa0CS\n\xfc\t\x8b\xe3EP\xc8\xa9o\xde\xf7\x17\xa95\xb125\xdb\x8f\xc2\x03a\x01\xfd\x8b\xad\xea\xb2+\xb3Z0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000000c0)='9p\x00', 0x0, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_mmap='cache=%map'}, {@cachetag={'cachetag', 0x3d, 'mime_typeppp0'}}]}}) 21:12:55 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x22, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0x0) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x7, 0x0, 0x9, 0x2}, 0x10}}, 0x0) 21:12:55 executing program 0: r0 = socket$kcm(0x29, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'veth1_to_bond\x00', &(0x7f0000000000)=@ethtool_stats={0x1b, 0x1, [0x0]}}) 21:12:55 executing program 5: syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x3) perf_event_open(&(0x7f000025c000)={0x1000000002, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0x0) r0 = openat$rfkill(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r0, 0x0, 0x0) r1 = memfd_create(&(0x7f0000000180)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\x10\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f\xf3\xc8\xbf\xdd~w\xa6\xbdZ\xe5\xa7\xda\xeb\x03\x98\xfe\xd9,\xa6\'\xb6q\x82\v\xcde7\x19K\xdc\"b\xf5\x8aY\\P\xf2\xcf\xdb\xdc~\xf1}K\x9d%\x1e\xe7\xe1\x12\xc3x\xa2\x19\xf3}\xfe\x8fW\xf9\x13\x1f$\xea\f3b\x1c\xcf\xcf\xb9\x9a\x8d\xa0CS\n\xfc\t\x8b\xe3EP\xc8\xa9o\xde\xf7\x17\xa95\xb125\xdb\x8f\xc2\x03a\x01\xfd\x8b\xad\xea\xb2+\xb3Z0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000000c0)='9p\x00', 0x0, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_mmap='cache=%map'}, {@cachetag={'cachetag', 0x3d, 'mime_typeppp0'}}]}}) 21:12:56 executing program 2: r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x42) ioctl$FS_IOC_FSGETXATTR(r0, 0x8038550a, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x0, 0x400000, 0x7ff0bdbe}) 21:12:56 executing program 0: r0 = socket$kcm(0x29, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'veth1_to_bond\x00', &(0x7f0000000000)=@ethtool_stats={0x1b, 0x1, [0x0]}}) 21:12:56 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") clone(0xfffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) clone(0x40000104001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) write$P9_ROPEN(0xffffffffffffffff, &(0x7f0000000000)={0x18}, 0x18) tkill(r1, 0x3) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x20000000, 0x9f}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) 21:12:56 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xffffdffffffffffb) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) [ 191.000274][ T8533] vhci_hcd: default hub control req: 7f45 v464c i0002 l769 [ 191.074917][ T8535] 9p: Unknown Cache mode %map [ 191.116425][ T26] audit: type=1804 audit(1554585176.845:35): pid=8541 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir279838966/syzkaller.ew0n32/11/bus" dev="sda1" ino=16520 res=1 21:12:57 executing program 2: r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x42) ioctl$FS_IOC_FSGETXATTR(r0, 0x8038550a, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x0, 0x400000, 0x7ff0bdbe}) 21:12:57 executing program 5: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000140)='/dev/uhid\x00', 0x2, 0x0) r1 = dup2(r0, r0) write$P9_RLERRORu(r1, 0x0, 0x215) 21:12:57 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xffffdffffffffffb) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) [ 191.425689][ T8612] vhci_hcd: default hub control req: 7f45 v464c i0002 l769 21:12:57 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x22, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0x0) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x7, 0x0, 0x9, 0x2}, 0x10}}, 0x0) 21:12:57 executing program 5: r0 = socket(0x10, 0x802, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x101000008912, &(0x7f0000000140)="0adc1f123c123f3188b070") write(r0, &(0x7f0000000040)="2400000020002502075f0b65ff61fc2280000000001000220ee1000c08000d00feff1700", 0x24) 21:12:57 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000000c0)='9p\x00', 0x0, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_mmap='cache=%map'}, {@cachetag={'cachetag', 0x3d, 'mime_typeppp0'}}]}}) 21:12:57 executing program 3: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(r0, 0x0, 0x0, 0x1000f4) open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) mlockall(0x1) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r0, 0x0, 0x0}, 0x10) lseek(r0, 0x0, 0x4) 21:12:57 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xffffdffffffffffb) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) 21:12:57 executing program 2: r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x40000fffffd, 0x42) ioctl$FS_IOC_FSGETXATTR(r0, 0x8038550a, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x0, 0x400000, 0x7ff0bdbe}) [ 191.931656][ T8626] vhci_hcd: default hub control req: 7f45 v464c i0002 l769 [ 191.946385][ T8627] 9p: Unknown Cache mode %map 21:12:57 executing program 2: r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r0, 0x0, 0x1000000000000004, &(0x7f0000000100), 0x4) setsockopt$inet_int(r0, 0x0, 0x7, &(0x7f0000000000)=0x8, 0x4) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000280), 0x10) recvmmsg(r0, &(0x7f0000003d80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 21:12:57 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xffffdffffffffffb) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) 21:12:57 executing program 5: r0 = socket(0x10, 0x802, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x101000008912, &(0x7f0000000140)="0adc1f123c123f3188b070") write(r0, &(0x7f0000000040)="2400000020002502075f0b65ff61fc2280000000001000220ee1000c08000d00feff1700", 0x24) 21:12:57 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000000c0)='9p\x00', 0x0, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_mmap='cache=%map'}, {@cachetag={'cachetag', 0x3d, 'mime_typeppp0'}}]}}) [ 192.094601][ T26] audit: type=1804 audit(1554585177.795:36): pid=8632 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir279838966/syzkaller.ew0n32/12/bus" dev="sda1" ino=16565 res=1 21:12:57 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f00000004c0)={0x7, 0x8, 0xfa00, {r2, 0xebd6}}, 0x10) 21:12:58 executing program 5: r0 = socket(0x10, 0x802, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x101000008912, &(0x7f0000000140)="0adc1f123c123f3188b070") write(r0, &(0x7f0000000040)="2400000020002502075f0b65ff61fc2280000000001000220ee1000c08000d00feff1700", 0x24) [ 192.272379][ T8650] 9p: Unknown Cache mode %map 21:12:58 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x22, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0x0) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x7, 0x0, 0x9, 0x2}, 0x10}}, 0x0) 21:12:58 executing program 0: r0 = socket$inet(0x2, 0x80001, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x4000010000000013, &(0x7f0000000040)=0x1, 0x4) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e23}, 0x10) bind$inet(r0, &(0x7f0000000000)={0x2, 0x400000004e21, @loopback}, 0x10) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e23, @loopback}, 0x10) 21:12:58 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f00000004c0)={0x7, 0x8, 0xfa00, {r2, 0xebd6}}, 0x10) 21:12:58 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB=',lowerdir=.:file0']) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x4) 21:12:58 executing program 5: r0 = socket(0x10, 0x802, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x101000008912, &(0x7f0000000140)="0adc1f123c123f3188b070") write(r0, &(0x7f0000000040)="2400000020002502075f0b65ff61fc2280000000001000220ee1000c08000d00feff1700", 0x24) 21:12:58 executing program 3: r0 = socket$inet(0x2, 0x80001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000180)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 21:12:58 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB=',lowerdir=.:file0']) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x4) 21:12:59 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f00000004c0)={0x7, 0x8, 0xfa00, {r2, 0xebd6}}, 0x10) 21:12:59 executing program 3: r0 = socket$inet(0x2, 0x80001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000180)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 21:12:59 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, 0x0, &(0x7f0000000000)) 21:12:59 executing program 2: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f00000004c0)={0x7, 0x8, 0xfa00, {r2, 0xebd6}}, 0x10) 21:12:59 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB=',lowerdir=.:file0']) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x4) 21:13:00 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x22, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev, 0x1}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) sendmmsg(r1, &(0x7f0000000240), 0x5c3, 0x0) sched_rr_get_interval(0x0, &(0x7f00000000c0)) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x7, 0x0, 0x9, 0x2}, 0x10}}, 0x0) 21:13:00 executing program 5: syz_mount_image$msdos(&(0x7f0000000340)='msdos\x00', &(0x7f0000000280)='./file0\x00', 0xe800, 0x1, &(0x7f0000000180)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) fchdir(r0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000600)='./file0\x00', 0x4000, 0x0) write(r1, &(0x7f0000000400)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sendfile(r1, r2, 0x0, 0xc7000000) 21:13:00 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x20) 21:13:00 executing program 3: r0 = socket$inet(0x2, 0x80001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000180)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) 21:13:00 executing program 1: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB=',lowerdir=.:file0']) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x4) 21:13:00 executing program 0: r0 = socket$inet(0x2, 0x80001, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x4000010000000013, &(0x7f0000000040)=0x1, 0x4) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e23}, 0x10) bind$inet(r0, &(0x7f0000000000)={0x2, 0x400000004e21, @loopback}, 0x10) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e23, @loopback}, 0x10) 21:13:00 executing program 1: socketpair(0x8000000000001e, 0x5, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000805000), 0xfe55) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000785000), 0x34a) sendmmsg$alg(r0, &(0x7f0000000740), 0x1, 0x0) close(r0) read(r1, &(0x7f0000000200)=""/253, 0x3cf) 21:13:00 executing program 3: r0 = socket$inet(0x2, 0x80001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000180)={0x0, 0x1}, 0x8) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1}], 0x1}, 0x0) [ 194.383488][ T26] audit: type=1800 audit(1554585180.115:37): pid=8751 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16590 res=0 [ 194.448361][ T26] audit: type=1804 audit(1554585180.175:38): pid=8751 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir574602337/syzkaller.WF9uVJ/16/file0/file0" dev="sda1" ino=16590 res=1 [ 194.533170][ T26] audit: type=1800 audit(1554585180.175:39): pid=8751 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=16590 res=0 21:13:00 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) setsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f0000000040)=@hopopts={0x0, 0x1, [], [@enc_lim, @enc_lim, @ra]}, 0x18) sendmsg(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) [ 194.658115][ T8772] BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor.2/8772 [ 194.668038][ T8772] caller is ip6_finish_output+0x335/0xdc0 [ 194.673871][ T8772] CPU: 0 PID: 8772 Comm: syz-executor.2 Not tainted 5.1.0-rc3-next-20190405 #19 [ 194.682908][ T8772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 194.692992][ T8772] Call Trace: [ 194.696307][ T8772] dump_stack+0x172/0x1f0 [ 194.700668][ T8772] __this_cpu_preempt_check+0x246/0x270 [ 194.706238][ T8772] ip6_finish_output+0x335/0xdc0 [ 194.711202][ T8772] ip6_output+0x235/0x7f0 [ 194.715561][ T8772] ? ip6_finish_output+0xdc0/0xdc0 [ 194.720707][ T8772] ? ip6_fragment+0x3980/0x3980 [ 194.725595][ T8772] ? ip6_autoflowlabel.part.0+0x70/0x70 [ 194.725647][ T8772] ip6_local_out+0xc4/0x1b0 [ 194.725684][ T8772] ip6_send_skb+0xbb/0x350 [ 194.725713][ T8772] ip6_push_pending_frames+0xc8/0xf0 [ 194.745467][ T8772] rawv6_sendmsg+0x299c/0x35e0 [ 194.750261][ T8772] ? rawv6_getsockopt+0x150/0x150 21:13:00 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f3188b070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x14, r2, 0xd}, 0x14}}, 0x0) [ 194.755306][ T8772] ? aa_profile_af_perm+0x320/0x320 [ 194.760534][ T8772] ? find_held_lock+0x35/0x130 [ 194.765321][ T8772] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 194.771590][ T8772] ? rw_copy_check_uvector+0x2a6/0x330 [ 194.777166][ T8772] ? ___might_sleep+0x163/0x280 [ 194.782028][ T8772] ? __might_sleep+0x95/0x190 [ 194.786760][ T8772] ? aa_sock_msg_perm.isra.0+0xba/0x170 [ 194.786782][ T8772] inet_sendmsg+0x147/0x5e0 [ 194.786807][ T8772] ? rawv6_getsockopt+0x150/0x150 [ 194.801866][ T8772] ? inet_sendmsg+0x147/0x5e0 [ 194.806561][ T8772] ? ipip_gro_receive+0x100/0x100 [ 194.811601][ T8772] sock_sendmsg+0xdd/0x130 [ 194.816040][ T8772] ___sys_sendmsg+0x806/0x930 [ 194.820790][ T8772] ? copy_msghdr_from_user+0x430/0x430 [ 194.826273][ T8772] ? lock_downgrade+0x880/0x880 [ 194.831136][ T8772] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 194.837401][ T8772] ? kasan_check_read+0x11/0x20 [ 194.842274][ T8772] ? __fget+0x381/0x550 [ 194.846457][ T8772] ? ksys_dup3+0x3e0/0x3e0 [ 194.850905][ T8772] ? lock_downgrade+0x880/0x880 [ 194.850927][ T8772] ? __fget_light+0x1a9/0x230 [ 194.850944][ T8772] ? __fdget+0x1b/0x20 [ 194.850961][ T8772] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 194.850982][ T8772] __sys_sendmsg+0x105/0x1d0 [ 194.850995][ T8772] ? __ia32_sys_shutdown+0x80/0x80 [ 194.851021][ T8772] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 194.851035][ T8772] ? do_syscall_64+0x26/0x610 [ 194.851050][ T8772] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 194.851061][ T8772] ? do_syscall_64+0x26/0x610 [ 194.851077][ T8772] __x64_sys_sendmsg+0x78/0xb0 21:13:00 executing program 3: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) poll(&(0x7f00000000c0)=[{r0, 0x4}], 0x1, 0x0) [ 194.851092][ T8772] do_syscall_64+0x103/0x610 [ 194.851110][ T8772] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 194.851122][ T8772] RIP: 0033:0x4582b9 [ 194.851139][ T8772] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 194.851145][ T8772] RSP: 002b:00007f7f6cacec78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 194.851159][ T8772] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 194.851167][ T8772] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000004 [ 194.851184][ T8772] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 194.972599][ T8772] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7f6cacf6d4 [ 194.980601][ T8772] R13: 00000000004c5279 R14: 00000000004d93f8 R15: 00000000ffffffff 21:13:00 executing program 1: syz_open_dev$sndpcmp(&(0x7f0000000240)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl(r0, 0x4143, 0x0) [ 195.127418][ T26] audit: type=1804 audit(1554585180.855:40): pid=8751 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir574602337/syzkaller.WF9uVJ/16/file0/file0" dev="sda1" ino=16590 res=1 [ 195.286135][ T26] audit: type=1804 audit(1554585180.875:41): pid=8787 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir574602337/syzkaller.WF9uVJ/16/file0/file0" dev="sda1" ino=16590 res=1 21:13:01 executing program 3: r0 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x3, 0x2) ioctl$VIDIOC_G_FREQUENCY(r0, 0xc02c5638, &(0x7f00000000c0)) 21:13:01 executing program 0: r0 = socket$inet(0x2, 0x80001, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x4000010000000013, &(0x7f0000000040)=0x1, 0x4) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e23}, 0x10) bind$inet(r0, &(0x7f0000000000)={0x2, 0x400000004e21, @loopback}, 0x10) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e23, @loopback}, 0x10) 21:13:01 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@setlink={0xa0, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_XDP={0x80, 0x2b, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x8}, @IFLA_XDP_FD={0x74, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}}]}]}, 0xa0}}, 0x0) 21:13:01 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x8, 0x4, &(0x7f0000000140)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x5, 0x1, 0x4}]}, &(0x7f0000000100)='GPL\x00'}, 0x48) 21:13:01 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000440)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x5, 0x0, 0x0, {0x0, 0x2710}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "3ce93489ca47e9a5"}}, 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x6, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "a9eb28d9d1b159c7"}}, 0x48}}, 0x0) [ 195.600541][ T8802] netlink: 'syz-executor.5': attribute type 1 has an invalid length. 21:13:01 executing program 3: r0 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000080)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, 0x0) 21:13:01 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x13, 0x76}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x487, &(0x7f000000cf3d)=""/195}, 0x48) [ 195.644829][ T8810] netlink: 'syz-executor.5': attribute type 1 has an invalid length. 21:13:01 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x0, 0x0) ioctl$BLKZEROOUT(r0, 0x125d, &(0x7f0000000080)) 21:13:01 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@setlink={0xa0, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_XDP={0x80, 0x2b, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x8}, @IFLA_XDP_FD={0x74, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}}]}]}, 0xa0}}, 0x0) 21:13:01 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x13, 0x76}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x487, &(0x7f000000cf3d)=""/195}, 0x48) 21:13:01 executing program 1: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x12, r0, 0x0) madvise(&(0x7f0000000000/0xc000)=nil, 0xc000, 0xc) 21:13:01 executing program 3: pipe(0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={@ipv4={[], [], @multicast1}}) syz_open_dev$sndseq(0x0, 0x0, 0x0) ioctl$CAPI_MANUFACTURER_CMD(0xffffffffffffffff, 0xc0104320, 0x0) fchdir(0xffffffffffffffff) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(0xffffffffffffffff, 0x84, 0x78, 0x0, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc\x00', 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x7003, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$netrom_NETROM_T2(0xffffffffffffffff, 0x103, 0x2, &(0x7f0000000080), 0x0) close(0xffffffffffffffff) [ 195.851024][ T8825] netlink: 'syz-executor.5': attribute type 1 has an invalid length. 21:13:01 executing program 2: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x0, 0x0) ioctl$BLKZEROOUT(r0, 0x125d, &(0x7f0000000080))