[ 56.925405][ T26] audit: type=1800 audit(1572942140.904:25): pid=8747 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 56.970906][ T26] audit: type=1800 audit(1572942140.904:26): pid=8747 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 57.025654][ T26] audit: type=1800 audit(1572942140.904:27): pid=8747 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 57.472957][ T8812] sshd (8812) used greatest stack depth: 22728 bytes left [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.15.228' (ECDSA) to the list of known hosts. 2019/11/05 08:22:31 fuzzer started 2019/11/05 08:22:33 dialing manager at 10.128.0.26:42879 2019/11/05 08:22:33 syscalls: 2566 2019/11/05 08:22:33 code coverage: enabled 2019/11/05 08:22:33 comparison tracing: enabled 2019/11/05 08:22:33 extra coverage: extra coverage is not supported by the kernel 2019/11/05 08:22:33 setuid sandbox: enabled 2019/11/05 08:22:33 namespace sandbox: enabled 2019/11/05 08:22:33 Android sandbox: /sys/fs/selinux/policy does not exist 2019/11/05 08:22:33 fault injection: enabled 2019/11/05 08:22:33 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/11/05 08:22:33 net packet injection: enabled 2019/11/05 08:22:33 net device setup: enabled 2019/11/05 08:22:33 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2019/11/05 08:22:33 devlink PCI setup: PCI device 0000:00:10.0 is not available 08:25:05 executing program 0: wait4(0x0, 0x0, 0x0, 0x0) getpid() r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x24000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)) io_setup(0x8, &(0x7f00000004c0)=0x0) io_submit(r3, 0xc2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x3, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000, 0x200000}]) 08:25:05 executing program 1: r0 = socket$inet6_sctp(0xa, 0x80000000000001, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000107ff8)={0x0, 0x10040000}, 0x8) connect$inet6(r0, &(0x7f00008c0000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000080)={0x0, 0x0, 0x1c2}, 0x8) syzkaller login: [ 222.011465][ T8912] IPVS: ftp: loaded support on port[0] = 21 [ 222.178352][ T8914] IPVS: ftp: loaded support on port[0] = 21 08:25:06 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x13, 0x10, 0x3}, 0x2c) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0xb, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x10000000}, [@map={0x18, 0x0, 0x1, 0x0, r0}]}, &(0x7f0000000440)='syzkaller\x00', 0x5, 0x270, &(0x7f0000000200)=""/144}, 0x48) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") bind$alg(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r1, 0x0, 0xe, 0x1000, &(0x7f0000000100)="a4dbae5a340ce56385b874bfe370", &(0x7f0000002040)=""/4096}, 0x28) [ 222.227951][ T8912] chnl_net:caif_netlink_parms(): no params data found [ 222.323195][ T8912] bridge0: port 1(bridge_slave_0) entered blocking state [ 222.348179][ T8912] bridge0: port 1(bridge_slave_0) entered disabled state [ 222.366696][ T8912] device bridge_slave_0 entered promiscuous mode [ 222.375373][ T8912] bridge0: port 2(bridge_slave_1) entered blocking state [ 222.392181][ T8912] bridge0: port 2(bridge_slave_1) entered disabled state [ 222.401708][ T8912] device bridge_slave_1 entered promiscuous mode [ 222.438215][ T8912] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 222.453603][ T8912] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 08:25:06 executing program 3: perf_event_open(&(0x7f0000000040)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x28, &(0x7f0000000000), 0x4) [ 222.484780][ T8917] IPVS: ftp: loaded support on port[0] = 21 [ 222.560479][ T8912] team0: Port device team_slave_0 added [ 222.592774][ T8914] chnl_net:caif_netlink_parms(): no params data found [ 222.623316][ T8912] team0: Port device team_slave_1 added 08:25:06 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x13, 0x10, 0x3}, 0x2c) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0xb, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x10000000}, [@map={0x18, 0x0, 0x1, 0x0, r0}]}, &(0x7f0000000440)='syzkaller\x00', 0x5, 0x270, &(0x7f0000000200)=""/144}, 0x48) socket$alg(0x26, 0x5, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r1, 0x0, 0xe, 0x1000, &(0x7f0000000100)="a4dbae5a340ce56385b874bfe370", &(0x7f0000002040)=""/4096}, 0x28) [ 222.749849][ T8912] device hsr_slave_0 entered promiscuous mode [ 222.789219][ T8912] device hsr_slave_1 entered promiscuous mode [ 222.875094][ T8920] IPVS: ftp: loaded support on port[0] = 21 [ 222.948265][ T8914] bridge0: port 1(bridge_slave_0) entered blocking state [ 222.955355][ T8914] bridge0: port 1(bridge_slave_0) entered disabled state [ 222.974803][ T8914] device bridge_slave_0 entered promiscuous mode 08:25:07 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt(r0, 0x10e, 0xb, &(0x7f0000000240)="75cc11ec", 0x4) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000000)=0x646, 0x4) sendmsg(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000140)="24000000200007041dfffd946f610500020000001f00000000000800050006000400ff7e", 0x24}], 0x1}, 0x0) [ 223.020702][ T8923] IPVS: ftp: loaded support on port[0] = 21 [ 223.030578][ T8914] bridge0: port 2(bridge_slave_1) entered blocking state [ 223.039448][ T8914] bridge0: port 2(bridge_slave_1) entered disabled state [ 223.052712][ T8914] device bridge_slave_1 entered promiscuous mode [ 223.081499][ T8917] chnl_net:caif_netlink_parms(): no params data found [ 223.180110][ T8914] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 223.223903][ T8914] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 223.237819][ T8917] bridge0: port 1(bridge_slave_0) entered blocking state [ 223.244899][ T8917] bridge0: port 1(bridge_slave_0) entered disabled state [ 223.254155][ T8917] device bridge_slave_0 entered promiscuous mode [ 223.262204][ T8917] bridge0: port 2(bridge_slave_1) entered blocking state [ 223.269431][ T8917] bridge0: port 2(bridge_slave_1) entered disabled state [ 223.277509][ T8917] device bridge_slave_1 entered promiscuous mode [ 223.365445][ T8914] team0: Port device team_slave_0 added [ 223.376335][ T8914] team0: Port device team_slave_1 added [ 223.385858][ T8917] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 223.426924][ T8923] chnl_net:caif_netlink_parms(): no params data found [ 223.441914][ T8917] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 223.442866][ T8925] IPVS: ftp: loaded support on port[0] = 21 [ 223.451338][ T8920] chnl_net:caif_netlink_parms(): no params data found [ 223.525697][ T8920] bridge0: port 1(bridge_slave_0) entered blocking state [ 223.535576][ T8920] bridge0: port 1(bridge_slave_0) entered disabled state [ 223.543402][ T8920] device bridge_slave_0 entered promiscuous mode [ 223.610134][ T8914] device hsr_slave_0 entered promiscuous mode [ 223.676942][ T8914] device hsr_slave_1 entered promiscuous mode [ 223.766839][ T8914] debugfs: Directory 'hsr0' with parent '/' already present! [ 223.777178][ T8917] team0: Port device team_slave_0 added [ 223.783706][ T8920] bridge0: port 2(bridge_slave_1) entered blocking state [ 223.790961][ T8920] bridge0: port 2(bridge_slave_1) entered disabled state [ 223.799050][ T8920] device bridge_slave_1 entered promiscuous mode [ 223.837659][ T8917] team0: Port device team_slave_1 added [ 223.851661][ T8923] bridge0: port 1(bridge_slave_0) entered blocking state [ 223.859718][ T8923] bridge0: port 1(bridge_slave_0) entered disabled state [ 223.870514][ T8923] device bridge_slave_0 entered promiscuous mode [ 223.880974][ T8923] bridge0: port 2(bridge_slave_1) entered blocking state [ 223.888293][ T8923] bridge0: port 2(bridge_slave_1) entered disabled state [ 223.896126][ T8923] device bridge_slave_1 entered promiscuous mode [ 223.905219][ T8920] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 223.937104][ T8923] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 223.955975][ T8920] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 224.029680][ T8917] device hsr_slave_0 entered promiscuous mode [ 224.078225][ T8917] device hsr_slave_1 entered promiscuous mode [ 224.136928][ T8917] debugfs: Directory 'hsr0' with parent '/' already present! [ 224.145885][ T8923] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 224.206304][ T8925] chnl_net:caif_netlink_parms(): no params data found [ 224.224031][ T8920] team0: Port device team_slave_0 added [ 224.237103][ T8920] team0: Port device team_slave_1 added [ 224.309873][ T8920] device hsr_slave_0 entered promiscuous mode [ 224.348223][ T8920] device hsr_slave_1 entered promiscuous mode [ 224.406835][ T8920] debugfs: Directory 'hsr0' with parent '/' already present! [ 224.419159][ T8923] team0: Port device team_slave_0 added [ 224.451746][ T8923] team0: Port device team_slave_1 added [ 224.471414][ T8912] 8021q: adding VLAN 0 to HW filter on device bond0 [ 224.557690][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 224.567936][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 224.620157][ T8923] device hsr_slave_0 entered promiscuous mode [ 224.658866][ T8923] device hsr_slave_1 entered promiscuous mode [ 224.716803][ T8923] debugfs: Directory 'hsr0' with parent '/' already present! [ 224.733060][ T8912] 8021q: adding VLAN 0 to HW filter on device team0 [ 224.741291][ T8925] bridge0: port 1(bridge_slave_0) entered blocking state [ 224.751714][ T8925] bridge0: port 1(bridge_slave_0) entered disabled state [ 224.759726][ T8925] device bridge_slave_0 entered promiscuous mode [ 224.772792][ T8925] bridge0: port 2(bridge_slave_1) entered blocking state [ 224.780125][ T8925] bridge0: port 2(bridge_slave_1) entered disabled state [ 224.788479][ T8925] device bridge_slave_1 entered promiscuous mode [ 224.815286][ T8925] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 224.846973][ T8925] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 224.888655][ T8925] team0: Port device team_slave_0 added [ 224.909988][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 224.919221][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 224.927837][ T3059] bridge0: port 1(bridge_slave_0) entered blocking state [ 224.935146][ T3059] bridge0: port 1(bridge_slave_0) entered forwarding state [ 224.943627][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 224.953944][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 224.962830][ T3059] bridge0: port 2(bridge_slave_1) entered blocking state [ 224.970091][ T3059] bridge0: port 2(bridge_slave_1) entered forwarding state [ 224.977819][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 224.987120][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 224.996866][ T8925] team0: Port device team_slave_1 added [ 225.013268][ T8914] 8021q: adding VLAN 0 to HW filter on device bond0 [ 225.044504][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 225.058214][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 225.071817][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 225.080794][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 225.093022][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 225.160538][ T8925] device hsr_slave_0 entered promiscuous mode [ 225.207092][ T8925] device hsr_slave_1 entered promiscuous mode [ 225.247025][ T8925] debugfs: Directory 'hsr0' with parent '/' already present! [ 225.273555][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 225.282488][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 225.291308][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 225.300384][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 225.309197][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 225.328653][ T8914] 8021q: adding VLAN 0 to HW filter on device team0 [ 225.360184][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 225.368366][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 225.396091][ T8912] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 225.406890][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 225.415530][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 225.424451][ T8928] bridge0: port 1(bridge_slave_0) entered blocking state [ 225.431588][ T8928] bridge0: port 1(bridge_slave_0) entered forwarding state [ 225.439413][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 225.448141][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 225.456869][ T8928] bridge0: port 2(bridge_slave_1) entered blocking state [ 225.463914][ T8928] bridge0: port 2(bridge_slave_1) entered forwarding state [ 225.491267][ T8920] 8021q: adding VLAN 0 to HW filter on device bond0 [ 225.528325][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 225.536269][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 225.545240][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 225.568456][ T8912] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 225.598067][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 225.605570][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 225.622013][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 225.630905][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 225.640136][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 225.648032][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 225.655964][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 225.664692][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 225.673652][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 225.685112][ T8923] 8021q: adding VLAN 0 to HW filter on device bond0 [ 225.699113][ T8920] 8021q: adding VLAN 0 to HW filter on device team0 [ 225.715627][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 225.732471][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 225.741707][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 225.750955][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 225.759674][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 225.768653][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 225.777242][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 225.784303][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 225.796325][ T8917] 8021q: adding VLAN 0 to HW filter on device bond0 [ 225.805526][ T8914] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 225.833858][ T8923] 8021q: adding VLAN 0 to HW filter on device team0 [ 225.843202][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 225.852204][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 225.861300][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 225.870641][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 225.877766][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 225.886161][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 225.895221][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 225.904028][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 225.911798][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 225.928206][ T8917] 8021q: adding VLAN 0 to HW filter on device team0 [ 225.956171][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 225.967573][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 225.976212][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 225.985481][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 225.995363][ T3059] bridge0: port 1(bridge_slave_0) entered blocking state [ 226.002595][ T3059] bridge0: port 1(bridge_slave_0) entered forwarding state [ 226.010598][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 226.019506][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 226.028673][ T3059] bridge0: port 2(bridge_slave_1) entered blocking state [ 226.035826][ T3059] bridge0: port 2(bridge_slave_1) entered forwarding state [ 226.043817][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 226.058253][ T8914] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 226.065857][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 226.074320][ T3059] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 226.112852][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 226.132681][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 226.152573][ T8931] bridge0: port 1(bridge_slave_0) entered blocking state [ 226.159728][ T8931] bridge0: port 1(bridge_slave_0) entered forwarding state [ 226.177004][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 226.185685][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 226.194319][ T8931] bridge0: port 2(bridge_slave_1) entered blocking state [ 226.201528][ T8931] bridge0: port 2(bridge_slave_1) entered forwarding state [ 226.211938][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 226.221099][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 226.230949][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 226.239748][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 226.249066][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 226.258151][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 226.267024][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 226.276090][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 226.286537][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 226.294657][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 226.302822][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 226.310773][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 226.354481][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 226.367661][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 226.376226][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 226.384965][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 226.393509][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 226.402641][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 226.411466][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 226.420035][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 226.428616][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 226.437129][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 226.445643][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 08:25:10 executing program 0: r0 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'dummy0\x00', 0x0}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$packet(r0, &(0x7f0000000000)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) sendmmsg(r0, &(0x7f0000000d00), 0x400004e, 0x0) [ 226.454965][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 226.464803][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 226.478310][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 226.487505][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 226.499529][ T8923] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 226.518571][ T8925] 8021q: adding VLAN 0 to HW filter on device bond0 [ 226.536506][ T8920] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 226.546793][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 226.588246][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 226.595937][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 226.604453][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 226.622880][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 226.643095][ T8920] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 226.672536][ T8925] 8021q: adding VLAN 0 to HW filter on device team0 [ 226.692185][ C0] hrtimer: interrupt took 37571 ns [ 226.706719][ T8917] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 226.731331][ T8917] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 226.744034][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 226.758310][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 226.766267][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 226.788124][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 226.850635][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 226.868386][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 226.875948][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready 08:25:10 executing program 0: syz_emit_ethernet(0x2ea, &(0x7f0000000000)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x223}, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@timestamp={0x44, 0x3c, 0x0, 0x0, 0x0, [{}, {}, {}, {}, {[@empty]}, {}, {}, {}, {[@broadcast]}, {[@remote]}]}, @generic={0x0, 0x1c7}]}}}}}}}, 0x0) [ 226.902786][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 226.915290][ T8926] bridge0: port 1(bridge_slave_0) entered blocking state [ 226.922459][ T8926] bridge0: port 1(bridge_slave_0) entered forwarding state [ 226.937036][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 08:25:10 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r5 = dup2(r3, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) [ 226.945952][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 226.961091][ T8926] bridge0: port 2(bridge_slave_1) entered blocking state [ 226.968245][ T8926] bridge0: port 2(bridge_slave_1) entered forwarding state [ 226.981890][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 226.991752][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 227.006389][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 227.014753][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 227.023201][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 227.036345][ T8917] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 227.053384][ T8923] 8021q: adding VLAN 0 to HW filter on device batadv0 08:25:11 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x380, 0x200007fd, &(0x7f0000000440)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='scalable\x00', 0x9) sendto$inet(r0, &(0x7f00000012c0)="0d268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 227.104248][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 227.125271][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 227.138881][ T8967] l2tp_ppp: sess 4/2: set debug=464c457f [ 227.157187][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 227.164000][ T7] l2tp_core: sess 4/2: closing session [ 227.167986][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 227.231062][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 227.272670][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 227.287980][ T8931] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready 08:25:11 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r5 = dup2(r3, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) [ 227.315368][ T8925] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 227.367073][ T8925] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 227.395431][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 227.409222][ T8926] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 227.428495][ T8982] l2tp_ppp: sess 4/2: set debug=464c457f [ 227.453966][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 227.464775][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 08:25:11 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r5 = dup2(r3, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) [ 227.532654][ T8925] 8021q: adding VLAN 0 to HW filter on device batadv0 08:25:11 executing program 3: io_getevents(0x0, 0x20, 0x5, &(0x7f0000000480)=[{}, {}, {}, {}, {}], 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x7, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) setresgid(0x0, 0xee01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000002c0)=""/23, &(0x7f0000000300)=0x17) perf_event_open(&(0x7f0000000040)={0x0, 0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f000}) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x6, 0x80080) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000440)={0x0, {0x5}}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r5 = syz_open_dev$dmmidi(0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000013000/0x18000)=nil, 0x0, 0x58c854808237c20f, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000180)) accept4$llc(r5, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000003c0)=0x10, 0xc0800) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(r6, 0x40247007, &(0x7f0000000180)={0x0, 0x0, 0x400}) syz_open_procfs(0xffffffffffffffff, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) [ 227.575731][ T8988] BPF:hdr_len not found 08:25:11 executing program 1: ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setns(0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000008040)=[{0x0, 0x0, &(0x7f0000000840)=[{0x0}], 0x1, &(0x7f00000008c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000003500)=""/4096, 0x1000}], 0x1, 0x0, 0x6}, 0x0) [ 227.681848][ T8992] l2tp_ppp: sess 4/2: set debug=464c457f 08:25:11 executing program 2: mkdir(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r4, &(0x7f0000000180)={0x2, 0x4e23, @multicast2}, 0x10) ioctl$FITRIM(r1, 0xc0185879, &(0x7f00000000c0)={0xffffffffffff0001, 0x7, 0x100000001}) setsockopt$inet_tcp_int(r4, 0x6, 0x2, &(0x7f0000000040)=0xfff, 0x4) sendto$inet(r4, 0x0, 0x0, 0x24054095, &(0x7f0000001180)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000001c0)='veth1_to_bridge\x00', 0x10) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(0xffffffffffffffff, 0x4010ae74, &(0x7f0000000080)={0x9, 0x7ff, 0x7f}) sendto$inet(r4, &(0x7f0000000000), 0xfffffffffffffe16, 0x5dc, 0x0, 0xffffffffffffffa0) [ 227.730757][ T8996] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. 08:25:11 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r5 = dup2(r3, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) [ 227.933625][ T9012] l2tp_ppp: sess 4/2: set debug=464c457f 08:25:11 executing program 4: [ 228.008049][ T7] l2tp_core: sess 4/2: closing session [ 228.038326][ T9018] netlink: 'syz-executor.5': attribute type 6 has an invalid length. 08:25:12 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_procfs(0x0, &(0x7f0000000400)='net/fib_triestat\x00') r3 = dup2(r1, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x1c, 0x33, 0x113, 0x0, 0x0, {0x1}, [@generic="ffd38d9b", @nested={0x4, 0x8}]}, 0x1c}}, 0x0) 08:25:12 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r5 = dup2(r3, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) 08:25:12 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e0000001c008105e00f80ecdb4cb9f207c804a01c0000004a0006000a0002000a0ada1b40d805000500c50083b8", 0xa4}], 0x1}, 0x0) [ 228.359579][ T9031] bridge_slave_1: FDB only supports static addresses [ 228.420831][ T9032] bridge_slave_1: FDB only supports static addresses 08:25:12 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r5 = dup2(r3, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) 08:25:12 executing program 1: ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setns(0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000008040)=[{0x0, 0x0, &(0x7f0000000840)=[{0x0}], 0x1, &(0x7f00000008c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000003500)=""/4096, 0x1000}], 0x1, 0x0, 0x6}, 0x0) 08:25:12 executing program 4: mkdir(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) ioctl$TCSETXW(0xffffffffffffffff, 0x5435, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000040)) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r4, &(0x7f0000000180)={0x2, 0x4e23, @multicast2}, 0x10) ioctl$FITRIM(r1, 0xc0185879, &(0x7f00000000c0)={0xffffffffffff0001, 0x7, 0x100000001}) sendto$inet(r4, 0x0, 0x0, 0x24054095, &(0x7f0000001180)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000001c0)='veth1_to_bridge\x00', 0x10) sendto$inet(r4, &(0x7f0000000000), 0xfffffffffffffe16, 0x5dc, 0x0, 0xffffffffffffffa0) 08:25:12 executing program 5: r0 = socket$inet(0x10, 0x2, 0x0) semctl$GETZCNT(0x0, 0x0, 0xf, 0x0) prctl$PR_SET_UNALIGN(0x6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0x4690cf2deae4822b}, [@IFLA_MASTER={0x8, 0xa, r6}]}, 0x28}}, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@empty}}, &(0x7f0000000140)=0xe8) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB, @ANYRES32=r7, @ANYBLOB="74000600a2991f41e065c7baa58c01f08c75189be84fddf2cab50d9247fbd0d3b82ba1f644427a19699083cbf6e3e39f234b8a791bd0e904d567ddfd7afcb799cf6ff23efe967e52d0da83f45168b15c3c7791aa5411f55eaebe7500d8f4cf4ad14ebe6dfc06d7f6d81666270c38f2ad86644d00000008000300fffffffd"], 0x3}}, 0x0) syz_open_procfs$namespace(0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000080), 0x532, 0x1fffffee) close(0xffffffffffffffff) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r8 = accept$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r8, 0x6611) pivot_root(0x0, 0x0) semget(0x0, 0x0, 0x0) socket(0x1, 0x4, 0x40) [ 228.999524][ T9046] device bridge_slave_0 left promiscuous mode [ 229.076643][ T9046] bridge0: port 1(bridge_slave_0) entered disabled state 08:25:13 executing program 4: mkdir(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) ioctl$TCSETXW(0xffffffffffffffff, 0x5435, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, &(0x7f0000000040)) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r4, &(0x7f0000000180)={0x2, 0x4e23, @multicast2}, 0x10) ioctl$FITRIM(r1, 0xc0185879, &(0x7f00000000c0)={0xffffffffffff0001, 0x7, 0x100000001}) sendto$inet(r4, 0x0, 0x0, 0x24054095, &(0x7f0000001180)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000001c0)='veth1_to_bridge\x00', 0x10) sendto$inet(r4, &(0x7f0000000000), 0xfffffffffffffe16, 0x5dc, 0x0, 0xffffffffffffffa0) 08:25:13 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r5 = dup2(r3, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) 08:25:13 executing program 2: mkdir(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(0xffffffffffffffff, 0xc0305302, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r4, &(0x7f0000000180)={0x2, 0x4e23, @multicast2}, 0x10) ioctl$FITRIM(r1, 0xc0185879, &(0x7f00000000c0)={0xffffffffffff0001, 0x7, 0x100000001}) setsockopt$inet_tcp_int(r4, 0x6, 0x2, &(0x7f0000000040)=0xfff, 0x4) sendto$inet(r4, 0x0, 0x0, 0x24054095, &(0x7f0000001180)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000001c0)='veth1_to_bridge\x00', 0x10) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(0xffffffffffffffff, 0x4010ae74, &(0x7f0000000080)={0x9, 0x7ff, 0x7f}) sendto$inet(r4, &(0x7f0000000000), 0xfffffffffffffe16, 0x5dc, 0x0, 0xffffffffffffffa0) 08:25:13 executing program 1: ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setns(0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000008040)=[{0x0, 0x0, &(0x7f0000000840)=[{0x0}], 0x1, &(0x7f00000008c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000003500)=""/4096, 0x1000}], 0x1, 0x0, 0x6}, 0x0) 08:25:13 executing program 3: io_getevents(0x0, 0x20, 0x5, &(0x7f0000000480)=[{}, {}, {}, {}, {}], 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x7, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) setresgid(0x0, 0xee01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000002c0)=""/23, &(0x7f0000000300)=0x17) perf_event_open(&(0x7f0000000040)={0x0, 0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f000}) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x6, 0x80080) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000440)={0x0, {0x5}}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r5 = syz_open_dev$dmmidi(0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000013000/0x18000)=nil, 0x0, 0x58c854808237c20f, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000180)) accept4$llc(r5, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000003c0)=0x10, 0xc0800) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(r6, 0x40247007, &(0x7f0000000180)={0x0, 0x0, 0x400}) syz_open_procfs(0xffffffffffffffff, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) 08:25:13 executing program 5: r0 = socket$inet(0x10, 0x2, 0x0) semctl$GETZCNT(0x0, 0x0, 0xf, 0x0) prctl$PR_SET_UNALIGN(0x6, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0x4690cf2deae4822b}, [@IFLA_MASTER={0x8, 0xa, r6}]}, 0x28}}, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000300)={{{@in=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@empty}}, &(0x7f0000000140)=0xe8) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB, @ANYRES32=r7, @ANYBLOB="74000600a2991f41e065c7baa58c01f08c75189be84fddf2cab50d9247fbd0d3b82ba1f644427a19699083cbf6e3e39f234b8a791bd0e904d567ddfd7afcb799cf6ff23efe967e52d0da83f45168b15c3c7791aa5411f55eaebe7500d8f4cf4ad14ebe6dfc06d7f6d81666270c38f2ad86644d00000008000300fffffffd"], 0x3}}, 0x0) syz_open_procfs$namespace(0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000080), 0x532, 0x1fffffee) close(0xffffffffffffffff) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r8 = accept$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r8, 0x6611) pivot_root(0x0, 0x0) semget(0x0, 0x0, 0x0) socket(0x1, 0x4, 0x40) 08:25:13 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') dup2(r3, r4) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) 08:25:14 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000400)='/proc/capi/capi20\x00', 0x200800, 0x0) getegid() lstat(0x0, &(0x7f0000000240)) socketpair$unix(0x1, 0x5, 0x0, 0x0) fstat(0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000040)=""/2, 0x2}], 0x1, 0x57) getpeername(r0, &(0x7f0000000500)=@hci, 0x0) keyctl$chown(0x4, 0x0, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x110000, 0x0) ioctl$KDENABIO(0xffffffffffffffff, 0x4b36) r1 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x1, 0x2) write$cgroup_subtree(r1, &(0x7f0000000080), 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000900)={0x5, @raw_data="505c631f862d8d38f4ea9bbd00d6e25e2efb4afa4fd49df79e5058d0ce4acc08a81b4eef32e733d658c9b38715fbb4f6fe4e9f19357b24983b35625498c8d32d94b89cce480fc78a24839298205853ed2e2f8917426319d51bcc54c7a3b8e5b5c9d579c985f2709e7c22429dde7e5524e2b767eb263c3dc79b47fc46fa003ab1150874efd688474d19b014e867b7651249f1a2cfd0c87fef34dd111b2a8c01290c62c27456cb98aef0a997ad1d903f83034d248b5898562375e855aa06e0277b482631802a496fdf"}) write$UHID_INPUT2(r1, &(0x7f0000000180)={0xc, 0x18, "f94b30821c9e4b609e1b9e81fdacb96645f06bbb31edf03d"}, 0x1e) socket$inet_udplite(0x2, 0x2, 0x88) syz_open_dev$vbi(&(0x7f0000000440)='/dev/vbi#\x00', 0x0, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5}, [@IFLA_LINKINFO={0x1c, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0xc, 0x2, [@IFLA_BOND_MODE={0x8, 0x1, 0x2}]}}}]}, 0x3c}}, 0x0) [ 230.145535][ T9098] l2tp_ppp: sess 4/2: set debug=464c457f 08:25:14 executing program 5: [ 230.187320][ T7] l2tp_core: sess 4/2: closing session 08:25:14 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') dup2(r3, r4) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) [ 230.291874][ T9101] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 08:25:14 executing program 5: [ 230.395401][ T9107] l2tp_ppp: sess 4/2: set debug=464c457f [ 230.471240][ T406] l2tp_core: sess 4/2: closing session 08:25:14 executing program 5: 08:25:14 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') dup2(r3, r4) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) 08:25:14 executing program 2: [ 230.652677][ T9101] 8021q: adding VLAN 0 to HW filter on device bond1 08:25:14 executing program 5: 08:25:14 executing program 1: ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setns(0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000008040)=[{0x0, 0x0, &(0x7f0000000840)=[{0x0}], 0x1, &(0x7f00000008c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000003500)=""/4096, 0x1000}], 0x1, 0x0, 0x6}, 0x0) [ 230.749570][ T9117] netlink: 'syz-executor.4': attribute type 1 has an invalid length. [ 230.764585][ T9118] l2tp_ppp: sess 4/2: set debug=464c457f [ 231.125100][ T9086] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. 08:25:15 executing program 3: io_getevents(0x0, 0x20, 0x5, &(0x7f0000000480)=[{}, {}, {}, {}, {}], 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x7, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) setresgid(0x0, 0xee01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000002c0)=""/23, &(0x7f0000000300)=0x17) perf_event_open(&(0x7f0000000040)={0x0, 0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f000}) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x6, 0x80080) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000440)={0x0, {0x5}}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r5 = syz_open_dev$dmmidi(0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000013000/0x18000)=nil, 0x0, 0x58c854808237c20f, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000180)) accept4$llc(r5, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000003c0)=0x10, 0xc0800) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(r6, 0x40247007, &(0x7f0000000180)={0x0, 0x0, 0x400}) syz_open_procfs(0xffffffffffffffff, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) 08:25:15 executing program 2: 08:25:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) 08:25:15 executing program 5: 08:25:15 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000400)='/proc/capi/capi20\x00', 0x200800, 0x0) getegid() lstat(0x0, &(0x7f0000000240)) socketpair$unix(0x1, 0x5, 0x0, 0x0) fstat(0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000040)=""/2, 0x2}], 0x1, 0x57) getpeername(r0, &(0x7f0000000500)=@hci, 0x0) keyctl$chown(0x4, 0x0, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x110000, 0x0) ioctl$KDENABIO(0xffffffffffffffff, 0x4b36) r1 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x1, 0x2) write$cgroup_subtree(r1, &(0x7f0000000080), 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000900)={0x5, @raw_data="505c631f862d8d38f4ea9bbd00d6e25e2efb4afa4fd49df79e5058d0ce4acc08a81b4eef32e733d658c9b38715fbb4f6fe4e9f19357b24983b35625498c8d32d94b89cce480fc78a24839298205853ed2e2f8917426319d51bcc54c7a3b8e5b5c9d579c985f2709e7c22429dde7e5524e2b767eb263c3dc79b47fc46fa003ab1150874efd688474d19b014e867b7651249f1a2cfd0c87fef34dd111b2a8c01290c62c27456cb98aef0a997ad1d903f83034d248b5898562375e855aa06e0277b482631802a496fdf"}) write$UHID_INPUT2(r1, &(0x7f0000000180)={0xc, 0x18, "f94b30821c9e4b609e1b9e81fdacb96645f06bbb31edf03d"}, 0x1e) socket$inet_udplite(0x2, 0x2, 0x88) syz_open_dev$vbi(&(0x7f0000000440)='/dev/vbi#\x00', 0x0, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5}, [@IFLA_LINKINFO={0x1c, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0xc, 0x2, [@IFLA_BOND_MODE={0x8, 0x1, 0x2}]}}}]}, 0x3c}}, 0x0) 08:25:15 executing program 1: 08:25:15 executing program 1: 08:25:15 executing program 2: [ 231.375558][ T9137] l2tp_ppp: sess 4/2: set debug=464c457f [ 231.400508][ T9140] netlink: 'syz-executor.4': attribute type 1 has an invalid length. 08:25:15 executing program 5: 08:25:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) 08:25:15 executing program 2: 08:25:15 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) flistxattr(r2, 0x0, 0xffc3) [ 231.633959][ T9152] l2tp_ppp: sess 4/2: set debug=464c457f [ 231.652909][ T120] l2tp_core: sess 4/2: closing session [ 231.995892][ T9140] 8021q: adding VLAN 0 to HW filter on device bond2 [ 232.141163][ T9141] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. 08:25:16 executing program 3: io_getevents(0x0, 0x20, 0x5, &(0x7f0000000480)=[{}, {}, {}, {}, {}], 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x7, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) setresgid(0x0, 0xee01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000002c0)=""/23, &(0x7f0000000300)=0x17) perf_event_open(&(0x7f0000000040)={0x0, 0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f000}) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x6, 0x80080) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000440)={0x0, {0x5}}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r5 = syz_open_dev$dmmidi(0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000013000/0x18000)=nil, 0x0, 0x58c854808237c20f, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000180)) accept4$llc(r5, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000003c0)=0x10, 0xc0800) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(r6, 0x40247007, &(0x7f0000000180)={0x0, 0x0, 0x400}) syz_open_procfs(0xffffffffffffffff, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) 08:25:16 executing program 5: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6100) write$cgroup_type(r0, &(0x7f0000000200)='threaded\x00', 0xf642e7e) 08:25:16 executing program 2: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x9d, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000002a00000084000000000000009500000000000000"], &(0x7f0000000180)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2'}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000740)={r0, 0xc0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000880)={r1}, 0xc) 08:25:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) 08:25:16 executing program 1: 08:25:16 executing program 4: 08:25:16 executing program 1: 08:25:16 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x800002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, @perf_bp={&(0x7f00000001c0), 0x1}}, 0x0, 0xfeffffffffffffff, 0xffffffffffffffff, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_SOCK_GET(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r4, 0x29, 0x44, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000200)=0x1e) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f00000000c0)="0f20d86635200000000f22d826d33566b91109000066b80060000066ba000000000f306766c74424000d0000006766c7442402f60000006766c744240600000000670f0114246766c74424003f8c00006766c7442402e4d400006766c744240600000000670f011424660f38827500b8dd000f00d80f21f30f01c3ddc3", 0x7d}], 0xb, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_TSS_ADDR(r3, 0xae47, 0xd000) r6 = add_key$keyring(0x0, &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$read(0xb, r6, &(0x7f0000000000), 0x0) keyctl$setperm(0x5, r6, 0x20000) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) io_submit(0x0, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x377140be6b5ef4c7}]) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_open_procfs(0x0, 0x0) r7 = socket(0x10, 0x2, 0x0) write(r7, &(0x7f0000000280), 0x0) socket(0x10, 0x2, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000700)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r8, &(0x7f00000007c0)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000780)={&(0x7f0000000580)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000000000000005002a80008000100000000009e000b2e000000f3306ca69a11d245f86a4a2b7250ab39fdc6f8c15ead0e6b2b2592d4ad999abadd77cc928b1260edd0d0345c97630d93a03da2d55486b03ba99c203374d55790aabe7eefd250820123df5c10777827dfe3eedd3f5fa744f5c09691319900022ae24601d58500f8d7bcaecbc762a862ee6d9180dc62ab63ffe1437be86d031fee6289979e5b89e365c32fd163aa98fff90d71b424aba98c63fe6adbf924d0b6645882ff0eef9fc207b4db9873825011ff4670e04a256cbe95afe0b6df748ff30595ce3bbc5921d14a13cd1f4d796631afecfe929ac0c32e15c7bcc01a6c9d3378fa3176eb82ccb2c37b8ea3e0ec7ad04757f8cab92fd52331393c009489"]}, 0x1, 0x0, 0x0, 0xbd81b30298e9f40f}, 0x4000000) [ 232.284948][ T9172] l2tp_ppp: sess 4/2: set debug=464c457f [ 232.312893][ T406] l2tp_core: sess 4/2: closing session 08:25:16 executing program 1: r0 = perf_event_open(&(0x7f000025c000)={0x400000001, 0x70, 0x2005, 0x0, 0x0, 0x0, 0x0, 0x1, 0x9c090, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) 08:25:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r3, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) 08:25:16 executing program 2: r0 = socket(0x200000000000011, 0x4000000000080002, 0x0) sendmmsg(r0, &(0x7f0000000d00), 0x400004e, 0x0) 08:25:16 executing program 5: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x9d, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$set_timeout(0xf, r0, 0x0) [ 232.548241][ T9187] l2tp_ppp: sess 4/2: set debug=464c457f [ 232.618360][ T120] l2tp_core: sess 4/2: closing session [ 232.716502][ T9175] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. 08:25:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r3, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) 08:25:16 executing program 2: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x9d, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = fanotify_init(0x0, 0x0) r1 = epoll_create1(0x0) unshare(0x400) r2 = fcntl$dupfd(r1, 0x2, 0xffffffffffffffff) fanotify_mark(r0, 0x51, 0x10, r2, 0x0) 08:25:16 executing program 3: io_getevents(0x0, 0x20, 0x5, &(0x7f0000000480)=[{}, {}, {}, {}, {}], 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x7, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) setresgid(0x0, 0xee01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000002c0)=""/23, &(0x7f0000000300)=0x17) perf_event_open(&(0x7f0000000040)={0x0, 0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f000}) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x6, 0x80080) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000440)={0x0, {0x5}}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r5 = syz_open_dev$dmmidi(0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000013000/0x18000)=nil, 0x0, 0x58c854808237c20f, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000180)) accept4$llc(r5, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000003c0)=0x10, 0xc0800) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(r6, 0x40247007, &(0x7f0000000180)={0x0, 0x0, 0x400}) syz_open_procfs(0xffffffffffffffff, 0x0) 08:25:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r3, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) [ 232.915619][ T9206] l2tp_ppp: sess 4/2: set debug=464c457f [ 232.929309][ T406] l2tp_core: sess 4/2: closing session 08:25:16 executing program 5: socket$inet_udp(0x2, 0x2, 0x0) socket$packet(0x11, 0x0, 0x300) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040), 0xd537fd8843d15c33) write(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='reno\x00', 0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_origin(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) mmap(&(0x7f0000b32000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x13012, r0, 0x0) 08:25:17 executing program 2: perf_event_open(&(0x7f0000000500)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x0, 0x800) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000002840)={{{@in6=@ipv4={[], [], @dev}, @in6}}, {{@in6=@empty}, 0x0, @in=@empty}}, 0x0) ioctl$BLKZEROOUT(0xffffffffffffffff, 0xc01812f4, &(0x7f0000000100)) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f0000000080)="f2a6bad004b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0x2b}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80000) pipe(&(0x7f0000000000)) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(0xffffffffffffffff, 0x28, 0x0, &(0x7f0000000100)=0x80000000000, 0x8) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x70d, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_LINKINFO={0x1c, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0xc, 0x2, [@IFLA_BOND_MODE={0x8, 0x1, 0x5}]}}}]}, 0x3c}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x20, 0x10, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x10aec61bc6caa7b3}}, 0x20}}, 0x0) 08:25:17 executing program 4: r0 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'dummy0\x00'}) [ 233.087024][ T9213] l2tp_ppp: sess 4/2: set debug=464c457f 08:25:17 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r4 = dup2(0xffffffffffffffff, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) [ 233.305564][ T9222] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 233.324826][ T9222] device veth1_to_team entered promiscuous mode [ 233.406866][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 233.421146][ T9227] l2tp_ppp: sess 4/2: set debug=464c457f 08:25:17 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x13012, r0, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000), 0x10) 08:25:17 executing program 4: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x9d, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) name_to_handle_at(r0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x8}, &(0x7f0000000100), 0x0) 08:25:17 executing program 5: bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) fcntl$setownex(0xffffffffffffffff, 0xf, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000bc0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'vat\x00\x00\x00\x00\x00\x00\x00\xa8\x03\xa4h\x04\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) clock_nanosleep(0x0, 0x0, 0x0, 0x0) pread64(r1, &(0x7f0000000200)=""/39, 0xfdef, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xfffffffffffffe5d, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2800000010005fba000000004000000000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000bc96c7499010528f1346d4cb100c0b4f1ace4aafdf940816f0ebb162677fdfbea1789a1bee3cfe4ef5510068e29e0ef99deaca98b678c787aa1bac18f9a65722b77b711ca136ed7bd478d345150a5d5be39d7d65229ad25fe353892cb8e636a91a61c09d7de089656ea7040ca705c29af6d217be43c92623916d9bc430ff988ead5d1efbe92afa5fdc53dd7b2518138bbf92f199bb62dafbe68246c72a0e27a4f77ca8c418c6454789a90d9a2771c52b6b74665f3f15d2"], 0x28}}, 0x0) dup2(r0, r1) getsockopt$netlink(0xffffffffffffffff, 0x10e, 0x0, 0x0, 0x0) 08:25:17 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r4 = dup2(0xffffffffffffffff, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) [ 233.599650][ T9239] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 233.639763][ T9244] l2tp_ppp: sess 4/2: set debug=464c457f 08:25:17 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$l2tp(0x18, 0x1, 0x1) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r4 = dup2(0xffffffffffffffff, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$l2tp(r2, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r2, 0x111, 0x1, 0x400000, 0x28d) 08:25:17 executing program 4: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0x9d, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) [ 233.772019][ T9253] l2tp_ppp: sess 4/2: set debug=464c457f [ 233.827643][ T9248] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 233.880418][ T9248] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 233.926706][ T9248] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 234.046745][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 234.052964][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 234.136647][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 234.142509][ C0] protocol 88fb is buggy, dev hsr_slave_1 08:25:18 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x13012, r0, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000), 0x10) 08:25:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r4 = dup2(r2, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$l2tp(0xffffffffffffffff, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(0xffffffffffffffff, 0x111, 0x1, 0x400000, 0x28d) 08:25:18 executing program 2: syslog(0x0, &(0x7f00000000c0), 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000002a00), 0x33b}}], 0x1, 0x0, 0x0) r0 = socket(0x1e, 0x1, 0x0) ioctl$IMGETCOUNT(r0, 0x80044943, &(0x7f0000000180)) r1 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ptmx\x00', 0x0, 0x0) dup2(r1, r2) add_key(0x0, 0x0, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) getpid() seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000300)) getpid() syz_init_net_socket$rose(0xb, 0x5, 0x0) writev(r2, &(0x7f00000023c0), 0x1000000000000252) 08:25:18 executing program 4: syslog(0x0, &(0x7f00000000c0), 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000002a00), 0x33b}}], 0x1, 0x0, 0x0) r0 = socket(0x0, 0x1, 0x0) ioctl$IMGETCOUNT(r0, 0x80044943, &(0x7f0000000180)) r1 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ptmx\x00', 0x0, 0x0) dup2(r1, r2) add_key(&(0x7f00000000c0)='cifs.spnego\x00', 0x0, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000300)) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000100)=0x1, 0x4) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f00000002c0)) syz_init_net_socket$rose(0xb, 0x5, 0x0) writev(r2, &(0x7f00000023c0), 0x1000000000000252) 08:25:18 executing program 3: io_getevents(0x0, 0x20, 0x5, &(0x7f0000000480)=[{}, {}, {}, {}, {}], 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x7, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) setresgid(0x0, 0xee01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000002c0)=""/23, &(0x7f0000000300)=0x17) perf_event_open(&(0x7f0000000040)={0x0, 0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f000}) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x6, 0x80080) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000440)={0x0, {0x5}}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r5 = syz_open_dev$dmmidi(0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000013000/0x18000)=nil, 0x0, 0x58c854808237c20f, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000180)) accept4$llc(r5, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000003c0)=0x10, 0xc0800) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(r6, 0x40247007, &(0x7f0000000180)={0x0, 0x0, 0x400}) [ 234.408628][ T9250] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 234.437226][ T9250] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 08:25:18 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x13012, r0, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000), 0x10) 08:25:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r4 = dup2(r2, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$l2tp(0xffffffffffffffff, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(0xffffffffffffffff, 0x111, 0x1, 0x400000, 0x28d) 08:25:18 executing program 4: r0 = fanotify_init(0x0, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000340)='/dev/vbi#\x00', 0x1, 0x2) fanotify_mark(r0, 0x15, 0x30, r1, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/autofs\x00', 0x0, 0x0) 08:25:18 executing program 5: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) write$cgroup_type(r0, &(0x7f0000000200)='threaded\x00', 0xf642e7e) r1 = open(&(0x7f0000000340)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) madvise(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x9) 08:25:18 executing program 2: syslog(0x0, &(0x7f00000000c0), 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) socket(0x0, 0x1, 0x0) r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ptmx\x00', 0x0, 0x0) dup2(r0, r1) add_key(&(0x7f00000000c0)='cifs.spnego\x00', 0x0, 0x0, 0x0, 0x0) 08:25:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r4 = dup2(r2, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$l2tp(0xffffffffffffffff, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(0xffffffffffffffff, 0x111, 0x1, 0x400000, 0x28d) 08:25:18 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x13012, r0, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000), 0x10) 08:25:19 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) fcntl$setownex(0xffffffffffffffff, 0xf, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000bc0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'vat\x00\x00\x00\x00\x00\x00\x00\xa8\x03\xa4h\x04\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) pread64(r1, &(0x7f0000000200)=""/39, 0xfdef, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0xfffffffffffffe5d, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="2800000010005fba000000004000000000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000bc96c7499010528f1346d4cb100c0b4f1ace4aafdf940816f0ebb162677fdfbea1789a1bee3cfe4ef5510068e29e0ef99deaca98b678c787aa1bac18f9a65722b77b711ca136ed7bd478d345150a5d5be39d7d65229ad25fe353892cb8e636a91a61c09d7de089656ea7040ca705c29af6d217be43c92623916d9bc430ff988ead5d1efbe92afa5fdc53dd7b2518138bbf92f199bb62dafbe68246c72a0e27a4f77ca8c418c6454789a90d9a2771c52b6b74665f3f15d2"], 0x28}}, 0x0) dup2(r0, r1) syz_open_procfs(0x0, 0x0) 08:25:19 executing program 2: r0 = gettid() r1 = creat(&(0x7f0000000100)='./file0\x00', 0x10003) write$binfmt_script(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="01e23ddf45f1f8eddb8ee3440fa20c4d99f10cc6297fadb9b3853c78451263e89b340b34dd1361e3d845347b7de0e9a7cc254d6354f9033c3f00ffff009196c72c93c261e3bd2c4c060cfb6e59c3c9"], 0x45) r2 = open(&(0x7f0000000300)='./file0\x00', 0x0, 0x0) fchdir(0xffffffffffffffff) open(&(0x7f0000000500)='./file0\x00', 0x20000, 0x80) fsetxattr$trusted_overlay_upper(r2, &(0x7f0000000000)='trusted.overlay.upper\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="00262ccaa1d17ab99b1c61e88a88ee082e15119d509dc7cb14524a7d97f8df3b547a2868d36ea659408fb5c687a4d217e44a000000000000"], 0x3b, 0x1) socket(0x10, 0x0, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x9) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)) accept4(0xffffffffffffffff, &(0x7f00000003c0)=@alg, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x42, 0x4008001, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0x0, 0xfffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_PTRACER(0x59616d61, r0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x200000000000}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) pipe2$9p(&(0x7f0000000280), 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) 08:25:19 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) socket$l2tp(0x18, 0x1, 0x1) r0 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r3 = dup2(r1, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$l2tp(r0, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r0, 0x111, 0x1, 0x400000, 0x28d) 08:25:19 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000), 0x10) [ 235.153881][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 235.153896][ T26] audit: type=1804 audit(1572942319.134:31): pid=9316 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir185655829/syzkaller.S4xaZB/13/file0" dev="sda1" ino=16563 res=1 [ 235.223878][ T9319] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 235.247169][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 235.253430][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 235.259867][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 235.265431][ T9319] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 235.307001][ T26] audit: type=1804 audit(1572942319.194:32): pid=9316 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir185655829/syzkaller.S4xaZB/13/file0" dev="sda1" ino=16563 res=1 08:25:19 executing program 3: io_getevents(0x0, 0x20, 0x5, &(0x7f0000000480)=[{}, {}, {}, {}, {}], 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x7, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) setresgid(0x0, 0xee01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f00000002c0)=""/23, &(0x7f0000000300)=0x17) perf_event_open(&(0x7f0000000040)={0x0, 0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f000}) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x6, 0x80080) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(0xffffffffffffffff, 0xc0305615, &(0x7f0000000440)={0x0, {0x5}}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r5 = syz_open_dev$dmmidi(0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000013000/0x18000)=nil, 0x0, 0x58c854808237c20f, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000180)) accept4$llc(r5, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000003c0)=0x10, 0xc0800) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(r6, 0x40247007, &(0x7f0000000180)={0x0, 0x0, 0x400}) 08:25:19 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000), 0x10) 08:25:19 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) socket$l2tp(0x18, 0x1, 0x1) r0 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r3 = dup2(r1, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$l2tp(r0, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r0, 0x111, 0x1, 0x400000, 0x28d) 08:25:19 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) socket$l2tp(0x18, 0x1, 0x1) r0 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r3 = dup2(r1, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$l2tp(r0, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r0, 0x111, 0x1, 0x400000, 0x28d) [ 235.947006][ T9319] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 236.332996][ T9337] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. 08:25:20 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') getdents(r0, &(0x7f0000000680)=""/31, 0x1f) 08:25:20 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000), 0x10) 08:25:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r1 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r4 = dup2(r2, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$l2tp(r1, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r1, 0x111, 0x1, 0x400000, 0x28d) 08:25:20 executing program 4: r0 = eventfd(0x2) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) eventfd(0x0) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000080)={r0}) 08:25:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$l2tp(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r1 = socket$l2tp(0x18, 0x1, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_tables_matches\x00') r4 = dup2(r2, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$l2tp(r1, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4, 0x2}}, 0x26) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r1, 0x111, 0x1, 0x400000, 0x28d) [ 236.847507][ T1079] INFO: task khugepaged:1086 blocked for more than 143 seconds. [ 236.855789][ T1079] Not tainted 5.4.0-rc5-next-20191031 #0 [ 236.862111][ T1079] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 236.870890][ T1079] khugepaged D27840 1086 2 0x80004000 [ 236.877292][ T1079] Call Trace: [ 236.880642][ T1079] __schedule+0x94a/0x1e70 [ 236.885056][ T1079] ? __sched_text_start+0x8/0x8 [ 236.890059][ T1079] ? blk_insert_cloned_request+0x530/0x530 [ 236.895913][ T1079] ? _raw_spin_unlock_irq+0x23/0x80 [ 236.901308][ T1079] ? __lock_page+0x3d9/0xab0 [ 236.905895][ T1079] ? _raw_spin_unlock_irq+0x23/0x80 [ 236.911159][ T1079] schedule+0xdc/0x2b0 [ 236.915222][ T1079] io_schedule+0x1c/0x70 [ 236.919610][ T1079] __lock_page+0x422/0xab0 [ 236.924040][ T1079] ? wait_on_page_bit+0xa60/0xa60 [ 236.929137][ T1079] ? page_cache_next_miss+0x340/0x340 [ 236.934523][ T1079] ? ___might_sleep+0x163/0x2c0 [ 236.939444][ T1079] ? __might_sleep+0x95/0x190 [ 236.944130][ T1079] mpage_prepare_extent_to_map+0xb3f/0xf90 [ 236.950434][ T1079] ? mpage_process_page_bufs+0x780/0x780 [ 236.956062][ T1079] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 236.961667][ T1079] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 236.967695][ T1079] ? __kmalloc_node+0xf/0x70 [ 236.972289][ T1079] ext4_writepages+0x954/0x2e70 [ 236.977276][ T1079] ? __this_cpu_preempt_check+0x2c/0x190 [ 236.982918][ T1079] ? __this_cpu_preempt_check+0x35/0x190 [ 236.988601][ T1079] ? retint_kernel+0x2b/0x2b [ 236.993196][ T1079] ? ext4_mark_inode_dirty+0x9b0/0x9b0 [ 236.998758][ T1079] ? 0xffffffff81000000 [ 237.002940][ T1079] ? mark_lock+0xc2/0x1220 [ 237.007609][ T1079] ? prep_new_page+0x19f/0x200 [ 237.012389][ T1079] ? wbc_attach_and_unlock_inode+0x514/0x920 [ 237.018450][ T1079] ? find_held_lock+0x35/0x130 [ 237.023210][ T1079] ? wbc_attach_and_unlock_inode+0x515/0x920 [ 237.029328][ T1079] ? ext4_mark_inode_dirty+0x9b0/0x9b0 [ 237.034787][ T1079] do_writepages+0xfa/0x2a0 [ 237.039371][ T1079] ? do_writepages+0xfa/0x2a0 [ 237.044041][ T1079] ? lock_downgrade+0x920/0x920 [ 237.048968][ T1079] ? page_writeback_cpu_online+0x20/0x20 [ 237.054597][ T1079] ? __kasan_check_read+0x11/0x20 [ 237.059673][ T1079] ? do_raw_spin_unlock+0x57/0x270 [ 237.064778][ T1079] ? _raw_spin_unlock+0x28/0x40 [ 237.069684][ T1079] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 237.075921][ T1079] ? wbc_attach_and_unlock_inode+0x5bf/0x920 [ 237.082090][ T1079] __filemap_fdatawrite_range+0x2bc/0x3b0 [ 237.088444][ T1079] ? delete_from_page_cache_batch+0xfe0/0xfe0 [ 237.094603][ T1079] ? lockdep_hardirqs_on+0x421/0x5e0 [ 237.099977][ T1079] filemap_flush+0x24/0x30 [ 237.104387][ T1079] collapse_file+0x36b1/0x41a0 [ 237.109288][ T1079] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 237.115445][ T1079] ? khugepaged+0x21c0/0x4360 [ 237.120212][ T1079] ? trace_event_raw_event_mm_collapse_huge_page_isolate+0x370/0x370 [ 237.128358][ T1079] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 237.134070][ T1079] ? khugepaged_find_target_node+0x142/0x180 [ 237.140189][ T1079] khugepaged+0x2da9/0x4360 [ 237.144693][ T1079] ? __kasan_check_read+0x11/0x20 [ 237.149776][ T1079] ? __lock_acquire+0x16f2/0x4a00 [ 237.154807][ T1079] ? _raw_spin_unlock_irq+0x23/0x80 [ 237.160085][ T1079] ? finish_task_switch+0x147/0x750 [ 237.165390][ T1079] ? _raw_spin_unlock_irq+0x23/0x80 [ 237.170715][ T1079] ? lockdep_hardirqs_on+0x421/0x5e0 [ 237.176132][ T1079] ? collapse_pte_mapped_thp+0xbe0/0xbe0 [ 237.181827][ T1079] ? lock_downgrade+0x920/0x920 [ 237.186739][ T1079] ? finish_wait+0x260/0x260 [ 237.191495][ T1079] ? lockdep_hardirqs_on+0x421/0x5e0 [ 237.196843][ T1079] ? trace_hardirqs_on+0x67/0x240 [ 237.201869][ T1079] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 237.208142][ T1079] ? __kthread_parkme+0x108/0x1c0 [ 237.213162][ T1079] ? __kasan_check_read+0x11/0x20 [ 237.218279][ T1079] kthread+0x361/0x430 [ 237.222344][ T1079] ? collapse_pte_mapped_thp+0xbe0/0xbe0 [ 237.228146][ T1079] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 237.233863][ T1079] ret_from_fork+0x24/0x30 [ 237.238445][ T1079] [ 237.238445][ T1079] Showing all locks held in the system: [ 237.246166][ T1079] 4 locks held by kworker/u4:1/21: [ 237.251394][ T1079] #0: ffff8880a7c62d28 ((wq_completion)writeback){+.+.}, at: process_one_work+0x88b/0x1740 [ 237.261651][ T1079] #1: ffff8880a9a07dc0 ((work_completion)(&(&wb->dwork)->work)){+.+.}, at: process_one_work+0x8c1/0x1740 [ 237.273009][ T1079] #2: ffff88809ac040d8 (&type->s_umount_key#32){++++}, at: trylock_super+0x22/0x110 [ 237.282663][ T1079] #3: ffff88809ac06990 (&sbi->s_journal_flag_rwsem){.+.+}, at: do_writepages+0xfa/0x2a0 [ 237.292526][ T1079] 1 lock held by khungtaskd/1079: [ 237.297601][ T1079] #0: ffffffff88faba40 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x279 [ 237.307116][ T1079] 1 lock held by khugepaged/1086: [ 237.312135][ T1079] #0: ffff88809ac06990 (&sbi->s_journal_flag_rwsem){.+.+}, at: do_writepages+0xfa/0x2a0 [ 237.322059][ T1079] 2 locks held by getty/8875: [ 237.327172][ T1079] #0: ffff888093b82090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 237.336236][ T1079] #1: ffffc90005f332e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 237.345974][ T1079] 2 locks held by getty/8876: [ 237.350685][ T1079] #0: ffff88809f818090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 237.359775][ T1079] #1: ffffc90005f432e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 237.369378][ T1079] 2 locks held by getty/8877: [ 237.374031][ T1079] #0: ffff8880a075c090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 237.383025][ T1079] #1: ffffc90005f4b2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 237.392712][ T1079] 2 locks held by getty/8878: [ 237.397454][ T1079] #0: ffff88809fd82090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 237.406403][ T1079] #1: ffffc90005f2f2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 237.416072][ T1079] 2 locks held by getty/8879: [ 237.420802][ T1079] #0: ffff8880a0cea090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 237.429806][ T1079] #1: ffffc90005f532e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 237.439515][ T1079] 2 locks held by getty/8880: [ 237.444168][ T1079] #0: ffff88808f263090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 237.453228][ T1079] #1: ffffc90005f4f2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 237.462857][ T1079] 2 locks held by getty/8881: [ 237.467653][ T1079] #0: ffff8880a71fa090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 237.476670][ T1079] #1: ffffc90005f232e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 237.486380][ T1079] [ 237.489518][ T1079] ============================================= [ 237.489518][ T1079] [ 237.498043][ T1079] NMI backtrace for cpu 0 [ 237.502371][ T1079] CPU: 0 PID: 1079 Comm: khungtaskd Not tainted 5.4.0-rc5-next-20191031 #0 [ 237.510940][ T1079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 237.520976][ T1079] Call Trace: [ 237.524319][ T1079] dump_stack+0x172/0x1f0 [ 237.528639][ T1079] nmi_cpu_backtrace.cold+0x70/0xb2 [ 237.533815][ T1079] ? vprintk_func+0x86/0x189 [ 237.538499][ T1079] ? lapic_can_unplug_cpu.cold+0x3a/0x3a [ 237.544120][ T1079] nmi_trigger_cpumask_backtrace+0x23b/0x28b [ 237.550094][ T1079] arch_trigger_cpumask_backtrace+0x14/0x20 [ 237.555970][ T1079] watchdog+0xc8f/0x1350 [ 237.560196][ T1079] kthread+0x361/0x430 [ 237.564243][ T1079] ? reset_hung_task_detector+0x30/0x30 [ 237.569764][ T1079] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 237.575461][ T1079] ret_from_fork+0x24/0x30 [ 237.580184][ T1079] Sending NMI from CPU 0 to CPUs 1: [ 237.585448][ C1] NMI backtrace for cpu 1 skipped: idling at native_safe_halt+0xe/0x10 [ 237.586663][ T1079] Kernel panic - not syncing: hung_task: blocked tasks [ 237.600532][ T1079] CPU: 0 PID: 1079 Comm: khungtaskd Not tainted 5.4.0-rc5-next-20191031 #0 [ 237.609122][ T1079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 237.619159][ T1079] Call Trace: [ 237.622433][ T1079] dump_stack+0x172/0x1f0 [ 237.626754][ T1079] panic+0x2e3/0x75c [ 237.630637][ T1079] ? add_taint.cold+0x16/0x16 [ 237.635304][ T1079] ? lapic_can_unplug_cpu.cold+0x3a/0x3a [ 237.640934][ T1079] ? ___preempt_schedule+0x16/0x18 [ 237.646043][ T1079] ? nmi_trigger_cpumask_backtrace+0x21b/0x28b [ 237.652174][ T1079] ? nmi_trigger_cpumask_backtrace+0x24c/0x28b [ 237.658302][ T1079] ? nmi_trigger_cpumask_backtrace+0x256/0x28b [ 237.664539][ T1079] ? nmi_trigger_cpumask_backtrace+0x21b/0x28b [ 237.670675][ T1079] watchdog+0xca0/0x1350 [ 237.674992][ T1079] kthread+0x361/0x430 [ 237.679040][ T1079] ? reset_hung_task_detector+0x30/0x30 [ 237.684575][ T1079] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 237.690277][ T1079] ret_from_fork+0x24/0x30 [ 237.696847][ T1079] Kernel Offset: disabled [ 237.701217][ T1079] Rebooting in 86400 seconds..