[   40.957380] audit: type=1800 audit(1559604885.956:30): pid=7613 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2490 res=0
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
Starting mcstransd: 
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   90.522620] kauditd_printk_skb: 4 callbacks suppressed
[   90.522635] audit: type=1400 audit(1559604935.556:35): avc:  denied  { map } for  pid=7786 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
Warning: Permanently added '10.128.0.167' (ECDSA) to the list of known hosts.
2019/06/03 23:35:42 fuzzer started
[   97.036950] audit: type=1400 audit(1559604942.076:36): avc:  denied  { map } for  pid=7795 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
2019/06/03 23:35:44 dialing manager at 10.128.0.105:38735
2019/06/03 23:35:44 syscalls: 2460
2019/06/03 23:35:44 code coverage: enabled
2019/06/03 23:35:44 comparison tracing: enabled
2019/06/03 23:35:44 extra coverage: extra coverage is not supported by the kernel
2019/06/03 23:35:44 setuid sandbox: enabled
2019/06/03 23:35:44 namespace sandbox: enabled
2019/06/03 23:35:44 Android sandbox: /sys/fs/selinux/policy does not exist
2019/06/03 23:35:44 fault injection: enabled
2019/06/03 23:35:44 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2019/06/03 23:35:44 net packet injection: enabled
2019/06/03 23:35:44 net device setup: enabled
23:35:45 executing program 0:
socket$inet(0x10, 0x0, 0x0)
socket$inet_dccp(0x2, 0x6, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000440)='TIPC\x00')
sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0xc0)
syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffff9, 0x0)
fsetxattr$security_evm(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
lsetxattr$security_smack_transmute(0x0, 0x0, &(0x7f0000000280)='TRUE', 0x4, 0x12)
r0 = syz_open_procfs(0x0, 0x0)
setsockopt$inet6_dccp_int(r0, 0x21, 0x0, 0x0, 0x0)
write$FUSE_STATFS(r0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046208, 0x0)

[  100.938159] audit: type=1400 audit(1559604945.976:37): avc:  denied  { map } for  pid=7813 comm="syz-executor.0" path="/sys/kernel/debug/kcov" dev="debugfs" ino=14988 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
[  101.063134] IPVS: ftp: loaded support on port[0] = 21
[  101.073145] NET: Registered protocol family 30
[  101.078227] Failed to register TIPC socket type
23:35:46 executing program 1:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000140)=<r2=>0x0)
openat$dsp(0xffffffffffffff9c, 0x0, 0x2, 0x0)
kcmp$KCMP_EPOLL_TFD(0x0, r2, 0x7, 0xffffffffffffffff, 0x0)
r3 = openat$null(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/null\x00', 0x0, 0x0)
ioctl$ASHMEM_GET_SIZE(r3, 0x7704, 0x0)
getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f00000017c0), 0x0)
r4 = syz_open_dev$cec(0x0, 0x2, 0x2)
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000001500)={0x0, 0x8001}, 0xc)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clone(0x100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
keyctl$set_reqkey_keyring(0xe, 0x0)
keyctl$join(0x1, 0x0)
request_key(&(0x7f0000000000)='user\x00', &(0x7f00000001c0)={'syz', 0xffffffffffffffff, 0xfffffe00}, &(0x7f00000000c0)='\xd1?\xf3\xd7v', 0xfffffffffffffffe)
sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0)
fstatfs(r0, &(0x7f00000002c0)=""/225)

[  101.284491] IPVS: ftp: loaded support on port[0] = 21
[  101.293769] NET: Registered protocol family 30
[  101.298911] Failed to register TIPC socket type
23:35:46 executing program 2:
unshare(0x8000400)
r0 = mq_open(&(0x7f0000000080)='-$\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f00000000c0)={0x0, 0x5, 0x71a})
mq_timedsend(r0, 0x0, 0x0, 0x0, 0x0)
mq_timedreceive(r0, &(0x7f00000021c0)=""/4096, 0x1000, 0x0, 0x0)

[  101.663306] IPVS: ftp: loaded support on port[0] = 21
[  101.690464] NET: Registered protocol family 30
[  101.695175] Failed to register TIPC socket type
23:35:46 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
r1 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10)
r2 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_int(r2, 0x107, 0x9, &(0x7f0000000300)=0x1000, 0x4)
setsockopt$packet_tx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4)
connect$inet(r1, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r1, &(0x7f0000007fc0), 0x4000000000001a8, 0x0)

[  102.200789] IPVS: ftp: loaded support on port[0] = 21
[  102.210648] NET: Registered protocol family 30
[  102.215279] Failed to register TIPC socket type
23:35:47 executing program 4:
r0 = socket(0x1e, 0x5, 0x0)
sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000440)='/', 0x1}], 0x1}, 0x0)
getsockname$inet(r0, &(0x7f0000000000), &(0x7f0000000480)=0x10)
writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000), 0x1e6}], 0x1038)
sendmmsg(r0, &(0x7f0000000080), 0x1c0, 0x0)

[  102.778837] IPVS: ftp: loaded support on port[0] = 21
[  102.808295] NET: Registered protocol family 30
[  102.812920] Failed to register TIPC socket type
23:35:48 executing program 5:
r0 = socket$inet6_udplite(0xa, 0x2, 0x88)
getsockopt$inet6_buf(r0, 0x29, 0x46, 0x0, &(0x7f0000000000))

[  103.449126] IPVS: ftp: loaded support on port[0] = 21
[  103.478729] NET: Registered protocol family 30
[  103.483543] Failed to register TIPC socket type
[  104.252302] chnl_net:caif_netlink_parms(): no params data found
[  104.637594] bridge0: port 1(bridge_slave_0) entered blocking state
[  104.718837] bridge0: port 1(bridge_slave_0) entered disabled state
[  104.827571] device bridge_slave_0 entered promiscuous mode
[  104.987572] bridge0: port 2(bridge_slave_1) entered blocking state
[  104.994025] bridge0: port 2(bridge_slave_1) entered disabled state
[  105.127934] device bridge_slave_1 entered promiscuous mode
[  105.610696] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  105.903101] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  106.410693] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  106.558019] team0: Port device team_slave_0 added
[  106.738343] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  106.897426] team0: Port device team_slave_1 added
[  107.067201] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  107.323578] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  107.802524] device hsr_slave_0 entered promiscuous mode
[  108.139879] device hsr_slave_1 entered promiscuous mode
[  108.271299] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready
[  108.408260] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready
[  108.701106] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  109.347937] 8021q: adding VLAN 0 to HW filter on device bond0
[  109.538683] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  109.707384] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  109.713619] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  109.745674] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  109.946774] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready
[  109.952901] 8021q: adding VLAN 0 to HW filter on device team0
[  110.187419] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  110.194503] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  110.218954] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  110.323643] bridge0: port 1(bridge_slave_0) entered blocking state
[  110.330231] bridge0: port 1(bridge_slave_0) entered forwarding state
[  110.507835] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  110.626345] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  110.633641] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  110.726475] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  110.807058] bridge0: port 2(bridge_slave_1) entered blocking state
[  110.813460] bridge0: port 2(bridge_slave_1) entered forwarding state
[  110.958582] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  111.028109] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  111.179006] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  111.293051] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  111.409436] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  111.529361] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  111.567509] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  111.760635] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  111.857269] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  111.864558] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  112.026679] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  112.187445] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready
[  112.323359] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  112.341536] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  112.546478] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready
[  112.677564] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  112.685364] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  112.871312] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready
[  112.996965] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  113.197926] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
[  113.519034] 8021q: adding VLAN 0 to HW filter on device batadv0
[  113.838715] audit: type=1400 audit(1559604958.876:38): avc:  denied  { associate } for  pid=7814 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1
[  114.808812] audit: type=1400 audit(1559604959.846:39): avc:  denied  { create } for  pid=8298 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[  115.175841] hrtimer: interrupt took 44762 ns
[  115.590368] audit: type=1400 audit(1559604959.956:40): avc:  denied  { write } for  pid=8298 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[  116.625960] audit: type=1400 audit(1559604959.956:41): avc:  denied  { read } for  pid=8298 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
23:36:02 executing program 0:
socket$inet(0x10, 0x0, 0x0)
socket$inet_dccp(0x2, 0x6, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000440)='TIPC\x00')
sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0xc0)
syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffff9, 0x0)
fsetxattr$security_evm(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
lsetxattr$security_smack_transmute(0x0, 0x0, &(0x7f0000000280)='TRUE', 0x4, 0x12)
r0 = syz_open_procfs(0x0, 0x0)
setsockopt$inet6_dccp_int(r0, 0x21, 0x0, 0x0, 0x0)
write$FUSE_STATFS(r0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046208, 0x0)

[  117.717168] binder: 8385:8395 ioctl c0306201 0 returned -14
[  117.971685] audit: type=1400 audit(1559604962.916:42): avc:  denied  { set_context_mgr } for  pid=8385 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1
23:36:03 executing program 0:
socket$inet(0x10, 0x0, 0x0)
socket$inet_dccp(0x2, 0x6, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000440)='TIPC\x00')
sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0xc0)
syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffff9, 0x0)
fsetxattr$security_evm(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
lsetxattr$security_smack_transmute(0x0, 0x0, &(0x7f0000000280)='TRUE', 0x4, 0x12)
r0 = syz_open_procfs(0x0, 0x0)
setsockopt$inet6_dccp_int(r0, 0x21, 0x0, 0x0, 0x0)
write$FUSE_STATFS(r0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046208, 0x0)

[  118.381056] binder: 8443:8446 ioctl c0306201 0 returned -14
23:36:03 executing program 0:
socket$inet(0x10, 0x0, 0x0)
socket$inet_dccp(0x2, 0x6, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000440)='TIPC\x00')
sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0xc0)
syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffff9, 0x0)
fsetxattr$security_evm(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
lsetxattr$security_smack_transmute(0x0, 0x0, &(0x7f0000000280)='TRUE', 0x4, 0x12)
r0 = syz_open_procfs(0x0, 0x0)
setsockopt$inet6_dccp_int(r0, 0x21, 0x0, 0x0, 0x0)
write$FUSE_STATFS(r0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046208, 0x0)

[  118.537959] binder: 8461:8462 ioctl c0306201 0 returned -14
[  118.561493] IPVS: ftp: loaded support on port[0] = 21
[  118.562016] IPVS: ftp: loaded support on port[0] = 21
23:36:03 executing program 0:
socket$inet(0x10, 0x0, 0x0)
socket$inet_dccp(0x2, 0x6, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000440)='TIPC\x00')
sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0xc0)
syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffff9, 0x0)
fsetxattr$security_evm(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
lsetxattr$security_smack_transmute(0x0, 0x0, &(0x7f0000000280)='TRUE', 0x4, 0x12)
r0 = syz_open_procfs(0x0, 0x0)
setsockopt$inet6_dccp_int(r0, 0x21, 0x0, 0x0, 0x0)
write$FUSE_STATFS(r0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046208, 0x0)

[  118.596314] IPVS: ftp: loaded support on port[0] = 21
[  118.613345] NET: Registered protocol family 30
[  118.624793] list_add double add: new=ffffffff892e7630, prev=ffffffff890f3140, next=ffffffff892e7630.
[  118.639670] Failed to register TIPC socket type
[  118.645057] ------------[ cut here ]------------
[  118.649836] kernel BUG at lib/list_debug.c:29!
[  118.656340] invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[  118.661735] CPU: 0 PID: 8464 Comm: syz-executor.1 Not tainted 4.19.47 #19
[  118.669183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  118.678571] RIP: 0010:__list_add_valid.cold+0x26/0x3c
[  118.682736] binder: 8467:8468 ioctl c0306201 0 returned -14
[  118.683771] Code: 56 ff ff ff 4c 89 e1 48 c7 c7 a0 ae 81 87 e8 d0 f3 30 fe 0f 0b 48 89 f2 4c 89 e1 4c 89 ee 48 c7 c7 e0 af 81 87 e8 b9 f3 30 fe <0f> 0b 48 89 f1 48 c7 c7 60 af 81 87 4c 89 e6 e8 a5 f3 30 fe 0f 0b
[  118.683787] RSP: 0018:ffff8880a4ccfb88 EFLAGS: 00010282
[  118.713889] RAX: 0000000000000058 RBX: ffffffff892e74a0 RCX: 0000000000000000
[  118.721152] RDX: 0000000000000000 RSI: ffffffff81559f66 RDI: ffffed1014999f63
[  118.728406] RBP: ffff8880a4ccfba0 R08: 0000000000000058 R09: ffffed1015d03ee3
[  118.735661] R10: ffffed1015d03ee2 R11: ffff8880ae81f717 R12: ffffffff892e7630
[  118.742938] R13: ffffffff892e7630 R14: ffffffff892e7630 R15: ffffffff892e75d0
[  118.750192] FS:  00000000018bd940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
[  118.758406] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  118.764272] CR2: 00007ff704088000 CR3: 0000000076b35000 CR4: 00000000001406f0
[  118.771574] Call Trace:
[  118.774155]  ? mutex_lock_nested+0x16/0x20
[  118.778379]  proto_register+0x459/0x8e0
[  118.782378]  tipc_socket_init+0x1c/0x70
[  118.786337]  tipc_init_net+0x2ed/0x570
[  118.790211]  ? tipc_exit_net+0x40/0x40
[  118.794088]  ops_init+0xb3/0x410
[  118.797443]  setup_net+0x2d3/0x740
[  118.800971]  ? lock_acquire+0x16f/0x3f0
[  118.804930]  ? ops_init+0x410/0x410
[  118.808545]  copy_net_ns+0x1df/0x340
[  118.812244]  create_new_namespaces+0x400/0x7b0
[  118.817190]  unshare_nsproxy_namespaces+0xc2/0x200
[  118.822135]  ksys_unshare+0x440/0x980
[  118.825957]  ? walk_process_tree+0x2c0/0x2c0
[  118.830358]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  118.835097]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  118.840444]  ? do_syscall_64+0x26/0x620
[  118.844426]  ? lockdep_hardirqs_on+0x415/0x5d0
[  118.849005]  __x64_sys_unshare+0x31/0x40
[  118.853054]  do_syscall_64+0xfd/0x620
[  118.856842]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  118.862011] RIP: 0033:0x45bd47
[  118.865189] Code: 00 00 00 b8 63 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 1d 8d fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 10 01 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 fd 8c fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  118.884078] RSP: 002b:00007ffd7a74cf08 EFLAGS: 00000206 ORIG_RAX: 0000000000000110
23:36:03 executing program 0:
socket$inet(0x10, 0x0, 0x0)
socket$inet_dccp(0x2, 0x6, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000440)='TIPC\x00')
sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0xc0)
syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffff9, 0x0)
fsetxattr$security_evm(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
lsetxattr$security_smack_transmute(0x0, 0x0, &(0x7f0000000280)='TRUE', 0x4, 0x12)
r0 = syz_open_procfs(0x0, 0x0)
setsockopt$inet6_dccp_int(r0, 0x21, 0x0, 0x0, 0x0)
write$FUSE_STATFS(r0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046208, 0x0)

[  118.891779] RAX: ffffffffffffffda RBX: 000000000075c9a8 RCX: 000000000045bd47
[  118.899036] RDX: 0000000000000000 RSI: 00007ffd7a74ceb0 RDI: 0000000040000000
[  118.906287] RBP: 00000000000000f8 R08: 0000000000000000 R09: 0000000000000005
[  118.913557] R10: 0000000000000000 R11: 0000000000000206 R12: 000000000075c9a8
[  118.920815] R13: 00007ffd7a74d178 R14: 0000000000000000 R15: 0000000000000000
[  118.928098] Modules linked in:
[  118.931718] ---[ end trace e95979092b36251a ]---
[  118.936858] RIP: 0010:__list_add_valid.cold+0x26/0x3c
[  118.942560] kobject: 'loop0' (00000000a51732c7): kobject_uevent_env
[  118.949308] Code: 56 ff ff ff 4c 89 e1 48 c7 c7 a0 ae 81 87 e8 d0 f3 30 fe 0f 0b 48 89 f2 4c 89 e1 4c 89 ee 48 c7 c7 e0 af 81 87 e8 b9 f3 30 fe <0f> 0b 48 89 f1 48 c7 c7 60 af 81 87 4c 89 e6 e8 a5 f3 30 fe 0f 0b
[  118.970727] kobject: 'loop0' (00000000a51732c7): fill_kobj_path: path = '/devices/virtual/block/loop0'
[  118.981629] RSP: 0018:ffff8880a4ccfb88 EFLAGS: 00010282
[  118.991531] binder: 8470:8471 ioctl c0306201 0 returned -14
23:36:04 executing program 0:
socket$inet(0x10, 0x0, 0x0)
socket$inet_dccp(0x2, 0x6, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000440)='TIPC\x00')
sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0xc0)
syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffff9, 0x0)
fsetxattr$security_evm(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
lsetxattr$security_smack_transmute(0x0, 0x0, &(0x7f0000000280)='TRUE', 0x4, 0x12)
r0 = syz_open_procfs(0x0, 0x0)
setsockopt$inet6_dccp_int(r0, 0x21, 0x0, 0x0, 0x0)
write$FUSE_STATFS(r0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046208, 0x0)

[  119.003860] RAX: 0000000000000058 RBX: ffffffff892e74a0 RCX: 0000000000000000
[  119.013994] IPVS: ftp: loaded support on port[0] = 21
[  119.023055] RDX: 0000000000000000 RSI: ffffffff81559f66 RDI: ffffed1014999f63
[  119.030398] RBP: ffff8880a4ccfba0 R08: 0000000000000058 R09: ffffed1015d03ee3
[  119.033344] kobject: 'loop0' (00000000a51732c7): kobject_uevent_env
[  119.038421] R10: ffffed1015d03ee2 R11: ffff8880ae81f717 R12: ffffffff892e7630
[  119.044352] kobject: 'loop0' (00000000a51732c7): fill_kobj_path: path = '/devices/virtual/block/loop0'
[  119.051898] R13: ffffffff892e7630 R14: ffffffff892e7630 R15: ffffffff892e75d0
[  119.069301] FS:  00000000018bd940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
[  119.077872] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  119.084070] CR2: 0000000000a75e58 CR3: 0000000076b35000 CR4: 00000000001406e0
[  119.091446] Kernel panic - not syncing: Fatal exception
[  119.094133] binder: 8474:8475 ioctl c0306201 0 returned -14
[  119.097702] Kernel Offset: disabled
[  119.107004] Rebooting in 86400 seconds..