[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 77.743160][ T32] audit: type=1800 audit(1569328563.792:25): pid=11593 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 77.766309][ T32] audit: type=1800 audit(1569328563.812:26): pid=11593 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 77.812304][ T32] audit: type=1800 audit(1569328563.842:27): pid=11593 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.187' (ECDSA) to the list of known hosts. 2019/09/24 12:36:16 fuzzer started 2019/09/24 12:36:20 dialing manager at 10.128.0.26:34199 2019/09/24 12:36:20 syscalls: 2382 2019/09/24 12:36:20 code coverage: enabled 2019/09/24 12:36:20 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/09/24 12:36:20 extra coverage: enabled 2019/09/24 12:36:20 setuid sandbox: enabled 2019/09/24 12:36:20 namespace sandbox: enabled 2019/09/24 12:36:20 Android sandbox: /sys/fs/selinux/policy does not exist 2019/09/24 12:36:20 fault injection: enabled 2019/09/24 12:36:20 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/09/24 12:36:20 net packet injection: enabled 2019/09/24 12:36:20 net device setup: enabled 12:38:56 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f00000000c0)='cgroup.procs\x00', 0x2, 0x0) sendfile(r1, r1, 0x0, 0x10a000d04) syzkaller login: [ 250.720926][T11757] IPVS: ftp: loaded support on port[0] = 21 [ 250.858161][T11757] chnl_net:caif_netlink_parms(): no params data found [ 250.919622][T11757] bridge0: port 1(bridge_slave_0) entered blocking state [ 250.926943][T11757] bridge0: port 1(bridge_slave_0) entered disabled state [ 250.935647][T11757] device bridge_slave_0 entered promiscuous mode [ 250.945763][T11757] bridge0: port 2(bridge_slave_1) entered blocking state [ 250.953048][T11757] bridge0: port 2(bridge_slave_1) entered disabled state [ 250.961673][T11757] device bridge_slave_1 entered promiscuous mode [ 250.993811][T11757] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 251.006711][T11757] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 251.038732][T11757] team0: Port device team_slave_0 added [ 251.048263][T11757] team0: Port device team_slave_1 added [ 251.176640][T11757] device hsr_slave_0 entered promiscuous mode [ 251.442678][T11757] device hsr_slave_1 entered promiscuous mode [ 251.722030][T11757] bridge0: port 2(bridge_slave_1) entered blocking state [ 251.729260][T11757] bridge0: port 2(bridge_slave_1) entered forwarding state [ 251.737066][T11757] bridge0: port 1(bridge_slave_0) entered blocking state [ 251.744300][T11757] bridge0: port 1(bridge_slave_0) entered forwarding state [ 251.820185][T11757] 8021q: adding VLAN 0 to HW filter on device bond0 [ 251.839358][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 251.854643][ T31] bridge0: port 1(bridge_slave_0) entered disabled state [ 251.865409][ T31] bridge0: port 2(bridge_slave_1) entered disabled state [ 251.879474][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 251.898756][T11757] 8021q: adding VLAN 0 to HW filter on device team0 [ 251.912561][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 251.921951][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 251.930937][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 251.938135][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 251.986057][T11757] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 251.996514][T11757] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 252.012422][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 252.021945][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 252.030957][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 252.038294][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 252.047610][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 252.057523][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 252.067404][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 252.077174][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 252.086744][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 252.096433][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 252.106040][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 252.115156][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 252.124982][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 252.134277][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 252.152402][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 252.160962][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 252.182967][T11757] 8021q: adding VLAN 0 to HW filter on device batadv0 12:38:58 executing program 0: process_vm_readv(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="850000002200000007000000000000009500000000000000c256f81ceef4a74d2e3914e3504ee11b525f202c33178114ec6a58e99e37ec61d16ecb6731f0ecd6afb660d265cf02ffdb2d942f36242c7fede3e2d1ea3874207b546b2e6268bd4373cf3066d525719ff1468100ac561d9a62879597f681760601de6540c6ac368eb59bc166bd592f53267e130ee772d98b686d49006afe2111fa694278b371d2a9e7133a6a7b782f16a53d0fe942a0359f0d93a6d3e42b7d0b1b2a3c459327015a"], &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x3c) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={r0, 0xc0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000003c0)={r1}, 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod(0x0, 0x0, 0x0) 12:38:58 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) clock_gettime(0x0, 0x0) write$input_event(r0, 0x0, 0x0) 12:38:58 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000, 0x2, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x24001) 12:38:58 executing program 0: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000200)) sendto$unix(0xffffffffffffffff, 0x0, 0x0, 0x4, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$vsock(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x8108551b, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(0xffffffffffffffff, 0x403c5404, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ion\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240), &(0x7f0000000280)=0x5) setreuid(0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000100)="11") ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f00000004c0)={0x1000000a, 0xfffbffffffffffff}) [ 253.433345][ C0] hrtimer: interrupt took 35017 ns 12:38:59 executing program 0: r0 = shmget(0x2, 0x1000, 0x218, &(0x7f0000ffe000/0x1000)=nil) shmat(r0, &(0x7f0000ffd000/0x2000)=nil, 0x4000) shmctl$IPC_RMID(r0, 0x0) 12:38:59 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x200, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0) set_mempolicy(0x3, &(0x7f0000000040)=0x5, 0x7) readv(r0, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/129, 0x81}], 0x1) socket$caif_seqpacket(0x25, 0x5, 0x1) 12:38:59 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x200, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0) set_mempolicy(0x3, &(0x7f0000000040)=0x5, 0x7) readv(r0, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/129, 0x81}], 0x1) socket$caif_seqpacket(0x25, 0x5, 0x1) 12:39:00 executing program 0: r0 = socket(0x10, 0x802, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000100)=[@in={0x2, 0x4e23, @rand_addr=0xb225}, @in6={0xa, 0x4e23, 0x7, @rand_addr="55091a81861e000800", 0x1}, @in={0x2, 0x4e23, @multicast1}, @in={0x2, 0x4e20, @multicast2}, @in={0x2, 0x4e24, @multicast2}], 0x5c) connect$inet6(r1, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000180)=0x8) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000080)={r3}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000000)={r3, 0x1}, 0x8) 12:39:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca5055e0bcfe47bf070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$caif_stream(0x25, 0x1, 0x4) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000040)={'lo:\x85\xe6\r\x00 \x85\x01\x00\x00\x00\x10\x03\x00', {0x2, 0x0, @rand_addr=0x7fffffff}}) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x4, &(0x7f0000ffd000/0x1000)=nil) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'lo:\x05\xe6\r\x00\x00\x85\x01\x00\x00\x00\x10\x03\x00', {0x2, 0x0, @empty}}) 12:39:00 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000002c0)="6653070000003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab35f4ad614", 0x48}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') writev(r1, &(0x7f0000e11ff0), 0x20000000000000c5) r2 = getpid() tkill(r2, 0x1d) r3 = syz_open_dev$sndmidi(&(0x7f0000000080)='/dev/snd/midiC#D#\x00', 0x5, 0x2000) r4 = getpid() tkill(r4, 0x1d) r5 = getpid() tkill(r5, 0x1d) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r6, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r6, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r7, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r7, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r7, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r8, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r8, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r8, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r9, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r9, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r9, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r10 = fspick(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) r11 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r11, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r11, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r11, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r12 = syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x101, 0x10000) r13 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r13, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) ioctl$VIDIOC_QUERYBUF(r13, 0xc0585609, &(0x7f0000000240)={0x0, 0x0, 0x4, 0x840, {r14, r15/1000+30000}, {0x2, 0x0, 0x20, 0x2, 0x76, 0x72, "214c51e4"}, 0x6, 0x4, @planes=&(0x7f0000000200)={0x65, 0x9, @fd=0xffffffffffffffff, 0x101}, 0x4}) r17 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r17, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r17, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r17, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r18 = getpid() r19 = socket$inet6(0xa, 0x1, 0x0) getsockopt$sock_cred(r19, 0x1, 0x11, &(0x7f0000000640)={0x0, 0x0}, &(0x7f0000000780)=0xc) chown(&(0x7f0000000080)='./file0\x00', r20, 0x0) r21 = getegid() r22 = getpid() tkill(r22, 0x1d) r23 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r23, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r23, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r23, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) getsockopt$sock_cred(r23, 0x1, 0x11, &(0x7f0000000c80)={0x0, 0x0}, &(0x7f0000000cc0)=0xc) stat(&(0x7f0000000d00)='./file0\x00', &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r26 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r26, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r26, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r26, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r27 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r27, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r27, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r27, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r28 = syz_open_dev$loop(&(0x7f0000000dc0)='/dev/loop#\x00', 0xb4f, 0x101000) r29 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000e00)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r30 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r30, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r30, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r30, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r31 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000e40)='/dev/sequencer\x00', 0x80000, 0x0) r32 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000ec0)={&(0x7f0000000e80)='./file0\x00', 0x0, 0x10}, 0x10) r33 = socket$nl_xfrm(0x10, 0x3, 0x6) r34 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r34, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r34, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r34, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r35 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000f00)='/dev/vfio/vfio\x00', 0x0, 0x0) r36 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000003300)=0x0) fstat(0xffffffffffffffff, &(0x7f0000003340)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffffff, &(0x7f00000033c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000003440)='./file0\x00', &(0x7f0000003480)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000a80)='./file0\x00', &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setregid(r41, r42) r43 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$netlink(r1, &(0x7f0000003680)={&(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x20002}, 0xc, &(0x7f0000000100)=[{&(0x7f0000000340)={0x1ec, 0x18, 0x1, 0x70bd2a, 0x25dfdbfd, "", [@generic="36ca8fc0e3bef0435682fc8ccc8ae6c039df8b2ccdd017a499926387282ddc1c48fa", @nested={0x1b0, 0x5d, [@generic="1353a6058437c1197b292436701254b475a2bf24d16908b7d2071c3a73aff5c965b77fbb8bb0f1035e045cb58d2eb9c27e41d38360255042e0a5fbf6463f1e25865e58f0eba3530be45c545f47c1c4d186b3297e7882ad0b7213d3d69c1953d3430e1e8c4972be", @typed={0x8, 0x30, @pid=r2}, @generic="ae9b4c1df2c10222b1d742f62b9d79dc6182d2ab781961b7b7960639a810f06106a28b26cd1c3bb7290beb", @generic="d08274beeea08781410dc2075ee4c933472c467f208827c2128863ae17029878", @typed={0x8, 0x7c, @pid=0xffffffffffffffff}, @generic="bc7f66b3010628649acc2816669908e015adbc760bb21fcc93d51ce1f1a742538bc4b974de775a4d9d6c25e09ed6519ee55e6e37f17bbcfb52ca5ef256477c958f797256fe912c71", @generic="3ecff100b1c9e626f2c91fd1b1e15b06379d6aa9b1705bbc733a7bf9ef28d3a10480c85c79004b26ff650a89faa10b7c1bfe77cc8875bb9a80b87735ee071f0fa64585fe741ee6b8a6d1eac60aad5a3c86a1b017a45b7ad9390685a51b6a176417927ca65652393d2118faaf4b6d7a5d76f5d4f91cb57545993cf11f706c52168ed133b839207765177ec3b5d2ed7150ce3d17a85ff144dc6f2f60618a23d53397"]}, @typed={0x4, 0x4c}, @nested={0x4}]}, 0x1ec}, {&(0x7f0000000040)={0x18, 0x18, 0x480, 0x70bd26, 0x25dfdbfe, "", [@typed={0x8, 0x65, @pid=0xffffffffffffffff}]}, 0x18}, {&(0x7f0000000540)={0x460, 0x20, 0x4, 0x70bd2b, 0x25dfdbfb, "", [@generic="a75378aaa62018d82e5dd8f51e5143ff3b3ee6aaf3dd0c39071e11c658b20320c1ba224d8651394147", @generic="2ce94d842aca0d1991d03f61f726f5be9ea639c94beb5bda94347379b53a1e8cb83fa07bcdcaf1b9612c88cc2947e8e7ee5297061b6616640777e519c8cc9c51f645084963f11a38dd376d4546632d1d38f352479f3e2a6ef091e93e9619e6f7fd6b6227dde6db6ddda949233f36cd8c6ecf8af7c23eea01bdd6c15efcea0a25d33303d94e1f94c35706524f03f4c22d6b593e1d37d62093da705b165feaef354267092dbb610646dfd2c77b67ee16e9b5a68b910ba31e68c97b61", @nested={0x164, 0x1f, [@typed={0x8, 0x12, @fd=r3}, @generic="510cee45d3bd86b1e10e7386b2955df61f07d2bbc6d4cfb37c5baad57fcd917b7b0f578e7266f01093e504d32a63dac940261cd878842787de8cb56e31f4a4caf6bc753a7bd203647a660404b2aa08bf4d7fac4dbf98caf276dab844a4618d13", @generic="e9050bf8ae7542cce877f5ab13d25d9325b5f935e512ced9e8b8b8acca7d8d454a7d97d66f3c0a37cdafa33c4ceee79435aa634bfa3ae4924866a7d6109cdea80265d5693d05533d4462f44bfe889a8c0e21cdfb264920a937720596303ca74373aa69428ece980b669a5ae5cce38d4f7897ad0fde24c7df5bc525d5ebf396c6f49b604c9d0eda794050cb1c72c0", @generic="09ff950cc846039d3a6e6d18af71e3f7a026ae817edda357e7fa50a05bad3132ec7fa20009dc24919002933d0d28ed83ea1eaa4c336ac7731771cfd75ab9362c8f73cf9e4e79c37ca090c4132316d78826fbee66885a2e4ed68b1d4c1d6f671c5a93ab31c2535c2256"]}, @typed={0x8, 0x8d, @pid=r4}, @typed={0x8, 0x6c, @pid=r0}, @nested={0x38, 0x55, [@typed={0xc, 0x43, @u64=0x1f}, @typed={0x8, 0x66, @pid=r5}, @generic="c149ea10aa5c20ec639e79df44130fa704d0511b869b25f5", @typed={0x8, 0x21, @u32=0x5d}]}, @generic="31aabc007044c0c343d51f70a83056705a38246d87f0d3b00b51a44410d8ceb4924a53c159a5bf31491885b488347d94377a0418052c2ccd69f9441fe5944c6359afe2c98eb98e354c89324ac4b6d445eaf811a8734f434814f2f28130a76ae12bbc34830412530008a42fa7ea2498893bf3fe213df06f8666db307f244c8c337a96b120e2da40be98769d0cf981aa768a7bc5bdc57b53b9ecbf8fa9dfd861975304d14a6d422e1706015c848db420adfb06f34a3b28cdffb9ce4b3178f448fb97e21e6856be2bf423e5b634dd731da5", @generic="7e4c87a10f2a0138c44bb95e1d99f3e69f92f759f96f7d98331c02733db84c556a4ec4c182c89853ac207ad87b045fb80bdc528bcc1d284ed8be410fb44d069389663232c23a52ecd1b705a46269197d6586beab880251a28b67b7b72de8e45be2b538a3ee55c3cb7f9f9b7f31b69cf9ea73f89ace937d3a6f52c066b7e8bb9c846a9e45eafa479b5643d316ace151eb52ac086c32b00adae37a899d6d36745d02412ffa46785262ebede9b30e6fd72a99a8612e0d83103638ab092df397b1ecf94a2f5efdd1a89933d30a40cebabd0d5bc1a250c08e434b78aecf39307302ccd05fd4ea197f2101a9e0786040"]}, 0x460}, {&(0x7f00000009c0)={0x284, 0x3c, 0x4, 0x70bd2c, 0x25dfdbfc, "", [@nested={0x1e8, 0x20, [@generic="d1abb76e2be1250962e8f12996b378de4d46a0d2efbd93c7373b542abb530674137c8592c94e2624dab22d4e6fa34f59a9a5e241440bfef28b7c955f74f3a9504521f3bc26ef98095bd3ee826a6eb49f80f47212fbfeac531a56a6c8286ff25d3d743f704a66a4953318a6949c1678d60be63d3d8017cc05909862a5bc0dc82a6288bf19b744869a4470e505bf73427fb87883544eebbc493e30b88935b6a70160445ffd06eb206a7eeb8873ef30c6d52e9807c8301bcdf86d87a3797a7bb3d965ab8703f35deaa8502bc7cb6580ab05eb65b281c57c2019b064eda885d1e2", @generic="bdaec8eccd78029b348334ff7b4efa731f0955c9471b82f0f5b426b64c0e24d151f35d5330606a23fd2005eb066b98bd6a47180bb986a0b5edc37404f5a7f55448fd577d71b47433424875f77cd374cc4ad0c442426e1f72954bb7c5617b4ecd8a9976217e1b9761a782ddc07a4a5f6f222b8172a9f627f5c6d521fc650e98f0710b4518012090d3a2fc337734b4df050c931d6ae17d1037775fa0786903a2290f8c153e58dbbade9ef62e223ffaed9cdbaceb6e4a2afcad8a636b4632ed07baca26e0b5a274762714146ceaef4befb5072a7ca6869f9c3488825e622860a3c215413782dc34af55433ffde519f8c45ff223", @typed={0x4, 0x65}, @typed={0xc, 0xc, @u64=0xb4}]}, @generic="209ab6d6818672735f1cdc60aa5c7e83554100d2750e1aa2e1ae71e6aa0cf57aea27305e712f24e10a7bc78e562b2701b5bfc7daf2b713b8b993d3d8e0c074754aa637f6d2", @generic="04d3546b89174da1eecc5392b9cd227769bc842b9a56a51ee4482c16179cf2a9ce0df6a04bf617de4d0ca67b0bdf181f5d889adab35539c361c8d8df385ce5fe5e5039eb47"]}, 0x284}], 0x4, &(0x7f0000003500)=[@rights={{0x20, 0x1, 0x1, [r6, r7, r8, r9]}}, @rights={{0x10}}, @rights={{0x24, 0x1, 0x1, [r10, r11, r12, r16, r17]}}, @cred={{0x1c, 0x1, 0x2, {r18, r20, r21}}}, @cred={{0x1c, 0x1, 0x2, {r22, r24, r25}}}, @rights={{0x34, 0x1, 0x1, [r26, 0xffffffffffffffff, r27, r28, 0xffffffffffffffff, r29, r30, r31, r32]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, r33, r34, r35, r36]}}, @cred={{0x1c, 0x1, 0x2, {r37, r38, r39}}}, @cred={{0x1c, 0x1, 0x2, {r0, r40, r41}}}, @rights={{0x14, 0x1, 0x1, [r43]}}], 0x150, 0x1}, 0x80) ptrace$cont(0x9, r0, 0x0, 0x0) 12:39:00 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000640)={0x0, 0x0}, &(0x7f0000000780)=0xc) chown(&(0x7f0000000080)='./file0\x00', r1, 0x0) lsetxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='security.capability\x00', &(0x7f00000000c0)=@v3={0x3000000, [{0x3ff}, {0x0, 0x2}], r1}, 0x18, 0x0) capset(&(0x7f00000fc000)={0x20080522}, &(0x7f000047efe8)) mknod$loop(&(0x7f0000000040)='./file0/file1\x00', 0x600f, 0xffffffffffffffff) 12:39:00 executing program 1: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x5, 0x0) ioctl$KVM_SET_TSS_ADDR(r0, 0xae47, 0x0) r1 = openat$cgroup(0xffffffffffffffff, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x3, 0x70, 0x0, 0x3, 0x6, 0x1, 0x0, 0x5, 0x4800, 0xd, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x3ff, 0x2, @perf_config_ext={0x6, 0x100000000}, 0x18050, 0x1, 0x7fe1, 0x7, 0x2, 0x81, 0x6}, r1, 0xb, r0, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x8001, 0x40800) r3 = syz_open_dev$radio(&(0x7f0000000140)='/dev/radio#\x00', 0x0, 0x2) ioctl$PERF_EVENT_IOC_ID(r3, 0x80082407, &(0x7f0000000180)) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_FIOSETOWN(r4, 0x8901, &(0x7f00000001c0)) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) utimes(&(0x7f0000000200)='./file0\x00', &(0x7f0000000280)={{0x0, 0x2710}, {r5, r6/1000+10000}}) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000002c0)=@assoc_value={0x0, 0x2}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000340)={0x3, 0x8, 0x400, 0xfc2b, 0x7, 0x9, 0x3, 0x0, r7}, 0x20) r8 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000380)='/dev/cachefiles\x00', 0x5000, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f00000003c0)={0x0, 0xff}, &(0x7f0000000400)=0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r8, 0x84, 0x75, &(0x7f0000000440)={r9, 0x1f}, 0x8) prctl$PR_SET_SECUREBITS(0x1c, 0x10) r10 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000480)='/proc/capi/capi20ncci\x00', 0x600201, 0x0) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r10, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x21041c80}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x34, r11, 0x397466f481e4f78e, 0x70bd2b, 0x25dfdbfe, {{}, 0x0, 0x4101, 0x0, {0x18, 0x17, {0x16, 0x4, @l2={'eth', 0x3a, 'irlan0\x00'}}}}, ["", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x44000}, 0x40000) r12 = semget$private(0x0, 0x2, 0x2c1) semop(r12, &(0x7f0000000600)=[{0x0, 0xfff7, 0x800}, {0xac8ff9ac00a963b1, 0x1, 0x800}, {0x4, 0x81}], 0x3) r13 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000640)='/dev/dlm_plock\x00', 0x298202, 0x0) r14 = syz_genetlink_get_family_id$tipc2(&(0x7f00000006c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r13, &(0x7f0000000780)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x82009000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x14, r14, 0x8, 0x70bd2d, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x10) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000007c0)={0x0, 0x0, 0x20}, &(0x7f0000000800)=0xc) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000840)={r15, 0x7ff, 0xfffe}, 0x8) r16 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000880)='/dev/vsock\x00', 0x2000, 0x0) ioctl$VIDIOC_G_MODULATOR(r16, 0xc0445636, &(0x7f00000008c0)={0x45, "6cafef8430bbc573d106d77a51dbf3dd8dd7610a688c6e19cdc80afcec9c472a", 0x40, 0x0, 0x5, 0x4, 0x4}) openat$autofs(0xffffffffffffff9c, &(0x7f0000000940)='/dev/autofs\x00', 0x400000, 0x0) 12:39:00 executing program 0: r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000000)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r0, &(0x7f00000001c0)={0x18, 0x2, {0x0, @initdev}}, 0x1e) socket$inet6(0xa, 0x40000080806, 0x0) socket(0x3, 0x800, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cpuacct.stat\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0x3, &(0x7f0000000080)=0x7ff, 0xfffffffffffffea0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r2, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r4, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) bind$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x11}}, 0x1c) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r3, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r5, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r6, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r6, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r6, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r7, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r7, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r7, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r8 = dup2(r6, r7) setsockopt$inet6_group_source_req(r8, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x17}}}}, 0x108) r9 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f0000000040)='./file0\x00'}, 0x10) r10 = getpid() tkill(r10, 0x1d) fcntl$lock(r9, 0x24, &(0x7f0000000140)={0x1, 0x2, 0x1, 0x7, r10}) r11 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r11, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r11, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r11, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) dup3(r2, r11, 0x0) [ 255.004035][T11813] IPVS: ftp: loaded support on port[0] = 21 [ 255.168811][T11813] chnl_net:caif_netlink_parms(): no params data found 12:39:01 executing program 0: clock_gettime(0x0, &(0x7f0000005100)={0x0, 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f0000004f80)=[{{&(0x7f0000000080)=@rc, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)=""/192, 0xc0}, {&(0x7f0000000200)=""/182, 0xb6}, {&(0x7f00000002c0)=""/11, 0xb}, {&(0x7f0000000300)=""/71, 0x47}, {&(0x7f00000003c0)=""/217, 0xd9}], 0x5}, 0xfa6}, {{&(0x7f0000000540)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x80, &(0x7f0000002600)=[{&(0x7f00000005c0)=""/4096, 0xffffffffffffff19}, {&(0x7f00000015c0)=""/30, 0x1e}, {&(0x7f0000001600)=""/4096, 0x1000}], 0x3, &(0x7f0000002640)=""/62, 0x3e}, 0x8}, {{0x0, 0x0, &(0x7f0000002840)=[{&(0x7f0000002680)=""/255, 0xff}, {&(0x7f0000002780)=""/192, 0xc0}], 0x2, &(0x7f0000002880)=""/126, 0x7e}, 0x8000}, {{&(0x7f0000002900)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000002a80)=[{&(0x7f0000002980)=""/202, 0xfffffffffffffd61}], 0x1, &(0x7f0000002ac0)=""/107, 0x6b}, 0x8}, {{&(0x7f0000002b40)=@caif=@dgm, 0x80, &(0x7f0000003c80)=[{&(0x7f0000002bc0)=""/9, 0x9}, {&(0x7f0000002c00)=""/49, 0x31}, {&(0x7f0000002c40)=""/4096, 0x1000}, {&(0x7f0000003c40)=""/1, 0x1}], 0x4, &(0x7f0000003cc0)=""/74, 0x4a}, 0xee}, {{&(0x7f0000003d40)=@alg, 0x80, &(0x7f0000004f00)=[{&(0x7f0000003dc0)=""/4096, 0x1000}, {&(0x7f0000004dc0)=""/76, 0x4c}, {&(0x7f0000004e40)=""/139, 0x8b}], 0x3, &(0x7f0000004f40)=""/44, 0x2c}, 0x10000}], 0x6, 0x400001c2, &(0x7f0000005140)={r0, r1+30000000}) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000040)="1c0000001a005f0214f9f407000904001100"/28, 0x1c) recvmmsg(r3, &(0x7f0000005340)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000019c0)=[{&(0x7f0000000800)=""/4096, 0x1000}], 0x1}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x6, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r5, 0xc01, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x4074e506, @media='eth\x00'}}}}, 0x68}}, 0x0) sendmsg$TIPC_CMD_GET_LINKS(r3, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r5, 0x20, 0x70bd27, 0x25dfdbfd, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x7f}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4040090}, 0x40088) sendmsg$TIPC_CMD_SET_LINK_PRI(r2, &(0x7f0000005280)={&(0x7f0000005180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000005240)={&(0x7f00000051c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="000400000000010000000100161d59f6b50703be708364f37ff94b890000000000000841000000140018"], 0x30}, 0x1, 0x0, 0x0, 0x20004801}, 0x4000034) socket$inet_udplite(0x2, 0x2, 0x88) r6 = socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$hidraw(&(0x7f0000005200)='/dev/hidraw#\x00', 0x100000000, 0x0) ioctl(r6, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f00000001c0)=0xf) ioctl$TCSETSW(r7, 0x5403, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa22c}) [ 255.286792][T11813] bridge0: port 1(bridge_slave_0) entered blocking state [ 255.294308][T11813] bridge0: port 1(bridge_slave_0) entered disabled state [ 255.303197][T11813] device bridge_slave_0 entered promiscuous mode [ 255.314306][T11813] bridge0: port 2(bridge_slave_1) entered blocking state [ 255.321494][T11813] bridge0: port 2(bridge_slave_1) entered disabled state [ 255.330267][T11813] device bridge_slave_1 entered promiscuous mode [ 255.361439][T11813] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 255.374727][T11813] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 255.408901][T11813] team0: Port device team_slave_0 added [ 255.417982][T11813] team0: Port device team_slave_1 added [ 255.516576][T11813] device hsr_slave_0 entered promiscuous mode [ 255.553144][T11813] device hsr_slave_1 entered promiscuous mode 12:39:01 executing program 0: r0 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(r0, &(0x7f0000000340)=[{&(0x7f0000000040)='9', 0x1}], 0x10000000000000d2, 0x0) read(r0, 0x0, 0x0) [ 255.802241][T11813] debugfs: Directory 'hsr0' with parent '/' already present! [ 255.854552][T11813] bridge0: port 2(bridge_slave_1) entered blocking state [ 255.861825][T11813] bridge0: port 2(bridge_slave_1) entered forwarding state [ 255.869621][T11813] bridge0: port 1(bridge_slave_0) entered blocking state [ 255.876964][T11813] bridge0: port 1(bridge_slave_0) entered forwarding state [ 255.995053][T11813] 8021q: adding VLAN 0 to HW filter on device bond0 [ 256.013857][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 256.032268][ T31] bridge0: port 1(bridge_slave_0) entered disabled state [ 256.041323][ T31] bridge0: port 2(bridge_slave_1) entered disabled state [ 256.058444][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready 12:39:02 executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @rand_addr="6e31bfd72c89323c0c80b5167329292c"}]}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x7a, &(0x7f0000000080)={r1}, &(0x7f0000000140)=0x18) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r3, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) ioctl(r3, 0x7fff, &(0x7f0000000580)="0df14dfccee776b1e287515429f692809355b5eed5ec9e8d2b3d5763ec4e785943f9ba35ff565a5c86a06ab06061bbf1634532a253992a52365125dd06dfcd50b42232f3884c9a4f7d4bb980cc8c560ad14ca31b84c17917d9f8a971b7438874f9232c6e04485b73a90bdf4caa55bc124b166684ebfc2da09398a9eb511d7b7131f6b3da2f1b1f893543d5bee083b3d6af124b4358898858cc05442cc781121f4afddaeb5913527c02bc54a6cce6fcb7e29b25ee8261819d106a9b5441c5f515a76b54357018005ad9849f9ab9631797c05239e226e7a9688f374765ecdd381d84192079b2adfb3debfe046c1ddb9b15641715") r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r4, 0x0) ioctl$KVM_GET_SREGS(r4, 0x8138ae83, &(0x7f00000002c0)) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x76, &(0x7f0000000180)={r2, @in6={{0xa, 0x0, 0x0, @initdev}}}, &(0x7f0000000280)=0x100) [ 256.089785][T11813] 8021q: adding VLAN 0 to HW filter on device team0 [ 256.124519][ T31] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 256.133679][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 256.140849][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 256.169653][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 256.179034][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 256.186276][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 256.208984][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 256.230305][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 256.240427][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 256.250224][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready 12:39:02 executing program 0: add_key$user(&(0x7f0000000180)='user\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f00000001c0)='user\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) r0 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$chown(0x4, r0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') writev(r1, &(0x7f0000e11ff0), 0x20000000000000c5) getsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x7, &(0x7f0000000000)=0x1, &(0x7f0000000040)=0x4) [ 256.290730][T11813] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 256.301769][T11813] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 256.325587][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 256.337047][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 256.346907][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 256.356469][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 256.366537][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 256.376026][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 256.385076][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 12:39:02 executing program 0: bpf$MAP_CREATE(0x900000000000000, &(0x7f0000000100)={0x4, 0x4, 0x200000004, 0x7, 0x0, 0xffffffffffffffff, 0x1000, [0x305f, 0x2e, 0x2e, 0x80ffff, 0x2e, 0x2e, 0x80ffff, 0x5f, 0x2e], 0x0, 0xffffffffffffffff, 0x2}, 0x3c) [ 256.419404][T11813] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 256.436861][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 256.568799][T11839] Unknown ioctl -1069263306 [ 256.584580][T11841] Unknown ioctl -1069263306 12:39:02 executing program 0: rt_sigprocmask(0x0, 0x0, &(0x7f0000000040), 0x8) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x8400, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x5, 0x200000) write$P9_RMKDIR(r1, &(0x7f00000000c0)={0x14, 0x49, 0x1, {0x8, 0x1, 0x5}}, 0x14) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) 12:39:02 executing program 1: r0 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f00000001c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000001000)='keyring\x00', &(0x7f0000000000)={'syz'}, 0x0, 0x0, r0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f0000000280)='asymmetric\x00\xf3\xad\xe75\xf9\x03\x00AU\xa0\xe1\x94N\xd8\xdfLA\x1e0\x89dm\x10\xb4e\xa6\x91\v\x13', &(0x7f0000000240)=@keyring={'key_or_keyring:', r0}) r2 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f00000001c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000340)='asymmetric\x00', &(0x7f0000000300)=@chain={'key_or_keyring:', r1, ':chain\x00'}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000000)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000400)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @dev, 0x4}, {0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, r4}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0x2, 0x0, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x60000000, 0x0, 0x0, 0xc000000, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x700000000000000]}}, {0x2, 0x0, 0xfffffffffffffffd, @local}, r4}}, 0x48) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x30, 0xfa00, {&(0x7f0000000040), 0x0, {0xa, 0x4e23, 0x798c, @mcast1, 0x8001}, r4}}, 0x38) r5 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f00000001c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) r6 = add_key$keyring(&(0x7f0000001000)='keyring\x00', &(0x7f0000000000)={'syz'}, 0x0, 0x0, r5) r7 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f00000001c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r7, &(0x7f0000000340)='asymmetric\x00', &(0x7f0000000300)=@chain={'key_or_keyring:', r6, ':chain\x00'}) keyctl$KEYCTL_MOVE(0x1e, r1, r6, 0x0, 0x2) 12:39:02 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x10, 0x3, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') writev(r2, &(0x7f0000e11ff0), 0x20000000000000c5) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000100)={0x1000, {{0x2, 0x4e23, @loopback}}, 0x1, 0x2, [{{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1e}}}, {{0x2, 0x4e20, @rand_addr=0xfffffffd}}]}, 0x190) sendmsg(r1, &(0x7f0000000040)={0x0, 0xfffffffffffffd32, &(0x7f0000009ff0)=[{&(0x7f0000000800)="24000000660007031dfffd946fa2830020200a000000003fa61d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b138a32052b44e099d881e02546dcda4cc7e6397", 0x4c}], 0x1}, 0x0) 12:39:02 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x400000, 0x0) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000100)={{0x2, 0x4e24, @multicast1}, {}, 0x22, {0x2, 0x4e24, @loopback}, 'veth1_to_bridge\x00'}) r2 = openat$cgroup_int(r0, &(0x7f00000000c0)='cpuset.mems\x00', 0x2, 0x0) write$FUSE_NOTIFY_STORE(r2, 0x0, 0x0) 12:39:02 executing program 0: r0 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x3, 0x100040) ioctl$KVM_GET_XSAVE(r0, 0x9000aea4, &(0x7f0000000180)) syz_emit_ethernet(0x3e, &(0x7f0000000100)={@local, @remote, [], {@ipv4={0x800, {{0x40000000000000b5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x2, 0x0, @remote={0xac, 0x70}, @dev}, @icmp=@parameter_prob={0x14, 0x2, 0x0, 0x0, 0x0, 0x6, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @broadcast}}}}}}, 0x0) sysinfo(&(0x7f0000000000)=""/201) 12:39:03 executing program 1: sendmmsg(0xffffffffffffffff, &(0x7f0000001980)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000500)="ef50213cca2de8879b1e124c15b301f9a5aa710602d24ccc6fe4e61f34c119917ddac56f2625957a44d79fc8abe624ed862fd7d0329b7f8055a6e6063a462e5407cafb90cbc90b85c76db310df91df33d6a799262eec2b3271964ad2190b993cd7e5e75411fe316a59eb4c7fe935dd47cd8b98a03bd18fca4b5cdaed6cd8e3e8b4ec763913", 0x85}], 0x1}}], 0x1, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=@migrate={0xac, 0x21, 0x21, 0x0, 0x0, {{@in=@local}, 0x0, 0x3}, [@migrate={0x5c, 0x11, [{@in6=@remote, @in=@local, 0x6}, {@in=@broadcast, @in6=@empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}]}]}, 0xac}}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000000080)=""/21) 12:39:03 executing program 0: r0 = perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4102, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video0\x00', 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000272000)) 12:39:03 executing program 1: modify_ldt$read_default(0x2, &(0x7f0000000000)=""/17, 0x11) r0 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x7, 0x200001) ioctl$DRM_IOCTL_ADD_BUFS(r0, 0xc0206416, &(0x7f0000000080)={0x5, 0x8, 0x9, 0x8000, 0x2}) unshare(0x8000400) r1 = mq_open(&(0x7f00000001c0)='-$\x00\x1b\xdc\xaf\x02\x1c\xc4\xdf\xef\v\n\x8b\xdf\x16\b\xef-\xfc\x17Yo\xac\xe2\xd5\xc1\x00\x15]\x01\x1b\xaa3\x13n\x9c\x10\xe5\xa0\xab\xbe9l\xfe\xd5\xfa\xc4\xfe2\xe8X\xed}\xf7\xe7\t\xe5\xf9\xfcU\xbc:\x98\xa2V\x967\xb5\xa3\'qj#\xed\b\xd7#\x9f\x96\xa6\xde\xefQ\xdaI\xb4\x84+\x82N\x84\xa6\xcd\x03\xef\x06\xcd\xa9\xf82\x98\x1e\xd87\x1aUn\xa1M\xf5?\x9a\xb9x\xb4\xf7\x96\x82U\x96;\x9c\x02W\xb6\xedS\xefK\x1eH\xee\x1a~ 8e+Qr\xed\xbfB \x065\x9f\xea\x84\"n\xe2\xc4\"\x94O\x1clB\xa6\xa6\xf1\xe2\x10O-\xddg\xf3s\xe1\xff/Y\v8\x11\xde\x19\xbb\xa7\xb3', 0x42, 0x0, 0x0) mq_timedsend(r1, 0x0, 0x4000, 0x0, 0x0) 12:39:03 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5000000000000000000000000000000000009500", @ANYRES32=0x0, @ANYBLOB="00000000000000000800200002000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="380008009c080000"], 0x50}}, 0x0) 12:39:03 executing program 1: r0 = socket$inet6(0xa, 0x4, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x11, 0x0, 0x6b) 12:39:03 executing program 0: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x0, 0x0) r1 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) close(r1) writev(0xffffffffffffffff, &(0x7f0000e11ff0), 0x20000000000000c5) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') writev(r2, &(0x7f0000e11ff0), 0x20000000000000c5) ioctl$VIDIOC_TRY_DECODER_CMD(r1, 0xc0485661, &(0x7f0000000280)={0x7959967436bc7369, 0x7, @raw_data=[0x4, 0x1, 0x5, 0x0, 0x1, 0x7, 0x9d, 0x0, 0x931, 0x1, 0x3ff, 0x1, 0xfffffff7, 0x9, 0x7, 0x9]}) ioctl$DRM_IOCTL_MODE_SETCRTC(r2, 0xc06864a2, &(0x7f0000000200)={&(0x7f00000001c0)=[0x3, 0x9, 0x7], 0x3, 0x2, 0xf5, 0x0, 0x10000, 0x0, {0xe3, 0x401, 0x9, 0x3, 0x9, 0x7, 0x1, 0x5, 0x0, 0x9, 0x7fff, 0x2, 0x2, 0x6, "3c1f8dc1dc7c19b00d975293ded70a954ad36374e3b9a328a599a7b0ab4ebe9c"}}) r3 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x2, 0x2) r4 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r5 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r4, r5, &(0x7f0000000040)=0x100060, 0xa808) ioctl$VIDIOC_STREAMON(r5, 0x40045612, &(0x7f0000000300)=0x3a09449c) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, &(0x7f0000000180)={0x0, r3}) seccomp(0x0, 0xa, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x5}]}) dup2(r0, r1) prctl$PR_CAPBSET_READ(0x17, 0x1a) fsetxattr$security_selinux(0xffffffffffffffff, &(0x7f0000000040)='security.selinux\x00', &(0x7f00000000c0)='system_u:object_r:devicekit_var_run_t:s0\x00', 0x29, 0x44da17b9dc0d78bc) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, &(0x7f0000000340)=0xf) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0xb) 12:39:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x284841, 0x0) io_uring_register$IORING_REGISTER_EVENTFD(r5, 0x4, &(0x7f00000002c0), 0x1) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}]}, 0x48}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r9}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}]}, 0x48}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r9}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_1\x00'}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=@newqdisc={0x40, 0x24, 0x507, 0x0, 0x0, {0x0, r9, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14, 0x1, 'pfifo_head_drop\x00'}, {0x4}}]}, 0xfda5}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x40, 0x24, 0x507, 0x0, 0x0, {0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14, 0xe, 'pfifo_head_drop\x00'}, {0x8}}]}, 0x40}}, 0x0) [ 257.574796][T11894] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. [ 257.585609][T11894] netlink: 'syz-executor.1': attribute type 14 has an invalid length. [ 257.648945][T11897] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. 12:39:03 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000500)='/dev/nullb0\x00', 0x0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000d, 0x7f21094b9a54a94, r1, 0x0) ioctl$KVM_IRQ_LINE_STATUS(0xffffffffffffffff, 0xc008ae67, &(0x7f0000000000)={0x2, 0x4}) mlock(&(0x7f0000a0c000/0x1000)=nil, 0x1000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fadvise64(r0, 0x1, 0x0, 0x4) 12:39:03 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r2, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) sendmsg$sock(r1, &(0x7f0000000200)={&(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, r2, {0x2, 0x4e20, @local}, 0x1, 0x0, 0x0, 0x4}}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000140)="8aded2dd78fe0428855aac3833b5695fc2d5a23ed98b3c9cb1367cb865b09773ca0a4b4aec5ac4a478397d9261ce8e92e8d7fa5f749c2a0aefc776d260522cfc3dabe0e2b85703ca0e1f26", 0x4b}, {&(0x7f00000002c0)="fe9b4ae10d69fc047533d488106cbf4d2eb2a0aa9468233d3d9d79ddb9ac2318599a7204adf28659756428ca8c6d76d982dc44996062676783bf253799d1a4d7e6e96df45dfef5b289ef7cdfc255988bc9776b9abe71b0b5bf9fb445373cb16cbd8de64769a7ace0e7939e0b4fbbe564cb4a49e700a7aafa23b6307b752abb461aae480e43c71c3c16ff48271fc0ee1352f371ca56d7580dec30d1f8f12dc03f8e9dfd335fb7d67896a7022beb832fc63642ee92c838a296c4b05295762c90b932971024ba3841d459ba2332bd6710af8ce6dedbf68f58f777ad38554941bb1261719a8addf483ce751a85f3d3823becac776643a83af7", 0xf7}], 0x2}, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca5055e0bcfe47bf070") r3 = socket$inet(0x10, 0x2, 0x0) sendmsg(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="24000000180007841dfffd946f610500020081001f038b0504000800080005000400ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) 12:39:03 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000500)='/dev/nullb0\x00', 0x0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000d, 0x7f21094b9a54a94, r1, 0x0) ioctl$KVM_IRQ_LINE_STATUS(0xffffffffffffffff, 0xc008ae67, &(0x7f0000000000)={0x2, 0x4}) mlock(&(0x7f0000a0c000/0x1000)=nil, 0x1000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fadvise64(r0, 0x1, 0x0, 0x4) [ 257.881229][T11904] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 12:39:04 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@remote, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000000, 0x12, r1, 0x1) ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000040)=[0x3c, 0x1]) sendmsg$inet6(r0, &(0x7f0000000180)={&(0x7f0000000080)={0xa, 0x4e22, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000140)=[@tclass={{0x18, 0x29, 0x3b}}], 0x16}, 0x0) 12:39:04 executing program 0: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) sendmmsg$inet6(r0, &(0x7f0000002700)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0x0, @remote}, 0x1c, 0x0}}, {{&(0x7f0000000400)={0xa, 0x4e23, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f00000000c0)=[@dstopts_2292={{0x18, 0x29, 0x2}}], 0x18}}], 0x2, 0x0) 12:39:04 executing program 1: r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0xffffffffffffff80, 0x400) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000040)=0x1, 0x4) clock_gettime(0x2, &(0x7f0000000280)) 12:39:04 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="8bf0d05460a4472a221001c0000000000000000000800000"]) [ 258.396125][T11925] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. 12:39:04 executing program 1: syz_emit_ethernet(0x7a, &(0x7f00000002c0)={@local, @random="5004ad23e93a", [], {@ipv6={0x86dd, {0x0, 0x6, "1faac1", 0x44, 0x73, 0x0, @remote, @mcast2, {[], @gre}}}}}, 0x0) rt_sigprocmask(0x0, &(0x7f0000000000)={0x100000001}, &(0x7f0000000040), 0x8) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0) ioctl$VHOST_GET_VRING_BASE(r0, 0xc008af12, &(0x7f0000000080)) 12:39:04 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x10000, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x54000, 0x0) ioctl$MON_IOCX_MFETCH(r3, 0xc0109207, &(0x7f0000000200)={&(0x7f00000001c0)=[0x0, 0x0, 0x0], 0x3, 0x5}) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r2, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r5 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x10000, 0x400) ioctl$KVM_SMI(r5, 0xaeb7) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r4, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000140)=@broute={'\xa2^\xc5zte\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\xab\x7f\x8d\x18\x00', 0x20, 0x1, 0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000500], 0x7, 0x0, &(0x7f0000000080)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="c474cf5fc9323abc9060c383c3c5ba41c667ece1b6b73f1872dfcb0905d961b7cf24f46980323dd296e9b16e15d696bafb1ca8e8f63fc6ca795030", @ANYRESOCT=r1, @ANYBLOB="cd74eb2b", @ANYRES32=r4]]}, 0x80) 12:39:04 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x280001, 0x0) recvfrom(r0, &(0x7f0000000080)=""/87, 0x57, 0x0, &(0x7f0000000140)=@un=@file={0x0, './file0\x00'}, 0x80) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000880)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(0xffffffffffffffff, 0xc1105518, &(0x7f00000002c0)={{0x0, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 'syz1\x00', &(0x7f0000000040)=['/dev/kvm\x00', '-\x00', '/dev/kvm\x00', 'nodev,@userposix_acl_access\x00', '/dev/kvm\x00', 'em0:\x00'], 0x3e}) r3 = getpgrp(0xffffffffffffffff) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f0000000400)={{0x6, 0xf20fa7b220a92084, 0x2, 0x1, 'syz0\x00', 0x1f}, 0x5, 0x4, 0x7f, r3, 0x3, 0x6, 'syz0\x00', &(0x7f00000001c0)=['\x00', 'em0:\x00', '&}\x00'], 0x9, [], [0x1ff, 0x7, 0x2, 0x8000]}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000840)=[@text32={0x20, 0x0}], 0x1, 0x4a, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 12:39:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newlink={0x40, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x20, 0x12, @ip6gretap={{0x10, 0x1, 'ip6gretap\x00'}, {0xc, 0x2, [@gre_common_policy=[@IFLA_GRE_ENCAP_TYPE={0x8, 0xe, 0x1}]]}}}]}, 0x40}}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') writev(r2, &(0x7f0000e11ff0), 0x20000000000000c5) setsockopt$packet_int(r2, 0x107, 0x12, &(0x7f0000000000)=0x6, 0x4) [ 259.173862][T11942] netlink: 'syz-executor.1': attribute type 14 has an invalid length. [ 259.212416][T11943] netlink: 'syz-executor.1': attribute type 14 has an invalid length. 12:39:05 executing program 1: syz_emit_ethernet(0x66, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffffff0180c289030086dd6076605100303a977aaa1a79e4757a57810ffffe80034300050dff00000000000000ffff020000000000000000000000000001860090780007080060c5961e00005e000304000000000000180300000500000100000000000000000000000000000001"], 0x0) 12:39:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r3 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r2, r3, &(0x7f0000000040)=0x100060, 0xa808) setsockopt$IP_VS_SO_SET_STARTDAEMON(r3, 0x0, 0x48b, &(0x7f00000000c0)={0x0, 'bpq0\x00', 0x2}, 0x18) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x50, 0x24, 0x507, 0x0, 0x0, {0x0, r4, {}, {0xffff, 0xa}}, [@TCA_RATE={0x0, 0x5, {0x8, 0x7f}}]}, 0x50}}, 0x0) [ 259.570932][T11950] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. 12:39:05 executing program 0: r0 = socket(0x10, 0x802, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x8, 0x240) ioctl$KVM_SET_DEBUGREGS(r1, 0x4080aea2, &(0x7f0000000140)={[0x3003, 0xf000, 0xf000, 0x1000], 0xfc, 0x13, 0x8}) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000200)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r3, 0x408, 0x70bd2c, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r3, 0x410, 0x70bd28, 0x25dfdbfd, {}, [@SEG6_ATTR_DSTLEN={0x8, 0x2, 0x64374271}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x80) ioctl$KVM_INTERRUPT(r1, 0x4004ae86, &(0x7f0000000300)=0xe732) write(r0, &(0x7f0000000100)="1b0000001c000705ab092506090007000aab080006000000020025", 0x1b) [ 259.702368][T11952] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. 12:39:05 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0xa, 0x4e26, 0xff, @mcast1, 0x7}, 0x6be) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000740)={0x3, 0x0, 0xf000, 0x1000, &(0x7f0000001000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000], 0x0, 0x4}) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(0xffffffffffffffff, 0x4010ae74, &(0x7f0000000180)={0x7, 0x0, 0x8}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x1, 0x1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bcsf0\x00', 0x0}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r5, 0x0) bind$xdp(r3, &(0x7f00000000c0)={0x2c, 0xd2b9249d89cba3d1, r4, 0x32, r5}, 0x10) ioctl$KVM_RUN(r2, 0xae80, 0x0) 12:39:05 executing program 0: socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') writev(r0, &(0x7f0000e11ff0), 0x20000000000000c5) r1 = accept4$alg(r0, 0x0, 0x0, 0x800) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r2, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'veth0_to_bond\x00', 0x2}) getsockopt$sock_buf(r1, 0x1, 0x3d, &(0x7f0000000040)=""/15, &(0x7f0000000000)=0xffffffffffffffdd) r3 = socket$inet6(0xa, 0x80000, 0x2) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r3, r4, &(0x7f0000000040)=0x100060, 0xa808) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r3, 0x84, 0x21, &(0x7f0000000100), &(0x7f0000000140)=0x4) 12:39:06 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x300, 0x70bd28, 0x25dfdbff, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8004) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f0000000200)=@fragment, 0x8) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r1, &(0x7f0000000040), 0x400000000000284, 0x44000102, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000000002000000ae96e47cda9c6b16ce50c5a746de448100"/35], 0x8) setsockopt$inet6_int(r1, 0x29, 0x38, &(0x7f0000000080)=0x800, 0x4) setsockopt$inet6_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000000)=@gcm_256={{0x304}, "38275ef4de17bcc9", "d972469955a7ed1c16a3125df69ac472f2f859a95ac2b81be21d35b3054c2c7a", "e74cd145", "a6e7101ca6fd212f"}, 0x38) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) [ 260.304839][T11974] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 12:39:06 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socketpair(0x5, 0xc, 0xee, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000000c0)={'veth0\x00', &(0x7f0000000100)=ANY=[]}) bind(r0, &(0x7f0000000180)=@vsock={0x28, 0x0, 0x0, @host}, 0x80) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x101000, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x0, 0x80100) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x2003, 0x99b4, 0x1b85}, 0xc) 12:39:06 executing program 0: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x60080, 0x0) r1 = socket$netlink(0x10, 0x3, 0xf) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f0000000280)={&(0x7f0000000100), 0xc, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="14175c02a2fb196acb2a3519143f000000", @ANYRES16=r2, @ANYBLOB="0108000000eeff000000004666519d257f58a13fda38d9688966f0bc75d619886aa3539993e3eb85e01e52e6989230b96557c6530e61bcd261968f04f3afc345461658107a944e691d99290ac34f6852e761a07176abc29046c8fb021efe460c032ecf9cf9cf1fa9c860e8e653c70ce2783100d099a2a2"], 0x14}}, 0x0) sendmsg$IPVS_CMD_SET_DEST(r0, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000004}, 0xc, &(0x7f0000000240)={&(0x7f00000006c0)={0xcc, r2, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, [@IPVS_DEST_ATTR_TUN_TYPE={0x8, 0xd, 0x8ae1f872391cb4ed}, @IPVS_DEST_ATTR_TUN_TYPE={0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@dev={0xac, 0x14, 0x14, 0x18}}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x4}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x4c}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x80000001}]}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xf9}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0\x00'}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_bond\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x7}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}]}, 0xcc}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000004) get_mempolicy(0x0, 0x0, 0x0, &(0x7f00005ad000/0x1000)=nil, 0x3) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f00000002c0)=0x4240, 0x4) mlock2(&(0x7f0000486000/0x4000)=nil, 0x4000, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0) ioctl$VIDIOC_RESERVED(r3, 0x5601, 0x0) madvise(&(0x7f0000546000/0x4000)=nil, 0x4000, 0x12) r4 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_SIOCBRDELBR(r4, 0x89a1, &(0x7f0000000000)='veth0_to_bridge\x00') r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r5, 0x0) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r5, 0x84, 0x4, &(0x7f0000000040)=0x80, 0x4) 12:39:06 executing program 0: r0 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x0, 0x2) ioctl$ASHMEM_GET_PROT_MASK(r0, 0x7706, &(0x7f00000000c0)) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x44101, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000013c0)={{{@in, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x2}, {{@in6=@local, 0x0, 0x6c}, 0x0, @in6=@dev}}, 0xe8) 12:39:06 executing program 2: r0 = getpgid(0xffffffffffffffff) ptrace$pokeuser(0x6, r0, 0xc27, 0x100000000) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) capget(&(0x7f0000000040)={0x20071026, r1}, &(0x7f0000000080)={0x2, 0x6, 0x1000, 0x9, 0x2, 0x8ecae7f}) r2 = shmget(0x1, 0x3000, 0x200, &(0x7f0000ffc000/0x3000)=nil) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in=@empty, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@dev}}, &(0x7f00000001c0)=0xe8) fstat(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@dev}}, &(0x7f0000000380)=0xe8) getresgid(&(0x7f00000003c0), &(0x7f0000000400), &(0x7f0000000440)=0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000480)=0x0) r8 = gettid() shmctl$IPC_SET(r2, 0x1, &(0x7f00000004c0)={{0x8001, r3, r4, r5, r6, 0x1, 0x8}, 0x2, 0x7, 0x3, 0x8, r7, r8, 0xff}) r9 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000540)='/dev/dlm-control\x00', 0x400000, 0x0) setsockopt$bt_BT_VOICE(r9, 0x112, 0xb, &(0x7f0000000580)=0x3, 0x2) setsockopt$inet_sctp6_SCTP_MAX_BURST(r9, 0x84, 0x14, &(0x7f00000005c0)=@int=0x3, 0x4) ioctl$TIOCLINUX7(r9, 0x541c, &(0x7f0000000600)={0x7, 0xfe}) r10 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000640)='/dev/dlm_plock\x00', 0xa4081, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r10, 0x400c6615, &(0x7f0000000680)={0x0, @aes128}) r11 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/btrfs-control\x00', 0x480, 0x0) ioctl$KVM_GET_DEVICE_ATTR(r11, 0x4018aee2, &(0x7f0000000740)={0x0, 0x9, 0xffffffffffffff8a, &(0x7f0000000700)=0x4bf}) r12 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000780)='/dev/btrfs-control\x00', 0x1, 0x0) ioctl$RTC_EPOCH_SET(r12, 0x4008700e, 0xffff) r13 = syz_open_dev$sg(&(0x7f00000007c0)='/dev/sg#\x00', 0x4, 0x204043) ioctl$SCSI_IOCTL_START_UNIT(r13, 0x5) r14 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000800)='/dev/dsp\x00', 0x200000, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x4, 0x813, r14, 0x10000000) r15 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000840)='/dev/sequencer\x00', 0x121000, 0x0) write$P9_RVERSION(r15, &(0x7f0000000880)={0x15, 0x65, 0xffff, 0x8, 0x8, '9P2000.L'}, 0x15) r16 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/ptmx\x00', 0x80000, 0x0) ioctl$TIOCLINUX7(r16, 0x541c, &(0x7f0000000900)={0x7, 0x3f}) 12:39:06 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x10032, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) r2 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x0, 0xc001) ioctl$EVIOCGUNIQ(r2, 0x80404508, &(0x7f0000000200)=""/193) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000480)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000300)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x6c, &(0x7f0000013ff4)=@assoc_value, &(0x7f0000002000)=0x8) getsockopt$inet_sctp6_SCTP_STATUS(r3, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in6={{0xa, 0x0, 0x0, @empty}}}}, &(0x7f0000000080)=0xb0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r5 = dup2(r0, r3) dup3(r5, r1, 0x0) rmdir(&(0x7f0000000040)='./file0\x00') 12:39:06 executing program 1: r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r2, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000040)=ANY=[@ANYBLOB="09000200", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f00000000c0)=0x20) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000180)={r3, 0x8}, 0x8) listen(r0, 0x4d) connect$inet(r1, &(0x7f0000000100)={0x2, 0x4e20, @empty}, 0x10) getsockopt$inet_int(r1, 0x10d, 0xbf, &(0x7f0000000140), &(0x7f0000000080)=0x4) 12:39:07 executing program 0: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/icmp\x00') writev(r1, &(0x7f0000e11ff0), 0x20000000000000c5) ioctl$BLKBSZSET(r1, 0x40081271, &(0x7f0000000040)) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000680)={@my=0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000001c0)={&(0x7f0000000180)='./file0\x00', 0x0, 0x10}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000000c0)='(}$$\x00', r3}, 0x10) connect$vsock_dgram(r2, &(0x7f0000000640)={0x28, 0x0, 0x0, @my=0x0}, 0x10) shutdown(r2, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) ppoll(&(0x7f0000000100)=[{r2}], 0x1, &(0x7f0000000140)={r4, r5+30000000}, 0x0, 0x0) 12:39:07 executing program 1: r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x0, 0x400601) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) connect$inet6(r1, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000180)=0x8) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000080)={r3}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000000c0)={r3, 0xffffc323}, &(0x7f0000000100)=0x8) r4 = socket(0x10, 0x3, 0x0) r5 = syz_open_dev$midi(&(0x7f0000000140)='/dev/midi#\x00', 0x5, 0x8100) accept4$packet(r5, 0x0, &(0x7f00000001c0), 0x180000) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000000)={0x4}, 0x10) write(r4, &(0x7f0000000080)="240000001a005f0014f9f407000904000a00000000000000000000000800110000000000", 0x24) 12:39:07 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x84) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x9}, 0x1c) write$binfmt_aout(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000001600000000000103040700"], 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}]}, 0x48}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_1\x00'}]}, 0x34}}, 0x0) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000040)={@local, r4}, 0x14) [ 261.274245][T12007] IPVS: ftp: loaded support on port[0] = 21 [ 261.464805][T12007] chnl_net:caif_netlink_parms(): no params data found 12:39:07 executing program 1: unshare(0x8000400) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r0, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) fsetxattr$security_ima(r0, &(0x7f0000000000)='security.ima\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="02fc39bf66742b997ff8c247251ed00d762e59133153637b0d4c52731cec5096a4ada9ba"], 0x8, 0x2) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x3, 0x29d, 0x94d}) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_ABSBIT(r2, 0x40045567, 0xfffffffffffffffc) [ 261.523724][T12007] bridge0: port 1(bridge_slave_0) entered blocking state [ 261.531005][T12007] bridge0: port 1(bridge_slave_0) entered disabled state [ 261.539628][T12007] device bridge_slave_0 entered promiscuous mode [ 261.589162][T12007] bridge0: port 2(bridge_slave_1) entered blocking state [ 261.596664][T12007] bridge0: port 2(bridge_slave_1) entered disabled state [ 261.611088][T12007] device bridge_slave_1 entered promiscuous mode [ 261.652802][T12007] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 261.668618][T12007] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 261.701316][T12007] team0: Port device team_slave_0 added [ 261.718782][T12007] team0: Port device team_slave_1 added 12:39:07 executing program 1: sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) set_mempolicy(0x4003, &(0x7f0000000140)=0x6, 0x9) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x80, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, &(0x7f0000000040)=0x100060, 0xa808) sendmsg$nl_generic(r2, &(0x7f00000015c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001580)={&(0x7f0000001340)={0x21c, 0x2e, 0x100, 0x70bd27, 0x25dfdbff, {0x1a}, [@nested={0x208, 0x32, [@typed={0xc, 0x26, @str='\x00\x00\x00\x00H'}, @typed={0x8, 0x78, @ipv4=@dev={0xac, 0x14, 0x14, 0x11}}, @typed={0x8, 0x9, @fd=r0}, @typed={0x4, 0x6f}, @generic="58ea681421ecc6fe733e33de51850ec017d80455b7db835dbb68a780685a7a371d7cbece4d71aa536b6829a84878e189ed9991565a956086f266d29ef44e65a61544b67ce77a98dd6a0a23e464d82eb3477ad514677ac507e24fc6ccdd7b89fb0b95b4458991462c83f45a0518ded89c5dfa4fc490b715bdea029b94c34bf51325d3b541a2bfff77c71c29ef0f0490fa04272519d37106175918234c10c4c40cbd96c165934acd82e8fd1da4c7deaddeeffc1d7f6da765d7dbf4e2918881c801d41a379dc62981a7e1d795d87056da18bee0d45ddfbada19792dbd573be4af38a1f08963ca8fe4834c57f42d1163d9f5d3b78e26f08c64ac16a742c3e2dbb2", @generic="8d6ccc0ee732dba4bb1452ea6ff586487dc6addd6b93dc83bfb3ea3315b2141afccd4b4cc300aa8ef42d836500299c0a3ec6f636f4563eb9a594f347d8f5da4e484ec7c6447e7d2ef5025dec540e4921a4a7992ba2a7d0fa22a55977825af10bc5f7cfba9d30757c634bd244ea9311755e7f9a8b660eab4bbc7a7634e794a40646ccaa747e0a65732a01e2eaf050fa0086ac705c7a1291fb076ac0447a861e97d6b22332ad1ff88dee108767376093c1b3de2ca86aeecf42b1b0221d607f1b2da73d69a0a2c2679be3f76fdd701cb3b68e09d41aae8f555eb735e811865f73aa08b2"]}]}, 0x21c}, 0x1, 0x0, 0x0, 0x40000}, 0x4) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000100)={@my=0x0}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='\x00\x00\x00\x00H') r4 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r5 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r4, r5, &(0x7f0000000040)=0x100060, 0xa808) connect$can_bcm(r5, &(0x7f0000001780), 0x10) r6 = fsmount(0xffffffffffffffff, 0x3, 0x4) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000000000)='\x00\x00\x00\x00H', 0x0, r6) openat$cgroup_ro(r3, &(0x7f0000000180)='mem\x00\x01y7swaS.cur\x89\xc9B\xab\xe3\xfarent\x00\x1aw\xb7\xc3B\xef\xf0\xd5\xf34|\x98.\x857Y\xab[d\xfa\x83\xdf\xc6\xf3\xb5\xab\xbb\x98y\xe7\xff\x87o\xb2\xfe\xd0\x9d\x9a\x89\xfe\xc4\x1d\x92|z\xbc\nl%\x97,#\xab3aEW\x18A3@\x94\x05%Y\x1d\x90\xf3\xc8\x89\x9a.\x7fm5\xaa\b\xceo\t\xcc\x98\xb7\x18\x90\x1cM\x91\x0fzb\x85\xb5$\x86\xe4\xd9\x1bJ\x1f\xf0>\x18\xed\xb0\r.8\xc9\xcb\x03t\xa7\xd0D\x04\x1d\x04$\xecAb\b\xcf\xd40\xe8qg\xc5\x18\xd1\x8f\xe6D\xa8\x00\xf6H|y\xa1\x0f\xde\xe3\xbb\'\xb1\x02\x00\xc8p\xbfQh\"\n=\x90\xf9vUo9\x85\xb3\xa9\xec\xda\xc2\x99\xbe8\x9f[*\x80\xb7%\x9d33\xb9\xc3\xf0\x11!\x11\xc3\xa5$<\xcfC\x91|\x05\x1aO\xb4\xf0_\xbd>\xf3[\xbb[\x058\x01\xf4\xca\xf4(\xab8\x87R\xc8\xe0l\xce\x930\xec\xf5\x8f\xb0%I\xb7\x7f[\\i\xfb\x96d\xa1aA\x97j\xc3\xef\xb65\xc0e\xb2%\x1f\xba}\x0e$\x16\xbcw\xff&DRYp\xb8I\xc3\xa8\xee\x03\x19\xe8\xd9\x18i\xffHw\xea\x9d\x86\x0e\bl5\x945\xab\xd3\xef\x11\xbd\"\xbc\xf3\x8b\xf2.:\x8c\xe2\xb2\a\xac\x8b\x19\x80\x8b\xa3&\x19\x16\x80\xa1\x88\xbe\xc3\x0f\xf3\xb7V]\x89e\xf2D\xf6T\xc0\xb8/\xa5\x11\x15\x8cqV/', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000024c0)=[{0x0}, {&(0x7f0000000340)=""/4096, 0x1000}], 0x2, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r8, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r9 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r8, r9, &(0x7f0000000040)=0x100060, 0xa808) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000001600)={0x0, @in={{0x2, 0x4e20, @rand_addr=0x7}}}, &(0x7f00000016c0)=0x84) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r8, 0x84, 0x75, &(0x7f0000001700)={r10, 0x4}, &(0x7f0000001740)=0x8) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r11 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r7, r11, &(0x7f0000000040)=0x100060, 0xa808) fsconfig$FSCONFIG_SET_FLAG(r11, 0x0, &(0x7f0000000040)='dirsync\x00', 0x0, 0x0) [ 261.807625][T12007] device hsr_slave_0 entered promiscuous mode [ 261.870962][T12021] Unknown ioctl 1074311008 [ 261.873355][T12007] device hsr_slave_1 entered promiscuous mode [ 261.972087][T12007] debugfs: Directory 'hsr0' with parent '/' already present! [ 262.000606][T12024] Unknown ioctl 1074311008 [ 262.021290][T12007] bridge0: port 2(bridge_slave_1) entered blocking state [ 262.028541][T12007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 262.036257][T12007] bridge0: port 1(bridge_slave_0) entered blocking state [ 262.043918][T12007] bridge0: port 1(bridge_slave_0) entered forwarding state 12:39:08 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @loopback}, 0x4}}, 0x2e) unshare(0x2000400) r2 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r2, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, 0x32) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r2, 0x111, 0x3, 0x400040, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000540)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @rand_addr="0000000000e1ffffffffffffe700"}}}, 0x108) setsockopt$inet6_group_source_req(r4, 0x29, 0x1000000002e, &(0x7f0000000300)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) sendmsg$nl_generic(r3, &(0x7f00000012c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001280)={&(0x7f00000000c0)={0x70, 0x28, 0x4, 0x70bd27, 0x25dfdbff, {0x20}, [@typed={0x8, 0x50, @fd=r4}, @generic="73d63a426bb10c28ae543e152e62380d35b57c0c5ba507122bde56df53aea395699438f4b5bccaaa338204da56be077527dd3d1f04180648c8110343cb69d4e078d677bff5bf92db2acb3f5413b699c408c832"]}, 0x70}, 0x1, 0x0, 0x0, 0x20000000}, 0x1e630117f784944a) r5 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/btrfs-control\x00', 0x50040, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r5, 0x0, 0x81, &(0x7f0000000280)={'filter\x00', 0x0, 0x3, 0x6c, [], 0x5, &(0x7f0000000180)=[{}, {}, {}, {}, {}], &(0x7f0000000200)=""/108}, &(0x7f0000000480)=0x78) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r7 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r6, r7, &(0x7f0000000040)=0x100060, 0xa808) ioctl$UFFDIO_ZEROPAGE(r7, 0xc020aa04, &(0x7f0000001300)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}, 0x1}) 12:39:08 executing program 1: sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) set_mempolicy(0x4003, &(0x7f0000000140)=0x6, 0x9) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x80, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, &(0x7f0000000040)=0x100060, 0xa808) sendmsg$nl_generic(r2, &(0x7f00000015c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001580)={&(0x7f0000001340)={0x21c, 0x2e, 0x100, 0x70bd27, 0x25dfdbff, {0x1a}, [@nested={0x208, 0x32, [@typed={0xc, 0x26, @str='\x00\x00\x00\x00H'}, @typed={0x8, 0x78, @ipv4=@dev={0xac, 0x14, 0x14, 0x11}}, @typed={0x8, 0x9, @fd=r0}, @typed={0x4, 0x6f}, @generic="58ea681421ecc6fe733e33de51850ec017d80455b7db835dbb68a780685a7a371d7cbece4d71aa536b6829a84878e189ed9991565a956086f266d29ef44e65a61544b67ce77a98dd6a0a23e464d82eb3477ad514677ac507e24fc6ccdd7b89fb0b95b4458991462c83f45a0518ded89c5dfa4fc490b715bdea029b94c34bf51325d3b541a2bfff77c71c29ef0f0490fa04272519d37106175918234c10c4c40cbd96c165934acd82e8fd1da4c7deaddeeffc1d7f6da765d7dbf4e2918881c801d41a379dc62981a7e1d795d87056da18bee0d45ddfbada19792dbd573be4af38a1f08963ca8fe4834c57f42d1163d9f5d3b78e26f08c64ac16a742c3e2dbb2", @generic="8d6ccc0ee732dba4bb1452ea6ff586487dc6addd6b93dc83bfb3ea3315b2141afccd4b4cc300aa8ef42d836500299c0a3ec6f636f4563eb9a594f347d8f5da4e484ec7c6447e7d2ef5025dec540e4921a4a7992ba2a7d0fa22a55977825af10bc5f7cfba9d30757c634bd244ea9311755e7f9a8b660eab4bbc7a7634e794a40646ccaa747e0a65732a01e2eaf050fa0086ac705c7a1291fb076ac0447a861e97d6b22332ad1ff88dee108767376093c1b3de2ca86aeecf42b1b0221d607f1b2da73d69a0a2c2679be3f76fdd701cb3b68e09d41aae8f555eb735e811865f73aa08b2"]}]}, 0x21c}, 0x1, 0x0, 0x0, 0x40000}, 0x4) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000100)={@my=0x0}) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='\x00\x00\x00\x00H') r4 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r5 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r4, r5, &(0x7f0000000040)=0x100060, 0xa808) connect$can_bcm(r5, &(0x7f0000001780), 0x10) r6 = fsmount(0xffffffffffffffff, 0x3, 0x4) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000000000)='\x00\x00\x00\x00H', 0x0, r6) openat$cgroup_ro(r3, &(0x7f0000000180)='mem\x00\x01y7swaS.cur\x89\xc9B\xab\xe3\xfarent\x00\x1aw\xb7\xc3B\xef\xf0\xd5\xf34|\x98.\x857Y\xab[d\xfa\x83\xdf\xc6\xf3\xb5\xab\xbb\x98y\xe7\xff\x87o\xb2\xfe\xd0\x9d\x9a\x89\xfe\xc4\x1d\x92|z\xbc\nl%\x97,#\xab3aEW\x18A3@\x94\x05%Y\x1d\x90\xf3\xc8\x89\x9a.\x7fm5\xaa\b\xceo\t\xcc\x98\xb7\x18\x90\x1cM\x91\x0fzb\x85\xb5$\x86\xe4\xd9\x1bJ\x1f\xf0>\x18\xed\xb0\r.8\xc9\xcb\x03t\xa7\xd0D\x04\x1d\x04$\xecAb\b\xcf\xd40\xe8qg\xc5\x18\xd1\x8f\xe6D\xa8\x00\xf6H|y\xa1\x0f\xde\xe3\xbb\'\xb1\x02\x00\xc8p\xbfQh\"\n=\x90\xf9vUo9\x85\xb3\xa9\xec\xda\xc2\x99\xbe8\x9f[*\x80\xb7%\x9d33\xb9\xc3\xf0\x11!\x11\xc3\xa5$<\xcfC\x91|\x05\x1aO\xb4\xf0_\xbd>\xf3[\xbb[\x058\x01\xf4\xca\xf4(\xab8\x87R\xc8\xe0l\xce\x930\xec\xf5\x8f\xb0%I\xb7\x7f[\\i\xfb\x96d\xa1aA\x97j\xc3\xef\xb65\xc0e\xb2%\x1f\xba}\x0e$\x16\xbcw\xff&DRYp\xb8I\xc3\xa8\xee\x03\x19\xe8\xd9\x18i\xffHw\xea\x9d\x86\x0e\bl5\x945\xab\xd3\xef\x11\xbd\"\xbc\xf3\x8b\xf2.:\x8c\xe2\xb2\a\xac\x8b\x19\x80\x8b\xa3&\x19\x16\x80\xa1\x88\xbe\xc3\x0f\xf3\xb7V]\x89e\xf2D\xf6T\xc0\xb8/\xa5\x11\x15\x8cqV/', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000024c0)=[{0x0}, {&(0x7f0000000340)=""/4096, 0x1000}], 0x2, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r8, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r9 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r8, r9, &(0x7f0000000040)=0x100060, 0xa808) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000001600)={0x0, @in={{0x2, 0x4e20, @rand_addr=0x7}}}, &(0x7f00000016c0)=0x84) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r8, 0x84, 0x75, &(0x7f0000001700)={r10, 0x4}, &(0x7f0000001740)=0x8) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r11 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r7, r11, &(0x7f0000000040)=0x100060, 0xa808) fsconfig$FSCONFIG_SET_FLAG(r11, 0x0, &(0x7f0000000040)='dirsync\x00', 0x0, 0x0) [ 262.208791][T12007] 8021q: adding VLAN 0 to HW filter on device bond0 [ 262.262165][ T2953] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 262.275039][T12033] Unknown ioctl 1074311008 [ 262.279938][ T2953] bridge0: port 1(bridge_slave_0) entered disabled state [ 262.317343][T12033] ================================================================== [ 262.325463][T12033] BUG: KMSAN: uninit-value in kmem_cache_alloc+0x4ed/0xd10 [ 262.332668][T12033] CPU: 0 PID: 12033 Comm: syz-executor.1 Not tainted 5.3.0-rc7+ #0 [ 262.340546][T12033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 262.350595][T12033] Call Trace: [ 262.353989][T12033] dump_stack+0x191/0x1f0 [ 262.358327][T12033] kmsan_report+0x162/0x2d0 [ 262.362841][T12033] __msan_warning+0x75/0xe0 [ 262.367356][T12033] kmem_cache_alloc+0x4ed/0xd10 [ 262.372286][T12033] ? skb_clone+0x326/0x5d0 [ 262.376720][T12033] skb_clone+0x326/0x5d0 [ 262.381017][T12033] ip6_finish_output2+0x548/0x2670 [ 262.386168][T12033] ? kmsan_get_shadow_origin_ptr+0x71/0x4c0 [ 262.392070][T12033] ip6_fragment+0x2447/0x37d0 [ 262.396753][T12033] ? __ip6_finish_output+0x8f0/0x8f0 [ 262.402084][T12033] ? kmsan_get_shadow_origin_ptr+0x71/0x4c0 [ 262.407987][T12033] __ip6_finish_output+0x753/0x8f0 [ 262.413127][T12033] ip6_finish_output+0x2db/0x420 [ 262.418097][T12033] ip6_output+0x5d3/0x720 [ 262.422447][T12033] ? ip6_output+0x720/0x720 [ 262.426954][T12033] ? ac6_seq_show+0x200/0x200 [ 262.431721][T12033] ip6_local_out+0x164/0x1d0 [ 262.436335][T12033] ip6_send_skb+0xfa/0x390 [ 262.440809][T12033] udp_v6_send_skb+0x1763/0x1d50 [ 262.445784][T12033] udpv6_sendmsg+0x4315/0x4660 [ 262.450599][T12033] ? ip_do_fragment+0x35f0/0x35f0 [ 262.455660][T12033] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 262.461729][T12033] ? aa_sk_perm+0x730/0xaf0 [ 262.466271][T12033] ? udpv6_rcv+0x70/0x70 [ 262.470515][T12033] ? udpv6_rcv+0x70/0x70 [ 262.474765][T12033] inet6_sendmsg+0x276/0x2e0 [ 262.479419][T12033] kernel_sendmsg+0x24a/0x440 [ 262.484114][T12033] sock_no_sendpage+0x205/0x2b0 [ 262.488985][T12033] ? sock_no_mmap+0x30/0x30 [ 262.493496][T12033] sock_sendpage+0x1f1/0x2e0 [ 262.498107][T12033] pipe_to_sendpage+0x342/0x470 [ 262.502962][T12033] ? sock_fasync+0x250/0x250 [ 262.507569][T12033] __splice_from_pipe+0x484/0xe80 [ 262.512596][T12033] ? generic_splice_sendpage+0x2d0/0x2d0 [ 262.518255][T12033] generic_splice_sendpage+0x1d5/0x2d0 [ 262.523728][T12033] ? iter_file_splice_write+0x17f0/0x17f0 [ 262.529450][T12033] direct_splice_actor+0x19e/0x200 [ 262.534579][T12033] splice_direct_to_actor+0x852/0x1130 [ 262.540135][T12033] ? do_splice_direct+0x580/0x580 [ 262.545184][T12033] do_splice_direct+0x342/0x580 [ 262.550063][T12033] do_sendfile+0x1010/0x1d20 [ 262.554694][T12033] __se_sys_sendfile64+0x174/0x360 [ 262.559832][T12033] __x64_sys_sendfile64+0x56/0x70 [ 262.565650][T12033] do_syscall_64+0xbc/0xf0 [ 262.570112][T12033] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 262.576010][T12033] RIP: 0033:0x459a09 [ 262.580001][T12033] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 262.599616][T12033] RSP: 002b:00007f22eb234c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 262.608038][T12033] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459a09 [ 262.616282][T12033] RDX: 0000000020000040 RSI: 0000000000000008 RDI: 0000000000000007 [ 262.624335][T12033] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 262.632328][T12033] R10: 000000000000a808 R11: 0000000000000246 R12: 00007f22eb2356d4 [ 262.640307][T12033] R13: 00000000004c71d6 R14: 00000000004dc9e0 R15: 00000000ffffffff [ 262.648302][T12033] [ 262.650628][T12033] Uninit was stored to memory at: [ 262.655665][T12033] kmsan_internal_chain_origin+0xcc/0x150 [ 262.661396][T12033] __msan_chain_origin+0x6b/0xe0 [ 262.666343][T12033] ___slab_alloc+0x1dbc/0x1fb0 [ 262.671108][T12033] kmem_cache_alloc+0xade/0xd10 [ 262.675959][T12033] skb_clone+0x326/0x5d0 [ 262.680199][T12033] ip6_finish_output2+0x548/0x2670 [ 262.685307][T12033] ip6_fragment+0x2447/0x37d0 [ 262.689984][T12033] __ip6_finish_output+0x753/0x8f0 [ 262.695096][T12033] ip6_finish_output+0x2db/0x420 [ 262.700037][T12033] ip6_output+0x5d3/0x720 [ 262.704366][T12033] ip6_local_out+0x164/0x1d0 [ 262.708957][T12033] ip6_send_skb+0xfa/0x390 [ 262.713374][T12033] udp_v6_send_skb+0x1763/0x1d50 [ 262.718312][T12033] udpv6_sendmsg+0x4315/0x4660 [ 262.723077][T12033] inet6_sendmsg+0x276/0x2e0 [ 262.727672][T12033] kernel_sendmsg+0x24a/0x440 [ 262.732351][T12033] sock_no_sendpage+0x205/0x2b0 [ 262.737200][T12033] sock_sendpage+0x1f1/0x2e0 [ 262.741787][T12033] pipe_to_sendpage+0x342/0x470 [ 262.746632][T12033] __splice_from_pipe+0x484/0xe80 [ 262.751653][T12033] generic_splice_sendpage+0x1d5/0x2d0 [ 262.757116][T12033] direct_splice_actor+0x19e/0x200 [ 262.762227][T12033] splice_direct_to_actor+0x852/0x1130 [ 262.767679][T12033] do_splice_direct+0x342/0x580 [ 262.772526][T12033] do_sendfile+0x1010/0x1d20 [ 262.777118][T12033] __se_sys_sendfile64+0x174/0x360 [ 262.782227][T12033] __x64_sys_sendfile64+0x56/0x70 [ 262.787249][T12033] do_syscall_64+0xbc/0xf0 [ 262.791674][T12033] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 262.797553][T12033] [ 262.799875][T12033] Uninit was created at: [ 262.804122][T12033] kmsan_internal_poison_shadow+0x58/0xb0 [ 262.809839][T12033] kmsan_slab_free+0x8d/0x100 [ 262.814518][T12033] kmem_cache_free_bulk+0x3ad9/0x3f50 [ 262.819891][T12033] __kfree_skb_flush+0xb0/0x100 [ 262.824817][T12033] net_rx_action+0x1908/0x1950 [ 262.829625][T12033] __do_softirq+0x4a1/0x83a [ 262.834126][T12033] irq_exit+0x230/0x280 [ 262.838276][T12033] do_IRQ+0x20d/0x3a0 [ 262.842254][T12033] ret_from_intr+0x0/0x33 [ 262.846620][T12033] hash_conntrack_raw+0x160/0x6d0 [ 262.851646][T12033] nf_conntrack_in+0x986/0x2664 [ 262.856522][T12033] ipv4_conntrack_local+0x1b7/0x300 [ 262.861719][T12033] nf_hook_slow+0x18b/0x3f0 [ 262.866219][T12033] __ip_local_out+0x69b/0x800 [ 262.870892][T12033] __ip_queue_xmit+0x1bdc/0x21f0 [ 262.875944][T12033] ip_queue_xmit+0xcc/0xf0 [ 262.880357][T12033] __tcp_transmit_skb+0x409e/0x5c60 [ 262.885562][T12033] __tcp_send_ack+0x701/0x840 [ 262.890243][T12033] tcp_send_ack+0x68/0x90 [ 262.894578][T12033] tcp_cleanup_rbuf+0x764/0x800 [ 262.899422][T12033] tcp_recvmsg+0x334d/0x4ff0 [ 262.904037][T12033] inet_recvmsg+0x237/0x7d0 [ 262.908540][T12033] sock_read_iter+0x5be/0x660 [ 262.913221][T12033] __vfs_read+0xa67/0xc90 [ 262.917548][T12033] vfs_read+0x359/0x6f0 [ 262.921701][T12033] ksys_read+0x265/0x430 [ 262.925941][T12033] __se_sys_read+0x92/0xb0 [ 262.930374][T12033] __x64_sys_read+0x4a/0x70 [ 262.934879][T12033] do_syscall_64+0xbc/0xf0 [ 262.939297][T12033] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 262.945180][T12033] ================================================================== [ 262.953228][T12033] Disabling lock debugging due to kernel taint [ 262.959375][T12033] Kernel panic - not syncing: panic_on_warn set ... [ 262.965967][T12033] CPU: 0 PID: 12033 Comm: syz-executor.1 Tainted: G B 5.3.0-rc7+ #0 [ 262.975284][T12033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 262.985337][T12033] Call Trace: [ 262.988646][T12033] dump_stack+0x191/0x1f0 [ 262.992991][T12033] panic+0x3c9/0xc1e [ 262.996926][T12033] kmsan_report+0x2ca/0x2d0 [ 263.001435][T12033] __msan_warning+0x75/0xe0 [ 263.005953][T12033] kmem_cache_alloc+0x4ed/0xd10 [ 263.010807][T12033] ? skb_clone+0x326/0x5d0 [ 263.015236][T12033] skb_clone+0x326/0x5d0 [ 263.019516][T12033] ip6_finish_output2+0x548/0x2670 [ 263.024660][T12033] ? kmsan_get_shadow_origin_ptr+0x71/0x4c0 [ 263.030555][T12033] ip6_fragment+0x2447/0x37d0 [ 263.035234][T12033] ? __ip6_finish_output+0x8f0/0x8f0 [ 263.040559][T12033] ? kmsan_get_shadow_origin_ptr+0x71/0x4c0 [ 263.046456][T12033] __ip6_finish_output+0x753/0x8f0 [ 263.051583][T12033] ip6_finish_output+0x2db/0x420 [ 263.056532][T12033] ip6_output+0x5d3/0x720 [ 263.060871][T12033] ? ip6_output+0x720/0x720 [ 263.065371][T12033] ? ac6_seq_show+0x200/0x200 [ 263.070058][T12033] ip6_local_out+0x164/0x1d0 [ 263.074661][T12033] ip6_send_skb+0xfa/0x390 [ 263.079108][T12033] udp_v6_send_skb+0x1763/0x1d50 [ 263.084076][T12033] udpv6_sendmsg+0x4315/0x4660 [ 263.088845][T12033] ? ip_do_fragment+0x35f0/0x35f0 [ 263.093900][T12033] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 263.099971][T12033] ? aa_sk_perm+0x730/0xaf0 [ 263.104506][T12033] ? udpv6_rcv+0x70/0x70 [ 263.108746][T12033] ? udpv6_rcv+0x70/0x70 [ 263.112991][T12033] inet6_sendmsg+0x276/0x2e0 [ 263.117602][T12033] kernel_sendmsg+0x24a/0x440 [ 263.122293][T12033] sock_no_sendpage+0x205/0x2b0 [ 263.127160][T12033] ? sock_no_mmap+0x30/0x30 [ 263.131665][T12033] sock_sendpage+0x1f1/0x2e0 [ 263.136277][T12033] pipe_to_sendpage+0x342/0x470 [ 263.141132][T12033] ? sock_fasync+0x250/0x250 [ 263.145741][T12033] __splice_from_pipe+0x484/0xe80 [ 263.150763][T12033] ? generic_splice_sendpage+0x2d0/0x2d0 [ 263.156414][T12033] generic_splice_sendpage+0x1d5/0x2d0 [ 263.161883][T12033] ? iter_file_splice_write+0x17f0/0x17f0 [ 263.167618][T12033] direct_splice_actor+0x19e/0x200 [ 263.172739][T12033] splice_direct_to_actor+0x852/0x1130 [ 263.178196][T12033] ? do_splice_direct+0x580/0x580 [ 263.183245][T12033] do_splice_direct+0x342/0x580 [ 263.188122][T12033] do_sendfile+0x1010/0x1d20 [ 263.192744][T12033] __se_sys_sendfile64+0x174/0x360 [ 263.197870][T12033] __x64_sys_sendfile64+0x56/0x70 [ 263.202900][T12033] do_syscall_64+0xbc/0xf0 [ 263.207327][T12033] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 263.213216][T12033] RIP: 0033:0x459a09 [ 263.217109][T12033] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 263.236717][T12033] RSP: 002b:00007f22eb234c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 263.245130][T12033] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459a09 [ 263.253100][T12033] RDX: 0000000020000040 RSI: 0000000000000008 RDI: 0000000000000007 [ 263.261069][T12033] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 263.269036][T12033] R10: 000000000000a808 R11: 0000000000000246 R12: 00007f22eb2356d4 [ 263.277009][T12033] R13: 00000000004c71d6 R14: 00000000004dc9e0 R15: 00000000ffffffff [ 263.286402][T12033] Kernel Offset: disabled [ 263.290736][T12033] Rebooting in 86400 seconds..