[ 38.432833][ T26] audit: type=1800 audit(1554333541.033:27): pid=7698 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 38.461303][ T26] audit: type=1800 audit(1554333541.033:28): pid=7698 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 39.155197][ T26] audit: type=1800 audit(1554333541.813:29): pid=7698 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 39.175419][ T26] audit: type=1800 audit(1554333541.813:30): pid=7698 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.159' (ECDSA) to the list of known hosts. 2019/04/03 23:19:35 fuzzer started 2019/04/03 23:19:37 dialing manager at 10.128.0.26:37451 2019/04/03 23:19:37 syscalls: 2408 2019/04/03 23:19:37 code coverage: enabled 2019/04/03 23:19:37 comparison tracing: enabled 2019/04/03 23:19:37 extra coverage: extra coverage is not supported by the kernel 2019/04/03 23:19:37 setuid sandbox: enabled 2019/04/03 23:19:37 namespace sandbox: enabled 2019/04/03 23:19:37 Android sandbox: /sys/fs/selinux/policy does not exist 2019/04/03 23:19:37 fault injection: enabled 2019/04/03 23:19:37 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/04/03 23:19:37 net packet injection: enabled 2019/04/03 23:19:37 net device setup: enabled 23:19:57 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000240)='/dev/dsp#\x00', 0x0, 0x2000) ioctl$BLKFRASET(r0, 0x1264, &(0x7f0000000280)=0x9) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, &(0x7f0000000140)={{0xa, 0x4e24, 0x0, @mcast2, 0x9}, {0xa, 0x4e20, 0xfffffffffffffffd, @local, 0x121e}, 0x7, [0x1, 0x7, 0x4, 0x9, 0x0, 0x80000000, 0x3ff, 0x2]}, 0x5c) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000200)=0x100000001, 0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000a8eff8)) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) stat(0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x41, 0x0) mount(&(0x7f00000004c0)=ANY=[], &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmget(0x0, 0x3000, 0x8, &(0x7f0000ffd000/0x3000)=nil) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) umount2(&(0x7f0000000000)='./file0\x00', 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x21}, 0x7fff}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='pagemap\x00') openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000000000)=0x100b00, 0xb00) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_emit_ethernet(0xfea8, &(0x7f0000000100)={@link_local={0x21}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x8, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @dev}}}}}}, 0x0) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) syzkaller login: [ 94.927436][ T7863] IPVS: ftp: loaded support on port[0] = 21 23:19:57 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x2100) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x800000000002, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040), 0x4) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="2e000000280081aee4050cecdb4cb9040a485e510b00000000000000ffffffff00008000"/46, 0x2e}], 0x1}, 0x0) unlink(0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'bond_slave_0\x00', 0x4005}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000e00)}, 0x0) ioctl$TUNSETNOCSUM(0xffffffffffffffff, 0x400454c8, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, 0x0) write$cgroup_subtree(r1, &(0x7f0000000380)=ANY=[], 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000840)='cpuacct.usage_user\x00', 0x0, 0x0) [ 95.051484][ T7863] chnl_net:caif_netlink_parms(): no params data found [ 95.106516][ T7863] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.114319][ T7863] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.122312][ T7863] device bridge_slave_0 entered promiscuous mode [ 95.134773][ T7863] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.141897][ T7863] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.151347][ T7863] device bridge_slave_1 entered promiscuous mode [ 95.178287][ T7863] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 95.189746][ T7863] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 95.193333][ T7866] IPVS: ftp: loaded support on port[0] = 21 [ 95.232635][ T7863] team0: Port device team_slave_0 added [ 95.255449][ T7863] team0: Port device team_slave_1 added 23:19:58 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vbi(&(0x7f00000002c0)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) r3 = add_key$keyring(&(0x7f0000000300)='keyring\x00', &(0x7f0000000340)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000380)={{{@in=@dev, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000480)=0xe8) r5 = getgid() keyctl$chown(0x4, r3, r4, r5) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x802, 0x0) ioctl$BLKZEROOUT(r6, 0x127f, &(0x7f00000000c0)={0x0, 0x4004400}) r7 = fcntl$dupfd(r1, 0x406, r1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000100)={0x0, @rand_addr, @initdev}, &(0x7f0000000140)=0xc) ioctl$sock_inet6_SIOCDELRT(r7, 0x890c, &(0x7f0000000240)={@initdev={0xfe, 0x88, [], 0x1, 0x0}, @local, @dev={0xfe, 0x80, [], 0xa}, 0x80000000, 0x7f, 0x1, 0x100, 0x6, 0x1000101, r8}) r9 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setuid(r10) ioctl$sock_kcm_SIOCKCMATTACH(r9, 0x89e0, 0x0) mincore(&(0x7f0000ffb000/0x2000)=nil, 0x2000, &(0x7f00000004c0)=""/209) r11 = shmget$private(0x0, 0x4000, 0x78000000, &(0x7f0000ffb000/0x4000)=nil) shmctl$SHM_STAT(r11, 0xd, &(0x7f00000005c0)=""/137) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0x0) accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) r12 = openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$ax25(r12, &(0x7f00000001c0)={{}, [@netrom, @netrom, @null, @rose, @default, @rose, @default, @bcast]}, &(0x7f0000000000)=0x48) ioctl$TUNSETSNDBUF(r12, 0x400454d4, &(0x7f00000000c0)=0x4) [ 95.356125][ T7863] device hsr_slave_0 entered promiscuous mode [ 95.433002][ T7863] device hsr_slave_1 entered promiscuous mode 23:19:58 executing program 3: sendmsg$TIPC_CMD_GET_MEDIA_NAMES(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x2001002, 0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0x0, 0x3, 0x0) mount$bpf(0x0, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000580)='bpf\x00', 0x80000, 0x0) perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x0, 0x0, 0x101, 0x400, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xff, 0x8, 0x0, 0x86, 0x0, 0x2, 0x3f, 0xfffffffffffffff9, 0x0, 0x8, 0x0, 0xc48, 0x0, 0xffffffffffffffe0, 0x1, 0x0, 0x0, 0x0, 0x2746ec8a, 0x9, 0x1, 0x3, 0x1fc0000, 0x8, 0x0, 0x0, 0x8, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0xfff, 0xfffffffffffffffe, 0x0, 0xdf}, 0x0, 0xc, 0xffffffffffffffff, 0x9) mount$bpf(0x20000000, &(0x7f0000000300)='./file0/file0\x00', 0x0, 0x5004, 0x0) mount$bpf(0x20000000, &(0x7f00000004c0)='./file0/file0\x00', 0x0, 0x588e, 0x0) mount$bpf(0x0, &(0x7f00000005c0)='./file0/file0\x00', &(0x7f0000000a40)='bpf\x00', 0x0, 0x0) umount2(0x0, 0x0) [ 95.551808][ T7869] IPVS: ftp: loaded support on port[0] = 21 [ 95.560295][ T7866] chnl_net:caif_netlink_parms(): no params data found [ 95.572826][ T7863] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.580001][ T7863] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.587778][ T7863] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.594891][ T7863] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.745656][ T7872] IPVS: ftp: loaded support on port[0] = 21 [ 95.755309][ T7866] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.762451][ T7866] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.774873][ T7866] device bridge_slave_0 entered promiscuous mode [ 95.807855][ T7866] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.815288][ T7866] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.825630][ T7866] device bridge_slave_1 entered promiscuous mode [ 95.854795][ T7869] chnl_net:caif_netlink_parms(): no params data found 23:19:58 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r2 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x2000, 0x264, &(0x7f0000ffb000/0x2000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) r4 = socket$inet(0x2, 0x3, 0x2) r5 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, r5, 0x0) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, &(0x7f0000000440)=0xfbe, 0x4) getsockname(r6, &(0x7f0000000340)=@ipx, &(0x7f00000001c0)=0x80) syz_genetlink_get_family_id$ipvs(&(0x7f00000004c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r6, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x1a00001}, 0xc, &(0x7f0000000580)={&(0x7f0000000780)=ANY=[@ANYBLOB="000227d1b58f00000008000500090000000c000100080001000a0000001400032008000000080003000200c9db56b1c0f21115c1600b8f6c73da062c7c187ca9cb891d7557392775beb2fbd3286772448fbe6d93a361dc3d47e51550ec999800900080f8000000000000000000008a423f15181b01867a286f0191941a06f57dbfd82d35bc95ffd08b0114d80d57247a258a18eb1f48eb6f415f7748b09422c937c9fe5b7f7f3bd18726648d4f7cafb6184ddf21b13b8c000000003c47651295de081f337ba28bd80700c2e700000000000038000000000000000611753341e06ccfcff475109091696574deec6aa4a18a8327526670569b7101efcb1d8d9d2593121a1819bdce7d0108430ce2f424a13c7a85c64df634533d550009ccdb6199c3b09f3c8d2f9d05577853dd968ead42efb7c403cc20cafd55aad40a395a1fa009782453138126da6c32e7095d37bce751852fb941328434661e6795dc7c3ed1d1b175d69b03412eb110078ef23f3a0ab38c6ce7561371734db9b34b6f458e3eff01000000000000937140178ba43d344626fc8e2f1919e1b9b1a00c9c736d10f8855037fc9a23af86baf4c55367ee94440bd06c6d4e628fa3ba60a3b0f9644a72214c7c31eb1618845c1ee9f0964980229602883268f7edbddfd33a227bad235d4770ed63629e9c00393e3b6dad7338f83b182223e66ec9719a3ee7676254cf85f1adb9b233b2d9836c454d36972e9ff763fcd99856e4dbc0b772ba4109cba9a5a54c6eedeacdb8b3000000e4a3dce444b81a0ddd0e12cfd5fbb4005cbd10587ef8bc50d25087f11a8173c6a9683a83ea57639d3dcaf9f12bfc37c2781930b51494981218c8e13d9561cd798816f293ea966ea6460bbf4621a33e856e30f8039d2faf1357db5347077310298340412bf2735d741239e067207d0f5b6026ddf3478742a5de83b39a00c522446531e48326905698b8b7184f5bf93493644804794e67a84ac4196c7efd931405007eaef605e8718abd318f258f0d1232b6ed3b66ff6ef721142c29657108c5189d853a593009193bbfbb86dfbb27bfafcf122e4fa57697bc42dd403ba622d40000000000000000000000000017587bccff7979a7b5883b7cb5c03249f75cf6245f6d9c7361583b9fce62dcb257fb51da"], 0x1}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r6, 0x28, 0x0, &(0x7f0000000100)=0x10000001, 0x8) setsockopt$inet_int(r4, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) mmap$xdp(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x3040000, 0x110, r6, 0x80000000) r7 = dup2(r2, r2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x100000, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(r4, 0x80081272, &(0x7f0000000240)) ioctl$ASHMEM_GET_SIZE(r7, 0x7704, 0x0) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='clear_refs\x00') openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r8, &(0x7f0000000740)={0xc, 0xecc3aadb5d6b339, 0xfa00, {&(0x7f0000000d00)}}, 0x907b3fc4954fa586) r9 = openat$md(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/md0\x00', 0x4001, 0x0) lgetxattr(&(0x7f0000000500)='./file0\x00', &(0x7f0000000ac0)=ANY=[@ANYBLOB="737973746582ba4d019981aaeb0000c55dca0000000400005f296ef2c0811a551eb4123660bec27317fceda2a02cbc8a5428f5a6ef1d4bd99ce324e3fd87f63b4f06cafb462854cd7bf761cec3b2fd1729ee8de348c520893989d245e4f7dc2262632d948d6f89908e2fbce7a811b2bd533e176b245383fd004af56d4c7e332dfc4ff19f614994bbfeec664b25beb8d07c52f58d08f0dc258f8f8a2a6459c066a0432a8f1f6a2644800d906f0522b6a925f1cde98541e6c61925432b0df51758cef22454a13458aa23aad0e713d72502005927c72c3ff082d9cc7a48296f27e483e63ac665c8c369b20158ede98efd5886db9150f58222734f782603459439b661d46edf48e4321347b7e322be38d37eeb7589398db87597ccd8d926f1d24500"/300], 0x0, 0x0) ioctl$BLKPG(r9, 0x40140921, &(0x7f0000000080)={0x4, 0x7, 0x86, &(0x7f0000000280)="d0e423b71a6225486a6af46106eb41da351f6d99d047b8e4b7b635a435c553cbfdf8ac0fcab53e48de15699253eba21f3ccc0076948c01849ff8f2e5e93741cdd7b5a43260f1767efb914415a6f612e590c251d48701fedc872ad4b2661354a2daeec836cb7bd5dfbd2ff61dbcae38ef67d115c316206f5e15e3b9bfb1926b164b10a43a1c4a"}) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc-cast6-avx)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7da12a9bf3b3923b121d9c9e2cc98a64d", 0x11) [ 95.910250][ T7863] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.941844][ T7866] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 95.991803][ T7869] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.012788][ T7869] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.020730][ T7869] device bridge_slave_0 entered promiscuous mode [ 96.061643][ T7866] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 96.085981][ T22] bridge0: port 1(bridge_slave_0) entered disabled state [ 96.097417][ T22] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.108375][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 96.126512][ T7869] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.137954][ T7869] bridge0: port 2(bridge_slave_1) entered disabled state [ 96.146427][ T7869] device bridge_slave_1 entered promiscuous mode [ 96.168758][ T7863] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.171630][ T7875] IPVS: ftp: loaded support on port[0] = 21 [ 96.189957][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 96.203326][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 23:19:58 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x5, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) fsetxattr$security_smack_entry(0xffffffffffffffff, &(0x7f0000000040)='security.SMACK64MMAP\x00', &(0x7f00000000c0)='nr\xc5\"\x85}\xfa\xfd\x1e', 0x9, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0xffffffffffffffff, 0x100000}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000ac0)={0x26, 'hash\x00', 0x0, 0x0, 'tgr128\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) r4 = accept4(r3, &(0x7f0000000640)=@xdp, &(0x7f0000000100)=0x80, 0x800) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) eventfd2(0x2, 0x80001) write$apparmor_current(r5, &(0x7f0000000500)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303012315e631fff6f7570275c002f6465762f6d6978657200746772313238002f6465762f6d69786572002f6465762f6d6978657200318a775bf97af245cfd2bc1d60fa85b98ed605c4d18c79953e8a4a1c65dff8a0d088740868bccbb0ee5af654c966b494be8d14f5f581c17377fa5f0caac38fccf88d"], 0x1) accept4(r3, &(0x7f00000009c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4}}}, &(0x7f0000000180)=0x80, 0x80800) syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_DEL_SERVICE(r4, &(0x7f0000000700)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000006c0)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x10) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r7, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x0, @loopback}, {0xa, 0x4e21, 0x8000000000000000, @dev}, r8}}, 0x48) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000140)={0x7, 0x8, 0x2, 0xf50c, 0x8, 0x4, 0xca, 0x8, 0x0}, &(0x7f0000000440)=0x20) getsockopt$inet_sctp6_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000480)={r9, 0x3}, &(0x7f00000004c0)=0x8) [ 96.234566][ T7866] team0: Port device team_slave_0 added [ 96.252624][ T7869] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 96.265140][ T7869] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 96.284527][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 96.303548][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 96.311959][ T22] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.319599][ T22] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.328529][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 96.337277][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 96.346159][ T22] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.353293][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.365082][ T7866] team0: Port device team_slave_1 added [ 96.399319][ T7877] IPVS: ftp: loaded support on port[0] = 21 [ 96.430906][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 96.457430][ T7869] team0: Port device team_slave_0 added [ 96.467367][ T7869] team0: Port device team_slave_1 added [ 96.525091][ T7866] device hsr_slave_0 entered promiscuous mode [ 96.563084][ T7866] device hsr_slave_1 entered promiscuous mode [ 96.615155][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 96.698427][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 96.707780][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 96.716124][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 96.724798][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 96.741372][ T7863] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 96.752786][ T7863] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 96.779648][ T7872] chnl_net:caif_netlink_parms(): no params data found [ 96.815478][ T7869] device hsr_slave_0 entered promiscuous mode [ 96.863071][ T7869] device hsr_slave_1 entered promiscuous mode [ 96.945695][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 96.954071][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 96.962201][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 96.971057][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 96.979368][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 96.987595][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 97.028048][ T7875] chnl_net:caif_netlink_parms(): no params data found [ 97.128137][ T7866] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.139643][ T7863] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 97.153681][ T7875] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.160839][ T7875] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.171995][ T7875] device bridge_slave_0 entered promiscuous mode [ 97.179831][ T7875] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.187345][ T7875] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.195943][ T7875] device bridge_slave_1 entered promiscuous mode [ 97.207446][ T7872] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.215017][ T7872] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.223284][ T7872] device bridge_slave_0 entered promiscuous mode [ 97.259318][ T7872] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.267048][ T7872] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.276782][ T7872] device bridge_slave_1 entered promiscuous mode [ 97.284241][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 97.291922][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 97.305517][ T7866] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.321333][ T7875] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 97.342101][ T7872] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 97.403676][ T7875] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 97.429582][ T7869] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.439978][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 97.450779][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 97.462357][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.469475][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.479464][ T7872] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 97.494674][ T7877] chnl_net:caif_netlink_parms(): no params data found [ 97.517515][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 97.544769][ C0] hrtimer: interrupt took 45307 ns 23:20:00 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000240)='/dev/dsp#\x00', 0x0, 0x2000) ioctl$BLKFRASET(r0, 0x1264, &(0x7f0000000280)=0x9) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, &(0x7f0000000140)={{0xa, 0x4e24, 0x0, @mcast2, 0x9}, {0xa, 0x4e20, 0xfffffffffffffffd, @local, 0x121e}, 0x7, [0x1, 0x7, 0x4, 0x9, 0x0, 0x80000000, 0x3ff, 0x2]}, 0x5c) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000200)=0x100000001, 0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000a8eff8)) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) stat(0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x41, 0x0) mount(&(0x7f00000004c0)=ANY=[], &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmget(0x0, 0x3000, 0x8, &(0x7f0000ffd000/0x3000)=nil) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) umount2(&(0x7f0000000000)='./file0\x00', 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x21}, 0x7fff}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='pagemap\x00') openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000000000)=0x100b00, 0xb00) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_emit_ethernet(0xfea8, &(0x7f0000000100)={@link_local={0x21}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x8, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @dev}}}}}}, 0x0) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) [ 97.570339][ T7872] team0: Port device team_slave_0 added [ 97.578602][ T7875] team0: Port device team_slave_0 added [ 97.590771][ T7869] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.600066][ T7872] team0: Port device team_slave_1 added [ 97.628624][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 97.637728][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 97.652019][ T7880] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.659128][ T7880] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.667677][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 97.682183][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 97.700392][ T7875] team0: Port device team_slave_1 added [ 97.766519][ T7875] device hsr_slave_0 entered promiscuous mode [ 97.823096][ T7875] device hsr_slave_1 entered promiscuous mode 23:20:00 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000240)='/dev/dsp#\x00', 0x0, 0x2000) ioctl$BLKFRASET(r0, 0x1264, &(0x7f0000000280)=0x9) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, &(0x7f0000000140)={{0xa, 0x4e24, 0x0, @mcast2, 0x9}, {0xa, 0x4e20, 0xfffffffffffffffd, @local, 0x121e}, 0x7, [0x1, 0x7, 0x4, 0x9, 0x0, 0x80000000, 0x3ff, 0x2]}, 0x5c) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000200)=0x100000001, 0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000a8eff8)) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) stat(0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x41, 0x0) mount(&(0x7f00000004c0)=ANY=[], &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmget(0x0, 0x3000, 0x8, &(0x7f0000ffd000/0x3000)=nil) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) umount2(&(0x7f0000000000)='./file0\x00', 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x21}, 0x7fff}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='pagemap\x00') openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000000000)=0x100b00, 0xb00) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_emit_ethernet(0xfea8, &(0x7f0000000100)={@link_local={0x21}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x8, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @dev}}}}}}, 0x0) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) [ 97.890138][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 97.898952][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 97.919405][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 97.938106][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 97.955749][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 97.964691][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 97.973535][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 97.987613][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 97.996237][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 98.026678][ T7877] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.035140][ T7877] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.044238][ T7877] device bridge_slave_0 entered promiscuous mode [ 98.072241][ T7869] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network 23:20:00 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000240)='/dev/dsp#\x00', 0x0, 0x2000) ioctl$BLKFRASET(r0, 0x1264, &(0x7f0000000280)=0x9) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, &(0x7f0000000140)={{0xa, 0x4e24, 0x0, @mcast2, 0x9}, {0xa, 0x4e20, 0xfffffffffffffffd, @local, 0x121e}, 0x7, [0x1, 0x7, 0x4, 0x9, 0x0, 0x80000000, 0x3ff, 0x2]}, 0x5c) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000200)=0x100000001, 0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000a8eff8)) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) stat(0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x41, 0x0) mount(&(0x7f00000004c0)=ANY=[], &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmget(0x0, 0x3000, 0x8, &(0x7f0000ffd000/0x3000)=nil) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) umount2(&(0x7f0000000000)='./file0\x00', 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x21}, 0x7fff}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='pagemap\x00') openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000000000)=0x100b00, 0xb00) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_emit_ethernet(0xfea8, &(0x7f0000000100)={@link_local={0x21}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x8, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @dev}}}}}}, 0x0) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) [ 98.088527][ T7869] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 98.116305][ T7866] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 98.133520][ T7866] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 98.165837][ T7872] device hsr_slave_0 entered promiscuous mode [ 98.193216][ T7872] device hsr_slave_1 entered promiscuous mode [ 98.213390][ T7877] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.220512][ T7877] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.228391][ T7877] device bridge_slave_1 entered promiscuous mode [ 98.239186][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 98.250031][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 98.258493][ T7880] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.265595][ T7880] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.273901][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 98.282318][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 98.290751][ T7880] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.297818][ T7880] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.305470][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 98.314201][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 98.322611][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 98.331274][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 98.339735][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 98.348311][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 98.356902][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 98.365218][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 98.373626][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 98.381819][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 98.390075][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 98.398439][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 98.432463][ T7866] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.470219][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 98.480612][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 98.490578][ T7880] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 98.526773][ T7869] 8021q: adding VLAN 0 to HW filter on device batadv0 23:20:01 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000240)='/dev/dsp#\x00', 0x0, 0x2000) ioctl$BLKFRASET(r0, 0x1264, &(0x7f0000000280)=0x9) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, &(0x7f0000000140)={{0xa, 0x4e24, 0x0, @mcast2, 0x9}, {0xa, 0x4e20, 0xfffffffffffffffd, @local, 0x121e}, 0x7, [0x1, 0x7, 0x4, 0x9, 0x0, 0x80000000, 0x3ff, 0x2]}, 0x5c) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000200)=0x100000001, 0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000a8eff8)) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) stat(0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x41, 0x0) mount(&(0x7f00000004c0)=ANY=[], &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmget(0x0, 0x3000, 0x8, &(0x7f0000ffd000/0x3000)=nil) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) umount2(&(0x7f0000000000)='./file0\x00', 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x21}, 0x7fff}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='pagemap\x00') openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000000000)=0x100b00, 0xb00) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_emit_ethernet(0xfea8, &(0x7f0000000100)={@link_local={0x21}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x8, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @dev}}}}}}, 0x0) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) [ 98.569150][ T7877] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 98.598936][ T7877] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 98.653315][ T7910] netlink: 10 bytes leftover after parsing attributes in process `syz-executor.1'. 23:20:01 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000240)='/dev/dsp#\x00', 0x0, 0x2000) ioctl$BLKFRASET(r0, 0x1264, &(0x7f0000000280)=0x9) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, &(0x7f0000000140)={{0xa, 0x4e24, 0x0, @mcast2, 0x9}, {0xa, 0x4e20, 0xfffffffffffffffd, @local, 0x121e}, 0x7, [0x1, 0x7, 0x4, 0x9, 0x0, 0x80000000, 0x3ff, 0x2]}, 0x5c) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000200)=0x100000001, 0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000a8eff8)) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) stat(0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x41, 0x0) mount(&(0x7f00000004c0)=ANY=[], &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmget(0x0, 0x3000, 0x8, &(0x7f0000ffd000/0x3000)=nil) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) umount2(&(0x7f0000000000)='./file0\x00', 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x21}, 0x7fff}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='pagemap\x00') openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000000000)=0x100b00, 0xb00) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_emit_ethernet(0xfea8, &(0x7f0000000100)={@link_local={0x21}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x8, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @dev}}}}}}, 0x0) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) [ 98.737581][ T7877] team0: Port device team_slave_0 added [ 98.753205][ T7877] team0: Port device team_slave_1 added [ 98.762305][ T7872] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.813474][ T7875] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.846057][ T7919] netlink: 10 bytes leftover after parsing attributes in process `syz-executor.1'. [ 98.866356][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 98.876952][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 23:20:01 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x2100) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x800000000002, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040), 0x4) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="2e000000280081aee4050cecdb4cb9040a485e510b00000000000000ffffffff00008000"/46, 0x2e}], 0x1}, 0x0) unlink(0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'bond_slave_0\x00', 0x4005}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000e00)}, 0x0) ioctl$TUNSETNOCSUM(0xffffffffffffffff, 0x400454c8, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, 0x0) write$cgroup_subtree(r1, &(0x7f0000000380)=ANY=[], 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000840)='cpuacct.usage_user\x00', 0x0, 0x0) [ 98.910806][ T7875] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.977879][ T7877] device hsr_slave_0 entered promiscuous mode [ 99.067987][ T7877] device hsr_slave_1 entered promiscuous mode [ 99.123273][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 99.131023][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 23:20:01 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000240)='/dev/dsp#\x00', 0x0, 0x2000) ioctl$BLKFRASET(r0, 0x1264, &(0x7f0000000280)=0x9) setsockopt$inet6_MRT6_DEL_MFC(0xffffffffffffffff, 0x29, 0xcd, &(0x7f0000000140)={{0xa, 0x4e24, 0x0, @mcast2, 0x9}, {0xa, 0x4e20, 0xfffffffffffffffd, @local, 0x121e}, 0x7, [0x1, 0x7, 0x4, 0x9, 0x0, 0x80000000, 0x3ff, 0x2]}, 0x5c) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000200)=0x100000001, 0x4) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000a8eff8)) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) stat(0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x41, 0x0) mount(&(0x7f00000004c0)=ANY=[], &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmget(0x0, 0x3000, 0x8, &(0x7f0000ffd000/0x3000)=nil) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) umount2(&(0x7f0000000000)='./file0\x00', 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x21}, 0x7fff}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='pagemap\x00') openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000000000)=0x100b00, 0xb00) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_emit_ethernet(0xfea8, &(0x7f0000000100)={@link_local={0x21}, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x8, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @dev}}}}}}, 0x0) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) [ 99.185230][ T7872] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.192596][ T7927] netlink: 10 bytes leftover after parsing attributes in process `syz-executor.1'. 23:20:01 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x2100) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x800000000002, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040), 0x4) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="2e000000280081aee4050cecdb4cb9040a485e510b00000000000000ffffffff00008000"/46, 0x2e}], 0x1}, 0x0) unlink(0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'bond_slave_0\x00', 0x4005}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000e00)}, 0x0) ioctl$TUNSETNOCSUM(0xffffffffffffffff, 0x400454c8, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, 0x0) write$cgroup_subtree(r1, &(0x7f0000000380)=ANY=[], 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000840)='cpuacct.usage_user\x00', 0x0, 0x0) [ 99.269903][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 99.291543][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 99.337504][ T7871] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.345129][ T7871] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.376102][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 99.385564][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 99.394832][ T7871] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.401966][ T7871] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.411437][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 99.424050][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 99.433111][ T7871] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.440252][ T7871] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.448499][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 99.457954][ T7871] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 99.469080][ T7871] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.476278][ T7871] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.517075][ T7934] netlink: 10 bytes leftover after parsing attributes in process `syz-executor.1'. [ 99.540532][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 99.551080][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 99.563693][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 99.588608][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 99.598178][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 99.607528][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 99.616539][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 99.626437][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 23:20:02 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vbi(&(0x7f00000002c0)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) r3 = add_key$keyring(&(0x7f0000000300)='keyring\x00', &(0x7f0000000340)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000380)={{{@in=@dev, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000480)=0xe8) r5 = getgid() keyctl$chown(0x4, r3, r4, r5) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x802, 0x0) ioctl$BLKZEROOUT(r6, 0x127f, &(0x7f00000000c0)={0x0, 0x4004400}) r7 = fcntl$dupfd(r1, 0x406, r1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000100)={0x0, @rand_addr, @initdev}, &(0x7f0000000140)=0xc) ioctl$sock_inet6_SIOCDELRT(r7, 0x890c, &(0x7f0000000240)={@initdev={0xfe, 0x88, [], 0x1, 0x0}, @local, @dev={0xfe, 0x80, [], 0xa}, 0x80000000, 0x7f, 0x1, 0x100, 0x6, 0x1000101, r8}) r9 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setuid(r10) ioctl$sock_kcm_SIOCKCMATTACH(r9, 0x89e0, 0x0) mincore(&(0x7f0000ffb000/0x2000)=nil, 0x2000, &(0x7f00000004c0)=""/209) r11 = shmget$private(0x0, 0x4000, 0x78000000, &(0x7f0000ffb000/0x4000)=nil) shmctl$SHM_STAT(r11, 0xd, &(0x7f00000005c0)=""/137) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0x0) accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) r12 = openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$ax25(r12, &(0x7f00000001c0)={{}, [@netrom, @netrom, @null, @rose, @default, @rose, @default, @bcast]}, &(0x7f0000000000)=0x48) ioctl$TUNSETSNDBUF(r12, 0x400454d4, &(0x7f00000000c0)=0x4) [ 99.651781][ T7872] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 99.669566][ T7872] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 99.758743][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 99.770518][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 99.788148][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 99.796913][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 99.813569][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 99.822008][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 99.832146][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 99.840771][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 99.849642][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 99.858576][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 99.869598][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 99.878659][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 99.887445][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 99.896084][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 99.904737][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 99.913739][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 99.921647][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 99.934038][ T7875] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 99.949027][ T7877] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.010331][ T7875] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.032405][ T7872] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.049926][ T7877] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.087798][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 100.096992][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 100.135182][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 100.154879][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 100.181848][ T7879] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.189230][ T7879] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.238935][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 100.264510][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 100.279330][ T7879] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.286519][ T7879] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.296400][ T7879] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 100.320692][ T7877] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 100.345178][ T7952] md: loop134 has zero or unknown size, marking faulty! [ 100.366902][ T7952] md: md_import_device returned -22 [ 100.382595][ T7877] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 100.427521][ T2989] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 100.439017][ T2989] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 100.469011][ T2989] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 100.510268][ T2989] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 100.519170][ T2989] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 100.530699][ T2989] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 100.549127][ T2989] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 100.558103][ T2989] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 100.573892][ T2989] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 100.584852][ T2989] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 100.608389][ T7877] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.626164][ T2989] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 100.644013][ T2989] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 100.750622][ T7950] md: loop134 has zero or unknown size, marking faulty! [ 100.762043][ T7950] md: md_import_device returned -22 23:20:03 executing program 3: sendmsg$TIPC_CMD_GET_MEDIA_NAMES(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x2001002, 0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0x0, 0x3, 0x0) mount$bpf(0x0, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000580)='bpf\x00', 0x80000, 0x0) perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x0, 0x0, 0x101, 0x400, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xff, 0x8, 0x0, 0x86, 0x0, 0x2, 0x3f, 0xfffffffffffffff9, 0x0, 0x8, 0x0, 0xc48, 0x0, 0xffffffffffffffe0, 0x1, 0x0, 0x0, 0x0, 0x2746ec8a, 0x9, 0x1, 0x3, 0x1fc0000, 0x8, 0x0, 0x0, 0x8, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0xfff, 0xfffffffffffffffe, 0x0, 0xdf}, 0x0, 0xc, 0xffffffffffffffff, 0x9) mount$bpf(0x20000000, &(0x7f0000000300)='./file0/file0\x00', 0x0, 0x5004, 0x0) mount$bpf(0x20000000, &(0x7f00000004c0)='./file0/file0\x00', 0x0, 0x588e, 0x0) mount$bpf(0x0, &(0x7f00000005c0)='./file0/file0\x00', &(0x7f0000000a40)='bpf\x00', 0x0, 0x0) umount2(0x0, 0x0) [ 100.821154][ T7973] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 23:20:03 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r2 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x2000, 0x264, &(0x7f0000ffb000/0x2000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) r4 = socket$inet(0x2, 0x3, 0x2) r5 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, r5, 0x0) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, &(0x7f0000000440)=0xfbe, 0x4) getsockname(r6, &(0x7f0000000340)=@ipx, &(0x7f00000001c0)=0x80) syz_genetlink_get_family_id$ipvs(&(0x7f00000004c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r6, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x1a00001}, 0xc, &(0x7f0000000580)={&(0x7f0000000780)=ANY=[@ANYBLOB="000227d1b58f00000008000500090000000c000100080001000a0000001400032008000000080003000200c9db56b1c0f21115c1600b8f6c73da062c7c187ca9cb891d7557392775beb2fbd3286772448fbe6d93a361dc3d47e51550ec999800900080f8000000000000000000008a423f15181b01867a286f0191941a06f57dbfd82d35bc95ffd08b0114d80d57247a258a18eb1f48eb6f415f7748b09422c937c9fe5b7f7f3bd18726648d4f7cafb6184ddf21b13b8c000000003c47651295de081f337ba28bd80700c2e700000000000038000000000000000611753341e06ccfcff475109091696574deec6aa4a18a8327526670569b7101efcb1d8d9d2593121a1819bdce7d0108430ce2f424a13c7a85c64df634533d550009ccdb6199c3b09f3c8d2f9d05577853dd968ead42efb7c403cc20cafd55aad40a395a1fa009782453138126da6c32e7095d37bce751852fb941328434661e6795dc7c3ed1d1b175d69b03412eb110078ef23f3a0ab38c6ce7561371734db9b34b6f458e3eff01000000000000937140178ba43d344626fc8e2f1919e1b9b1a00c9c736d10f8855037fc9a23af86baf4c55367ee94440bd06c6d4e628fa3ba60a3b0f9644a72214c7c31eb1618845c1ee9f0964980229602883268f7edbddfd33a227bad235d4770ed63629e9c00393e3b6dad7338f83b182223e66ec9719a3ee7676254cf85f1adb9b233b2d9836c454d36972e9ff763fcd99856e4dbc0b772ba4109cba9a5a54c6eedeacdb8b3000000e4a3dce444b81a0ddd0e12cfd5fbb4005cbd10587ef8bc50d25087f11a8173c6a9683a83ea57639d3dcaf9f12bfc37c2781930b51494981218c8e13d9561cd798816f293ea966ea6460bbf4621a33e856e30f8039d2faf1357db5347077310298340412bf2735d741239e067207d0f5b6026ddf3478742a5de83b39a00c522446531e48326905698b8b7184f5bf93493644804794e67a84ac4196c7efd931405007eaef605e8718abd318f258f0d1232b6ed3b66ff6ef721142c29657108c5189d853a593009193bbfbb86dfbb27bfafcf122e4fa57697bc42dd403ba622d40000000000000000000000000017587bccff7979a7b5883b7cb5c03249f75cf6245f6d9c7361583b9fce62dcb257fb51da"], 0x1}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r6, 0x28, 0x0, &(0x7f0000000100)=0x10000001, 0x8) setsockopt$inet_int(r4, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) mmap$xdp(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x3040000, 0x110, r6, 0x80000000) r7 = dup2(r2, r2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x100000, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(r4, 0x80081272, &(0x7f0000000240)) ioctl$ASHMEM_GET_SIZE(r7, 0x7704, 0x0) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='clear_refs\x00') openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r8, &(0x7f0000000740)={0xc, 0xecc3aadb5d6b339, 0xfa00, {&(0x7f0000000d00)}}, 0x907b3fc4954fa586) r9 = openat$md(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/md0\x00', 0x4001, 0x0) lgetxattr(&(0x7f0000000500)='./file0\x00', &(0x7f0000000ac0)=ANY=[@ANYBLOB="737973746582ba4d019981aaeb0000c55dca0000000400005f296ef2c0811a551eb4123660bec27317fceda2a02cbc8a5428f5a6ef1d4bd99ce324e3fd87f63b4f06cafb462854cd7bf761cec3b2fd1729ee8de348c520893989d245e4f7dc2262632d948d6f89908e2fbce7a811b2bd533e176b245383fd004af56d4c7e332dfc4ff19f614994bbfeec664b25beb8d07c52f58d08f0dc258f8f8a2a6459c066a0432a8f1f6a2644800d906f0522b6a925f1cde98541e6c61925432b0df51758cef22454a13458aa23aad0e713d72502005927c72c3ff082d9cc7a48296f27e483e63ac665c8c369b20158ede98efd5886db9150f58222734f782603459439b661d46edf48e4321347b7e322be38d37eeb7589398db87597ccd8d926f1d24500"/300], 0x0, 0x0) ioctl$BLKPG(r9, 0x40140921, &(0x7f0000000080)={0x4, 0x7, 0x86, &(0x7f0000000280)="d0e423b71a6225486a6af46106eb41da351f6d99d047b8e4b7b635a435c553cbfdf8ac0fcab53e48de15699253eba21f3ccc0076948c01849ff8f2e5e93741cdd7b5a43260f1767efb914415a6f612e590c251d48701fedc872ad4b2661354a2daeec836cb7bd5dfbd2ff61dbcae38ef67d115c316206f5e15e3b9bfb1926b164b10a43a1c4a"}) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc-cast6-avx)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7da12a9bf3b3923b121d9c9e2cc98a64d", 0x11) 23:20:03 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x5, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) fsetxattr$security_smack_entry(0xffffffffffffffff, &(0x7f0000000040)='security.SMACK64MMAP\x00', &(0x7f00000000c0)='nr\xc5\"\x85}\xfa\xfd\x1e', 0x9, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0xffffffffffffffff, 0x100000}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000ac0)={0x26, 'hash\x00', 0x0, 0x0, 'tgr128\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) r4 = accept4(r3, &(0x7f0000000640)=@xdp, &(0x7f0000000100)=0x80, 0x800) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) eventfd2(0x2, 0x80001) write$apparmor_current(r5, &(0x7f0000000500)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303012315e631fff6f7570275c002f6465762f6d6978657200746772313238002f6465762f6d69786572002f6465762f6d6978657200318a775bf97af245cfd2bc1d60fa85b98ed605c4d18c79953e8a4a1c65dff8a0d088740868bccbb0ee5af654c966b494be8d14f5f581c17377fa5f0caac38fccf88d"], 0x1) accept4(r3, &(0x7f00000009c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4}}}, &(0x7f0000000180)=0x80, 0x80800) syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_DEL_SERVICE(r4, &(0x7f0000000700)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000006c0)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x10) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r7, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x0, @loopback}, {0xa, 0x4e21, 0x8000000000000000, @dev}, r8}}, 0x48) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000140)={0x7, 0x8, 0x2, 0xf50c, 0x8, 0x4, 0xca, 0x8, 0x0}, &(0x7f0000000440)=0x20) getsockopt$inet_sctp6_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000480)={r9, 0x3}, &(0x7f00000004c0)=0x8) 23:20:03 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x2100) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x800000000002, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040), 0x4) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="2e000000280081aee4050cecdb4cb9040a485e510b00000000000000ffffffff00008000"/46, 0x2e}], 0x1}, 0x0) unlink(0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'bond_slave_0\x00', 0x4005}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000e00)}, 0x0) ioctl$TUNSETNOCSUM(0xffffffffffffffff, 0x400454c8, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, 0x0) write$cgroup_subtree(r1, &(0x7f0000000380)=ANY=[], 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000840)='cpuacct.usage_user\x00', 0x0, 0x0) 23:20:03 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x2100) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x800000000002, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040), 0x4) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="2e000000280081aee4050cecdb4cb9040a485e510b00000000000000ffffffff00008000"/46, 0x2e}], 0x1}, 0x0) unlink(0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'bond_slave_0\x00', 0x4005}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000e00)}, 0x0) ioctl$TUNSETNOCSUM(0xffffffffffffffff, 0x400454c8, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, 0x0) write$cgroup_subtree(r1, &(0x7f0000000380)=ANY=[], 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000840)='cpuacct.usage_user\x00', 0x0, 0x0) 23:20:03 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vbi(&(0x7f00000002c0)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) r3 = add_key$keyring(&(0x7f0000000300)='keyring\x00', &(0x7f0000000340)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000380)={{{@in=@dev, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000480)=0xe8) r5 = getgid() keyctl$chown(0x4, r3, r4, r5) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x802, 0x0) ioctl$BLKZEROOUT(r6, 0x127f, &(0x7f00000000c0)={0x0, 0x4004400}) r7 = fcntl$dupfd(r1, 0x406, r1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000100)={0x0, @rand_addr, @initdev}, &(0x7f0000000140)=0xc) ioctl$sock_inet6_SIOCDELRT(r7, 0x890c, &(0x7f0000000240)={@initdev={0xfe, 0x88, [], 0x1, 0x0}, @local, @dev={0xfe, 0x80, [], 0xa}, 0x80000000, 0x7f, 0x1, 0x100, 0x6, 0x1000101, r8}) r9 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setuid(r10) ioctl$sock_kcm_SIOCKCMATTACH(r9, 0x89e0, 0x0) mincore(&(0x7f0000ffb000/0x2000)=nil, 0x2000, &(0x7f00000004c0)=""/209) r11 = shmget$private(0x0, 0x4000, 0x78000000, &(0x7f0000ffb000/0x4000)=nil) shmctl$SHM_STAT(r11, 0xd, &(0x7f00000005c0)=""/137) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0x0) accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) r12 = openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$ax25(r12, &(0x7f00000001c0)={{}, [@netrom, @netrom, @null, @rose, @default, @rose, @default, @bcast]}, &(0x7f0000000000)=0x48) ioctl$TUNSETSNDBUF(r12, 0x400454d4, &(0x7f00000000c0)=0x4) 23:20:03 executing program 3: sendmsg$TIPC_CMD_GET_MEDIA_NAMES(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x2001002, 0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0x0, 0x3, 0x0) mount$bpf(0x0, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000580)='bpf\x00', 0x80000, 0x0) perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x0, 0x0, 0x101, 0x400, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xff, 0x8, 0x0, 0x86, 0x0, 0x2, 0x3f, 0xfffffffffffffff9, 0x0, 0x8, 0x0, 0xc48, 0x0, 0xffffffffffffffe0, 0x1, 0x0, 0x0, 0x0, 0x2746ec8a, 0x9, 0x1, 0x3, 0x1fc0000, 0x8, 0x0, 0x0, 0x8, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0xfff, 0xfffffffffffffffe, 0x0, 0xdf}, 0x0, 0xc, 0xffffffffffffffff, 0x9) mount$bpf(0x20000000, &(0x7f0000000300)='./file0/file0\x00', 0x0, 0x5004, 0x0) mount$bpf(0x20000000, &(0x7f00000004c0)='./file0/file0\x00', 0x0, 0x588e, 0x0) mount$bpf(0x0, &(0x7f00000005c0)='./file0/file0\x00', &(0x7f0000000a40)='bpf\x00', 0x0, 0x0) umount2(0x0, 0x0) [ 101.194206][ T7983] md: loop134 has zero or unknown size, marking faulty! [ 101.221906][ T7983] md: md_import_device returned -22 [ 101.270928][ T7993] netlink: 10 bytes leftover after parsing attributes in process `syz-executor.0'. [ 101.336330][ T7999] netlink: 10 bytes leftover after parsing attributes in process `syz-executor.1'. 23:20:04 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x2100) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x800000000002, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040), 0x4) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="2e000000280081aee4050cecdb4cb9040a485e510b00000000000000ffffffff00008000"/46, 0x2e}], 0x1}, 0x0) unlink(0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'bond_slave_0\x00', 0x4005}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000e00)}, 0x0) ioctl$TUNSETNOCSUM(0xffffffffffffffff, 0x400454c8, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, 0x0) write$cgroup_subtree(r1, &(0x7f0000000380)=ANY=[], 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000840)='cpuacct.usage_user\x00', 0x0, 0x0) [ 101.481547][ T8006] ================================================================== [ 101.489825][ T8006] BUG: KASAN: use-after-free in cma_check_port+0x8ce/0x8f0 [ 101.497034][ T8006] Read of size 8 at addr ffff8880a3a77648 by task syz-executor.5/8006 [ 101.505180][ T8006] [ 101.507535][ T8006] CPU: 1 PID: 8006 Comm: syz-executor.5 Not tainted 5.1.0-rc3-next-20190403 #17 [ 101.516559][ T8006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 101.526715][ T8006] Call Trace: [ 101.530021][ T8006] dump_stack+0x172/0x1f0 [ 101.534536][ T8006] ? cma_check_port+0x8ce/0x8f0 [ 101.539410][ T8006] print_address_description.cold+0x7c/0x20d [ 101.545410][ T8006] ? cma_check_port+0x8ce/0x8f0 [ 101.550273][ T8006] ? cma_check_port+0x8ce/0x8f0 [ 101.555138][ T8006] kasan_report.cold+0x1b/0x40 [ 101.559938][ T8006] ? __xa_insert+0x1d0/0x2a0 [ 101.564550][ T8006] ? cma_check_port+0x8ce/0x8f0 [ 101.569413][ T8006] __asan_report_load8_noabort+0x14/0x20 [ 101.575051][ T8006] cma_check_port+0x8ce/0x8f0 [ 101.579747][ T8006] rdma_bind_addr+0x19c3/0x1f80 [ 101.584625][ T8006] ? lock_acquire+0x16f/0x3f0 [ 101.589309][ T8006] ? ucma_get_ctx+0x82/0x160 [ 101.593914][ T8006] ? find_held_lock+0x35/0x130 [ 101.598695][ T8006] ? cma_ndev_work_handler+0x1c0/0x1c0 [ 101.604180][ T8006] ? lock_downgrade+0x880/0x880 [ 101.609054][ T8006] rdma_resolve_addr+0x437/0x21f0 [ 101.614092][ T8006] ? kasan_check_write+0x14/0x20 [ 101.619036][ T8006] ? __mutex_unlock_slowpath+0xf8/0x6b0 [ 101.624585][ T8006] ? lock_downgrade+0x880/0x880 [ 101.629443][ T8006] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 101.635697][ T8006] ? rdma_bind_addr+0x1f80/0x1f80 [ 101.640760][ T8006] ucma_resolve_ip+0x153/0x210 [ 101.645527][ T8006] ? ucma_resolve_ip+0x153/0x210 [ 101.650480][ T8006] ? ucma_query+0x820/0x820 [ 101.655000][ T8006] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 101.661262][ T8006] ? _copy_from_user+0xdd/0x150 [ 101.666128][ T8006] ucma_write+0x2da/0x3c0 [ 101.670469][ T8006] ? ucma_query+0x820/0x820 [ 101.674980][ T8006] ? ucma_open+0x290/0x290 [ 101.679422][ T8006] ? apparmor_file_permission+0x25/0x30 [ 101.684975][ T8006] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 101.691239][ T8006] ? security_file_permission+0x94/0x380 [ 101.696890][ T8006] __vfs_write+0x8d/0x110 [ 101.701235][ T8006] ? ucma_open+0x290/0x290 [ 101.705669][ T8006] vfs_write+0x20c/0x580 [ 101.709939][ T8006] ksys_write+0xea/0x1f0 [ 101.714196][ T8006] ? __ia32_sys_read+0xb0/0xb0 [ 101.718984][ T8006] ? do_syscall_64+0x26/0x610 [ 101.723678][ T8006] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 101.729770][ T8006] ? do_syscall_64+0x26/0x610 [ 101.734470][ T8006] __x64_sys_write+0x73/0xb0 [ 101.739078][ T8006] do_syscall_64+0x103/0x610 [ 101.743684][ T8006] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 101.749597][ T8006] RIP: 0033:0x4582b9 [ 101.753498][ T8006] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 101.773105][ T8006] RSP: 002b:00007f3b456edc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 101.781521][ T8006] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 101.789507][ T8006] RDX: 0000000000000048 RSI: 00000000200001c0 RDI: 000000000000000b [ 101.797484][ T8006] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 101.805480][ T8006] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3b456ee6d4 [ 101.813452][ T8006] R13: 00000000004ce188 R14: 00000000004dd8c8 R15: 00000000ffffffff [ 101.821443][ T8006] [ 101.823773][ T8006] Allocated by task 7973: [ 101.828119][ T8006] save_stack+0x45/0xd0 [ 101.832278][ T8006] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 101.837937][ T8006] kasan_kmalloc+0x9/0x10 [ 101.842289][ T8006] kmem_cache_alloc_trace+0x151/0x760 [ 101.847667][ T8006] cma_alloc_port+0x4f/0x1a0 [ 101.852264][ T8006] rdma_bind_addr+0x1bc0/0x1f80 [ 101.857129][ T8006] rdma_resolve_addr+0x437/0x21f0 [ 101.862160][ T8006] ucma_resolve_ip+0x153/0x210 [ 101.866964][ T8006] ucma_write+0x2da/0x3c0 [ 101.871303][ T8006] __vfs_write+0x8d/0x110 [ 101.875637][ T8006] vfs_write+0x20c/0x580 [ 101.879883][ T8006] ksys_write+0xea/0x1f0 [ 101.884131][ T8006] __x64_sys_write+0x73/0xb0 [ 101.888765][ T8006] do_syscall_64+0x103/0x610 [ 101.893369][ T8006] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 101.899250][ T8006] [ 101.901578][ T8006] Freed by task 7972: [ 101.905576][ T8006] save_stack+0x45/0xd0 [ 101.909734][ T8006] __kasan_slab_free+0x102/0x150 [ 101.914669][ T8006] kasan_slab_free+0xe/0x10 [ 101.919166][ T8006] kfree+0xcf/0x230 [ 101.922968][ T8006] rdma_destroy_id+0x7fc/0xaa0 [ 101.927730][ T8006] ucma_close+0x115/0x320 [ 101.932051][ T8006] __fput+0x2e5/0x8d0 [ 101.936024][ T8006] ____fput+0x16/0x20 [ 101.940002][ T8006] task_work_run+0x14a/0x1c0 [ 101.944585][ T8006] exit_to_usermode_loop+0x273/0x2c0 [ 101.949865][ T8006] do_syscall_64+0x52d/0x610 [ 101.954450][ T8006] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 101.960328][ T8006] [ 101.962675][ T8006] The buggy address belongs to the object at ffff8880a3a77640 [ 101.962675][ T8006] which belongs to the cache kmalloc-32 of size 32 [ 101.976562][ T8006] The buggy address is located 8 bytes inside of [ 101.976562][ T8006] 32-byte region [ffff8880a3a77640, ffff8880a3a77660) [ 101.989558][ T8006] The buggy address belongs to the page: [ 101.995215][ T8006] page:ffffea00028e9dc0 count:1 mapcount:0 mapping:ffff88812c3f01c0 index:0xffff8880a3a77fc1 [ 102.005377][ T8006] flags: 0x1fffc0000000200(slab) [ 102.010317][ T8006] raw: 01fffc0000000200 ffffea000285a9c8 ffffea0002a51748 ffff88812c3f01c0 [ 102.018904][ T8006] raw: ffff8880a3a77fc1 ffff8880a3a77000 000000010000003f 0000000000000000 [ 102.027480][ T8006] page dumped because: kasan: bad access detected [ 102.033881][ T8006] [ 102.036203][ T8006] Memory state around the buggy address: [ 102.041848][ T8006] ffff8880a3a77500: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc [ 102.049906][ T8006] ffff8880a3a77580: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc [ 102.057960][ T8006] >ffff8880a3a77600: 00 00 fc fc fc fc fc fc fb fb fb fb fc fc fc fc [ 102.066004][ T8006] ^ [ 102.072411][ T8006] ffff8880a3a77680: 00 01 fc fc fc fc fc fc fb fb fb fb fc fc fc fc 23:20:04 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) r2 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x2000, 0x264, &(0x7f0000ffb000/0x2000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) r4 = socket$inet(0x2, 0x3, 0x2) r5 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, r5, 0x0) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, &(0x7f0000000440)=0xfbe, 0x4) getsockname(r6, &(0x7f0000000340)=@ipx, &(0x7f00000001c0)=0x80) syz_genetlink_get_family_id$ipvs(&(0x7f00000004c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r6, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x1a00001}, 0xc, &(0x7f0000000580)={&(0x7f0000000780)=ANY=[@ANYBLOB="000227d1b58f00000008000500090000000c000100080001000a0000001400032008000000080003000200c9db56b1c0f21115c1600b8f6c73da062c7c187ca9cb891d7557392775beb2fbd3286772448fbe6d93a361dc3d47e51550ec999800900080f8000000000000000000008a423f15181b01867a286f0191941a06f57dbfd82d35bc95ffd08b0114d80d57247a258a18eb1f48eb6f415f7748b09422c937c9fe5b7f7f3bd18726648d4f7cafb6184ddf21b13b8c000000003c47651295de081f337ba28bd80700c2e700000000000038000000000000000611753341e06ccfcff475109091696574deec6aa4a18a8327526670569b7101efcb1d8d9d2593121a1819bdce7d0108430ce2f424a13c7a85c64df634533d550009ccdb6199c3b09f3c8d2f9d05577853dd968ead42efb7c403cc20cafd55aad40a395a1fa009782453138126da6c32e7095d37bce751852fb941328434661e6795dc7c3ed1d1b175d69b03412eb110078ef23f3a0ab38c6ce7561371734db9b34b6f458e3eff01000000000000937140178ba43d344626fc8e2f1919e1b9b1a00c9c736d10f8855037fc9a23af86baf4c55367ee94440bd06c6d4e628fa3ba60a3b0f9644a72214c7c31eb1618845c1ee9f0964980229602883268f7edbddfd33a227bad235d4770ed63629e9c00393e3b6dad7338f83b182223e66ec9719a3ee7676254cf85f1adb9b233b2d9836c454d36972e9ff763fcd99856e4dbc0b772ba4109cba9a5a54c6eedeacdb8b3000000e4a3dce444b81a0ddd0e12cfd5fbb4005cbd10587ef8bc50d25087f11a8173c6a9683a83ea57639d3dcaf9f12bfc37c2781930b51494981218c8e13d9561cd798816f293ea966ea6460bbf4621a33e856e30f8039d2faf1357db5347077310298340412bf2735d741239e067207d0f5b6026ddf3478742a5de83b39a00c522446531e48326905698b8b7184f5bf93493644804794e67a84ac4196c7efd931405007eaef605e8718abd318f258f0d1232b6ed3b66ff6ef721142c29657108c5189d853a593009193bbfbb86dfbb27bfafcf122e4fa57697bc42dd403ba622d40000000000000000000000000017587bccff7979a7b5883b7cb5c03249f75cf6245f6d9c7361583b9fce62dcb257fb51da"], 0x1}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r6, 0x28, 0x0, &(0x7f0000000100)=0x10000001, 0x8) setsockopt$inet_int(r4, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) mmap$xdp(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x3040000, 0x110, r6, 0x80000000) r7 = dup2(r2, r2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x100000, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(r4, 0x80081272, &(0x7f0000000240)) ioctl$ASHMEM_GET_SIZE(r7, 0x7704, 0x0) r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='clear_refs\x00') openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r8, &(0x7f0000000740)={0xc, 0xecc3aadb5d6b339, 0xfa00, {&(0x7f0000000d00)}}, 0x907b3fc4954fa586) r9 = openat$md(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/md0\x00', 0x4001, 0x0) lgetxattr(&(0x7f0000000500)='./file0\x00', &(0x7f0000000ac0)=ANY=[@ANYBLOB="737973746582ba4d019981aaeb0000c55dca0000000400005f296ef2c0811a551eb4123660bec27317fceda2a02cbc8a5428f5a6ef1d4bd99ce324e3fd87f63b4f06cafb462854cd7bf761cec3b2fd1729ee8de348c520893989d245e4f7dc2262632d948d6f89908e2fbce7a811b2bd533e176b245383fd004af56d4c7e332dfc4ff19f614994bbfeec664b25beb8d07c52f58d08f0dc258f8f8a2a6459c066a0432a8f1f6a2644800d906f0522b6a925f1cde98541e6c61925432b0df51758cef22454a13458aa23aad0e713d72502005927c72c3ff082d9cc7a48296f27e483e63ac665c8c369b20158ede98efd5886db9150f58222734f782603459439b661d46edf48e4321347b7e322be38d37eeb7589398db87597ccd8d926f1d24500"/300], 0x0, 0x0) ioctl$BLKPG(r9, 0x40140921, &(0x7f0000000080)={0x4, 0x7, 0x86, &(0x7f0000000280)="d0e423b71a6225486a6af46106eb41da351f6d99d047b8e4b7b635a435c553cbfdf8ac0fcab53e48de15699253eba21f3ccc0076948c01849ff8f2e5e93741cdd7b5a43260f1767efb914415a6f612e590c251d48701fedc872ad4b2661354a2daeec836cb7bd5dfbd2ff61dbcae38ef67d115c316206f5e15e3b9bfb1926b164b10a43a1c4a"}) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc-cast6-avx)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="b7da12a9bf3b3923b121d9c9e2cc98a64d", 0x11) 23:20:04 executing program 3: sendmsg$TIPC_CMD_GET_MEDIA_NAMES(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x2001002, 0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0x0, 0x3, 0x0) mount$bpf(0x0, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000580)='bpf\x00', 0x80000, 0x0) perf_event_open(&(0x7f0000000400)={0x0, 0x70, 0x0, 0x0, 0x101, 0x400, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xff, 0x8, 0x0, 0x86, 0x0, 0x2, 0x3f, 0xfffffffffffffff9, 0x0, 0x8, 0x0, 0xc48, 0x0, 0xffffffffffffffe0, 0x1, 0x0, 0x0, 0x0, 0x2746ec8a, 0x9, 0x1, 0x3, 0x1fc0000, 0x8, 0x0, 0x0, 0x8, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0xfff, 0xfffffffffffffffe, 0x0, 0xdf}, 0x0, 0xc, 0xffffffffffffffff, 0x9) mount$bpf(0x20000000, &(0x7f0000000300)='./file0/file0\x00', 0x0, 0x5004, 0x0) mount$bpf(0x20000000, &(0x7f00000004c0)='./file0/file0\x00', 0x0, 0x588e, 0x0) mount$bpf(0x0, &(0x7f00000005c0)='./file0/file0\x00', &(0x7f0000000a40)='bpf\x00', 0x0, 0x0) umount2(0x0, 0x0) [ 102.080466][ T8006] ffff8880a3a77700: 00 00 fc fc fc fc fc fc 00 00 fc fc fc fc fc fc [ 102.088513][ T8006] ================================================================== [ 102.096582][ T8006] Disabling lock debugging due to kernel taint 23:20:04 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x5, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) fsetxattr$security_smack_entry(0xffffffffffffffff, &(0x7f0000000040)='security.SMACK64MMAP\x00', &(0x7f00000000c0)='nr\xc5\"\x85}\xfa\xfd\x1e', 0x9, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0xffffffffffffffff, 0x100000}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000ac0)={0x26, 'hash\x00', 0x0, 0x0, 'tgr128\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) r4 = accept4(r3, &(0x7f0000000640)=@xdp, &(0x7f0000000100)=0x80, 0x800) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) eventfd2(0x2, 0x80001) write$apparmor_current(r5, &(0x7f0000000500)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303012315e631fff6f7570275c002f6465762f6d6978657200746772313238002f6465762f6d69786572002f6465762f6d6978657200318a775bf97af245cfd2bc1d60fa85b98ed605c4d18c79953e8a4a1c65dff8a0d088740868bccbb0ee5af654c966b494be8d14f5f581c17377fa5f0caac38fccf88d"], 0x1) accept4(r3, &(0x7f00000009c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4}}}, &(0x7f0000000180)=0x80, 0x80800) syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_DEL_SERVICE(r4, &(0x7f0000000700)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000006c0)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x10) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r7, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x0, @loopback}, {0xa, 0x4e21, 0x8000000000000000, @dev}, r8}}, 0x48) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000140)={0x7, 0x8, 0x2, 0xf50c, 0x8, 0x4, 0xca, 0x8, 0x0}, &(0x7f0000000440)=0x20) getsockopt$inet_sctp6_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000480)={r9, 0x3}, &(0x7f00000004c0)=0x8) [ 102.188146][ T8013] netlink: 10 bytes leftover after parsing attributes in process `syz-executor.0'. 23:20:04 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$vbi(&(0x7f00000002c0)='/dev/vbi#\x00', 0x2, 0x2) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) r3 = add_key$keyring(&(0x7f0000000300)='keyring\x00', &(0x7f0000000340)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000380)={{{@in=@dev, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@loopback}}, &(0x7f0000000480)=0xe8) r5 = getgid() keyctl$chown(0x4, r3, r4, r5) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x802, 0x0) ioctl$BLKZEROOUT(r6, 0x127f, &(0x7f00000000c0)={0x0, 0x4004400}) r7 = fcntl$dupfd(r1, 0x406, r1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000100)={0x0, @rand_addr, @initdev}, &(0x7f0000000140)=0xc) ioctl$sock_inet6_SIOCDELRT(r7, 0x890c, &(0x7f0000000240)={@initdev={0xfe, 0x88, [], 0x1, 0x0}, @local, @dev={0xfe, 0x80, [], 0xa}, 0x80000000, 0x7f, 0x1, 0x100, 0x6, 0x1000101, r8}) r9 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setuid(r10) ioctl$sock_kcm_SIOCKCMATTACH(r9, 0x89e0, 0x0) mincore(&(0x7f0000ffb000/0x2000)=nil, 0x2000, &(0x7f00000004c0)=""/209) r11 = shmget$private(0x0, 0x4000, 0x78000000, &(0x7f0000ffb000/0x4000)=nil) shmctl$SHM_STAT(r11, 0xd, &(0x7f00000005c0)=""/137) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0x0) accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) r12 = openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockname$ax25(r12, &(0x7f00000001c0)={{}, [@netrom, @netrom, @null, @rose, @default, @rose, @default, @bcast]}, &(0x7f0000000000)=0x48) ioctl$TUNSETSNDBUF(r12, 0x400454d4, &(0x7f00000000c0)=0x4) 23:20:04 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x2100) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x800000000002, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040), 0x4) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="2e000000280081aee4050cecdb4cb9040a485e510b00000000000000ffffffff00008000"/46, 0x2e}], 0x1}, 0x0) unlink(0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'bond_slave_0\x00', 0x4005}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(0xffffffffffffffff, 0x400454d8, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000e00)}, 0x0) ioctl$TUNSETNOCSUM(0xffffffffffffffff, 0x400454c8, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, 0x0) write$cgroup_subtree(r1, &(0x7f0000000380)=ANY=[], 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000840)='cpuacct.usage_user\x00', 0x0, 0x0) [ 102.238467][ T8014] md: loop134 has zero or unknown size, marking faulty! [ 102.260434][ T8014] md: md_import_device returned -22 23:20:05 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x5, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) fsetxattr$security_smack_entry(0xffffffffffffffff, &(0x7f0000000040)='security.SMACK64MMAP\x00', &(0x7f00000000c0)='nr\xc5\"\x85}\xfa\xfd\x1e', 0x9, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0xffffffffffffffff, 0x100000}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000ac0)={0x26, 'hash\x00', 0x0, 0x0, 'tgr128\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) r4 = accept4(r3, &(0x7f0000000640)=@xdp, &(0x7f0000000100)=0x80, 0x800) r5 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) eventfd2(0x2, 0x80001) write$apparmor_current(r5, &(0x7f0000000500)=ANY=[@ANYBLOB="7065726d686174203078303030303030303030303030303012315e631fff6f7570275c002f6465762f6d6978657200746772313238002f6465762f6d69786572002f6465762f6d6978657200318a775bf97af245cfd2bc1d60fa85b98ed605c4d18c79953e8a4a1c65dff8a0d088740868bccbb0ee5af654c966b494be8d14f5f581c17377fa5f0caac38fccf88d"], 0x1) accept4(r3, &(0x7f00000009c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4}}}, &(0x7f0000000180)=0x80, 0x80800) syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_DEL_SERVICE(r4, &(0x7f0000000700)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000006c0)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x10) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r7, &(0x7f00000001c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x0, @loopback}, {0xa, 0x4e21, 0x8000000000000000, @dev}, r8}}, 0x48) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000140)={0x7, 0x8, 0x2, 0xf50c, 0x8, 0x4, 0xca, 0x8, 0x0}, &(0x7f0000000440)=0x20) getsockopt$inet_sctp6_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000480)={r9, 0x3}, &(0x7f00000004c0)=0x8) [ 102.311643][ T8006] Kernel panic - not syncing: panic_on_warn set ... [ 102.318247][ T8006] CPU: 1 PID: 8006 Comm: syz-executor.5 Tainted: G B 5.1.0-rc3-next-20190403 #17 [ 102.328638][ T8006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 102.338681][ T8006] Call Trace: [ 102.341989][ T8006] dump_stack+0x172/0x1f0 [ 102.346320][ T8006] panic+0x2cb/0x65c [ 102.350238][ T8006] ? __warn_printk+0xf3/0xf3 [ 102.354868][ T8006] ? cma_check_port+0x8ce/0x8f0 [ 102.359756][ T8006] ? preempt_schedule+0x4b/0x60 [ 102.364613][ T8006] ? ___preempt_schedule+0x16/0x18 [ 102.369739][ T8006] ? trace_hardirqs_on+0x5e/0x230 [ 102.374771][ T8006] ? cma_check_port+0x8ce/0x8f0 [ 102.379626][ T8006] end_report+0x47/0x4f [ 102.383798][ T8006] ? cma_check_port+0x8ce/0x8f0 [ 102.388645][ T8006] kasan_report.cold+0xe/0x40 [ 102.393323][ T8006] ? __xa_insert+0x1d0/0x2a0 [ 102.397923][ T8006] ? cma_check_port+0x8ce/0x8f0 [ 102.402770][ T8006] __asan_report_load8_noabort+0x14/0x20 [ 102.408399][ T8006] cma_check_port+0x8ce/0x8f0 [ 102.413079][ T8006] rdma_bind_addr+0x19c3/0x1f80 [ 102.417930][ T8006] ? lock_acquire+0x16f/0x3f0 [ 102.422629][ T8006] ? ucma_get_ctx+0x82/0x160 [ 102.427216][ T8006] ? find_held_lock+0x35/0x130 [ 102.431982][ T8006] ? cma_ndev_work_handler+0x1c0/0x1c0 [ 102.437437][ T8006] ? lock_downgrade+0x880/0x880 [ 102.441476][ T8035] netlink: 10 bytes leftover after parsing attributes in process `syz-executor.0'. [ 102.442283][ T8006] rdma_resolve_addr+0x437/0x21f0 [ 102.442299][ T8006] ? kasan_check_write+0x14/0x20 [ 102.442320][ T8006] ? __mutex_unlock_slowpath+0xf8/0x6b0 [ 102.467016][ T8006] ? lock_downgrade+0x880/0x880 [ 102.471863][ T8006] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 102.478104][ T8006] ? rdma_bind_addr+0x1f80/0x1f80 [ 102.483143][ T8006] ucma_resolve_ip+0x153/0x210 [ 102.487901][ T8006] ? ucma_resolve_ip+0x153/0x210 [ 102.492835][ T8006] ? ucma_query+0x820/0x820 [ 102.497341][ T8006] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 102.503577][ T8006] ? _copy_from_user+0xdd/0x150 [ 102.508426][ T8006] ucma_write+0x2da/0x3c0 [ 102.512774][ T8006] ? ucma_query+0x820/0x820 [ 102.517274][ T8006] ? ucma_open+0x290/0x290 [ 102.521741][ T8006] ? apparmor_file_permission+0x25/0x30 [ 102.527286][ T8006] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 102.533524][ T8006] ? security_file_permission+0x94/0x380 [ 102.539153][ T8006] __vfs_write+0x8d/0x110 [ 102.543478][ T8006] ? ucma_open+0x290/0x290 [ 102.547911][ T8006] vfs_write+0x20c/0x580 [ 102.552159][ T8006] ksys_write+0xea/0x1f0 [ 102.556405][ T8006] ? __ia32_sys_read+0xb0/0xb0 [ 102.561175][ T8006] ? do_syscall_64+0x26/0x610 [ 102.565859][ T8006] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 102.571934][ T8006] ? do_syscall_64+0x26/0x610 [ 102.576619][ T8006] __x64_sys_write+0x73/0xb0 [ 102.581209][ T8006] do_syscall_64+0x103/0x610 [ 102.585823][ T8006] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 102.591746][ T8006] RIP: 0033:0x4582b9 [ 102.595649][ T8006] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 102.615256][ T8006] RSP: 002b:00007f3b456edc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 102.622737][ T3878] kobject: 'loop0' (000000006dbbf6b7): kobject_uevent_env [ 102.623658][ T8006] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004582b9 [ 102.623667][ T8006] RDX: 0000000000000048 RSI: 00000000200001c0 RDI: 000000000000000b [ 102.623674][ T8006] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 102.623683][ T8006] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3b456ee6d4 [ 102.623698][ T8006] R13: 00000000004ce188 R14: 00000000004dd8c8 R15: 00000000ffffffff [ 102.630827][ T3878] kobject: 'loop0' (000000006dbbf6b7): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 102.639488][ T8006] Kernel Offset: disabled [ 102.685657][ T8006] Rebooting in 86400 seconds..