[ 67.600509][ T27] audit: type=1800 audit(1565644987.248:27): pid=10090 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [ 67.649039][ T27] audit: type=1800 audit(1565644987.328:28): pid=10090 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 68.507695][ T27] audit: type=1800 audit(1565644988.188:29): pid=10090 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 68.528256][ T27] audit: type=1800 audit(1565644988.188:30): pid=10090 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.147' (ECDSA) to the list of known hosts. 2019/08/12 21:23:17 fuzzer started 2019/08/12 21:23:21 dialing manager at 10.128.0.26:33609 2019/08/12 21:23:21 syscalls: 2487 2019/08/12 21:23:21 code coverage: enabled 2019/08/12 21:23:21 comparison tracing: enabled 2019/08/12 21:23:21 extra coverage: extra coverage is not supported by the kernel 2019/08/12 21:23:21 setuid sandbox: enabled 2019/08/12 21:23:21 namespace sandbox: enabled 2019/08/12 21:23:21 Android sandbox: /sys/fs/selinux/policy does not exist 2019/08/12 21:23:21 fault injection: enabled 2019/08/12 21:23:21 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/08/12 21:23:21 net packet injection: enabled 2019/08/12 21:23:21 net device setup: enabled 21:24:59 executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$TIOCGPTPEER(r0, 0x5441, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000000180)={r0, r0, 0x0, 0x5e, &(0x7f0000000100)="f74ced3c169a8ef3483a381ddfbee3ff04912c7897f1fb41f3ecd1acf9879ddbf92824b177a1f7f82fc64b7b0f99e93d4997e972c9163561681708a168968d8c9dcce9218091366c7f7567ea0b2f6371e119578f3b97884ade922a0ae989", 0x0, 0x7ff, 0x0, 0x12e, 0x4, 0x3, 0x2, 'syz0\x00'}) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffff9c, &(0x7f0000008880)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000240)=""/62, 0x3e}], 0x1}}], 0x1, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000280)=@abs={0x0, 0x0, 0x4e20}, 0x6e) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/snmp\x00') preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) r2 = add_key$keyring(&(0x7f0000000680)='keyring\x00', &(0x7f00000006c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000580)='asymmetric\x00', &(0x7f0000000640)={'syz', 0x3}, 0x0, 0x0, r2) ioctl$sock_TIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) 21:24:59 executing program 1: fcntl$notify(0xffffffffffffffff, 0x402, 0x0) perf_event_open(&(0x7f00000003c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000000340)=0x2, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) recvmmsg(r0, &(0x7f0000008880), 0x75d, 0x44000122, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) syzkaller login: [ 179.558115][T10259] IPVS: ftp: loaded support on port[0] = 21 [ 179.689381][T10259] chnl_net:caif_netlink_parms(): no params data found [ 179.732435][T10259] bridge0: port 1(bridge_slave_0) entered blocking state [ 179.740566][T10259] bridge0: port 1(bridge_slave_0) entered disabled state [ 179.749211][T10259] device bridge_slave_0 entered promiscuous mode [ 179.757414][T10259] bridge0: port 2(bridge_slave_1) entered blocking state [ 179.765251][T10259] bridge0: port 2(bridge_slave_1) entered disabled state [ 179.773039][T10259] device bridge_slave_1 entered promiscuous mode [ 179.781537][T10262] IPVS: ftp: loaded support on port[0] = 21 [ 179.801289][T10259] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 179.825866][T10259] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 21:24:59 executing program 2: ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffff9c, &(0x7f0000008880)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000240)=""/62, 0x3e}], 0x1}}], 0x1, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/snmp\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000237, 0x0) add_key$keyring(&(0x7f0000000680)='keyring\x00', &(0x7f00000006c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) [ 179.865492][T10259] team0: Port device team_slave_0 added [ 179.886807][T10259] team0: Port device team_slave_1 added [ 179.996180][T10259] device hsr_slave_0 entered promiscuous mode 21:24:59 executing program 3: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$SIOCRSSL2CALL(0xffffffffffffffff, 0x89e2, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0}, 0x0) ioprio_get$pid(0x3, r2) accept4$x25(0xffffffffffffffff, &(0x7f0000000200)={0x9, @remote}, &(0x7f0000000240)=0x12, 0x80800) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) sendfile(r1, 0xffffffffffffffff, 0x0, 0x20002000005) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, &(0x7f0000000140)=0x9) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$uinput(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_GET_VERSION(0xffffffffffffffff, 0x8004552d, 0x0) [ 180.073869][T10259] device hsr_slave_1 entered promiscuous mode [ 180.130157][T10262] chnl_net:caif_netlink_parms(): no params data found [ 180.151095][T10267] IPVS: ftp: loaded support on port[0] = 21 [ 180.152251][T10265] IPVS: ftp: loaded support on port[0] = 21 [ 180.197368][T10259] bridge0: port 2(bridge_slave_1) entered blocking state [ 180.204488][T10259] bridge0: port 2(bridge_slave_1) entered forwarding state [ 180.211843][T10259] bridge0: port 1(bridge_slave_0) entered blocking state [ 180.218943][T10259] bridge0: port 1(bridge_slave_0) entered forwarding state [ 180.281475][T10262] bridge0: port 1(bridge_slave_0) entered blocking state [ 180.290379][T10262] bridge0: port 1(bridge_slave_0) entered disabled state [ 180.298591][T10262] device bridge_slave_0 entered promiscuous mode 21:25:00 executing program 4: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) r2 = timerfd_create(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)={0x1}) timerfd_settime(r2, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x989680}}, 0x0) epoll_wait(r1, &(0x7f0000000200)=[{}], 0x1ef, 0x80) dup2(r0, r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000000)={0x2001}) [ 180.345770][T10262] bridge0: port 2(bridge_slave_1) entered blocking state [ 180.352849][T10262] bridge0: port 2(bridge_slave_1) entered disabled state [ 180.361429][T10262] device bridge_slave_1 entered promiscuous mode [ 180.470643][T10267] chnl_net:caif_netlink_parms(): no params data found [ 180.502638][T10259] 8021q: adding VLAN 0 to HW filter on device bond0 [ 180.526326][T10262] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link 21:25:00 executing program 5: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$TIOCGPTPEER(r0, 0x5441, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffff9c, &(0x7f0000008880)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000240)=""/62, 0x3e}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/snmp\x00') preadv(r1, &(0x7f0000000480), 0x1000000000000237, 0x0) syz_genetlink_get_family_id$fou(0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) [ 180.585927][T10262] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 180.599651][ T2987] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 180.608518][ T2987] bridge0: port 1(bridge_slave_0) entered disabled state [ 180.644397][ T2987] bridge0: port 2(bridge_slave_1) entered disabled state [ 180.652831][ T2987] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 180.676320][T10259] 8021q: adding VLAN 0 to HW filter on device team0 [ 180.698865][T10265] chnl_net:caif_netlink_parms(): no params data found [ 180.723127][T10272] IPVS: ftp: loaded support on port[0] = 21 [ 180.746931][T10275] IPVS: ftp: loaded support on port[0] = 21 [ 180.753608][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 180.764492][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 180.772823][ T3489] bridge0: port 1(bridge_slave_0) entered blocking state [ 180.780017][ T3489] bridge0: port 1(bridge_slave_0) entered forwarding state [ 180.787675][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 180.796256][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 180.804669][ T3489] bridge0: port 2(bridge_slave_1) entered blocking state [ 180.811752][ T3489] bridge0: port 2(bridge_slave_1) entered forwarding state [ 180.838800][T10262] team0: Port device team_slave_0 added [ 180.850909][T10262] team0: Port device team_slave_1 added [ 180.864457][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 180.889122][T10267] bridge0: port 1(bridge_slave_0) entered blocking state [ 180.896877][T10267] bridge0: port 1(bridge_slave_0) entered disabled state [ 180.905007][T10267] device bridge_slave_0 entered promiscuous mode [ 180.912477][T10267] bridge0: port 2(bridge_slave_1) entered blocking state [ 180.919841][T10267] bridge0: port 2(bridge_slave_1) entered disabled state [ 180.927529][T10267] device bridge_slave_1 entered promiscuous mode [ 180.941257][T10265] bridge0: port 1(bridge_slave_0) entered blocking state [ 180.948413][T10265] bridge0: port 1(bridge_slave_0) entered disabled state [ 180.956061][T10265] device bridge_slave_0 entered promiscuous mode [ 180.965432][T10265] bridge0: port 2(bridge_slave_1) entered blocking state [ 180.972540][T10265] bridge0: port 2(bridge_slave_1) entered disabled state [ 180.980185][T10265] device bridge_slave_1 entered promiscuous mode [ 181.008773][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 181.025475][T10267] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 181.036454][T10267] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 181.054994][T10265] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 181.064962][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 181.073614][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 181.115943][T10262] device hsr_slave_0 entered promiscuous mode [ 181.163881][T10262] device hsr_slave_1 entered promiscuous mode [ 181.234554][T10262] debugfs: Directory 'hsr0' with parent '/' already present! [ 181.262862][T10265] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 181.280219][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 181.293909][T10259] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 181.304309][T10259] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 181.339619][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 181.349140][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 181.357780][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 181.366039][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 181.375669][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 181.383917][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 181.392037][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 181.403220][T10267] team0: Port device team_slave_0 added [ 181.416001][T10267] team0: Port device team_slave_1 added [ 181.427274][T10265] team0: Port device team_slave_0 added [ 181.444309][T10265] team0: Port device team_slave_1 added [ 181.480500][T10272] chnl_net:caif_netlink_parms(): no params data found [ 181.503032][T10259] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 181.576077][T10265] device hsr_slave_0 entered promiscuous mode [ 181.623807][T10265] device hsr_slave_1 entered promiscuous mode [ 181.663613][T10265] debugfs: Directory 'hsr0' with parent '/' already present! [ 181.725091][T10267] device hsr_slave_0 entered promiscuous mode [ 181.773962][T10267] device hsr_slave_1 entered promiscuous mode [ 181.813759][T10267] debugfs: Directory 'hsr0' with parent '/' already present! [ 181.845917][T10272] bridge0: port 1(bridge_slave_0) entered blocking state [ 181.853080][T10272] bridge0: port 1(bridge_slave_0) entered disabled state [ 181.861248][T10272] device bridge_slave_0 entered promiscuous mode [ 181.897571][T10272] bridge0: port 2(bridge_slave_1) entered blocking state [ 181.905023][T10272] bridge0: port 2(bridge_slave_1) entered disabled state [ 181.913361][T10272] device bridge_slave_1 entered promiscuous mode [ 181.946528][T10275] chnl_net:caif_netlink_parms(): no params data found [ 181.957925][T10272] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 181.971921][T10262] 8021q: adding VLAN 0 to HW filter on device bond0 [ 181.991572][T10272] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 182.009845][T10262] 8021q: adding VLAN 0 to HW filter on device team0 [ 182.026830][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 182.035441][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 182.107285][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 182.120924][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 182.129475][T10276] bridge0: port 1(bridge_slave_0) entered blocking state [ 182.136545][T10276] bridge0: port 1(bridge_slave_0) entered forwarding state [ 182.144431][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 182.152922][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 182.161414][T10276] bridge0: port 2(bridge_slave_1) entered blocking state [ 182.168477][T10276] bridge0: port 2(bridge_slave_1) entered forwarding state [ 182.176589][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 182.185086][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 182.193682][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 182.202506][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 182.212401][T10272] team0: Port device team_slave_0 added [ 182.221277][T10272] team0: Port device team_slave_1 added [ 182.235134][T10275] bridge0: port 1(bridge_slave_0) entered blocking state [ 182.242218][T10275] bridge0: port 1(bridge_slave_0) entered disabled state [ 182.251058][T10275] device bridge_slave_0 entered promiscuous mode [ 182.259814][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 182.267979][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 182.276003][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 182.284858][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 182.293133][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 182.302009][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready 21:25:02 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20}, 0x1b) listen(r0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000240), 0x10) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpriority(0x0, 0x0) ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, &(0x7f0000000540)=@buf) write$P9_RSETATTR(0xffffffffffffffff, 0x0, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x2000, 0x0) r3 = dup3(r1, r1, 0x3fedf771d8f0d832) bind$alg(r3, 0x0, 0x0) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, 0x0) r4 = semget(0x2, 0x0, 0x8) semctl$GETNCNT(r4, 0x0, 0xe, &(0x7f0000000580)=""/4096) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r2, 0xc04c5349, &(0x7f0000000340)={0x47d, 0x5b7e, 0x8}) recvmmsg(0xffffffffffffffff, &(0x7f0000000500)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000440)=""/190, 0xfffffeb0}], 0x100000000000021c, 0x0, 0xda}}], 0x1, 0x0, 0x0) ioctl$TCSETA(r2, 0x5406, &(0x7f0000000000)={0x1ff, 0x3, 0x5, 0x4, 0x11, 0x4a17, 0x800, 0x4, 0xfffffffffffffffc, 0xffffffffffffe86d}) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r5, &(0x7f00000017c0), 0x1d0, 0x1f000000) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f00000001c0)=0x100) setsockopt$netlink_NETLINK_CAP_ACK(r5, 0x10e, 0xa, &(0x7f0000000300)=0x2, 0x2) syz_emit_ethernet(0x74, &(0x7f0000000100)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) [ 182.366877][T10272] device hsr_slave_0 entered promiscuous mode [ 182.403422][ C1] hrtimer: interrupt took 34289 ns [ 182.413882][T10272] device hsr_slave_1 entered promiscuous mode [ 182.445766][T10272] debugfs: Directory 'hsr0' with parent '/' already present! [ 182.456129][T10265] 8021q: adding VLAN 0 to HW filter on device bond0 [ 182.467157][T10275] bridge0: port 2(bridge_slave_1) entered blocking state [ 182.474759][T10275] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.482656][T10275] device bridge_slave_1 entered promiscuous mode [ 182.495915][T10262] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 182.507993][T10262] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 182.516603][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 182.524955][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 182.552838][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 182.561348][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 182.586215][T10275] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 182.598921][T10275] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 182.616141][T10265] 8021q: adding VLAN 0 to HW filter on device team0 [ 182.631994][T10267] 8021q: adding VLAN 0 to HW filter on device bond0 [ 182.647109][T10262] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 182.679615][T10275] team0: Port device team_slave_0 added [ 182.693311][T10275] team0: Port device team_slave_1 added [ 182.705314][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 182.714489][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 182.723246][ T3489] bridge0: port 1(bridge_slave_0) entered blocking state [ 182.730376][ T3489] bridge0: port 1(bridge_slave_0) entered forwarding state [ 182.737959][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 182.746762][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 182.755164][ T3489] bridge0: port 2(bridge_slave_1) entered blocking state [ 182.762212][ T3489] bridge0: port 2(bridge_slave_1) entered forwarding state [ 182.770322][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 21:25:02 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000006000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000180)) r2 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f00000000c0)='vmnet0\x00') ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000000)) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/audio\x00', 0x140202, 0x0) listen(0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000080)={0x0, 0x9c65}, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00000002c0)={r4, 0x7, 0x6, 0x7, 0x6, 0x80000000, 0x3, 0xfffffffffffffffa, {0x0, @in6={{0xa, 0x4e23, 0x9, @dev={0xfe, 0x80, [], 0x21}, 0x5}}, 0x0, 0x1000, 0x0, 0xf76c, 0x9}}, &(0x7f0000000380)=0xb0) r5 = syz_open_dev$sndpcmp(&(0x7f0000000480)='/dev/snd/pcmC#D#p\x00', 0x0, 0x405) dup2(r5, r3) getpriority(0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 182.798100][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 182.855936][T10275] device hsr_slave_0 entered promiscuous mode [ 182.883887][T10275] device hsr_slave_1 entered promiscuous mode 21:25:02 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x1ff, 0x0) clock_gettime(0x0, &(0x7f0000000440)) readv(r0, &(0x7f00000003c0)=[{&(0x7f0000001540)}, {&(0x7f0000001600)=""/158}, {&(0x7f0000000480)=""/4096}, {&(0x7f0000000300)=""/180}, {&(0x7f0000001480)=""/175}, {&(0x7f0000001580)=""/115}], 0x100000000000018f) [ 182.923629][T10275] debugfs: Directory 'hsr0' with parent '/' already present! [ 182.945187][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 182.958777][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 182.968278][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 182.977125][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 182.984893][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 182.992611][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 183.008531][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready 21:25:02 executing program 0: r0 = socket$inet6_udp(0x1c, 0x2, 0x0) poll(&(0x7f0000000080)=[{}, {}, {r0}, {}, {}], 0x5, 0x57) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xfffffd1b, 0x0, 0x0, 0x800e00505) recvmsg(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000180)=""/199, 0xc7}, {0x0}], 0x2}, 0x0) shutdown(r1, 0x0) [ 183.017580][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 183.026325][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 183.034959][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 183.064803][T10267] 8021q: adding VLAN 0 to HW filter on device team0 [ 183.101819][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 183.116599][T10308] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 183.128949][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 183.150781][T10272] 8021q: adding VLAN 0 to HW filter on device bond0 21:25:02 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfe47bf070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'crc32c\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000003bc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[{0x28, 0x0, 0x0, "29b3d9c5e0527a40590b282638110f02c8"}], 0x28}}], 0x2, 0x0) [ 183.165185][T10265] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 183.178087][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 183.186912][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 183.198466][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 183.205583][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 183.251052][ T2987] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 183.260467][ T2987] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 183.269594][ T2987] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 183.278319][ T2987] bridge0: port 2(bridge_slave_1) entered blocking state [ 183.285417][ T2987] bridge0: port 2(bridge_slave_1) entered forwarding state [ 183.293539][ T2987] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 183.301957][ T2987] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 183.309646][ T2987] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 183.317167][ T2987] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 183.329439][T10265] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 183.340064][T10272] 8021q: adding VLAN 0 to HW filter on device team0 [ 183.353467][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 183.362026][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 183.370773][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 183.379572][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 183.387972][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 183.396315][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready 21:25:03 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, {0x0, 0x0, 0x0, 0x0, 0x6}}, 0xe) [ 183.419258][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 183.428118][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 183.437240][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 183.446496][T10268] bridge0: port 1(bridge_slave_0) entered blocking state [ 183.453573][T10268] bridge0: port 1(bridge_slave_0) entered forwarding state [ 183.454614][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 21:25:03 executing program 0: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000080)='cgroup\x00', 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') r0 = openat$cgroup_int(0xffffffffffffff9c, &(0x7f0000001040)='cpuset.sched_load_balance\x00', 0x2, 0x0) write$cgroup_int(r0, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000200)=0x4, 0x12) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, 0xfffffffffffffffe) 21:25:03 executing program 0: poll(&(0x7f0000000080)=[{}, {}, {}, {}], 0x4, 0x42) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00509) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_int(r0, 0xffff, 0x1013, 0x0, &(0x7f0000000040)) recvfrom$inet(r1, 0x0, 0xccf3, 0x0, 0x0, 0x800e0050e) shutdown(r0, 0x0) shutdown(r1, 0x0) [ 183.471878][T10267] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 183.532447][T10267] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 183.571949][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 183.581365][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 183.594121][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 183.605915][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 183.614530][ T3489] bridge0: port 2(bridge_slave_1) entered blocking state [ 183.621646][ T3489] bridge0: port 2(bridge_slave_1) entered forwarding state [ 183.629322][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 183.641133][T10275] 8021q: adding VLAN 0 to HW filter on device bond0 [ 183.663967][T10276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 183.679741][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 183.692274][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 183.701077][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 183.709667][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 183.719553][T10267] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 183.730507][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 183.770512][T10275] 8021q: adding VLAN 0 to HW filter on device team0 [ 183.787169][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 183.796889][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 183.805935][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 183.827395][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 183.861927][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 183.869793][ T3489] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 183.880785][T10272] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 183.902259][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 183.917689][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 183.931848][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 183.938987][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 183.947540][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 183.956258][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 183.965091][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 183.972196][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 183.982843][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 184.014678][T10272] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 184.029216][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 184.041683][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 184.051586][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready 21:25:03 executing program 2: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x4000000032, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r0, &(0x7f0000000040)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x0, [@null, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x40) [ 184.079186][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 184.089313][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 184.098552][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 184.107977][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 184.127720][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 184.144485][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 184.156196][T10268] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 184.167278][T10275] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 184.176719][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 184.222369][T10275] 8021q: adding VLAN 0 to HW filter on device batadv0 21:25:04 executing program 3: prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$SIOCRSSL2CALL(0xffffffffffffffff, 0x89e2, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0}, 0x0) ioprio_get$pid(0x3, r2) accept4$x25(0xffffffffffffffff, &(0x7f0000000200)={0x9, @remote}, &(0x7f0000000240)=0x12, 0x80800) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) sendfile(r1, 0xffffffffffffffff, 0x0, 0x20002000005) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, &(0x7f0000000140)=0x9) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$uinput(0xffffffffffffff9c, &(0x7f0000000640)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_GET_VERSION(0xffffffffffffffff, 0x8004552d, 0x0) 21:25:04 executing program 4: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) r2 = timerfd_create(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)={0x1}) timerfd_settime(r2, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x989680}}, 0x0) epoll_wait(r1, &(0x7f0000000200)=[{}], 0x1ef, 0x80) dup2(r0, r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000000)={0x2001}) 21:25:04 executing program 5: poll(&(0x7f0000000100)=[{}, {0xffffffffffffffff, 0x1}, {}], 0x3, 0x4e) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e0055f) recvmsg(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001880)=[{&(0x7f0000000280)=""/142, 0x8e}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8}, 0x0) shutdown(r0, 0x0) 21:25:04 executing program 0: pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'crc32c\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) splice(r0, 0x0, r3, 0x0, 0x20000000003, 0x0) write$P9_RREADLINK(r1, &(0x7f0000000200)={0x10, 0x17, 0x0, {0x7, './file0'}}, 0x10) 21:25:04 executing program 2: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x4000000032, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r0, &(0x7f0000000040)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x0, [@null, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x40) 21:25:04 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, 0x0, 0x0) listen(r0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000240), 0x10) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpriority(0x0, 0x0) ioctl$sock_SIOCGIFCONF(0xffffffffffffffff, 0x8912, &(0x7f0000000540)=@buf) write$P9_RSETATTR(0xffffffffffffffff, 0x0, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x2000, 0x0) r3 = dup3(r1, r1, 0x3fedf771d8f0d832) bind$alg(r3, 0x0, 0x0) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, 0x0) r4 = semget(0x2, 0x0, 0x8) semctl$GETNCNT(r4, 0x0, 0xe, &(0x7f0000000580)=""/4096) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r2, 0xc04c5349, &(0x7f0000000340)={0x47d, 0x5b7e, 0x8}) recvmmsg(0xffffffffffffffff, &(0x7f0000000500)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000440)=""/190, 0xfffffeb0}], 0x100000000000021c, 0x0, 0xda}}], 0x1, 0x0, 0x0) ioctl$TCSETA(r2, 0x5406, &(0x7f0000000000)={0x1ff, 0x3, 0x5, 0x4, 0x11, 0x4a17, 0x800, 0x4, 0xfffffffffffffffc, 0xffffffffffffe86d}) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r5, &(0x7f00000017c0), 0x1d0, 0x1f000000) ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f00000001c0)=0x100) syz_emit_ethernet(0x74, &(0x7f0000000100)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) 21:25:04 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x249, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x500) 21:25:04 executing program 4: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) r2 = timerfd_create(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)={0x1}) timerfd_settime(r2, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x989680}}, 0x0) epoll_wait(r1, &(0x7f0000000200)=[{}], 0x1ef, 0x80) dup2(r0, r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000000)={0x2001}) 21:25:04 executing program 2: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x4000000032, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r0, &(0x7f0000000040)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x0, [@null, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x40) 21:25:04 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = accept$unix(0xffffffffffffffff, 0x0, 0x0) write$cgroup_int(r0, 0x0, 0x0) 21:25:04 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000006000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000180)) r2 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000000)) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/audio\x00', 0x140202, 0x0) listen(r3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000080)={0x0, 0x9c65}, &(0x7f0000000100)=0x8) r5 = syz_open_dev$sndpcmp(&(0x7f0000000480)='/dev/snd/pcmC#D#p\x00', 0x0, 0x405) dup2(r5, r4) getpriority(0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 21:25:04 executing program 4: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) r2 = timerfd_create(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)={0x1}) timerfd_settime(r2, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x989680}}, 0x0) epoll_wait(r1, &(0x7f0000000200)=[{}], 0x1ef, 0x80) dup2(r0, r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000000)={0x2001}) 21:25:04 executing program 2: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x4000000032, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r0, &(0x7f0000000040)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x0, [@null, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x40) 21:25:04 executing program 5: r0 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x1, 0x2) write$UHID_INPUT2(r0, &(0x7f0000000240), 0x6) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x13, r0, 0x0) 21:25:04 executing program 2: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x4000000032, 0xffffffffffffffff, 0x0) connect$rose(0xffffffffffffffff, &(0x7f0000000040)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x0, [@null, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x40) 21:25:04 executing program 4: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) r2 = timerfd_create(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)={0x1}) timerfd_settime(r2, 0x0, &(0x7f0000000080)={{0x77359400}, {0x0, 0x989680}}, 0x0) epoll_wait(r1, &(0x7f0000000200)=[{}], 0x1ef, 0x80) dup2(r0, r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 21:25:04 executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="28000000310001830000000066f3069a08f8e3ab14000100100001000800010000000000c30000439aaa3983c581b4fae0580255fe1519c0c4c73a000060801c76f00677c58b8c13f6d77b4461361deab89298a0aa4136fcfc750bdabda0382268b3aeff4a4125b04b6200002992b7c541d14b8f37faeb74765fcf85ad1a6e9985bff57f84d55f1fc4ba8f00dd1d4802070b2e639ed881"], 0x1}}, 0x0) recvfrom$rxrpc(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0xa) sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@ip_ttl={{0x18, 0x110, 0xd}}], 0x18}, 0x0) 21:25:04 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000006000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000180)) r2 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, 0x0) r3 = socket$l2tp(0x18, 0x1, 0x1) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000000)) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/audio\x00', 0x140202, 0x0) listen(r3, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000080)={0x0, 0x9c65}, &(0x7f0000000100)=0x8) r5 = syz_open_dev$sndpcmp(&(0x7f0000000480)='/dev/snd/pcmC#D#p\x00', 0x0, 0x405) dup2(r5, r4) getpriority(0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f0000000040)=[@in={0x2, 0x0, @multicast1}, @in={0x2, 0x0, @multicast1}, @in={0x2, 0x0, @dev}], 0x30) 21:25:04 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) perf_event_open(&(0x7f0000000580)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000003c00)='/dev/cachefiles\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) clone(0x2007ef, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x307, {0x0, 0x0, 0x0, 0x0, 0x6}}, 0xe) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, &(0x7f0000003d00)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x9}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f00000000c0)={r2, 0xe, "acda395cd4380c8f3b117c3af7b2"}, &(0x7f0000000180)=0x16) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) openat$vimc0(0xffffffffffffff9c, &(0x7f0000003d40)='/dev/video0\x00', 0x2, 0x0) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x1000001b3) getsockopt$inet_dccp_buf(0xffffffffffffffff, 0x21, 0xc2, &(0x7f0000000100)=""/70, 0xfffffffffffffffd) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40000000, 0x0) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) [ 185.190521][T10441] ================================================================== [ 185.198633][T10441] BUG: KASAN: null-ptr-deref in rxrpc_unuse_local+0x23/0x70 [ 185.205919][T10441] Write of size 4 at addr 0000000000000010 by task syz-executor.0/10441 [ 185.214235][T10441] [ 185.216573][T10441] CPU: 1 PID: 10441 Comm: syz-executor.0 Not tainted 5.3.0-rc4-next-20190812+ #64 [ 185.225763][T10441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 185.235849][T10441] Call Trace: [ 185.235871][T10441] dump_stack+0x172/0x1f0 [ 185.235885][T10441] ? rxrpc_unuse_local+0x23/0x70 [ 185.235896][T10441] ? rxrpc_unuse_local+0x23/0x70 [ 185.235910][T10441] __kasan_report.cold+0x5/0x36 [ 185.235923][T10441] ? _raw_spin_unlock_irqrestore+0x11/0xe0 [ 185.235932][T10441] ? rxrpc_unuse_local+0x23/0x70 [ 185.235946][T10441] kasan_report+0x12/0x17 [ 185.235960][T10441] check_memory_region+0x134/0x1a0 [ 185.235972][T10441] __kasan_check_write+0x14/0x20 [ 185.235983][T10441] rxrpc_unuse_local+0x23/0x70 [ 185.235997][T10441] rxrpc_release+0x47d/0x840 [ 185.236010][T10441] __sock_release+0xce/0x280 [ 185.236021][T10441] sock_close+0x1e/0x30 [ 185.236032][T10441] __fput+0x2ff/0x890 [ 185.236044][T10441] ? __sock_release+0x280/0x280 [ 185.236056][T10441] ____fput+0x16/0x20 [ 185.236071][T10441] task_work_run+0x145/0x1c0 [ 185.236097][T10441] exit_to_usermode_loop+0x316/0x380 [ 185.324490][T10441] do_syscall_64+0x65f/0x760 [ 185.329075][T10441] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 185.334961][T10441] RIP: 0033:0x413511 [ 185.338850][T10441] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 185.358450][T10441] RSP: 002b:00007ffd16ba4720 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 185.366860][T10441] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000413511 [ 185.374824][T10441] RDX: 0000000000000000 RSI: 0000000000000081 RDI: 0000000000000003 [ 185.382791][T10441] RBP: 0000000000000000 R08: 00000000007605b8 R09: ffffffffffffffff 21:25:04 executing program 2: mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x4000000032, 0xffffffffffffffff, 0x0) connect$rose(0xffffffffffffffff, &(0x7f0000000040)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x0, [@null, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x40) [ 185.390766][T10441] R10: 00007ffd16ba47f0 R11: 0000000000000293 R12: 000000000075bf20 [ 185.398743][T10441] R13: 0000000000000003 R14: 00000000007605c0 R15: ffffffffffffffff [ 185.406722][T10441] ================================================================== [ 185.453695][T10441] Kernel panic - not syncing: panic_on_warn set ... [ 185.460317][T10441] CPU: 0 PID: 10441 Comm: syz-executor.0 Tainted: G B 5.3.0-rc4-next-20190812+ #64 [ 185.470901][T10441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 185.480957][T10441] Call Trace: [ 185.484248][T10441] dump_stack+0x172/0x1f0 [ 185.488590][T10441] panic+0x2dc/0x755 [ 185.492495][T10441] ? add_taint.cold+0x16/0x16 [ 185.497175][T10441] ? rxrpc_unuse_local+0x23/0x70 [ 185.502120][T10441] ? preempt_schedule+0x4b/0x60 [ 185.506981][T10441] ? ___preempt_schedule+0x16/0x20 [ 185.512098][T10441] ? trace_hardirqs_on+0x5e/0x240 [ 185.517300][T10441] ? rxrpc_unuse_local+0x23/0x70 [ 185.522248][T10441] end_report+0x47/0x4f [ 185.526415][T10441] ? rxrpc_unuse_local+0x23/0x70 [ 185.531368][T10441] __kasan_report.cold+0xe/0x36 [ 185.536228][T10441] ? _raw_spin_unlock_irqrestore+0x11/0xe0 [ 185.542037][T10441] ? rxrpc_unuse_local+0x23/0x70 [ 185.546974][T10441] kasan_report+0x12/0x17 [ 185.551321][T10441] check_memory_region+0x134/0x1a0 [ 185.556439][T10441] __kasan_check_write+0x14/0x20 [ 185.561383][T10441] rxrpc_unuse_local+0x23/0x70 [ 185.566144][T10441] rxrpc_release+0x47d/0x840 [ 185.570730][T10441] __sock_release+0xce/0x280 [ 185.575351][T10441] sock_close+0x1e/0x30 [ 185.579523][T10441] __fput+0x2ff/0x890 [ 185.583496][T10441] ? __sock_release+0x280/0x280 [ 185.588349][T10441] ____fput+0x16/0x20 [ 185.592333][T10441] task_work_run+0x145/0x1c0 [ 185.596936][T10441] exit_to_usermode_loop+0x316/0x380 [ 185.602220][T10441] do_syscall_64+0x65f/0x760 [ 185.606806][T10441] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 185.612991][T10441] RIP: 0033:0x413511 [ 185.617075][T10441] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 185.636680][T10441] RSP: 002b:00007ffd16ba4720 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 185.645182][T10441] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000413511 [ 185.653260][T10441] RDX: 0000000000000000 RSI: 0000000000000081 RDI: 0000000000000003 [ 185.661244][T10441] RBP: 0000000000000000 R08: 00000000007605b8 R09: ffffffffffffffff [ 185.669212][T10441] R10: 00007ffd16ba47f0 R11: 0000000000000293 R12: 000000000075bf20 [ 185.677183][T10441] R13: 0000000000000003 R14: 00000000007605c0 R15: ffffffffffffffff [ 185.685901][T10441] Kernel Offset: disabled [ 185.690218][T10441] Rebooting in 86400 seconds..