[ 52.029469] audit: type=1800 audit(1545336431.056:26): pid=6306 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 53.710618] kauditd_printk_skb: 2 callbacks suppressed [ 53.710647] audit: type=1800 audit(1545336432.756:29): pid=6306 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 53.735475] audit: type=1800 audit(1545336432.766:30): pid=6306 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.35' (ECDSA) to the list of known hosts. 2018/12/20 20:07:26 fuzzer started 2018/12/20 20:07:31 dialing manager at 10.128.0.26:46613 2018/12/20 20:07:31 syscalls: 1 2018/12/20 20:07:31 code coverage: enabled 2018/12/20 20:07:31 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/12/20 20:07:31 setuid sandbox: enabled 2018/12/20 20:07:31 namespace sandbox: enabled 2018/12/20 20:07:31 Android sandbox: /sys/fs/selinux/policy does not exist 2018/12/20 20:07:31 fault injection: enabled 2018/12/20 20:07:31 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/12/20 20:07:31 net packet injection: enabled 2018/12/20 20:07:31 net device setup: enabled 20:10:02 executing program 0: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, 0x0, &(0x7f00000001c0)) syzkaller login: [ 223.943759] IPVS: ftp: loaded support on port[0] = 21 [ 225.360207] bridge0: port 1(bridge_slave_0) entered blocking state [ 225.366895] bridge0: port 1(bridge_slave_0) entered disabled state [ 225.375447] device bridge_slave_0 entered promiscuous mode [ 225.460343] bridge0: port 2(bridge_slave_1) entered blocking state [ 225.467063] bridge0: port 2(bridge_slave_1) entered disabled state [ 225.475458] device bridge_slave_1 entered promiscuous mode [ 225.559788] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 225.641730] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 225.905549] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 225.996066] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 226.081226] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 226.088324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 226.173619] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 226.180643] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 226.442174] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 226.450898] team0: Port device team_slave_0 added [ 226.536228] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 226.544967] team0: Port device team_slave_1 added [ 226.630133] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 226.724518] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 226.811572] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 226.819334] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 226.828706] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 226.918460] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 226.926215] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 226.935691] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 20:10:06 executing program 1: open(&(0x7f00000000c0)='./file1\x00', 0x40140, 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) name_to_handle_at(r0, &(0x7f0000000040)='./file1\x00', &(0x7f0000000100)={0x81, 0x0, "b6a3066eb8467b851725d09c4bc599773ad2393692c5d771a6f01cbe5f3144b7545532772e92c6c0c4ce1a6f3143da164034026d0c38b3ab815c438e19b7e04d9709fea41f6a7fd5e7aa1cd55a3cef0c22661b34d7ca5d672437c93c5fd562378a8a427657da6e7a8a45728782eff662cb8f398d9b229f56b1"}, 0x0, 0x0) [ 227.849080] IPVS: ftp: loaded support on port[0] = 21 [ 228.221537] bridge0: port 2(bridge_slave_1) entered blocking state [ 228.228160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 228.235411] bridge0: port 1(bridge_slave_0) entered blocking state [ 228.242019] bridge0: port 1(bridge_slave_0) entered forwarding state [ 228.251262] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 228.258001] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 230.012454] bridge0: port 1(bridge_slave_0) entered blocking state [ 230.019024] bridge0: port 1(bridge_slave_0) entered disabled state [ 230.027303] device bridge_slave_0 entered promiscuous mode [ 230.111825] bridge0: port 2(bridge_slave_1) entered blocking state [ 230.118385] bridge0: port 2(bridge_slave_1) entered disabled state [ 230.126818] device bridge_slave_1 entered promiscuous mode [ 230.213605] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 230.294912] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 230.643522] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 230.764481] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 231.225833] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 231.234686] team0: Port device team_slave_0 added [ 231.321511] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 231.330280] team0: Port device team_slave_1 added [ 231.414320] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 231.421334] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 231.430490] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 231.572553] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 231.579709] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 231.588846] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 231.759309] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 231.767072] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 231.776302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 231.913771] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 231.921475] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 231.930783] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 20:10:12 executing program 2: memfd_create(&(0x7f0000000e40)='\x00\x00\x00\x00\x00\x00r%\xf7\x83\x80\x80}\xdePS`\x18A\xa0\xd0\xf8+t7HR\xb0\x1f\x12Y\x97b-\xc4\xa5\xe7\x1d,\xe5\xac2\xff\x90\x82O\xa2^Y\a4\x87\xcf6\xadWn2\x92k\x04\x89M\xa7@\xf7\xe9\xc0\xff\xb4,5j\x1f([\xfc\x8f\v\x8cor\xef\x15\x1d\xabL\\*Zu\x1f\x04\xbf\xc6\x9a\xc5\xc3\xb5\x16\x8am\x13\xd8&\xb1\xed\fu\'\xd5\x8fT\xad\xc1/\xca\x1f%\xc8\xfc%\x86\xeaM\x90\xf8M\xab\xcd\xec)\x1f\xb7\x80\xa3\x9a\x11}\x12\xb0\x89;\x18 \x98\xdc\xee\xd3;\"*\x1dA7\t\xae5]M)\x7f\xe4,]N\x9d\x8b\xbd\x9d\fp\x9c\xaeG\xe8\x8f\x8a\xa2*P[>\x99[P\x1f\r7S\xcd5\x10\xe8t6a+@\x13\x05\xf3\x16\x17\x7fmMLp\xfd\x9d&!\xc3pz\xd8\x8d\xa7\x85%\x96\xd8\x9aY\xcbtP^gZ\xc6\xeb\xc0?\xaa>\xe9\x98\x89\x17kW\x115\x03\x1a\xfc\x97\xce\xc4]\"\xfdhy(A\x1b\x83\xf6\x8b\xf7\xbeK!\xfd\xf0\x03<\xf9I\xb8\xa7j\xa6]h\xad\x88Yg\xc2\xcc<-`\xect\xfc\xf5\xde\x16,\x94\xff\xe3\xe1Wu\xc1\xa1\xcf\xd9\x81\x8dL\x17\xa2\xf8\xd0\xa70%8\xf0y\xe7\xb1(\xef\x12<\x8b\xb9\t\x00\x00\x00\x00\x00\x00\x008\x14\xc2\xae\xa8l5\xfb\xf4$Jdc]2\xff\x12\xe4\xdc\xb3\xdfV\xe5\xd5\xd3\x88*\x99\x84\x99?\x8a\x7f\xefr\xd8u\xd2\x1c\x1e;\xb2\xbc>ny\xa2\xb6\xd3\"\xf7\x10\xf07\x8a\xbc \x95\xd3!9\xe3\x9f2#\xdb\x99a0\x92\x95\xe4\xc3\xc8\xe1\xb0\x00\x1d\xd7W\xaa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\xec\xa8\f{\f', 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000), 0x0) r0 = socket$nl_generic(0xa, 0x3, 0x10) setsockopt$netlink_NETLINK_RX_RING(r0, 0x29, 0x6, &(0x7f0000000ff0)={0x1c2, 0x0, 0x29, 0x2}, 0x1c2) [ 233.300513] bridge0: port 2(bridge_slave_1) entered blocking state [ 233.307143] bridge0: port 2(bridge_slave_1) entered forwarding state [ 233.314436] bridge0: port 1(bridge_slave_0) entered blocking state [ 233.320982] bridge0: port 1(bridge_slave_0) entered forwarding state [ 233.330938] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 233.381881] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 233.867512] IPVS: ftp: loaded support on port[0] = 21 [ 234.179964] 8021q: adding VLAN 0 to HW filter on device bond0 [ 234.782405] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 235.360463] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 235.366891] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 235.375083] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 235.977806] 8021q: adding VLAN 0 to HW filter on device team0 [ 236.602339] bridge0: port 1(bridge_slave_0) entered blocking state [ 236.608890] bridge0: port 1(bridge_slave_0) entered disabled state [ 236.617343] device bridge_slave_0 entered promiscuous mode [ 236.809552] bridge0: port 2(bridge_slave_1) entered blocking state [ 236.816198] bridge0: port 2(bridge_slave_1) entered disabled state [ 236.824436] device bridge_slave_1 entered promiscuous mode [ 237.019040] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 237.146256] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 237.626521] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 237.812420] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 237.988290] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 237.997862] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 238.686040] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 238.694769] team0: Port device team_slave_0 added [ 238.880905] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 238.889703] team0: Port device team_slave_1 added [ 239.059632] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 239.067970] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 239.076871] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 239.249472] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 239.410193] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 239.417894] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 239.427054] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 239.611407] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 239.619159] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 239.628268] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 239.850492] 8021q: adding VLAN 0 to HW filter on device bond0 [ 240.355494] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready 20:10:19 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) unshare(0x20400) ioctl$FICLONE(r0, 0x40049409, 0xffffffffffffffff) 20:10:19 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) unshare(0x20400) ioctl$FICLONE(r0, 0x40049409, 0xffffffffffffffff) 20:10:20 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) unshare(0x20400) ioctl$FICLONE(r0, 0x40049409, 0xffffffffffffffff) [ 241.140101] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 241.147100] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 241.155145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 20:10:20 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) syz_open_dev$dspn(&(0x7f0000000480)='/dev/dsp#\x00', 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000002700)={0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f00000004c0)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x200}], 0x30}, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmsg(r1, &(0x7f00000026c0)={&(0x7f0000000300)=@pppol2tpv3, 0x80, &(0x7f0000002540)=[{&(0x7f0000000000)=""/115, 0x73}, {&(0x7f00000023c0)=""/143, 0x8f}, {&(0x7f00000001c0)=""/22, 0xfffffea0}, {&(0x7f0000000400)=""/53, 0x35}, {&(0x7f00000000c0)=""/190, 0xbe}, {&(0x7f0000000440)=""/9, 0x9}], 0x6, &(0x7f00000025c0)=""/230, 0xe6}, 0x0) 20:10:20 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) unshare(0x20400) ioctl$FICLONE(r0, 0x40049409, 0xffffffffffffffff) [ 241.357252] bridge0: port 2(bridge_slave_1) entered blocking state [ 241.363871] bridge0: port 2(bridge_slave_1) entered forwarding state [ 241.371019] bridge0: port 1(bridge_slave_0) entered blocking state [ 241.377643] bridge0: port 1(bridge_slave_0) entered forwarding state [ 241.387028] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 20:10:20 executing program 0: getrandom(&(0x7f0000000240)=""/189, 0xbd, 0x0) 20:10:20 executing program 0: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x18, &(0x7f0000000000)='@\'user&posix_acl_access\x00', 0xffffffffffffffff}, 0x30) r1 = syz_open_procfs(r0, &(0x7f0000000200)='net/ip_vs_stats\x00') ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x80086603, 0x70e000) [ 241.846114] 8021q: adding VLAN 0 to HW filter on device team0 20:10:21 executing program 0: r0 = eventfd2(0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) r2 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000d4a000)) r3 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) getsockopt$inet6_tcp_int(r3, 0x6, 0x3f, &(0x7f0000000040), &(0x7f0000000080)=0x4) io_setup(0x200, &(0x7f0000000480)) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000100)={{{@in6=@dev, @in6=@local}}, {{@in=@multicast2}, 0x0, @in6}}, &(0x7f0000000200)=0xe8) ioctl$SIOCGIFHWADDR(r3, 0x8927, &(0x7f00000000c0)) [ 242.117188] IPVS: ftp: loaded support on port[0] = 21 [ 242.182795] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 20:10:21 executing program 0: modify_ldt$write2(0x11, &(0x7f0000000100), 0x10) modify_ldt$write2(0x11, &(0x7f0000000140), 0x10) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_mr_cache\x00') ioctl$VIDIOC_DBG_G_CHIP_INFO(r0, 0xc0c85666, &(0x7f0000000180)={{0x4, @name="f1824ba47ac68963bc04f6591afa33e812b952240056e4cf6dca8a497ec9caa5"}, "7dc9c1e48d6bce39fb219e8f978a7ac56854cdc6e71570e9608bd7ed6dd621e1", 0x1}) 20:10:21 executing program 0: openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x200000, 0x0) r0 = socket$inet6(0xa, 0x803, 0x3) ioctl(r0, 0x1000008912, &(0x7f0000000640)="0a5c2d023c126285718070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000002c0)={@dev={0xac, 0x14, 0x14, 0xfffffffd}, @local}, 0x7) [ 244.751818] bridge0: port 1(bridge_slave_0) entered blocking state [ 244.758369] bridge0: port 1(bridge_slave_0) entered disabled state [ 244.767001] device bridge_slave_0 entered promiscuous mode [ 244.945343] bridge0: port 2(bridge_slave_1) entered blocking state [ 244.952000] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.960303] device bridge_slave_1 entered promiscuous mode [ 245.145486] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 245.346469] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 245.887633] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 245.994519] bond0: Enslaving bond_slave_1 as an active interface with an up link 20:10:25 executing program 1: open(&(0x7f00000000c0)='./file1\x00', 0x40140, 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) name_to_handle_at(r0, &(0x7f0000000040)='./file1\x00', &(0x7f0000000100)={0x81, 0x0, "b6a3066eb8467b851725d09c4bc599773ad2393692c5d771a6f01cbe5f3144b7545532772e92c6c0c4ce1a6f3143da164034026d0c38b3ab815c438e19b7e04d9709fea41f6a7fd5e7aa1cd55a3cef0c22661b34d7ca5d672437c93c5fd562378a8a427657da6e7a8a45728782eff662cb8f398d9b229f56b1"}, 0x0, 0x0) [ 246.230409] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 246.237488] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 246.390288] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 246.397408] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 246.850269] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 246.859140] team0: Port device team_slave_0 added [ 247.018074] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 247.026655] team0: Port device team_slave_1 added [ 247.180252] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 247.187418] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 247.196431] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 247.325768] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 247.332901] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 247.341926] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 247.430628] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 247.438389] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 247.447448] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 247.602774] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 247.610575] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 247.619639] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 248.701422] 8021q: adding VLAN 0 to HW filter on device bond0 [ 249.118928] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 249.248707] bridge0: port 2(bridge_slave_1) entered blocking state [ 249.255318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 249.262658] bridge0: port 1(bridge_slave_0) entered blocking state [ 249.269201] bridge0: port 1(bridge_slave_0) entered forwarding state [ 249.279039] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 249.285582] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 249.626568] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 249.633002] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 249.640790] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 250.244552] 8021q: adding VLAN 0 to HW filter on device team0 20:10:32 executing program 2: memfd_create(&(0x7f0000000e40)='\x00\x00\x00\x00\x00\x00r%\xf7\x83\x80\x80}\xdePS`\x18A\xa0\xd0\xf8+t7HR\xb0\x1f\x12Y\x97b-\xc4\xa5\xe7\x1d,\xe5\xac2\xff\x90\x82O\xa2^Y\a4\x87\xcf6\xadWn2\x92k\x04\x89M\xa7@\xf7\xe9\xc0\xff\xb4,5j\x1f([\xfc\x8f\v\x8cor\xef\x15\x1d\xabL\\*Zu\x1f\x04\xbf\xc6\x9a\xc5\xc3\xb5\x16\x8am\x13\xd8&\xb1\xed\fu\'\xd5\x8fT\xad\xc1/\xca\x1f%\xc8\xfc%\x86\xeaM\x90\xf8M\xab\xcd\xec)\x1f\xb7\x80\xa3\x9a\x11}\x12\xb0\x89;\x18 \x98\xdc\xee\xd3;\"*\x1dA7\t\xae5]M)\x7f\xe4,]N\x9d\x8b\xbd\x9d\fp\x9c\xaeG\xe8\x8f\x8a\xa2*P[>\x99[P\x1f\r7S\xcd5\x10\xe8t6a+@\x13\x05\xf3\x16\x17\x7fmMLp\xfd\x9d&!\xc3pz\xd8\x8d\xa7\x85%\x96\xd8\x9aY\xcbtP^gZ\xc6\xeb\xc0?\xaa>\xe9\x98\x89\x17kW\x115\x03\x1a\xfc\x97\xce\xc4]\"\xfdhy(A\x1b\x83\xf6\x8b\xf7\xbeK!\xfd\xf0\x03<\xf9I\xb8\xa7j\xa6]h\xad\x88Yg\xc2\xcc<-`\xect\xfc\xf5\xde\x16,\x94\xff\xe3\xe1Wu\xc1\xa1\xcf\xd9\x81\x8dL\x17\xa2\xf8\xd0\xa70%8\xf0y\xe7\xb1(\xef\x12<\x8b\xb9\t\x00\x00\x00\x00\x00\x00\x008\x14\xc2\xae\xa8l5\xfb\xf4$Jdc]2\xff\x12\xe4\xdc\xb3\xdfV\xe5\xd5\xd3\x88*\x99\x84\x99?\x8a\x7f\xefr\xd8u\xd2\x1c\x1e;\xb2\xbc>ny\xa2\xb6\xd3\"\xf7\x10\xf07\x8a\xbc \x95\xd3!9\xe3\x9f2#\xdb\x99a0\x92\x95\xe4\xc3\xc8\xe1\xb0\x00\x1d\xd7W\xaa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\xec\xa8\f{\f', 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000), 0x0) r0 = socket$nl_generic(0xa, 0x3, 0x10) setsockopt$netlink_NETLINK_RX_RING(r0, 0x29, 0x6, &(0x7f0000000ff0)={0x1c2, 0x0, 0x29, 0x2}, 0x1c2) 20:10:32 executing program 0: r0 = socket$inet6(0xa, 0x6, 0x3) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0a5c2d023c126285718070") r1 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r1, 0x6, 0xc, &(0x7f0000dc6ffe), &(0x7f0000904000)=0x4) 20:10:32 executing program 1: open(&(0x7f00000000c0)='./file1\x00', 0x40140, 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) name_to_handle_at(r0, &(0x7f0000000040)='./file1\x00', &(0x7f0000000100)={0x81, 0x0, "b6a3066eb8467b851725d09c4bc599773ad2393692c5d771a6f01cbe5f3144b7545532772e92c6c0c4ce1a6f3143da164034026d0c38b3ab815c438e19b7e04d9709fea41f6a7fd5e7aa1cd55a3cef0c22661b34d7ca5d672437c93c5fd562378a8a427657da6e7a8a45728782eff662cb8f398d9b229f56b1"}, 0x0, 0x0) 20:10:32 executing program 4: mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000, 0x2, &(0x7f0000ffc000/0x2000)=nil) r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x0, 0x424000) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000040)=""/1, 0x4000, 0x0, 0x2}, 0x18) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'lo\x00', &(0x7f00000000c0)=@ethtool_dump={0x7e, 0x5, 0x1, 0x65, "9fa595629f20ec008da55237d276589fdadae59e474c1564116a4404dee329185fbe3438a1ac6a42908951d073ee72fbb144a84673c5742c80d9011d06603153d3420f9738531517d46a6501b702df2166e5d287b55384104086f9d8ebad1b31dedc9b87e5"}}) setxattr$security_smack_transmute(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x2) ioctl$TUNSETLINK(r0, 0x400454cd, 0x339) ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000280)={0x100000000, 0x7, 0x4, 0x0, {0x0, 0x7530}, {0x5, 0x1, 0x5, 0x80000000, 0x8, 0x6cf1, "e559c7a1"}, 0x9, 0x4, @planes=&(0x7f0000000240)={0x80, 0xb1, @mem_offset=0x5, 0x6ce6}, 0x4}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGSW(r2, 0x8040451b, &(0x7f0000000340)=""/156) recvmmsg(r1, &(0x7f0000003a80)=[{{&(0x7f0000000400)=@in6={0xa, 0x0, 0x0, @dev}, 0x80, &(0x7f00000007c0)=[{&(0x7f0000000480)=""/109, 0x6d}, {&(0x7f0000000500)=""/89, 0x59}, {&(0x7f0000000580)=""/177, 0xb1}, {&(0x7f0000000640)=""/100, 0x64}, {&(0x7f00000006c0)=""/120, 0x78}, {&(0x7f0000000740)=""/100, 0x64}], 0x6}, 0x80000001}, {{&(0x7f0000000840)=@pptp={0x18, 0x2, {0x0, @empty}}, 0x80, &(0x7f0000000a40)=[{&(0x7f00000008c0)=""/198, 0xc6}, {&(0x7f00000009c0)=""/115, 0x73}], 0x2, &(0x7f0000000a80)=""/249, 0xf9}, 0xc881}, {{&(0x7f0000000b80)=@can={0x1d, 0x0}, 0x80, &(0x7f0000001200)=[{&(0x7f0000000c00)=""/33, 0x21}, {&(0x7f0000000c40)=""/214, 0xd6}, {&(0x7f0000000d40)=""/249, 0xf9}, {&(0x7f0000000e40)=""/86, 0x56}, {&(0x7f0000000ec0)=""/98, 0x62}, {&(0x7f0000000f40)=""/46, 0x2e}, {&(0x7f0000000f80)=""/106, 0x6a}, {&(0x7f0000001000)=""/82, 0x52}, {&(0x7f0000001080)=""/143, 0x8f}, {&(0x7f0000001140)=""/135, 0x87}], 0xa, &(0x7f00000012c0)=""/125, 0x7d}, 0x7fff}, {{&(0x7f0000001340)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f00000038c0)=[{&(0x7f00000013c0)=""/207, 0xcf}, {&(0x7f00000014c0)=""/138, 0x8a}, {&(0x7f0000001580)=""/155, 0x9b}, {&(0x7f0000001640)=""/180, 0xb4}, {&(0x7f0000001700)=""/4096, 0x1000}, {&(0x7f0000002700)=""/4096, 0x1000}, {&(0x7f0000003700)=""/111, 0x6f}, {&(0x7f0000003780)=""/57, 0x39}, {&(0x7f00000037c0)=""/227, 0xe3}], 0x9, &(0x7f0000003980)=""/201, 0xc9}, 0x2}], 0x4, 0x40010020, &(0x7f0000003b80)={0x0, 0x1c9c380}) ioctl$TCFLSH(r0, 0x540b, 0x800) mkdirat(r0, &(0x7f0000003bc0)='./file0\x00', 0x0) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) ioctl$UI_SET_ABSBIT(r2, 0x40045567, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000003c00)=0x6, 0x8) r5 = syz_genetlink_get_family_id$team(&(0x7f0000003c80)='team\x00') sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000004040)={&(0x7f0000003c40)={0x10, 0x0, 0x0, 0x10001010}, 0xc, &(0x7f0000004000)={&(0x7f0000003cc0)={0x334, r5, 0x300, 0x70bd26, 0x25dfdbfd, {}, [{{0x8, 0x1, r4}, {0x8c, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}]}}, {{0x8, 0x1, r4}, {0x78, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r4}}}]}}, {{0x8, 0x1, r4}, {0xc4, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r4}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x14, 0x4, [{0x100000000, 0x80, 0x200, 0x20e4}, {0x2, 0x7, 0x7, 0x10001}]}}}]}}, {{0x8, 0x1, r4}, {0x138, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r4}}, {0x8}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}]}}]}, 0x334}}, 0x4090) recvmmsg(r1, &(0x7f0000006a80)=[{{&(0x7f0000004080)=@ax25, 0x80, &(0x7f0000006180)=[{&(0x7f0000004100)=""/4096, 0x1000}, {&(0x7f0000005100)=""/4096, 0x1000}, {&(0x7f0000006100)=""/42, 0x2a}, {&(0x7f0000006140)=""/50, 0x32}], 0x4, &(0x7f00000061c0)=""/93, 0x5d}, 0x1e}, {{0x0, 0x0, &(0x7f00000064c0)=[{&(0x7f0000006240)=""/14, 0xe}, {&(0x7f0000006280)=""/61, 0x3d}, {&(0x7f00000062c0)=""/112, 0x70}, {&(0x7f0000006340)=""/114, 0x72}, {&(0x7f00000063c0)=""/157, 0x9d}, {&(0x7f0000006480)=""/46, 0x2e}], 0x6, &(0x7f0000006540)=""/28, 0x1c}, 0x4}, {{&(0x7f0000006580)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000006900)=[{&(0x7f0000006600)=""/216, 0xd8}, {&(0x7f0000006700)=""/44, 0x2c}, {&(0x7f0000006740)=""/113, 0x71}, {&(0x7f00000067c0)=""/92, 0x5c}, {&(0x7f0000006840)=""/174, 0xae}], 0x5, &(0x7f0000006980)=""/235, 0xeb}, 0xb}], 0x3, 0x2000, &(0x7f0000006b40)={0x77359400}) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000006b80)) r6 = inotify_init() r7 = openat$autofs(0xffffffffffffff9c, &(0x7f0000006bc0)='/dev/autofs\x00', 0x800, 0x0) ioctl$TUNSETVNETHDRSZ(r7, 0x400454d8, &(0x7f0000006c00)=0x8) socket(0x0, 0xa, 0x400) pipe2(&(0x7f0000006c40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000006c80)) prctl$PR_SET_TIMERSLACK(0x1d, 0x8000) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r8, 0x40045731, &(0x7f0000006cc0)=0x7) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f0000006d00)='\x05\x00') dup3(r6, r1, 0x80000) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r2, 0xc08c5334, &(0x7f0000006d40)={0x3, 0x10001, 0x100000001, 'queue0\x00', 0x1}) [ 254.041065] IPVS: ftp: loaded support on port[0] = 21 [ 254.839814] 8021q: adding VLAN 0 to HW filter on device bond0 [ 255.158041] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 255.383920] bridge0: port 1(bridge_slave_0) entered blocking state [ 255.390484] bridge0: port 1(bridge_slave_0) entered disabled state [ 255.398886] device bridge_slave_0 entered promiscuous mode [ 255.489473] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 255.495865] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 255.503921] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 255.514004] bridge0: port 2(bridge_slave_1) entered blocking state [ 255.520504] bridge0: port 2(bridge_slave_1) entered disabled state [ 255.528944] device bridge_slave_1 entered promiscuous mode [ 255.611979] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 255.691911] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 255.809022] 8021q: adding VLAN 0 to HW filter on device team0 [ 255.944333] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 256.029413] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 256.112651] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 256.119690] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 256.201357] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 256.208873] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 256.464526] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 256.472802] team0: Port device team_slave_0 added [ 256.557070] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 256.565373] team0: Port device team_slave_1 added [ 256.649090] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 256.735201] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 256.834124] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 256.841851] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 256.851222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 256.937650] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 256.945464] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 256.954818] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 257.858315] bridge0: port 2(bridge_slave_1) entered blocking state [ 257.864839] bridge0: port 2(bridge_slave_1) entered forwarding state [ 257.871869] bridge0: port 1(bridge_slave_0) entered blocking state [ 257.878343] bridge0: port 1(bridge_slave_0) entered forwarding state [ 257.886792] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 258.003371] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 20:10:37 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) syz_open_dev$dspn(&(0x7f0000000480)='/dev/dsp#\x00', 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000002700)={0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f00000004c0)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x200}], 0x30}, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmsg(r1, &(0x7f00000026c0)={&(0x7f0000000300)=@pppol2tpv3, 0x80, &(0x7f0000002540)=[{&(0x7f0000000000)=""/115, 0x73}, {&(0x7f00000023c0)=""/143, 0x8f}, {&(0x7f00000001c0)=""/22, 0xfffffea0}, {&(0x7f0000000400)=""/53, 0x35}, {&(0x7f00000000c0)=""/190, 0xbe}, {&(0x7f0000000440)=""/9, 0x9}], 0x6, &(0x7f00000025c0)=""/230, 0xe6}, 0x0) 20:10:37 executing program 1: open(&(0x7f00000000c0)='./file1\x00', 0x40140, 0x0) r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) name_to_handle_at(r0, &(0x7f0000000040)='./file1\x00', &(0x7f0000000100)={0x81, 0x0, "b6a3066eb8467b851725d09c4bc599773ad2393692c5d771a6f01cbe5f3144b7545532772e92c6c0c4ce1a6f3143da164034026d0c38b3ab815c438e19b7e04d9709fea41f6a7fd5e7aa1cd55a3cef0c22661b34d7ca5d672437c93c5fd562378a8a427657da6e7a8a45728782eff662cb8f398d9b229f56b1"}, 0x0, 0x0) 20:10:37 executing program 2: memfd_create(&(0x7f0000000e40)='\x00\x00\x00\x00\x00\x00r%\xf7\x83\x80\x80}\xdePS`\x18A\xa0\xd0\xf8+t7HR\xb0\x1f\x12Y\x97b-\xc4\xa5\xe7\x1d,\xe5\xac2\xff\x90\x82O\xa2^Y\a4\x87\xcf6\xadWn2\x92k\x04\x89M\xa7@\xf7\xe9\xc0\xff\xb4,5j\x1f([\xfc\x8f\v\x8cor\xef\x15\x1d\xabL\\*Zu\x1f\x04\xbf\xc6\x9a\xc5\xc3\xb5\x16\x8am\x13\xd8&\xb1\xed\fu\'\xd5\x8fT\xad\xc1/\xca\x1f%\xc8\xfc%\x86\xeaM\x90\xf8M\xab\xcd\xec)\x1f\xb7\x80\xa3\x9a\x11}\x12\xb0\x89;\x18 \x98\xdc\xee\xd3;\"*\x1dA7\t\xae5]M)\x7f\xe4,]N\x9d\x8b\xbd\x9d\fp\x9c\xaeG\xe8\x8f\x8a\xa2*P[>\x99[P\x1f\r7S\xcd5\x10\xe8t6a+@\x13\x05\xf3\x16\x17\x7fmMLp\xfd\x9d&!\xc3pz\xd8\x8d\xa7\x85%\x96\xd8\x9aY\xcbtP^gZ\xc6\xeb\xc0?\xaa>\xe9\x98\x89\x17kW\x115\x03\x1a\xfc\x97\xce\xc4]\"\xfdhy(A\x1b\x83\xf6\x8b\xf7\xbeK!\xfd\xf0\x03<\xf9I\xb8\xa7j\xa6]h\xad\x88Yg\xc2\xcc<-`\xect\xfc\xf5\xde\x16,\x94\xff\xe3\xe1Wu\xc1\xa1\xcf\xd9\x81\x8dL\x17\xa2\xf8\xd0\xa70%8\xf0y\xe7\xb1(\xef\x12<\x8b\xb9\t\x00\x00\x00\x00\x00\x00\x008\x14\xc2\xae\xa8l5\xfb\xf4$Jdc]2\xff\x12\xe4\xdc\xb3\xdfV\xe5\xd5\xd3\x88*\x99\x84\x99?\x8a\x7f\xefr\xd8u\xd2\x1c\x1e;\xb2\xbc>ny\xa2\xb6\xd3\"\xf7\x10\xf07\x8a\xbc \x95\xd3!9\xe3\x9f2#\xdb\x99a0\x92\x95\xe4\xc3\xc8\xe1\xb0\x00\x1d\xd7W\xaa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\xec\xa8\f{\f', 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000), 0x0) r0 = socket$nl_generic(0xa, 0x3, 0x10) setsockopt$netlink_NETLINK_RX_RING(r0, 0x29, 0x6, &(0x7f0000000ff0)={0x1c2, 0x0, 0x29, 0x2}, 0x1c2) 20:10:37 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/igmp\x00') ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0xfffffffffffffffc) write$P9_RLERRORu(r0, &(0x7f0000000040)={0x37, 0x7, 0x2, {{0x2a, 'vmnet1posix_acl_access[vmnet1vboxnet1wlan0'}, 0x40}}, 0x37) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r0, 0x800455d1, &(0x7f0000000080)) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f00000000c0)) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f0000000100)={0x7, 0x0, [], {0x0, @reserved}}) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x6685) r1 = syz_open_dev$media(&(0x7f00000001c0)='/dev/media#\x00', 0x3f, 0xc00) open_by_handle_at(r1, &(0x7f0000000200)={0xb0, 0x6c3b, "e44f9b205920b3d2e0e8f5543bae2c470d435cfb6f2250dfd342fe80c59fdd447442e51bad00a7a96ed8c0f0ad108d463918bf0d90fc711e44684e9ccbd165a9142f28074c26eba1570b0a69f529f53f2beb6aafc8fb4c1a035114eaa51f8158713c6c1c1e2fbc84fc53f02110ec6d559be1044fb48bbd30ed834c8d94965c7c866ea54b10b6c02b4961ae1c01223a101f8526526d3f3727ab4781783164421471bd8230c5b3e732"}, 0x40) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r1, 0x4020565b, &(0x7f00000002c0)={0x800100d, 0x2, 0x2}) ioctl$TCSETA(r0, 0x5406, &(0x7f0000000300)={0x100000000, 0x8001, 0x1ff, 0x80000000, 0x143, 0x0, 0x3, 0x8, 0xa035, 0x3}) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000340)={{{@in=@local, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@dev}}, &(0x7f0000000440)=0xe8) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000480)=r2) getsockname$inet6(r0, &(0x7f00000004c0)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000500)=0x1c) getrlimit(0xf, &(0x7f0000000540)) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000580)='/dev/cuse\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000005c0)={0xffffffffffffffff}, 0x68f9e2dee48e8e12, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000640)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x19}, 0x3}, {0xa, 0x4e20, 0x0, @ipv4={[], [], @local}, 0x4}, r4, 0xfffffffffffffffc}}, 0x48) ioctl$KVM_SET_SREGS(r1, 0x4138ae84, &(0x7f00000006c0)={{0x102001, 0x104003, 0xc, 0x7d19, 0x2, 0x4, 0x3, 0x7, 0x6, 0x8000, 0x2, 0x1}, {0x0, 0x4, 0x8, 0x0, 0x81, 0x1, 0x20, 0x3, 0x7fffffff, 0xdce2, 0x1f, 0x1}, {0x10f001, 0x104000, 0xb, 0x20, 0x895, 0x1c0, 0x9, 0x6, 0x3, 0x100, 0x1, 0x7}, {0x0, 0x11f000, 0xf, 0x18, 0x0, 0xb60, 0xffffffff, 0x12, 0x4d99, 0x401, 0xfffffffffffffffe, 0x7}, {0x5000, 0xd000, 0xa, 0xffffffffffffffff, 0x10000, 0x5470d47e, 0x7, 0x9, 0x0, 0x5, 0x8, 0x4}, {0x4000, 0x7000, 0x0, 0x3, 0x0, 0x14d, 0x5, 0x0, 0xffffffffd2e3a197, 0x8, 0x10001, 0x1}, {0xf000, 0x1, 0x3, 0x3, 0x5, 0xffffffffb93e360c, 0x140c, 0x6, 0x8, 0x0, 0x81, 0x7}, {0x2, 0x2000, 0xe, 0x3, 0x6000000000000, 0x5, 0x4, 0x7f, 0x7, 0x10000, 0x200, 0x9}, {0x4000, 0x4}, {0x5000, 0x4000}, 0x20040000, 0x0, 0xd000, 0x20080, 0x3, 0x0, 0x6000, [0x2, 0x9, 0x4, 0x9]}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000880)={r0, 0x50, &(0x7f0000000800)}, 0x10) preadv(r0, &(0x7f0000000d40)=[{&(0x7f00000008c0)=""/12, 0xc}, {&(0x7f0000000900)=""/6, 0x6}, {&(0x7f0000000940)=""/40, 0x28}, {&(0x7f0000000980)=""/193, 0xc1}, {&(0x7f0000000a80)=""/100, 0x64}, {&(0x7f0000000b00)=""/40, 0x28}, {&(0x7f0000000b40)=""/203, 0xcb}, {&(0x7f0000000c40)=""/179, 0xb3}, {&(0x7f0000000d00)=""/37, 0x25}], 0x9, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000e00)={@empty, @multicast1, 0x0}, &(0x7f0000000e40)=0xc) fcntl$setpipe(r0, 0x407, 0x6) fcntl$F_SET_FILE_RW_HINT(r3, 0x40e, &(0x7f0000000e80)=0x5) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000ec0)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x18, 0x10000, 0x8, 0x8, 0xe1d7c28}, &(0x7f0000000f80)=0x98) setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000fc0)=@assoc_id=r6, 0x4) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f0000001000)=""/82) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000001080)) bind$can_raw(r0, &(0x7f00000010c0)={0x1d, r5}, 0x10) ioctl$VIDIOC_ENCODER_CMD(r1, 0xc028564d, &(0x7f0000001100)={0x0, 0x1, [0x2, 0x6, 0x2ad1, 0x7, 0x6, 0x7fffffff, 0x0, 0x7]}) 20:10:37 executing program 0: r0 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x638, 0x8083) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x0, 0x0, 0x10000001002, 0x0, [0xfffffffe]}) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 20:10:37 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x40085112, &(0x7f0000b18000)={{0x2000ffffff93}, {0xffffff90}}) read$eventfd(r0, &(0x7f0000000040), 0x20000048) 20:10:37 executing program 2: memfd_create(&(0x7f0000000e40)='\x00\x00\x00\x00\x00\x00r%\xf7\x83\x80\x80}\xdePS`\x18A\xa0\xd0\xf8+t7HR\xb0\x1f\x12Y\x97b-\xc4\xa5\xe7\x1d,\xe5\xac2\xff\x90\x82O\xa2^Y\a4\x87\xcf6\xadWn2\x92k\x04\x89M\xa7@\xf7\xe9\xc0\xff\xb4,5j\x1f([\xfc\x8f\v\x8cor\xef\x15\x1d\xabL\\*Zu\x1f\x04\xbf\xc6\x9a\xc5\xc3\xb5\x16\x8am\x13\xd8&\xb1\xed\fu\'\xd5\x8fT\xad\xc1/\xca\x1f%\xc8\xfc%\x86\xeaM\x90\xf8M\xab\xcd\xec)\x1f\xb7\x80\xa3\x9a\x11}\x12\xb0\x89;\x18 \x98\xdc\xee\xd3;\"*\x1dA7\t\xae5]M)\x7f\xe4,]N\x9d\x8b\xbd\x9d\fp\x9c\xaeG\xe8\x8f\x8a\xa2*P[>\x99[P\x1f\r7S\xcd5\x10\xe8t6a+@\x13\x05\xf3\x16\x17\x7fmMLp\xfd\x9d&!\xc3pz\xd8\x8d\xa7\x85%\x96\xd8\x9aY\xcbtP^gZ\xc6\xeb\xc0?\xaa>\xe9\x98\x89\x17kW\x115\x03\x1a\xfc\x97\xce\xc4]\"\xfdhy(A\x1b\x83\xf6\x8b\xf7\xbeK!\xfd\xf0\x03<\xf9I\xb8\xa7j\xa6]h\xad\x88Yg\xc2\xcc<-`\xect\xfc\xf5\xde\x16,\x94\xff\xe3\xe1Wu\xc1\xa1\xcf\xd9\x81\x8dL\x17\xa2\xf8\xd0\xa70%8\xf0y\xe7\xb1(\xef\x12<\x8b\xb9\t\x00\x00\x00\x00\x00\x00\x008\x14\xc2\xae\xa8l5\xfb\xf4$Jdc]2\xff\x12\xe4\xdc\xb3\xdfV\xe5\xd5\xd3\x88*\x99\x84\x99?\x8a\x7f\xefr\xd8u\xd2\x1c\x1e;\xb2\xbc>ny\xa2\xb6\xd3\"\xf7\x10\xf07\x8a\xbc \x95\xd3!9\xe3\x9f2#\xdb\x99a0\x92\x95\xe4\xc3\xc8\xe1\xb0\x00\x1d\xd7W\xaa\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\xec\xa8\f{\f', 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000), 0x0) r0 = socket$nl_generic(0xa, 0x3, 0x10) setsockopt$netlink_NETLINK_RX_RING(r0, 0x29, 0x6, &(0x7f0000000ff0)={0x1c2, 0x0, 0x29, 0x2}, 0x1c2) 20:10:38 executing program 0: r0 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x638, 0x8083) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x0, 0x0, 0x10000001002, 0x0, [0xfffffffe]}) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 20:10:38 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000940000)={0x2, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:10:38 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x40085112, &(0x7f0000b18000)={{0x2000ffffff93}, {0xffffff90}}) read$eventfd(r0, &(0x7f0000000040), 0x20000048) 20:10:38 executing program 0: r0 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x638, 0x8083) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x0, 0x0, 0x10000001002, 0x0, [0xfffffffe]}) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 259.646921] IPVS: ftp: loaded support on port[0] = 21 [ 261.108645] bridge0: port 1(bridge_slave_0) entered blocking state [ 261.115193] bridge0: port 1(bridge_slave_0) entered disabled state [ 261.123088] device bridge_slave_0 entered promiscuous mode [ 261.205296] bridge0: port 2(bridge_slave_1) entered blocking state [ 261.211847] bridge0: port 2(bridge_slave_1) entered disabled state [ 261.219247] device bridge_slave_1 entered promiscuous mode [ 261.304905] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 261.395465] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 261.648165] 8021q: adding VLAN 0 to HW filter on device bond0 [ 261.664848] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 261.753486] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 261.834810] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 261.841860] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 261.926011] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 261.933107] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 261.956905] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 262.186120] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 262.194087] team0: Port device team_slave_0 added [ 262.276869] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 262.285222] team0: Port device team_slave_1 added [ 262.296081] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 262.304116] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 262.312299] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 262.365695] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 262.453211] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 262.541828] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 262.549568] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 262.558742] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 262.642080] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 262.650948] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 262.660302] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 262.675370] 8021q: adding VLAN 0 to HW filter on device team0 [ 263.577253] bridge0: port 2(bridge_slave_1) entered blocking state [ 263.583877] bridge0: port 2(bridge_slave_1) entered forwarding state [ 263.590996] bridge0: port 1(bridge_slave_0) entered blocking state [ 263.597655] bridge0: port 1(bridge_slave_0) entered forwarding state [ 263.605735] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 263.721851] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 20:10:43 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xfa\aBJ\xdau\xaf\x1f\x02\xac\xc7\xed\xbc\xd7\xa0q\xfb53\x1c\xe3\x9cZ\x00\x00\x00\x00') fsetxattr(r0, &(0x7f0000000000)=@known='user.syz\x00', 0x0, 0x0, 0x3) 20:10:43 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000940000)={0x2, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:10:43 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x40085112, &(0x7f0000b18000)={{0x2000ffffff93}, {0xffffff90}}) read$eventfd(r0, &(0x7f0000000040), 0x20000048) 20:10:43 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) syz_open_dev$dspn(&(0x7f0000000480)='/dev/dsp#\x00', 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000002700)={0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f00000004c0)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x200}], 0x30}, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmsg(r1, &(0x7f00000026c0)={&(0x7f0000000300)=@pppol2tpv3, 0x80, &(0x7f0000002540)=[{&(0x7f0000000000)=""/115, 0x73}, {&(0x7f00000023c0)=""/143, 0x8f}, {&(0x7f00000001c0)=""/22, 0xfffffea0}, {&(0x7f0000000400)=""/53, 0x35}, {&(0x7f00000000c0)=""/190, 0xbe}, {&(0x7f0000000440)=""/9, 0x9}], 0x6, &(0x7f00000025c0)=""/230, 0xe6}, 0x0) [ 266.285115] 8021q: adding VLAN 0 to HW filter on device bond0 [ 266.455225] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 266.629043] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 266.635347] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 266.643297] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 266.819014] 8021q: adding VLAN 0 to HW filter on device team0 20:10:46 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r1, 0x0, 0x480, &(0x7f0000000140), &(0x7f0000000200)=0x40) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, &(0x7f00000001c0)="650fc75c276766b882000f00d0c4423d3c56eef22ede9a002000000f01cf0f3042802100660f38802afb0f23d4", 0x2d}], 0x1, 0x0, &(0x7f0000000140), 0x100000000000014f) ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000000)={0x65, 0xe8, 0x8000, 0x2, 0xfff, 0x4}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="2e8e6d0d66b80500000066b9000000000f01d9f30f7f7b3dba4100ed0f20c06635000000200f22c066b9800000c00f326635000800000f300f3806e8f2afca09180f01ca", 0x44}], 0x1, 0x0, 0x0, 0x0) creat(&(0x7f0000000240)='./file0\x00', 0x2) ioctl$KVM_RUN(r4, 0xae80, 0x0) 20:10:46 executing program 0: r0 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x638, 0x8083) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000040)={0x0, 0x0, 0x10000001002, 0x0, [0xfffffffe]}) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 20:10:46 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x40085112, &(0x7f0000b18000)={{0x2000ffffff93}, {0xffffff90}}) read$eventfd(r0, &(0x7f0000000040), 0x20000048) 20:10:46 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xfa\aBJ\xdau\xaf\x1f\x02\xac\xc7\xed\xbc\xd7\xa0q\xfb53\x1c\xe3\x9cZ\x00\x00\x00\x00') fsetxattr(r0, &(0x7f0000000000)=@known='user.syz\x00', 0x0, 0x0, 0x3) 20:10:46 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000940000)={0x2, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:10:46 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) syz_open_dev$dspn(&(0x7f0000000480)='/dev/dsp#\x00', 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000002700)={0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f00000004c0)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x200}], 0x30}, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[], 0xffffffaa) recvmsg(r1, &(0x7f00000026c0)={&(0x7f0000000300)=@pppol2tpv3, 0x80, &(0x7f0000002540)=[{&(0x7f0000000000)=""/115, 0x73}, {&(0x7f00000023c0)=""/143, 0x8f}, {&(0x7f00000001c0)=""/22, 0xfffffea0}, {&(0x7f0000000400)=""/53, 0x35}, {&(0x7f00000000c0)=""/190, 0xbe}, {&(0x7f0000000440)=""/9, 0x9}], 0x6, &(0x7f00000025c0)=""/230, 0xe6}, 0x0) [ 268.043743] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 20:10:47 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xfa\aBJ\xdau\xaf\x1f\x02\xac\xc7\xed\xbc\xd7\xa0q\xfb53\x1c\xe3\x9cZ\x00\x00\x00\x00') fsetxattr(r0, &(0x7f0000000000)=@known='user.syz\x00', 0x0, 0x0, 0x3) 20:10:47 executing program 1: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000040)=[{{}, 0x1, 0x48, 0x400000002}], 0x1c4) 20:10:47 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000940000)={0x2, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:10:47 executing program 0: unshare(0x20400) epoll_wait(0xffffffffffffffff, &(0x7f0000000180)=[{}], 0x1, 0x0) 20:10:47 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f00000000c0)={'\x00', 0x8400}) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000200)={0x1, &(0x7f0000000240)=[{0x5}]}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x43732e5398416f1a}) 20:10:47 executing program 1: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000040)=[{{}, 0x1, 0x48, 0x400000002}], 0x1c4) 20:10:47 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='/exe\x00\x00\x00\x00\x00\x04\t\x00K\xdd\xd9\xde\x91\xbe\x10\xee\xbf\x00\x0e\xe9\xa9\x0fy\x80XC\x9e\xd5T\xfa\aBJ\xdau\xaf\x1f\x02\xac\xc7\xed\xbc\xd7\xa0q\xfb53\x1c\xe3\x9cZ\x00\x00\x00\x00') fsetxattr(r0, &(0x7f0000000000)=@known='user.syz\x00', 0x0, 0x0, 0x3) 20:10:47 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000340)) 20:10:47 executing program 0: unshare(0x20400) epoll_wait(0xffffffffffffffff, &(0x7f0000000180)=[{}], 0x1, 0x0) 20:10:47 executing program 1: r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x20, 0x101002) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$evdev(r0, &(0x7f0000000040)=[{{}, 0x1, 0x48, 0x400000002}], 0x1c4) 20:10:47 executing program 4: r0 = socket$inet6(0xa, 0x2000000000001, 0x0) r1 = socket$inet6(0xa, 0x2000000000001, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000687000)=0x5c802861, 0x4) bind$inet6(r1, &(0x7f0000402000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0xfffffefffffffffe, &(0x7f0000f62fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000687000)=0x9, 0x4) bind$inet6(r0, &(0x7f0000402000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) close(r1) sendto$inet6(r0, 0x0, 0x0, 0x20000000, &(0x7f0000000040)={0xa, 0x4e20}, 0x1c) 20:10:48 executing program 0: unshare(0x20400) epoll_wait(0xffffffffffffffff, &(0x7f0000000180)=[{}], 0x1, 0x0) 20:10:48 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdh\x00', 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f00000000c0)={'\x00', 0x8400}) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000200)={0x1, &(0x7f0000000240)=[{0x5}]}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'vet\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0x43732e5398416f1a}) 20:10:48 executing program 3: unshare(0x20400) r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0xef9000)=nil, 0xef9000, 0x0, 0x4000000000072, 0xffffffffffffffff, 0x0) ioctl$int_in(r0, 0x800000c0045006, &(0x7f0000000080)) [ 268.992299] ================================================================== [ 268.999770] BUG: KMSAN: uninit-value in __siphash_aligned+0x512/0xae0 [ 269.006372] CPU: 1 PID: 8179 Comm: syz-executor4 Not tainted 4.20.0-rc7+ #8 [ 269.013486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 269.022857] Call Trace: [ 269.025475] dump_stack+0x173/0x1d0 [ 269.029151] kmsan_report+0x120/0x290 [ 269.033012] kmsan_internal_check_memory+0x9a7/0xa20 [ 269.038175] ? __local_bh_enable_ip+0xb3/0x1a0 [ 269.042817] __msan_instrument_asm_load+0x8a/0x90 [ 269.047694] __siphash_aligned+0x512/0xae0 [ 269.052011] secure_tcpv6_seq+0x143/0x2b0 [ 269.056201] ? inet6_hash_connect+0x176/0x1a0 [ 269.060755] tcp_v6_connect+0x242b/0x2890 [ 269.064958] ? __msan_poison_alloca+0x1e0/0x270 [ 269.069685] ? tcp_v6_pre_connect+0x130/0x130 [ 269.074233] __inet_stream_connect+0x2f9/0x1340 [ 269.078951] ? kmem_cache_alloc_trace+0x55a/0xb90 [ 269.083874] ? tcp_sendmsg_locked+0x6394/0x6be0 [ 269.088623] tcp_sendmsg_locked+0x65d5/0x6be0 [ 269.093152] ? aa_label_sk_perm+0xda/0x940 [ 269.097422] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 269.102815] ? aa_label_sk_perm+0x6d6/0x940 [ 269.107174] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 269.112576] ? futex_wait+0x912/0xc40 [ 269.116454] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 269.121847] ? lockref_put_not_zero+0xc4/0x390 [ 269.126485] tcp_sendmsg+0xb2/0x100 [ 269.130168] ? tcp_sendmsg_locked+0x6be0/0x6be0 [ 269.134865] inet_sendmsg+0x54a/0x720 20:10:48 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r1, 0x4018aebd, &(0x7f0000000340)) [ 269.138722] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 269.144134] ? security_socket_sendmsg+0x1bd/0x200 [ 269.149110] ? inet_getname+0x490/0x490 [ 269.153110] __sys_sendto+0x8c4/0xac0 [ 269.156991] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 269.162477] ? prepare_exit_to_usermode+0x114/0x420 [ 269.167525] ? syscall_return_slowpath+0x50/0x650 [ 269.172403] __se_sys_sendto+0x107/0x130 [ 269.176509] __x64_sys_sendto+0x6e/0x90 [ 269.180529] do_syscall_64+0xbc/0xf0 [ 269.184297] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 269.189541] RIP: 0033:0x457669 [ 269.192761] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 269.211680] RSP: 002b:00007f800792cc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 269.219420] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000457669 [ 269.226699] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 269.233988] RBP: 000000000072bf00 R08: 0000000020f62fe4 R09: 000000000000001c [ 269.241265] R10: fffffefffffffffe R11: 0000000000000246 R12: 00007f800792d6d4 [ 269.248544] R13: 00000000004c4539 R14: 00000000004d75a8 R15: 00000000ffffffff [ 269.255867] [ 269.257497] Local variable description: ----combined@secure_tcpv6_seq [ 269.264074] Variable was created at: [ 269.267800] secure_tcpv6_seq+0x7d/0x2b0 [ 269.271875] tcp_v6_connect+0x242b/0x2890 [ 269.276016] [ 269.277643] Bytes 4-7 of 8 are uninitialized [ 269.282052] Memory access of size 8 starts at ffff88813ab8f658 [ 269.288023] ================================================================== [ 269.295381] Disabling lock debugging due to kernel taint [ 269.300841] Kernel panic - not syncing: panic_on_warn set ... [ 269.306750] CPU: 1 PID: 8179 Comm: syz-executor4 Tainted: G B 4.20.0-rc7+ #8 [ 269.315241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 269.324601] Call Trace: [ 269.327230] dump_stack+0x173/0x1d0 [ 269.330888] panic+0x3ce/0x961 [ 269.334142] kmsan_report+0x285/0x290 [ 269.337980] kmsan_internal_check_memory+0x9a7/0xa20 [ 269.343110] ? __local_bh_enable_ip+0xb3/0x1a0 [ 269.347737] __msan_instrument_asm_load+0x8a/0x90 [ 269.352602] __siphash_aligned+0x512/0xae0 [ 269.356896] secure_tcpv6_seq+0x143/0x2b0 [ 269.361064] ? inet6_hash_connect+0x176/0x1a0 [ 269.365581] tcp_v6_connect+0x242b/0x2890 [ 269.369775] ? __msan_poison_alloca+0x1e0/0x270 [ 269.374473] ? tcp_v6_pre_connect+0x130/0x130 [ 269.378988] __inet_stream_connect+0x2f9/0x1340 [ 269.383677] ? kmem_cache_alloc_trace+0x55a/0xb90 [ 269.388543] ? tcp_sendmsg_locked+0x6394/0x6be0 [ 269.393257] tcp_sendmsg_locked+0x65d5/0x6be0 [ 269.397786] ? aa_label_sk_perm+0xda/0x940 [ 269.402047] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 269.407422] ? aa_label_sk_perm+0x6d6/0x940 [ 269.411766] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 269.417142] ? futex_wait+0x912/0xc40 [ 269.421008] ? __msan_metadata_ptr_for_load_1+0x10/0x20 [ 269.426425] ? lockref_put_not_zero+0xc4/0x390 [ 269.431089] tcp_sendmsg+0xb2/0x100 [ 269.434745] ? tcp_sendmsg_locked+0x6be0/0x6be0 [ 269.439434] inet_sendmsg+0x54a/0x720 [ 269.443259] ? __msan_metadata_ptr_for_load_8+0x10/0x20 [ 269.448648] ? security_socket_sendmsg+0x1bd/0x200 [ 269.453634] ? inet_getname+0x490/0x490 [ 269.457620] __sys_sendto+0x8c4/0xac0 [ 269.461475] ? __msan_metadata_ptr_for_store_4+0x13/0x20 [ 269.466943] ? prepare_exit_to_usermode+0x114/0x420 [ 269.472010] ? syscall_return_slowpath+0x50/0x650 [ 269.476876] __se_sys_sendto+0x107/0x130 [ 269.480978] __x64_sys_sendto+0x6e/0x90 [ 269.485008] do_syscall_64+0xbc/0xf0 [ 269.488744] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 269.493940] RIP: 0033:0x457669 [ 269.497147] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 269.516065] RSP: 002b:00007f800792cc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 269.523785] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000457669 [ 269.531062] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 269.538336] RBP: 000000000072bf00 R08: 0000000020f62fe4 R09: 000000000000001c [ 269.545613] R10: fffffefffffffffe R11: 0000000000000246 R12: 00007f800792d6d4 [ 269.552894] R13: 00000000004c4539 R14: 00000000004d75a8 R15: 00000000ffffffff [ 269.561182] Kernel Offset: disabled [ 269.564812] Rebooting in 86400 seconds..