1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xb90, 0xa, r8}]}, 0x28}}, 0x0) [ 1881.231278][ T7225] device syz_tun left promiscuous mode [ 1881.237030][ T7225] bridge1073: port 1(syz_tun) entered disabled state [ 1881.277275][ T7225] bridge1074: port 1(syz_tun) entered blocking state [ 1881.318131][ T7225] bridge1074: port 1(syz_tun) entered disabled state [ 1881.366284][ T7225] device syz_tun entered promiscuous mode [ 1881.487867][ T7233] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1881.519056][ T7235] device syz_tun left promiscuous mode [ 1881.535653][ T7235] bridge1116: port 1(syz_tun) entered disabled state 05:14:35 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x8000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1881.566290][ T7235] bridge1117: port 1(syz_tun) entered blocking state [ 1881.589782][ T7235] bridge1117: port 1(syz_tun) entered disabled state [ 1881.621044][ T7235] device syz_tun entered promiscuous mode [ 1881.653375][ T7239] bridge1117: port 2(bridge_slave_0) entered blocking state [ 1881.725397][ T7239] bridge1117: port 2(bridge_slave_0) entered disabled state [ 1881.801441][ T7241] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:35 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x22}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:35 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xb98, 0xa, r8}]}, 0x28}}, 0x0) 05:14:35 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x2000000000000000) 05:14:35 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xfffff000) 05:14:35 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xf6ffffff00000000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1882.092856][ T7250] device syz_tun left promiscuous mode [ 1882.098724][ T7250] bridge1117: port 1(syz_tun) entered disabled state [ 1882.120187][ T7250] bridge1118: port 1(syz_tun) entered blocking state [ 1882.143239][ T7250] bridge1118: port 1(syz_tun) entered disabled state [ 1882.201184][ T7250] device syz_tun entered promiscuous mode [ 1882.218718][ T7256] bridge1117: port 2(bridge_slave_0) entered disabled state [ 1882.245370][ T7256] bridge1118: port 2(bridge_slave_0) entered blocking state [ 1882.263433][ T7256] bridge1118: port 2(bridge_slave_0) entered disabled state [ 1882.313355][ T7257] device syz_tun left promiscuous mode [ 1882.322421][ T7257] bridge1074: port 1(syz_tun) entered disabled state [ 1882.379751][ T7257] bridge1075: port 1(syz_tun) entered blocking state [ 1882.422758][ T7257] bridge1075: port 1(syz_tun) entered disabled state 05:14:36 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xffffffff00000000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1882.478680][ T26] kauditd_printk_skb: 12 callbacks suppressed [ 1882.478734][ T26] audit: type=1804 audit(1579065275.986:920): pid=7262 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1473/file0/file0" dev="loop4" ino=1227 res=1 [ 1882.546219][ T7257] device syz_tun entered promiscuous mode 05:14:36 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x9000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:14:36 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x3c}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:36 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xba0, 0xa, r8}]}, 0x28}}, 0x0) [ 1882.828500][ T26] audit: type=1804 audit(1579065276.336:921): pid=7253 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1508/file0/file0" dev="loop1" ino=1225 res=1 [ 1882.873695][ T7280] device syz_tun left promiscuous mode [ 1882.886960][ T7280] bridge1118: port 1(syz_tun) entered disabled state [ 1882.894985][ T26] audit: type=1804 audit(1579065276.386:922): pid=7258 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1562/file0/file0" dev="loop3" ino=1226 res=1 05:14:36 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x4000080000000000) 05:14:36 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xffffffe5) [ 1882.945384][ T7280] bridge1119: port 1(syz_tun) entered blocking state [ 1882.963940][ T7280] bridge1119: port 1(syz_tun) entered disabled state [ 1882.988615][ T7280] device syz_tun entered promiscuous mode [ 1882.998150][ T7283] device syz_tun left promiscuous mode [ 1883.003911][ T7283] bridge1075: port 1(syz_tun) entered disabled state [ 1883.017539][ T7283] bridge1076: port 1(syz_tun) entered blocking state [ 1883.024438][ T7283] bridge1076: port 1(syz_tun) entered disabled state [ 1883.032273][ T7283] device syz_tun entered promiscuous mode [ 1883.041459][ T7286] bridge1118: port 2(bridge_slave_0) entered disabled state [ 1883.103844][ T7286] bridge1119: port 2(bridge_slave_0) entered blocking state [ 1883.152926][ T7286] bridge1119: port 2(bridge_slave_0) entered disabled state 05:14:36 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x48}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1883.253376][ T26] audit: type=1804 audit(1579065276.756:923): pid=7295 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1474/file0/file0" dev="loop4" ino=1228 res=1 05:14:36 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xba8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:37 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xfffffffffffff000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1883.475008][ T7299] device syz_tun left promiscuous mode [ 1883.514097][ T7299] bridge1119: port 1(syz_tun) entered disabled state [ 1883.521065][ T26] audit: type=1804 audit(1579065277.026:924): pid=7291 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1563/file0/file0" dev="loop3" ino=1230 res=1 [ 1883.561882][ T7299] bridge1120: port 1(syz_tun) entered blocking state [ 1883.575619][ T7299] bridge1120: port 1(syz_tun) entered disabled state [ 1883.583192][ T7299] device syz_tun entered promiscuous mode 05:14:37 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xfffffff6) [ 1883.660059][ T7298] bridge1119: port 2(bridge_slave_0) entered disabled state [ 1883.666341][ T26] audit: type=1804 audit(1579065277.166:925): pid=7288 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1509/file0/file0" dev="loop1" ino=1229 res=1 05:14:37 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xa000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1883.714864][ T7298] bridge1120: port 2(bridge_slave_0) entered blocking state [ 1883.746178][ T7298] bridge1120: port 2(bridge_slave_0) entered disabled state 05:14:37 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xe5ffffff00000000) [ 1883.781262][ T7303] device syz_tun left promiscuous mode [ 1883.789200][ T7303] bridge1076: port 1(syz_tun) entered disabled state [ 1883.843043][ T7303] bridge1077: port 1(syz_tun) entered blocking state [ 1883.877185][ T7303] bridge1077: port 1(syz_tun) entered disabled state [ 1883.930282][ T7303] device syz_tun entered promiscuous mode [ 1883.952104][ T26] audit: type=1804 audit(1579065277.456:926): pid=7314 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1564/file0/file0" dev="loop3" ino=1232 res=1 05:14:37 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xf0ffffffffffff) 05:14:37 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x4c}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:37 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xbb0, 0xa, r8}]}, 0x28}}, 0x0) 05:14:37 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x100000000000000) [ 1884.331540][ T26] audit: type=1804 audit(1579065277.836:927): pid=7329 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1565/file0/file0" dev="loop3" ino=1234 res=1 [ 1884.398224][ T7335] device syz_tun left promiscuous mode [ 1884.412608][ T7335] bridge1077: port 1(syz_tun) entered disabled state [ 1884.433018][ T26] audit: type=1804 audit(1579065277.936:928): pid=7310 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1475/file0/file0" dev="loop4" ino=1231 res=1 [ 1884.474959][ T7335] bridge1078: port 1(syz_tun) entered blocking state [ 1884.493747][ T7335] bridge1078: port 1(syz_tun) entered disabled state [ 1884.506218][ T26] audit: type=1804 audit(1579065277.936:929): pid=7317 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1475/file0/file0" dev="loop4" ino=1231 res=1 [ 1884.520018][ T7335] device syz_tun entered promiscuous mode 05:14:38 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000180)={0x0, 0x0, 0x4, &(0x7f0000000140)=0x7fff}) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1884.619829][ T7336] device syz_tun left promiscuous mode [ 1884.625548][ T7336] bridge1120: port 1(syz_tun) entered disabled state [ 1884.674252][ T7336] bridge1121: port 1(syz_tun) entered blocking state [ 1884.695505][ T7336] bridge1121: port 1(syz_tun) entered disabled state [ 1884.705722][ T7336] device syz_tun entered promiscuous mode [ 1884.738574][ T7339] bridge1120: port 2(bridge_slave_0) entered disabled state [ 1884.781439][ T7339] bridge1121: port 2(bridge_slave_0) entered blocking state [ 1884.804159][ T7339] bridge1121: port 2(bridge_slave_0) entered disabled state 05:14:38 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xf6ffffff00000000) [ 1884.834458][ T7340] __nla_validate_parse: 6 callbacks suppressed [ 1884.834470][ T7340] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:38 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x10000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1884.894800][ T7339] bridge1121: port 2(bridge_slave_0) entered disabled state [ 1884.925720][ T7335] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:38 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x60}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:38 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xbb8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:38 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x200000000000000) [ 1885.210307][ T7364] device syz_tun left promiscuous mode [ 1885.226875][ T7364] bridge1121: port 1(syz_tun) entered disabled state [ 1885.255763][ T7364] bridge1122: port 1(syz_tun) entered blocking state [ 1885.277498][ T7364] bridge1122: port 1(syz_tun) entered disabled state [ 1885.336884][ T7364] device syz_tun entered promiscuous mode 05:14:38 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) getsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000180), &(0x7f0000000200)=0x8) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0xfffffffc, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/cgroups\x00', 0x0, 0x0) 05:14:38 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xffffffff00000000) [ 1885.435845][ T7366] bridge1122: port 2(bridge_slave_0) entered blocking state [ 1885.457746][ T7366] bridge1122: port 2(bridge_slave_0) entered disabled state [ 1885.489001][ T7367] device syz_tun left promiscuous mode [ 1885.494752][ T7367] bridge1078: port 1(syz_tun) entered disabled state [ 1885.542131][ T7367] bridge1079: port 1(syz_tun) entered blocking state [ 1885.576748][ T7367] bridge1079: port 1(syz_tun) entered disabled state [ 1885.631729][ T7367] device syz_tun entered promiscuous mode [ 1885.671889][ T7371] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:39 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x68}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1885.741932][ T7365] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:39 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xbc0, 0xa, r8}]}, 0x28}}, 0x0) 05:14:39 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x300000000000000) [ 1885.928799][ T7391] device syz_tun left promiscuous mode [ 1885.944447][ T7391] bridge1122: port 1(syz_tun) entered disabled state [ 1885.963799][ T7391] bridge1123: port 1(syz_tun) entered blocking state 05:14:39 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x1f000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1886.015529][ T7391] bridge1123: port 1(syz_tun) entered disabled state [ 1886.022996][ T7391] device syz_tun entered promiscuous mode [ 1886.089952][ T7390] bridge1122: port 2(bridge_slave_0) entered disabled state [ 1886.106516][ T7390] bridge1123: port 2(bridge_slave_0) entered blocking state [ 1886.129718][ T7390] bridge1123: port 2(bridge_slave_0) entered disabled state 05:14:39 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x36b, &(0x7f0000000240), 0x40000, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80000, 0x0) fchdir(r1) alarm(0x2) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1886.166693][ T7396] device syz_tun left promiscuous mode [ 1886.172404][ T7396] bridge1079: port 1(syz_tun) entered disabled state 05:14:39 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xfffffffffffff000) [ 1886.232445][ T7396] bridge1080: port 1(syz_tun) entered blocking state [ 1886.249921][ T7396] bridge1080: port 1(syz_tun) entered disabled state [ 1886.264306][ T7396] device syz_tun entered promiscuous mode [ 1886.292282][ T7394] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1886.367267][ T7396] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:39 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x6c}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:39 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xbc8, 0xa, r8}]}, 0x28}}, 0x0) [ 1886.554196][ T7414] device syz_tun left promiscuous mode [ 1886.562076][ T7414] bridge1080: port 1(syz_tun) entered disabled state [ 1886.574934][ T7414] bridge1081: port 1(syz_tun) entered blocking state [ 1886.585018][ T7414] bridge1081: port 1(syz_tun) entered disabled state [ 1886.594108][ T7414] device syz_tun entered promiscuous mode 05:14:40 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x600000000000000) [ 1886.700026][ T7418] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1886.719146][ T7421] device syz_tun left promiscuous mode [ 1886.734076][ T7421] bridge1123: port 1(syz_tun) entered disabled state [ 1886.760933][ T7421] bridge1124: port 1(syz_tun) entered blocking state [ 1886.802293][ T7421] bridge1124: port 1(syz_tun) entered disabled state [ 1886.834610][ T7421] device syz_tun entered promiscuous mode [ 1886.858473][ T7417] bridge1123: port 2(bridge_slave_0) entered disabled state [ 1886.916340][ T7417] bridge1124: port 2(bridge_slave_0) entered blocking state [ 1886.966175][ T7417] bridge1124: port 2(bridge_slave_0) entered disabled state [ 1887.009617][ T7422] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:40 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x20000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:14:40 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) eventfd2(0x4, 0x1) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:14:40 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xbd0, 0xa, r8}]}, 0x28}}, 0x0) 05:14:40 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x74}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:40 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) ioctl$SIOCX25GCALLUSERDATA(r1, 0x89e4, &(0x7f0000000300)={0x6f, "c51c9f1dd1099d59206f7770e8d0ee97b07aa402f54af40575e2520d91a732cbfe9dba4862614b66eecc7fda99a4428bb8cb4fe8da6032c42da5f4063872bf9588d0dc90078b0be6c1d04546635211313716b3b0a8ad71142a8e61d8b3c9afd4db398b7c7d9d8a20994c068c01865ecac2e0aec2a3cbbc614418c25cace16d30"}) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) ioctl$SOUND_OLD_MIXER_INFO(r2, 0x80304d65, &(0x7f0000000140)) [ 1887.305506][ T7443] device syz_tun left promiscuous mode [ 1887.311193][ T7443] bridge1081: port 1(syz_tun) entered disabled state [ 1887.343436][ T7443] bridge1082: port 1(syz_tun) entered blocking state 05:14:40 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xc00000000000000) [ 1887.379823][ T7443] bridge1082: port 1(syz_tun) entered disabled state [ 1887.408496][ T7443] device syz_tun entered promiscuous mode [ 1887.455320][ T7446] device syz_tun left promiscuous mode [ 1887.461083][ T7446] bridge1124: port 1(syz_tun) entered disabled state [ 1887.523648][ T7446] bridge1125: port 1(syz_tun) entered blocking state [ 1887.564032][ T7446] bridge1125: port 1(syz_tun) entered disabled state [ 1887.614023][ T7446] device syz_tun entered promiscuous mode [ 1887.641604][ T7439] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1887.671592][ T7441] bridge1124: port 2(bridge_slave_0) entered disabled state [ 1887.724109][ T7441] bridge1125: port 2(bridge_slave_0) entered blocking state [ 1887.815560][ T7441] bridge1125: port 2(bridge_slave_0) entered disabled state [ 1887.822913][ T26] kauditd_printk_skb: 13 callbacks suppressed [ 1887.822937][ T26] audit: type=1804 audit(1579065281.326:943): pid=7453 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1479/file0/file0" dev="loop4" ino=1245 res=1 05:14:41 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000180)={0x38, 0x1, 0x10000000, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffe}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/loop-control\x00', 0x121000, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1887.886913][ T7456] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1887.908480][ T7446] bridge1125: port 2(bridge_slave_0) entered disabled state 05:14:41 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xbd8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:41 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x7a}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1888.092338][ T26] audit: type=1804 audit(1579065281.596:944): pid=7445 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1514/file0/file0" dev="loop1" ino=1244 res=1 [ 1888.131127][ T7468] device syz_tun left promiscuous mode 05:14:41 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7690, 0x0, &(0x7f0000000000), 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000300)={{0x1, 0x2, 0x2, 0x1, 0xe17}, 0x2, 0x3, 'id0\x00', 'timer1\x00', 0x0, 0x1000, 0x446a, 0x7f, 0xad}) fchdir(r0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) setsockopt$CAN_RAW_LOOPBACK(r3, 0x65, 0x3, &(0x7f0000000000)=0x1, 0x4) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1888.149575][ T7468] bridge1082: port 1(syz_tun) entered disabled state [ 1888.186442][ T7468] bridge1083: port 1(syz_tun) entered blocking state [ 1888.211394][ T26] audit: type=1804 audit(1579065281.716:945): pid=7457 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1570/file0/file0" dev="loop3" ino=1246 res=1 [ 1888.212155][ T7468] bridge1083: port 1(syz_tun) entered disabled state [ 1888.249684][ T7468] device syz_tun entered promiscuous mode [ 1888.298311][ T7472] device syz_tun left promiscuous mode [ 1888.310580][ T7472] bridge1125: port 1(syz_tun) entered disabled state [ 1888.313238][ T26] audit: type=1800 audit(1579065281.816:946): pid=7454 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="loop3" ino=1246 res=0 [ 1888.347580][ T7472] bridge1126: port 1(syz_tun) entered blocking state [ 1888.386754][ T7472] bridge1126: port 1(syz_tun) entered disabled state 05:14:41 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xf00000000000000) 05:14:41 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x20100000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1888.411296][ T7472] device syz_tun entered promiscuous mode [ 1888.419113][ T7479] FAT-fs (loop1): bogus number of reserved sectors [ 1888.435797][ T7479] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1888.436926][ T7476] bridge1126: port 2(bridge_slave_0) entered blocking state [ 1888.475304][ T7476] bridge1126: port 2(bridge_slave_0) entered disabled state 05:14:42 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xbe0, 0xa, r8}]}, 0x28}}, 0x0) 05:14:42 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x85}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1888.640395][ T26] audit: type=1804 audit(1579065282.146:947): pid=7473 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1480/file0/file0" dev="loop4" ino=1247 res=1 [ 1888.792457][ T7493] device syz_tun left promiscuous mode [ 1888.815035][ T7493] bridge1126: port 1(syz_tun) entered disabled state 05:14:42 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0x2) [ 1888.872326][ T7493] bridge1127: port 1(syz_tun) entered blocking state [ 1888.896826][ T7493] bridge1127: port 1(syz_tun) entered disabled state [ 1888.931438][ T7493] device syz_tun entered promiscuous mode [ 1888.999773][ T7495] bridge1126: port 2(bridge_slave_0) entered disabled state [ 1889.032017][ T7495] bridge1127: port 2(bridge_slave_0) entered blocking state [ 1889.052609][ T7479] FAT-fs (loop1): bogus number of reserved sectors [ 1889.070884][ T7479] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1889.077603][ T7495] bridge1127: port 2(bridge_slave_0) entered disabled state [ 1889.112061][ T7497] device syz_tun left promiscuous mode [ 1889.122581][ T7497] bridge1083: port 1(syz_tun) entered disabled state [ 1889.191535][ T7497] bridge1084: port 1(syz_tun) entered blocking state [ 1889.234867][ T7497] bridge1084: port 1(syz_tun) entered disabled state [ 1889.290446][ T7497] device syz_tun entered promiscuous mode [ 1889.320960][ T26] audit: type=1804 audit(1579065282.826:948): pid=7485 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1571/file0/file0" dev="loop3" ino=1248 res=1 [ 1889.374332][ T7495] bridge1127: port 2(bridge_slave_0) entered disabled state 05:14:42 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x1300000000000000) [ 1889.409893][ T26] audit: type=1804 audit(1579065282.886:949): pid=7479 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1515/file0/file0" dev="sda1" ino=16710 res=1 05:14:42 executing program 1: r0 = open(&(0x7f0000000040)='./file0\x00', 0x101000, 0x0) fchdir(r0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100220}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, r2, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x80) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) socket$inet6(0xa, 0x2, 0x5) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000000)={0x6}) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) getpeername(r4, &(0x7f00000002c0)=@caif, &(0x7f0000000340)=0x80) ioctl$VHOST_GET_VRING_ENDIAN(r4, 0x4008af14, &(0x7f00000000c0)={0x7, 0x6}) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:14:43 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x8c}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:43 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xbe8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:43 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x3f000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1889.589918][ T26] audit: type=1804 audit(1579065283.096:950): pid=7501 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1481/file0/file0" dev="loop4" ino=1249 res=1 [ 1889.654330][ T26] audit: type=1804 audit(1579065283.156:951): pid=7508 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1481/file0/file0" dev="loop4" ino=1249 res=1 [ 1889.743196][ T26] audit: type=1800 audit(1579065283.186:952): pid=7501 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=1249 res=0 05:14:43 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) r1 = getpgrp(0xffffffffffffffff) sched_setattr(r1, &(0x7f0000000040)={0x221, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffffffffffc}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) ioctl$sock_SIOCGSKNS(r4, 0x894c, &(0x7f0000000140)=0x8) [ 1889.821068][ T7528] device syz_tun left promiscuous mode [ 1889.844472][ T7528] bridge1127: port 1(syz_tun) entered disabled state [ 1889.904608][ T7528] bridge1128: port 1(syz_tun) entered blocking state [ 1889.915514][ T7528] bridge1128: port 1(syz_tun) entered disabled state [ 1889.955019][ T7528] device syz_tun entered promiscuous mode [ 1890.014623][ T7529] device syz_tun left promiscuous mode [ 1890.022704][ T7529] bridge1084: port 1(syz_tun) entered disabled state [ 1890.051037][ T7529] bridge1085: port 1(syz_tun) entered blocking state [ 1890.094526][ T7529] bridge1085: port 1(syz_tun) entered disabled state [ 1890.133313][ T7529] device syz_tun entered promiscuous mode [ 1890.167883][ T7531] bridge1128: port 2(bridge_slave_0) entered blocking state [ 1890.175294][ T7531] bridge1128: port 2(bridge_slave_0) entered disabled state [ 1890.194254][ T7532] __nla_validate_parse: 4 callbacks suppressed [ 1890.194267][ T7532] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:43 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x2000000000000000) [ 1890.270238][ T7526] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:43 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0xcc}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:43 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xbf0, 0xa, r8}]}, 0x28}}, 0x0) [ 1890.490547][ T7547] device syz_tun left promiscuous mode [ 1890.499770][ T7547] bridge1128: port 1(syz_tun) entered disabled state 05:14:44 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) getsockopt$inet_dccp_buf(r1, 0x21, 0x80, &(0x7f0000000300)=""/135, &(0x7f0000000000)=0x87) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) bind$l2tp6(r2, &(0x7f0000000040)={0xa, 0x0, 0x10000, @empty, 0x3ff}, 0x20) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1890.539328][ T7547] bridge1129: port 1(syz_tun) entered blocking state [ 1890.567174][ T7547] bridge1129: port 1(syz_tun) entered disabled state [ 1890.612833][ T7547] device syz_tun entered promiscuous mode 05:14:44 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000140)='/dev/video0\x00', 0x2, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00004de800000000"], 0x48}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r9}}, 0x20}}, 0x0) bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x10, r9, 0x1, 0x7, 0x6, @broadcast}, 0x14) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r4, &(0x7f00000004c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)=ANY=[@ANYBLOB="68002dd2", @ANYRES16=r5, @ANYBLOB="100026bd7000fbdbdf251d0000000c00990000100000020000000c0099005a000000ffffffff08000300", @ANYRES32=r9, @ANYBLOB="08000100020000000c00990002000000000000000c009900010000000100000008000100040000000c00230005000f0008000000"], 0x68}}, 0x8000) ioctl$VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f0000000300)={0xfffffffe, 0x100, 0x3, {0x5, @sliced={0x51, [0xff, 0x2, 0x1, 0x2, 0x7fff, 0x4, 0x7, 0x8, 0xf4b0, 0x9, 0x6, 0x0, 0x5, 0xa897, 0x40, 0x1, 0x8, 0x3, 0x20, 0x8, 0x1f, 0xfffe, 0x4, 0x7, 0x7fff, 0x0, 0xc101, 0x80, 0x0, 0x8, 0x7, 0x18b, 0x59, 0x80, 0x800, 0x4, 0x5c49, 0x1176, 0x0, 0x3, 0x800, 0x7ff, 0x7fff, 0x7, 0x5, 0x3, 0x5b, 0x3], 0x3f}}}) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1890.721012][ T7553] bridge1128: port 2(bridge_slave_0) entered disabled state [ 1890.746666][ T7553] bridge1129: port 2(bridge_slave_0) entered blocking state 05:14:44 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x40000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1890.765079][ T7553] bridge1129: port 2(bridge_slave_0) entered disabled state [ 1890.799026][ T7557] device syz_tun left promiscuous mode [ 1890.822469][ T7557] bridge1085: port 1(syz_tun) entered disabled state [ 1890.883827][ T7557] bridge1086: port 1(syz_tun) entered blocking state [ 1890.898366][ T7557] bridge1086: port 1(syz_tun) entered disabled state [ 1890.919088][ T7557] device syz_tun entered promiscuous mode [ 1890.944878][ T7559] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1890.967874][ T7557] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:44 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x3f00000000000000) 05:14:44 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0xd2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:44 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xbf8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:44 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) io_uring_setup(0x8a0, &(0x7f0000000000)={0x0, 0x0, 0x4, 0x0, 0x17c}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x200, 0x0) ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f0000000140)=""/99) fchdir(r0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000300)={0x3, 0x2, 0x4, 0x40000000, 0x10000, {0x0, 0x7530}, {0x2, 0x8, 0x81, 0x1, 0xa, 0xe0, "dec044d1"}, 0x6dc, 0x4, @planes=&(0x7f0000000200)={0xfffffffd, 0x8, @fd, 0x4582a5f3}, 0x9, 0x0, 0xffffffffffffffff}) mknodat(r3, &(0x7f0000000280)='./file1\x00', 0x400, 0x1) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1891.274876][ T7583] device syz_tun left promiscuous mode [ 1891.299845][ T7583] bridge1129: port 1(syz_tun) entered disabled state [ 1891.320762][ T7583] bridge1130: port 1(syz_tun) entered blocking state [ 1891.333127][ T7583] bridge1130: port 1(syz_tun) entered disabled state [ 1891.369449][ T7583] device syz_tun entered promiscuous mode [ 1891.448614][ T7586] device syz_tun left promiscuous mode [ 1891.488590][ T7586] bridge1086: port 1(syz_tun) entered disabled state [ 1891.543254][ T7586] bridge1087: port 1(syz_tun) entered blocking state [ 1891.581818][ T7586] bridge1087: port 1(syz_tun) entered disabled state [ 1891.622107][ T7586] device syz_tun entered promiscuous mode [ 1891.671300][ T7585] bridge1129: port 2(bridge_slave_0) entered disabled state [ 1891.693936][ T7585] bridge1130: port 2(bridge_slave_0) entered blocking state [ 1891.729307][ T7585] bridge1130: port 2(bridge_slave_0) entered disabled state [ 1891.758975][ T7588] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:45 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0) ioctl$KVM_GET_NESTED_STATE(r1, 0xc080aebe, &(0x7f0000000a00)={{0x0, 0x0, 0x80}}) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) sendmsg(r2, &(0x7f0000000140)={&(0x7f0000000000)=@isdn={0x22, 0x7, 0x81, 0x1, 0x1f}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000300)="0c7bbdd83bc1fc8307a57b93b16b81994595405a6b721adcb6845da7a15de64fe1fb3fbca3b9a306b05640d434f92104294fcd055fb593a2e42f923ca84dc0988307d5e8787729b836eb61fca352aa141b8f499963e0a19143d8ac793241d4f208c24052bb021126daf759bea400151902903211cec7caecd279fbe33b360fb0a77e00d0e10a3dac9e81a3cf96ac46f78037dfb85b000000", 0x98}, {&(0x7f0000000800)="b3b2062b89815989e128879587e279dfbda4affbbf314f7af61be0e5e2a1880d9189f17870a59c2e3123abb2801d71b5bced2f40c361b8589ea5030eda5889604c8f5402271cece89a627d7aa1b9182464ae9fdebf65ad99d7e22f0513e29dd9eac3050dbd753d543f820c0d5ec922cc9cc884a00e610296646116254b21c83e63e7de6a051a12c116fab80f5cd06f8c81653379952a5b079cee884ed302ce7438f2438cfc474def407b83afc2ace86b42e35a7f01304e7e7b2c5ee7becbd3383cb5c7a56f8746e7a0e6f990363fcaebafcb917469c887a64f1a2eb580d6525bf0a16243", 0xe4}], 0x2, &(0x7f0000000580)=ANY=[@ANYBLOB="5000000000000000000000000800000027d5a5b8ddbee9d2134bc0b4e1e5cdad9fce603e890faed87c8718e8c35b5b4d3a870e933e8fa30c86794574649fa9d627ef4a44fba984f186afde6f4e84000500000000000000000e0100008785ffff32b496a1ae40ae143219bd27512248fcc5c528a26f55e8b079b49e048db92cb97abc2895a8b58f9461072268a66edf70871cdcc8dd013b0050f82745738586e0db66f55398b990900afe75670954c9b9ceceec0c74b90474627d47698b8c684c2567bfb00b8c3e47b50d698794b433570f653eb8b55d32c8c142a7b6336c2a2013301b5440f38b7cee27b93c28e2ef634766e9a83661eb04c8a153120df46a501b81700c7232d14f1869a28ed7d26e24dd03b13076963c4784f2f3a8f488c6d368e3afd0647ef3797541f0a7fbc338de9a1cb90f9c72b3e99d2b3d2216ebf889549e33fab3b94f273097664cd93448858a0000000000000010010000000000080d02000008000000928d2dbbb69a981740c6191b5a9dd1363a7044ecf50bb3519ddfade061e179782ecdf9d7423a5add259a149ba5983760d79068e7df0e5812034d0100677e18a5cd414ea7d82f811bd3f8f4a3f795975325935b1b48e9a8a478ad52191b5d410e9cd5f05dfddfc4e42d4580708a155f93cbf2ebe08df0988ca796d131f92844c573d2701d00c4b3c491354dedb0f99ff44e558d135388d0617403b7a1ab4ec8123b7bfec6de9b0b226ac4d9dc9de7a386085d2d57b4572addabd53c9816f6f4bd72dd8a37c46d7658b735ae3fabc6095066af41f7f06d4f8fb98f0b16d6d180b50bfafad13e97f74c4ea4fb016c7e10e6bf3c991137b24c2ac375046ac56e3f82"], 0x268}, 0x4008000) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1891.800899][ T7584] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:45 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0xe6}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:45 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000300)={&(0x7f0000000140)=[0x6b, 0x0, 0x7f, 0x3, 0x6, 0x8], 0x6, 0x10001, 0x1, 0x7fff, 0xfffff801, 0xffffff5e, 0x7fffffff, {0xff, 0x1f3f, 0x8, 0xfff9, 0x800, 0x98c3, 0x6, 0x89, 0x1ff, 0xc1b5, 0x8001, 0x56, 0xbd00, 0x0, "cbc1d43f039a05f36e222657d0d1ffdf170eacb68fa2b3cf9ac701632fbe007e"}}) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:14:45 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x40000800, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:14:45 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc00, 0xa, r8}]}, 0x28}}, 0x0) 05:14:45 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x4000000000000000) [ 1892.044129][ T7610] device syz_tun left promiscuous mode [ 1892.075649][ T7610] bridge1130: port 1(syz_tun) entered disabled state [ 1892.111983][ T7610] bridge1131: port 1(syz_tun) entered blocking state [ 1892.125560][ T7610] bridge1131: port 1(syz_tun) entered disabled state [ 1892.145365][ T7610] device syz_tun entered promiscuous mode [ 1892.174757][ T7608] device syz_tun left promiscuous mode [ 1892.180628][ T7608] bridge1087: port 1(syz_tun) entered disabled state [ 1892.190878][ T7608] bridge1088: port 1(syz_tun) entered blocking state [ 1892.197803][ T7608] bridge1088: port 1(syz_tun) entered disabled state [ 1892.205301][ T7608] device syz_tun entered promiscuous mode [ 1892.214311][ T7615] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1892.226432][ T7604] bridge1130: port 2(bridge_slave_0) entered disabled state [ 1892.238997][ T7604] bridge1131: port 2(bridge_slave_0) entered blocking state [ 1892.246480][ T7604] bridge1131: port 2(bridge_slave_0) entered disabled state [ 1892.256525][ T7615] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:45 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc08, 0xa, r8}]}, 0x28}}, 0x0) 05:14:45 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x11a}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1892.480425][ T7624] device syz_tun left promiscuous mode [ 1892.497207][ T7624] bridge1088: port 1(syz_tun) entered disabled state [ 1892.532554][ T7624] bridge1089: port 1(syz_tun) entered blocking state [ 1892.549663][ T7624] bridge1089: port 1(syz_tun) entered disabled state [ 1892.580393][ T7624] device syz_tun entered promiscuous mode 05:14:46 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0x7, 0x14600) write$P9_RREAD(r1, &(0x7f00000003c0)={0xfffffec0, 0x75, 0xffff, {0x3dac, "817c9183ea31769801c907eb0d85514a125f08ac22d8ddab18307eb649da509a7eee86f84c7592b43af7b13c5174f3af2527839158bf025738c1d1aa1d6dd9035d9fd8643b08d76c6fcff0071e586fb4b4af67eb8c4d19021a873f308f5c2567f8b4910356709f06d7ae0ac3a3c1fdf8114e265c5b40"}}, 0xffffffffffffffe6) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) msgctl$IPC_INFO(0xffffffffffffffff, 0x3, &(0x7f0000000a00)=""/4096) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) mbind(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x8000, &(0x7f0000000140)=0xe943, 0x1, 0x1) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e666174007e8cd16718000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) connect$bt_rfcomm(r3, &(0x7f0000000180)={0x1f, {0x4, 0x7, 0xab, 0x6, 0x8, 0x3f}, 0x8}, 0xa) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1892.649264][ T7622] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1892.681128][ T7626] device syz_tun left promiscuous mode [ 1892.695642][ T7626] bridge1131: port 1(syz_tun) entered disabled state [ 1892.704373][ T7626] bridge1132: port 1(syz_tun) entered blocking state [ 1892.726067][ T7626] bridge1132: port 1(syz_tun) entered disabled state [ 1892.736538][ T7626] device syz_tun entered promiscuous mode 05:14:46 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x4000080000000000) 05:14:46 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000000)=0x20000, 0x4) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1892.750757][ T7630] device bridge_slave_0 left promiscuous mode [ 1892.767621][ T7630] bridge1131: port 2(bridge_slave_0) entered disabled state [ 1892.807175][ T7630] bridge1132: port 2(bridge_slave_0) entered blocking state [ 1892.814531][ T7630] bridge1132: port 2(bridge_slave_0) entered disabled state [ 1892.840163][ T7630] device bridge_slave_0 entered promiscuous mode [ 1892.861208][ T7631] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1892.945380][ T7633] FAT-fs (loop4): bogus logical sector size 32256 05:14:46 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc10, 0xa, r8}]}, 0x28}}, 0x0) 05:14:46 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x13c}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1893.025491][ T7633] FAT-fs (loop4): Can't find a valid FAT filesystem 05:14:46 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x48000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1893.249059][ T7653] device syz_tun left promiscuous mode [ 1893.254817][ T7653] bridge1132: port 1(syz_tun) entered disabled state [ 1893.289458][ T7653] bridge1133: port 1(syz_tun) entered blocking state [ 1893.316910][ T7653] bridge1133: port 1(syz_tun) entered disabled state [ 1893.345053][ T7653] device syz_tun entered promiscuous mode [ 1893.372607][ T7648] device bridge_slave_0 left promiscuous mode [ 1893.394319][ T7648] bridge1132: port 2(bridge_slave_0) entered disabled state [ 1893.437680][ T7648] bridge1133: port 2(bridge_slave_0) entered blocking state [ 1893.440151][ T7633] FAT-fs (loop4): bogus logical sector size 32256 [ 1893.464030][ T7633] FAT-fs (loop4): Can't find a valid FAT filesystem 05:14:47 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x4002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1893.495527][ T7648] bridge1133: port 2(bridge_slave_0) entered disabled state [ 1893.511057][ T26] kauditd_printk_skb: 11 callbacks suppressed [ 1893.511077][ T26] audit: type=1804 audit(1579065287.016:964): pid=7643 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1520/file0/file0" dev="loop1" ino=1261 res=1 [ 1893.564116][ T7648] device bridge_slave_0 entered promiscuous mode [ 1893.595759][ T7654] device syz_tun left promiscuous mode [ 1893.601490][ T7654] bridge1089: port 1(syz_tun) entered disabled state [ 1893.637056][ T7654] bridge1090: port 1(syz_tun) entered blocking state [ 1893.655526][ T7654] bridge1090: port 1(syz_tun) entered disabled state [ 1893.662788][ T26] audit: type=1804 audit(1579065287.166:965): pid=7645 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1576/file0/file0" dev="loop3" ino=1260 res=1 [ 1893.679634][ T7654] device syz_tun entered promiscuous mode [ 1893.741303][ T26] audit: type=1804 audit(1579065287.206:966): pid=7639 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1485/file0/file0" dev="sda1" ino=17009 res=1 05:14:47 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x2) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x10000000, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000180)) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x81, 0x100040) modify_ldt$read_default(0x2, &(0x7f0000000300)=""/239, 0xef) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:14:47 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x162}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:47 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xe500000000000000) 05:14:47 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc18, 0xa, r8}]}, 0x28}}, 0x0) 05:14:47 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x4c000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1894.060350][ T7673] device syz_tun left promiscuous mode [ 1894.099150][ T7673] bridge1133: port 1(syz_tun) entered disabled state [ 1894.139678][ T7673] bridge1134: port 1(syz_tun) entered blocking state [ 1894.162903][ T7673] bridge1134: port 1(syz_tun) entered disabled state [ 1894.222392][ T7673] device syz_tun entered promiscuous mode [ 1894.305585][ T7679] device syz_tun left promiscuous mode [ 1894.329472][ T7679] bridge1090: port 1(syz_tun) entered disabled state [ 1894.362624][ T26] audit: type=1804 audit(1579065287.866:967): pid=7665 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1521/file0/file0" dev="loop1" ino=1262 res=1 [ 1894.368254][ T7679] bridge1091: port 1(syz_tun) entered blocking state [ 1894.452543][ T7679] bridge1091: port 1(syz_tun) entered disabled state [ 1894.490257][ T7679] device syz_tun entered promiscuous mode 05:14:48 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x18a40, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)={0xffffffffffffffff}, 0x104, 0x3}}, 0x20) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x7ff, @empty, 0x7ff}, 0x1c) write$RDMA_USER_CM_CMD_JOIN_MCAST(r2, &(0x7f00000002c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000140), 0x4, r3, 0x10, 0x0, @in={0x2, 0x4e24, @remote}}}, 0xa0) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e41, 0x10001, @empty, 0xd719}}}, 0x30) [ 1894.504510][ T26] audit: type=1804 audit(1579065288.006:968): pid=7680 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1577/file0/file0" dev="loop3" ino=1263 res=1 [ 1894.516919][ T7678] device bridge_slave_0 left promiscuous mode [ 1894.561849][ T7678] bridge1133: port 2(bridge_slave_0) entered disabled state [ 1894.586017][ T7678] bridge1134: port 2(bridge_slave_0) entered blocking state 05:14:48 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xe5ffffff00000000) [ 1894.607495][ T7678] bridge1134: port 2(bridge_slave_0) entered disabled state [ 1894.628158][ T7678] device bridge_slave_0 entered promiscuous mode [ 1894.739563][ T26] audit: type=1804 audit(1579065288.246:969): pid=7684 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1486/file0" dev="sda1" ino=17073 res=1 05:14:48 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc20, 0xa, r8}]}, 0x28}}, 0x0) 05:14:48 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x26c}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1895.034953][ T7705] device syz_tun left promiscuous mode [ 1895.046797][ T7705] bridge1091: port 1(syz_tun) entered disabled state [ 1895.064591][ T7705] bridge1092: port 1(syz_tun) entered blocking state 05:14:48 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000140), &(0x7f0000000180)=0x4) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000200)) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) fstat(r3, &(0x7f0000000300)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1895.101276][ T7705] bridge1092: port 1(syz_tun) entered disabled state [ 1895.128724][ T7705] device syz_tun entered promiscuous mode 05:14:48 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x68000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1895.200324][ T7709] device syz_tun left promiscuous mode [ 1895.216879][ T7709] bridge1134: port 1(syz_tun) entered disabled state [ 1895.252666][ T7709] bridge1135: port 1(syz_tun) entered blocking state [ 1895.259491][ T26] audit: type=1804 audit(1579065288.756:970): pid=7692 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1522/file0/file0" dev="loop1" ino=1264 res=1 [ 1895.302154][ T7709] bridge1135: port 1(syz_tun) entered disabled state [ 1895.325163][ T7709] device syz_tun entered promiscuous mode [ 1895.351061][ T26] audit: type=1804 audit(1579065288.836:971): pid=7699 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1578/file0/file0" dev="loop3" ino=1265 res=1 [ 1895.408332][ T7708] __nla_validate_parse: 4 callbacks suppressed [ 1895.408345][ T7708] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1895.461804][ T7711] device bridge_slave_0 left promiscuous mode [ 1895.472240][ T7711] bridge1134: port 2(bridge_slave_0) entered disabled state 05:14:49 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xf6ffffff00000000) 05:14:49 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x141000, 0x0) ioctl$NS_GET_PARENT(r0, 0xb702, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1895.518605][ T7711] bridge1135: port 2(bridge_slave_0) entered blocking state [ 1895.545540][ T7711] bridge1135: port 2(bridge_slave_0) entered disabled state [ 1895.562201][ T7711] device bridge_slave_0 entered promiscuous mode [ 1895.598660][ T7720] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1895.615493][ T7709] device bridge_slave_0 left promiscuous mode [ 1895.626421][ T7709] bridge1135: port 2(bridge_slave_0) entered disabled state 05:14:49 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc28, 0xa, r8}]}, 0x28}}, 0x0) 05:14:49 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x300}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1895.813402][ T7727] QAT: Invalid ioctl [ 1895.823278][ T7729] device syz_tun left promiscuous mode [ 1895.868899][ T7729] bridge1092: port 1(syz_tun) entered disabled state [ 1895.883449][ T26] audit: type=1804 audit(1579065289.386:972): pid=7717 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1487/file0/file0" dev="loop4" ino=1266 res=1 [ 1895.950119][ T7729] bridge1093: port 1(syz_tun) entered blocking state [ 1895.985638][ T7729] bridge1093: port 1(syz_tun) entered disabled state [ 1895.993137][ T7729] device syz_tun entered promiscuous mode [ 1896.002285][ T26] audit: type=1800 audit(1579065289.406:973): pid=7730 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=1266 res=0 [ 1896.032098][ T7726] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1896.106749][ T7736] device syz_tun left promiscuous mode [ 1896.112486][ T7736] bridge1135: port 1(syz_tun) entered disabled state [ 1896.154804][ T7736] bridge1136: port 1(syz_tun) entered blocking state [ 1896.184855][ T7736] bridge1136: port 1(syz_tun) entered disabled state 05:14:49 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f00000006c0)='./file0\x00', 0x158) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dlm_plock\x00', 0x2000, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r3, 0x800c5012, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$ax25(r2, &(0x7f0000000300)={{0x3, @null}, [@remote, @bcast, @netrom, @rose, @default, @null, @null, @bcast]}, &(0x7f0000000180)=0x48) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r5, 0x330f, 0x0) r6 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r6, 0x84, 0x6d, &(0x7f00000003c0)=ANY=[@ANYRES32=r7, @ANYBLOB="76000000e64c772ff3d61ac642b6a108c69349d4b005dab21dda9f6e7688b89d179a2f8b59e30d89278d1f419f1d2065eeb4634d16618eda264d4502f4cc9c9c5dea5b347af89000000000000000000a4aae8e8ccf4c942cd6e1abd23f05f0ef0b15ba8c62135b218b34347007b09ab532f508356ea5738fd331207bb65971a2fa661b4b9be46013d5bbeed70dfd3a1ba99903a62b4d4ab056bf63796386d8383b02063da9"], &(0x7f0000000140)=0x2) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r8, 0x330f, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r8, 0x84, 0x6d, &(0x7f0000000440)={0x0, 0x4b, "84c43e36367c3309094ee602200b4442470570b33d28a0a50a04b7ec0a5241d079c50399996a1f96d3f068e83127671459c356c4f5b206881b5e112cdfcc9a71de0087e785a46eb11c475f"}, &(0x7f00000004c0)=0x53) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r9, 0x330f, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r9, 0x84, 0x72, &(0x7f0000000500)={0x0, 0x7ff, 0x10}, &(0x7f0000000580)=0xc) r10 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r10, 0x330f, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000600)={0x1, 0x100, 0x8, 0x0, 0x5, 0x1, 0x0, 0x9, 0x0}, &(0x7f0000000640)=0x20) setsockopt$inet_sctp6_SCTP_MAX_BURST(r10, 0x84, 0x14, &(0x7f00000005c0)=@assoc_value={r11, 0x83}, 0x8) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:14:49 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x6c000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1896.212226][ T7736] device syz_tun entered promiscuous mode [ 1896.237622][ T7737] bridge1136: port 2(bridge_slave_0) entered blocking state [ 1896.245096][ T7737] bridge1136: port 2(bridge_slave_0) entered disabled state [ 1896.277006][ T7737] device bridge_slave_0 entered promiscuous mode [ 1896.325098][ T7740] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:49 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xffffffff00000000) 05:14:49 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x328}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:50 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc30, 0xa, r8}]}, 0x28}}, 0x0) 05:14:50 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) bind$bt_hci(r2, &(0x7f0000000180)={0x1f, 0x4}, 0x6) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x7, 0x1, 0x108, 0x70bd27, 0x25dfdbfd, {0xc, 0x0, 0x8000}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:14:50 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r3 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r6 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r6, 0x202002) keyctl$chown(0x4, r6, r4, r5) setregid(r5, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1896.802129][ T7761] device syz_tun left promiscuous mode [ 1896.833929][ T7761] bridge1093: port 1(syz_tun) entered disabled state [ 1896.881014][ T7761] bridge1094: port 1(syz_tun) entered blocking state [ 1896.902095][ T7761] bridge1094: port 1(syz_tun) entered disabled state [ 1896.918615][ T7761] device syz_tun entered promiscuous mode [ 1896.932008][ T7760] device syz_tun left promiscuous mode [ 1896.945747][ T7760] bridge1136: port 1(syz_tun) entered disabled state [ 1896.990658][ T7760] bridge1137: port 1(syz_tun) entered blocking state [ 1897.021901][ T7760] bridge1137: port 1(syz_tun) entered disabled state [ 1897.061187][ T7760] device syz_tun entered promiscuous mode [ 1897.118449][ T7764] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1897.158719][ T7756] device bridge_slave_0 left promiscuous mode [ 1897.165176][ T7756] bridge1136: port 2(bridge_slave_0) entered disabled state [ 1897.201975][ T7756] bridge1137: port 2(bridge_slave_0) entered blocking state [ 1897.228950][ T7756] bridge1137: port 2(bridge_slave_0) entered disabled state 05:14:50 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x74000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1897.258844][ T7756] device bridge_slave_0 entered promiscuous mode 05:14:50 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0xfffffffffffff000) [ 1897.303438][ T7764] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1897.341486][ T7760] device bridge_slave_0 left promiscuous mode [ 1897.353600][ T7760] bridge1137: port 2(bridge_slave_0) entered disabled state 05:14:50 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc38, 0xa, r8}]}, 0x28}}, 0x0) 05:14:51 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x37a}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:51 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:14:51 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) r4 = dup2(r2, r3) ioctl$SNDRV_PCM_IOCTL_XRUN(r4, 0x4148, 0x0) [ 1897.731721][ T7789] device syz_tun left promiscuous mode [ 1897.749708][ T7789] bridge1094: port 1(syz_tun) entered disabled state 05:14:51 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) getsockopt$XDP_STATISTICS(r2, 0x11b, 0x7, &(0x7f0000000000), &(0x7f00000000c0)=0x18) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1897.783768][ T7789] bridge1095: port 1(syz_tun) entered blocking state [ 1897.804448][ T7789] bridge1095: port 1(syz_tun) entered disabled state [ 1897.823009][ T7789] device syz_tun entered promiscuous mode [ 1897.846481][ T7790] device syz_tun left promiscuous mode [ 1897.852090][ T7790] bridge1137: port 1(syz_tun) entered disabled state [ 1897.878138][ T7790] bridge1138: port 1(syz_tun) entered blocking state [ 1897.885516][ T7790] bridge1138: port 1(syz_tun) entered disabled state [ 1897.894210][ T7790] device syz_tun entered promiscuous mode [ 1897.966272][ T7786] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1897.993609][ T7793] bridge1138: port 2(bridge_slave_0) entered blocking state [ 1898.003345][ T7793] bridge1138: port 2(bridge_slave_0) entered disabled state [ 1898.019146][ T7793] device bridge_slave_0 entered promiscuous mode [ 1898.038164][ T7789] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:51 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc40, 0xa, r8}]}, 0x28}}, 0x0) 05:14:51 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x3cc}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:51 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x7a000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1898.403640][ T7816] device syz_tun left promiscuous mode [ 1898.409340][ T7816] bridge1138: port 1(syz_tun) entered disabled state [ 1898.432331][ T7816] bridge1139: port 1(syz_tun) entered blocking state [ 1898.448519][ T7816] bridge1139: port 1(syz_tun) entered disabled state [ 1898.473614][ T7816] device syz_tun entered promiscuous mode [ 1898.493705][ T7817] device syz_tun left promiscuous mode [ 1898.500443][ T7817] bridge1095: port 1(syz_tun) entered disabled state [ 1898.524147][ T7817] bridge1096: port 1(syz_tun) entered blocking state [ 1898.543105][ T7817] bridge1096: port 1(syz_tun) entered disabled state [ 1898.559452][ T7817] device syz_tun entered promiscuous mode [ 1898.576297][ T7814] device bridge_slave_0 left promiscuous mode [ 1898.582500][ T7814] bridge1138: port 2(bridge_slave_0) entered disabled state [ 1898.609469][ T7814] bridge1139: port 2(bridge_slave_0) entered blocking state [ 1898.623497][ T7814] bridge1139: port 2(bridge_slave_0) entered disabled state [ 1898.649216][ T7814] device bridge_slave_0 entered promiscuous mode 05:14:52 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x4}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x80000, 0x0) sendto$unix(r3, &(0x7f0000000300)="7707ea5dd50f4fec1499e32f15d15f26e0d5a58a26812b16be6954f8077e1272912b0b90c914037d1bdc7b5e884a4517b2646ee979d62e66a479f50593e53c0ce56eb2698a09932b6d4f418760ea3ce79fe4a0db91b4c9fe801c34e7630cd6830323e28ae44740746117fc3a0ac3f995f6280cf1f0f86b209eba0c03b1bda7d65b4ce5fcba2e0ffacfe88a8e88f80ff73112ef29959d18439c029e94b9cf6dacc2a03359c012", 0xa6, 0x10040, &(0x7f00000003c0)=@abs={0x1, 0x0, 0x4e21}, 0x6e) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:14:52 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) r3 = openat(r2, &(0x7f0000000280)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x880, 0x11) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000500)='tls\x00', 0x4) r4 = shmget$private(0x0, 0x1000, 0x20, &(0x7f0000ffd000/0x1000)=nil) shmctl$SHM_UNLOCK(r4, 0xc) [ 1898.670570][ T7815] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1898.679980][ T26] kauditd_printk_skb: 15 callbacks suppressed [ 1898.680007][ T26] audit: type=1804 audit(1579065292.176:989): pid=7807 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1582/file0/file0" dev="loop3" ino=1276 res=1 05:14:52 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) socket$rds(0x15, 0x5, 0x0) [ 1898.737617][ T7827] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:52 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x3f2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:52 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc48, 0xa, r8}]}, 0x28}}, 0x0) [ 1898.951742][ T7836] device syz_tun left promiscuous mode [ 1898.968905][ T7836] bridge1096: port 1(syz_tun) entered disabled state [ 1899.023782][ T7836] bridge1097: port 1(syz_tun) entered blocking state [ 1899.089783][ T7836] bridge1097: port 1(syz_tun) entered disabled state [ 1899.116277][ T7836] device syz_tun entered promiscuous mode [ 1899.171273][ T7848] device syz_tun left promiscuous mode [ 1899.203239][ T7848] bridge1139: port 1(syz_tun) entered disabled state [ 1899.231608][ T7848] bridge1140: port 1(syz_tun) entered blocking state [ 1899.268064][ T7848] bridge1140: port 1(syz_tun) entered disabled state 05:14:52 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc50, 0xa, r8}]}, 0x28}}, 0x0) [ 1899.291117][ T7848] device syz_tun entered promiscuous mode [ 1899.323295][ T7850] device bridge_slave_0 left promiscuous mode [ 1899.340654][ T7850] bridge1139: port 2(bridge_slave_0) entered disabled state [ 1899.384892][ T7850] bridge1140: port 2(bridge_slave_0) entered blocking state [ 1899.427825][ T7850] bridge1140: port 2(bridge_slave_0) entered disabled state [ 1899.440732][ T26] audit: type=1804 audit(1579065292.946:990): pid=7830 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1491/file0/file0" dev="loop4" ino=1277 res=1 05:14:53 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x8cffffff, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1899.478997][ T7850] device bridge_slave_0 entered promiscuous mode [ 1899.543582][ T26] audit: type=1800 audit(1579065292.976:991): pid=7830 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=1277 res=0 [ 1899.579395][ T7859] device syz_tun left promiscuous mode [ 1899.584988][ T7859] bridge1097: port 1(syz_tun) entered disabled state 05:14:53 executing program 3: socket$unix(0x1, 0x0, 0x0) r0 = syz_open_dev$vcsu(&(0x7f0000000000)='/dev/vcsu#\x00', 0x100000000, 0x100) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f00000000c0)=0x7ff) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x1, 0x0, 0x0, 0x5, 0x2, 0x7fffffff, 0x7, 0x7d}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:14:53 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) bind$netlink(r3, &(0x7f0000000140)={0x10, 0x0, 0x25dfdbff, 0x20}, 0xc) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000000180)=0x6, 0x4) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1899.649555][ T26] audit: type=1804 audit(1579065292.976:992): pid=7839 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1491/file0/file0" dev="loop4" ino=1277 res=1 [ 1899.690577][ T7859] bridge1098: port 1(syz_tun) entered blocking state [ 1899.723867][ T7859] bridge1098: port 1(syz_tun) entered disabled state 05:14:53 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x400, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r6, 0x330f, 0x0) r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r7, 0x330f, 0x0) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x101000, 0x0) ioctl$VHOST_SET_VRING_KICK(r8, 0x330f, 0x0) r9 = getpid() sched_setscheduler(r9, 0x5, &(0x7f0000000380)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000800)={r9, 0xffffffffffffffff, 0x0, 0x8, &(0x7f00000007c0)='keyring\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000200)={0x0, 0xffffffffffffffff, 0x0, 0xc, &(0x7f00000000c0)=')mime_type^\x00', r10}, 0x30) lstat(&(0x7f0000000280)='./file1\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r14 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r14, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r17 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r17, 0x202002) keyctl$chown(0x4, r17, r15, r16) r18 = getgid() r19 = getpid() sched_setscheduler(r19, 0x5, &(0x7f0000000380)) stat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000600)='./file0/file0\x00', &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r2, &(0x7f0000000780)={&(0x7f0000000140)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e, &(0x7f0000000040)=[{&(0x7f0000000300)="286d7029af5978f3dd888b05e75233929fa01559ba1d4274518888e09339f2153c4dc3405ddc300eb3863da274bf6f1133f40b804f027f6271e9e4ed7dba745f3225ae5d5019e503b929c7e64332d5fec6def2ed62aaa70c229c1a048dd1e6eafec8d1b756310ec8f7bcd53b7ed09b4489fd5ea06f3799a7ea0e32078f4995657ba1f6e4a1fccf4dd7c38eb3cd868732c508812b551558d1af66672b6fe09c4a73192dbfb22014ab1c80b2109c87cab320cd05613e8f4cb9f26b64e87681dcd423642852af4e7d84c331412a6569d06664d6f0acaab656ab4da81c1c4521", 0xde}], 0x1, &(0x7f0000000840)=ANY=[@ANYBLOB="30000000000000000100000001000000", @ANYRES32=r3, @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r1, @ANYRES32=r6, @ANYRES32=r0, @ANYRES32, @ANYRES32=r7, @ANYBLOB="18000000000000000100000001000000", @ANYRES32, @ANYRES32=r8, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r11, @ANYRES32=r12, @ANYRES32=r13, @ANYBLOB="000000001c00000000000000010000000200000047285d8fd88737d9c381900ed4c6e4cdcec5d2a5108b53fc339d15b31563d63a9ee37dd9584c4658c3cbfac035adb0eca6e6a32a7d773b", @ANYRES32, @ANYRES32=r15, @ANYRES32=r18, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r19, @ANYRES32=r20, @ANYRES32=r21, @ANYBLOB='\x00\x00\x00\x00'], 0xa8, 0x10}, 0x800) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1899.743374][ T7859] device syz_tun entered promiscuous mode [ 1899.761227][ T26] audit: type=1804 audit(1579065293.046:993): pid=7837 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1583/file0/file0" dev="loop3" ino=1279 res=1 [ 1899.815515][ T26] audit: type=1804 audit(1579065293.106:994): pid=7831 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1526/file0/file0" dev="loop1" ino=1278 res=1 05:14:53 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x500}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:53 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc58, 0xa, r8}]}, 0x28}}, 0x0) [ 1900.197138][ T7881] device syz_tun left promiscuous mode [ 1900.202832][ T7881] bridge1098: port 1(syz_tun) entered disabled state [ 1900.243570][ T26] audit: type=1804 audit(1579065293.746:995): pid=7869 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1492/file0/file0" dev="loop4" ino=1280 res=1 [ 1900.290479][ T7881] bridge1099: port 1(syz_tun) entered blocking state [ 1900.310809][ T7881] bridge1099: port 1(syz_tun) entered disabled state 05:14:53 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r1, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x801280}, 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0xd0, 0x0, 0x8, 0x2, 0x70bd2d, 0x25dfdbfe, {0x3}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}, @CTA_TIMEOUT_DATA={0x24, 0x4, 0x0, 0x1, @sctp=[@CTA_TIMEOUT_SCTP_COOKIE_ECHOED={0x8, 0x3, 0x1, 0x0, 0x80000001}, @CTA_TIMEOUT_SCTP_SHUTDOWN_SENT={0x8, 0x5, 0x1, 0x0, 0x12}, @CTA_TIMEOUT_SCTP_SHUTDOWN_RECD={0x8, 0x6, 0x1, 0x0, 0x101}, @CTA_TIMEOUT_SCTP_HEARTBEAT_ACKED={0x8, 0x9, 0x1, 0x0, 0x76c}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x1c}, @CTA_TIMEOUT_DATA={0x1c, 0x4, 0x0, 0x1, @gre=[@CTA_TIMEOUT_GRE_REPLIED={0x8, 0x2, 0x1, 0x0, 0x400}, @CTA_TIMEOUT_GRE_REPLIED={0x8, 0x2, 0x1, 0x0, 0x81}, @CTA_TIMEOUT_GRE_REPLIED={0x8, 0x2, 0x1, 0x0, 0x912}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x6558}, @CTA_TIMEOUT_L3PROTO={0x6}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_DATA={0x3c, 0x4, 0x0, 0x1, @tcp=[@CTA_TIMEOUT_TCP_ESTABLISHED={0x8, 0x3, 0x1, 0x0, 0x6}, @CTA_TIMEOUT_TCP_UNACK={0x8}, @CTA_TIMEOUT_TCP_CLOSE={0x8, 0x8, 0x1, 0x0, 0x1f}, @CTA_TIMEOUT_TCP_FIN_WAIT={0x8, 0x4, 0x1, 0x0, 0x5}, @CTA_TIMEOUT_TCP_LAST_ACK={0x8, 0x6, 0x1, 0x0, 0x7}, @CTA_TIMEOUT_TCP_ESTABLISHED={0x8, 0x3, 0x1, 0x0, 0x9}, @CTA_TIMEOUT_TCP_CLOSE_WAIT={0x8, 0x5, 0x1, 0x0, 0x8}]}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x84}]}, 0xd0}, 0x1, 0x0, 0x0, 0x4}, 0xc58) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r5, 0x330f, 0x0) ioctl$DRM_IOCTL_RES_CTX(r5, 0xc0106426, &(0x7f0000000480)={0x2, &(0x7f0000000440)=[{0x0}, {}]}) ioctl$DRM_IOCTL_GET_CTX(r4, 0xc0086423, &(0x7f00000004c0)={r6}) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, @perf_bp={0x0}, 0xb88a373ce3f30e16, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_RESUME(r5, 0x4147, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1900.341164][ T7881] device syz_tun entered promiscuous mode [ 1900.357414][ T26] audit: type=1804 audit(1579065293.866:996): pid=7870 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1584/file0/file0" dev="loop3" ino=1281 res=1 [ 1900.382879][ T7882] device syz_tun left promiscuous mode [ 1900.405641][ T7882] bridge1140: port 1(syz_tun) entered disabled state [ 1900.427506][ T7882] bridge1141: port 1(syz_tun) entered blocking state [ 1900.455766][ T7882] bridge1141: port 1(syz_tun) entered disabled state [ 1900.463256][ T7882] device syz_tun entered promiscuous mode [ 1900.488497][ T7879] __nla_validate_parse: 3 callbacks suppressed [ 1900.488545][ T7879] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:54 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x940f0000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1900.530212][ T7886] device bridge_slave_0 left promiscuous mode [ 1900.563351][ T7886] bridge1140: port 2(bridge_slave_0) entered disabled state [ 1900.600896][ T7886] bridge1141: port 2(bridge_slave_0) entered blocking state [ 1900.613139][ T7886] bridge1141: port 2(bridge_slave_0) entered disabled state [ 1900.632094][ T7886] device bridge_slave_0 entered promiscuous mode [ 1900.647154][ T7895] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:54 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x6) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) r3 = getpgrp(0x0) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r7 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r7, 0x202002) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200)='/dev/snapshot\x00', 0x549100, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r8, 0x541b, &(0x7f0000000500)) keyctl$chown(0x4, r7, r5, r6) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f0000000180)={0x7, 0x401, {r3}, {r5}, 0x1, 0x4}) r9 = getpid() sched_setscheduler(r9, 0x5, &(0x7f0000000380)) r10 = getpgrp(r9) r11 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) r12 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000300)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000280)='asymmetric\x00', 0x0, &(0x7f0000000340)="04", 0x2, r12) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000140)={r12, 0x75, 0x50}, &(0x7f0000000580)=ANY=[@ANYBLOB="656e503de5897261352d6e656f6e00000000000000000095770000ea52e5a2f76a73429f7b00f4ac000026291f6a753c5435751eba5cc8000000497a23be10b07b996d540002f3c4be5d162385a44ff441da10925126457fcaf303c978c1307fcbf854854e6aa5037002621cab8f8cf175d0ed218d5b5e61e2cd517cae289c5401b06f49225bca045e80275f4ad7299ccd1d3da9e1e67e99a575f14e70816d39331f23cc11e98bd626b7851d1d5b8dd6471e401cbb30c2665a1b8a97cd74a734aa466672393107d4097dc3fa6a42448ff06ad194027839bcdfeeb0d07564cd2632551fd7daab85520ee0c940d314df5ded5d9896dc537e9eae9cc188bc6655a0d7979efdc673f7e3142e560857e1c3d46bc5296a4d714df10d3dcf3d5f8e286a3d9aad10300301d7cbd3be2136ffdbeb00ba7ba12401a8565a58c8bea67d07a162d003080eec7729160f8d3ca80b3f4f2e7a3cdfbe40c323f0a7ad"], &(0x7f00000003c0)="c3f74052c469d51d8c4cb26e10b8260137ca4f0894a9ee1a91405a8d93d0d00588cae02dd5fa32620a444b64be309e6fa375c8a6fd2191d742b2967bad52363cae7e69675d2da3ff0977e49418308d583efb3029e354289860e00029e10b5a3c78361c9696f8920cc714ea7ed35f1b036614ec3799", &(0x7f0000000440)=""/80) ioctl$VHOST_SET_VRING_KICK(r11, 0x330f, 0x0) ioctl$TIOCGPGRP(r11, 0x540f, &(0x7f0000000100)=0x0) tgkill(r10, r13, 0x19) fsopen(&(0x7f0000000000)='binfmt_misc\x00', 0x1) 05:14:54 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc60, 0xa, r8}]}, 0x28}}, 0x0) [ 1900.674065][ T7882] device bridge_slave_0 left promiscuous mode [ 1900.704368][ T7882] bridge1141: port 2(bridge_slave_0) entered disabled state [ 1900.802476][ T7901] device syz_tun left promiscuous mode [ 1900.808053][ T26] audit: type=1804 audit(1579065294.306:997): pid=7885 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1527/file0/file0" dev="loop1" ino=1282 res=1 [ 1900.842251][ T7901] bridge1099: port 1(syz_tun) entered disabled state 05:14:54 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x600}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1900.864880][ T7901] bridge1100: port 1(syz_tun) entered blocking state [ 1900.885443][ T7901] bridge1100: port 1(syz_tun) entered disabled state [ 1900.904921][ T7901] device syz_tun entered promiscuous mode [ 1900.924926][ T7905] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1900.941042][ T7905] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1901.046337][ T7907] device syz_tun left promiscuous mode [ 1901.057654][ T7907] bridge1141: port 1(syz_tun) entered disabled state [ 1901.077084][ T7907] bridge1142: port 1(syz_tun) entered blocking state 05:14:54 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x3, 0x0, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0xfffffef3}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe523685740c29ff3, @perf_bp={0x0}, 0x26938, 0x2, 0x0, 0x0, 0x0, 0x0, 0xba}, 0x0, 0xfffffffffffffffb, 0xffffffffffffffff, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f00000003c0)=ANY=[@ANYRES32=r3, @ANYBLOB="76000000e64c772ff3d61ac642b6a108c69349d4b005dab21dda9f6e7688b89d179a2f8b59e30d89278d1f419f1d2065eeb4634d16618eda264d4502f4cc9c9c5dea5b347af89000000000000000000a4aae8e8ccf4c942cd6e1abd23f05f0ef0b15ba8c62135b218b34347007b09ab532f508356ea5738fd331207bb65971a2fa661b4b9be46013d5bbeed70dfd3a1ba99903a62b4d4ab056bf63796386d8383b02063da9"], &(0x7f0000000140)=0x2) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000000)={r3, 0x8}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000300)={r4, @in6={{0xa, 0x5, 0x9, @mcast2, 0x8}}, [0x8000, 0x2, 0x8, 0x3ff, 0x7, 0x4, 0x80000001, 0x5, 0x0, 0x1ff, 0x8000, 0x81, 0x10000, 0x7, 0x1]}, &(0x7f0000000140)=0x100) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:14:54 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc88, 0xa, r8}]}, 0x28}}, 0x0) [ 1901.090574][ T7907] bridge1142: port 1(syz_tun) entered disabled state [ 1901.106145][ T7907] device syz_tun entered promiscuous mode 05:14:54 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1901.155707][ T7908] bridge1142: port 2(bridge_slave_0) entered blocking state [ 1901.168915][ T7908] bridge1142: port 2(bridge_slave_0) entered disabled state [ 1901.192633][ T7908] device bridge_slave_0 entered promiscuous mode [ 1901.202205][ T26] audit: type=1804 audit(1579065294.706:998): pid=7893 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1493/file0/file0" dev="loop4" ino=1283 res=1 [ 1901.261382][ T7908] device bridge_slave_0 left promiscuous mode [ 1901.287053][ T7913] FAT-fs (loop3): bogus number of reserved sectors [ 1901.305281][ T7913] FAT-fs (loop3): Can't find a valid FAT filesystem 05:14:54 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) openat$random(0xffffffffffffff9c, &(0x7f0000000200)='/dev/urandom\x00', 0x10300, 0x0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x84040, 0x0) ioctl$PPPIOCSPASS(r2, 0x40107447, &(0x7f00000000c0)={0x8, &(0x7f0000000040)=[{0x4, 0x5, 0x2, 0x9882}, {0x6, 0x40, 0xff}, {0x2, 0x1, 0x2, 0x8766}, {0x76, 0xff, 0x3f, 0x8}, {0x7fff, 0x8, 0x2, 0x2}, {0x80, 0x3, 0x0, 0x3f}, {0x9, 0x2, 0xe6}, {0x3, 0x5, 0x3f, 0x838}]}) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000180)={&(0x7f0000000140)='./file0\x00', r1}, 0x10) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1901.325066][ T7908] bridge1142: port 2(bridge_slave_0) entered disabled state 05:14:54 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x700}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1901.424037][ T7921] device syz_tun left promiscuous mode [ 1901.436732][ T7921] bridge1100: port 1(syz_tun) entered disabled state [ 1901.470226][ T7921] bridge1101: port 1(syz_tun) entered blocking state [ 1901.492872][ T7921] bridge1101: port 1(syz_tun) entered disabled state [ 1901.521911][ T7921] device syz_tun entered promiscuous mode [ 1901.564285][ T7923] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1901.627353][ T7921] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1901.642334][ T7929] device syz_tun left promiscuous mode [ 1901.652618][ T7929] bridge1142: port 1(syz_tun) entered disabled state 05:14:55 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x80000000, 0x141900) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="2cde462efcb71b77decab22fc4fc9b92a771b2301996fe80881262c8053cb4c913c5d73d865c9fdf8f0936e626c8439f8320ced7cabd306d000000000000", @ANYRES16=r3, @ANYBLOB="010000000000000000000100000008000a000000000008000900000000000800070000000000"], 0x2c}}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(r1, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x28090a02}, 0xc, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="60033bed", @ANYRES16=r3, @ANYBLOB="00022cbd7000ffdbdf2505000000080009000100000006001a004e24000006000e0000020000050022000100000008001800ffffffff05000d0000000000050022000000000014002000ba5d05a224fe5510ff3b685e72f199af"], 0x60}, 0x1, 0x0, 0x0, 0x8000}, 0x4000) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r4) r5 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r5, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:14:55 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc8c, 0xa, r8}]}, 0x28}}, 0x0) [ 1901.688866][ T7929] bridge1143: port 1(syz_tun) entered blocking state [ 1901.714388][ T7929] bridge1143: port 1(syz_tun) entered disabled state 05:14:55 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xc0ed0000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1901.741691][ T7929] device syz_tun entered promiscuous mode [ 1901.775073][ T7928] bridge1143: port 2(bridge_slave_0) entered blocking state [ 1901.793912][ T7913] FAT-fs (loop3): bogus number of reserved sectors [ 1901.804990][ T7913] FAT-fs (loop3): Can't find a valid FAT filesystem [ 1901.811903][ T7928] bridge1143: port 2(bridge_slave_0) entered disabled state [ 1901.828962][ T7928] device bridge_slave_0 entered promiscuous mode [ 1901.867958][ T7942] device syz_tun left promiscuous mode [ 1901.894357][ T7942] bridge1101: port 1(syz_tun) entered disabled state 05:14:55 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0xa00}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1901.943865][ T7942] bridge1102: port 1(syz_tun) entered blocking state [ 1901.977893][ T7942] bridge1102: port 1(syz_tun) entered disabled state [ 1902.019633][ T7942] device syz_tun entered promiscuous mode [ 1902.048847][ T7949] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:55 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f0000000140)={'security\x00'}, &(0x7f0000000000)=0x54) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1902.148351][ T7955] device syz_tun left promiscuous mode [ 1902.161084][ T7955] bridge1143: port 1(syz_tun) entered disabled state [ 1902.214225][ T7955] bridge1144: port 1(syz_tun) entered blocking state [ 1902.258936][ T7955] bridge1144: port 1(syz_tun) entered disabled state [ 1902.290883][ T7955] device syz_tun entered promiscuous mode [ 1902.340385][ T7949] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1902.369541][ T7952] device bridge_slave_0 left promiscuous mode [ 1902.432617][ T7952] bridge1143: port 2(bridge_slave_0) entered disabled state [ 1902.458029][ T7952] bridge1144: port 2(bridge_slave_0) entered blocking state 05:14:56 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xc94, 0xa, r8}]}, 0x28}}, 0x0) [ 1902.512357][ T7952] bridge1144: port 2(bridge_slave_0) entered disabled state [ 1902.526499][ T7952] device bridge_slave_0 entered promiscuous mode 05:14:56 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$TIOCL_UNBLANKSCREEN(r3, 0x541c, &(0x7f0000000140)) 05:14:56 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0xc00}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1902.722021][ T7979] device syz_tun left promiscuous mode [ 1902.763287][ T7979] bridge1102: port 1(syz_tun) entered disabled state [ 1902.805406][ T7979] bridge1103: port 1(syz_tun) entered blocking state [ 1902.836198][ T7979] bridge1103: port 1(syz_tun) entered disabled state [ 1902.864728][ T7979] device syz_tun entered promiscuous mode [ 1902.878825][ T7978] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1902.946875][ T7987] device syz_tun left promiscuous mode [ 1902.952569][ T7987] bridge1144: port 1(syz_tun) entered disabled state [ 1902.971486][ T7987] bridge1145: port 1(syz_tun) entered blocking state [ 1902.980533][ T7987] bridge1145: port 1(syz_tun) entered disabled state [ 1902.991182][ T7987] device syz_tun entered promiscuous mode 05:14:56 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x9) r2 = getpid() r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) sched_setscheduler(r3, 0x5, &(0x7f0000000380)=0x7) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x1, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x3}, 0x4148, 0x0, 0x400, 0x0, 0x0, 0x0, 0x4e01}, r2, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x168, 0x2) [ 1903.007332][ T7990] device bridge_slave_0 left promiscuous mode [ 1903.032713][ T7990] bridge1144: port 2(bridge_slave_0) entered disabled state 05:14:56 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xf6ffffff, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:14:56 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000780)=[{0x0, 0x0, 0xffffffff}], 0x0, 0x0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1903.057982][ T7990] bridge1145: port 2(bridge_slave_0) entered blocking state [ 1903.078805][ T7990] bridge1145: port 2(bridge_slave_0) entered disabled state [ 1903.094676][ T7990] device bridge_slave_0 entered promiscuous mode [ 1903.130283][ T7993] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1903.158507][ T7987] device bridge_slave_0 left promiscuous mode [ 1903.169295][ T7987] bridge1145: port 2(bridge_slave_0) entered disabled state 05:14:56 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xdf8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:56 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0xe00}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:14:56 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000000)=@v1={0x0, @aes128, 0x2, "f0f3a08d6479a453"}) fchdir(r0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f0000000140)={0xa9, [0x1, 0x3ff, 0x0, 0x80, 0x20, 0x7ff, 0xa1e, 0xcf7c, 0xff, 0x92e, 0x7, 0x5, 0xd2ec, 0xfffe, 0x101, 0x7, 0xe6ec, 0xa574, 0x8, 0x7, 0x8, 0x6, 0x0, 0x9, 0x8, 0x8, 0x8, 0x9, 0x6d8, 0x1, 0x5, 0x7, 0x81, 0x6, 0x5, 0x508, 0x9, 0x3, 0x7, 0x6, 0x4, 0x8001, 0xc212, 0x7, 0x0, 0x1, 0x4, 0x8001], 0xa}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:14:56 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000140)={0xffffffffffffffff}) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00004de800000000"], 0x48}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}}, 0x0) bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x10, r7, 0x1, 0x7, 0x6, @broadcast}, 0x14) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000180)={'team0\x00', r7}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:14:57 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x80, 0x0, &(0x7f0000000240), 0x2e0084, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x1e) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) recvfrom$rxrpc(r2, &(0x7f0000000140)=""/78, 0x4e, 0x8120, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e21, @remote}}, 0x24) ioctl$USBDEVFS_SETINTERFACE(r0, 0x80085504, &(0x7f0000000100)={0x5, 0x5}) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f0000000200)={0x0, 0x490, 0xc32a, 0x4, 0x3, 0xa9c}, &(0x7f0000000280)=0x14) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000300)={r4, 0x8000}, &(0x7f0000000340)=0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x520c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0x1, 0x40}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x800}, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1903.504097][ T8009] device syz_tun left promiscuous mode [ 1903.523034][ T8009] bridge1103: port 1(syz_tun) entered disabled state [ 1903.556836][ T8009] bridge1104: port 1(syz_tun) entered blocking state [ 1903.565270][ T8009] bridge1104: port 1(syz_tun) entered disabled state [ 1903.576566][ T8009] device syz_tun entered promiscuous mode [ 1903.602856][ T8012] bridge1146: port 1(bridge_slave_0) entered blocking state [ 1903.610386][ T8012] bridge1146: port 1(bridge_slave_0) entered disabled state [ 1903.622147][ T8012] device bridge_slave_0 entered promiscuous mode [ 1903.631982][ T8010] device syz_tun left promiscuous mode [ 1903.652297][ T8010] bridge1145: port 1(syz_tun) entered disabled state [ 1903.677143][ T8010] bridge1146: port 2(syz_tun) entered blocking state [ 1903.690782][ T8010] bridge1146: port 2(syz_tun) entered disabled state [ 1903.699691][ T8010] device syz_tun entered promiscuous mode 05:14:57 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xdfc, 0xa, r8}]}, 0x28}}, 0x0) 05:14:57 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0xf00}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1903.926754][ T26] kauditd_printk_skb: 10 callbacks suppressed [ 1903.926817][ T26] audit: type=1804 audit(1579065297.436:1009): pid=8025 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1531/file0/file0" dev="loop1" ino=1289 res=1 05:14:57 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, &(0x7f0000000180)={0x9e0000, 0x7f, 0x6, 0xffffffffffffffff, 0x0, &(0x7f0000000140)={0xa3007d, 0x3, [], @string=&(0x7f00000000c0)=0x80}}) setsockopt$inet6_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000200)=@gcm_128={{0x304}, "95e595ef36c8a891", "74420216c9a51d3dce6a72c78a3576d1", "ee3136bc", "de95b06a9f7bad7d"}, 0x28) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, &(0x7f0000000380)={0x0, 0x0, 0x4, 0x0, [], [{0x1, 0x800, 0x80000001, 0xffffffff00000001, 0x9, 0x6}, {0x8, 0x2ca8, 0x4, 0x6, 0x4754, 0x400}], [[], [], [], []]}) accept4$inet(r3, &(0x7f0000000300)={0x2, 0x0, @initdev}, &(0x7f0000000340)=0x10, 0x1000) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x1) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x0, 0x0) ioctl$PPPOEIOCSFWD(r4, 0x4008b100, &(0x7f0000000040)={0x18, 0x0, {0x1, @dev={[], 0x36}, 'veth1_to_bond\x00'}}) [ 1904.073390][ T26] audit: type=1804 audit(1579065297.576:1010): pid=8022 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1589/file0/file0" dev="sda1" ino=16775 res=1 [ 1904.136474][ T26] audit: type=1800 audit(1579065297.636:1011): pid=8019 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="sda1" ino=16775 res=0 05:14:57 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xf9fdffff, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:14:57 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) getsockname$netrom(r0, &(0x7f0000000140)={{0x3, @rose}, [@rose, @rose, @null, @bcast, @remote, @bcast, @null, @netrom]}, &(0x7f0000000200)=0x48) pipe(&(0x7f0000000480)={0xffffffffffffffff}) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) getresuid(&(0x7f00000004c0)=0x0, &(0x7f0000000500), &(0x7f0000000580)) mount$9p_fd(0x0, &(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='9p\x00', 0x20000, &(0x7f00000005c0)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cachetag={'cachetag', 0x3d, '/proc/self/net/pfkey\x00'}}], [{@subj_user={'subj_user', 0x3d, '\''}}, {@seclabel='seclabel'}, {@uid_gt={'uid>', r3}}, {@subj_type={'subj_type'}}, {@smackfsroot={'smackfsroot', 0x3d, 'threaded\x00'}}, {@pcr={'pcr', 0x3d, 0x3a}}]}}) open(&(0x7f0000000300)='./file0\x00', 0x109c02, 0x180) setsockopt$nfc_llcp_NFC_LLCP_RW(r0, 0x118, 0x0, &(0x7f0000000340)=0x100, 0x4) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0xb21400, 0x0) read$usbmon(r4, &(0x7f00000000c0)=""/51, 0x33) r5 = gettid() ptrace$setsig(0x4203, r5, 0x1, &(0x7f0000000380)={0xc, 0x2, 0x30000}) r6 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r6) r7 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r7, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1904.301897][ T8036] device syz_tun left promiscuous mode [ 1904.318855][ T8036] bridge1146: port 2(syz_tun) entered disabled state [ 1904.358912][ T8036] bridge1147: port 1(syz_tun) entered blocking state [ 1904.392356][ T8036] bridge1147: port 1(syz_tun) entered disabled state [ 1904.449079][ T8036] device syz_tun entered promiscuous mode [ 1904.457938][ T26] audit: type=1804 audit(1579065297.966:1012): pid=8023 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1496/file0/file0" dev="loop4" ino=1290 res=1 [ 1904.495359][ T8048] Unknown ioctl 1074311424 [ 1904.503597][ T8037] device syz_tun left promiscuous mode [ 1904.512820][ T8037] bridge1104: port 1(syz_tun) entered disabled state [ 1904.545644][ T8037] bridge1105: port 1(syz_tun) entered blocking state [ 1904.577571][ T26] audit: type=1804 audit(1579065297.996:1013): pid=8027 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1496/file0/file0" dev="loop4" ino=1290 res=1 [ 1904.581846][ T8037] bridge1105: port 1(syz_tun) entered disabled state [ 1904.678540][ T8037] device syz_tun entered promiscuous mode [ 1904.709299][ T8039] device bridge_slave_0 left promiscuous mode [ 1904.721383][ T8039] bridge1146: port 1(bridge_slave_0) entered disabled state [ 1904.744513][ T8039] bridge1147: port 2(bridge_slave_0) entered blocking state [ 1904.753880][ T26] audit: type=1804 audit(1579065298.256:1014): pid=8046 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1590/file0/file0" dev="loop3" ino=1292 res=1 [ 1904.764082][ T8039] bridge1147: port 2(bridge_slave_0) entered disabled state [ 1904.829961][ T8039] device bridge_slave_0 entered promiscuous mode [ 1904.833068][ T26] audit: type=1804 audit(1579065298.296:1015): pid=8051 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1590/file0/file0" dev="loop3" ino=1292 res=1 05:14:58 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f00000006c0)=[{&(0x7f0000000300)="d564734f87c304cd3dcff8ec7c4298bcbf3d68b382013610c73e579dc6147b617e700063b9e0a8d5c52084ef52f0a8a20747d4ee478fd23f15de024fc41a2dd8e2cf26a8e0de14e811e87e4131018a56c4b2da8bc98b5951a0f7f9bc809318c65abe75a66afbe5ccbd70f0383a000a00d12d2356a79306433e4c298832c779ed7194f12913e1fee7dae4", 0x196, 0x1000}, {&(0x7f00000003c0)="30bd47d6b45cf627a4537018f1fcece9d4456bb3a7129d5a43ec51d66268e64c12c264fec9c36eb9aa430c596e7f67d19080ab4d5902bba20904fd81da71c7d47f81e03d09127e8644cdf376add9e9cc742ed43c16ba448cdfa5acc7a99545d12f888613eebafe4328e1061b35bdec38591589f9de37e4ebf1880fdcb0559f679d6f1a65e0120f3e19df2d89b5e738ac47832d919eaeece59f974a50ec449c30c1a7167c1168919624bcb85c1cb2c05febfe7add6d041c5c324767f006c404ab2e409b7f35c9fadb04ac5003662571e80b3452ce3556bb31", 0x0, 0x2}, {&(0x7f0000000580)="c467d4134d090377788e36dcc5cbdd1b7bbf761cdd9d018d6b1ef5152d1fa46222b6ba4d28dcf4d8eb44464d501c789d78057634d6e7b01fc627cee31120c0fd3dab34b611af3d76fe9a4f326f1592dca3f764a47b4720374b3af1855109b1fb99af5f121704be6a90baf6497141c3b0fa20d36660e24833fe2498b3e382b359d6003885b2776b9c3576101119ec233805e7f86415", 0xffffffffffffffa1}, {&(0x7f0000000180)="10a5b4e35515bbd6a96f43ed8f3087d2a796dce4dad61de6c16a089448eccc63b2c2bf0e95cb202bb86ae2aebe5f27ee5e15112d13e3b26fa8319f61eba38e", 0x13}, {&(0x7f0000000640)="bc04c1e75746450dc2a48e246a0c6b629673ae58f8cf1b651df751f97d487de9132a8866cb7ede7ecc13b20ac34f495bf37b03dc303823ed0feeca0b0395cf353ac573191d46d1a414cf52294190cf8676dfa9dc47bae7aa6cdf35a4a8a71983ce202eae399b5a3240", 0x0, 0x6}], 0x240000, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/mISDNtimer\x00', 0x40, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000200)=0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff, 0x0, 0x81}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1904.875804][ T8036] device bridge_slave_0 left promiscuous mode [ 1904.894591][ T8036] bridge1147: port 2(bridge_slave_0) entered disabled state 05:14:58 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe00, 0xa, r8}]}, 0x28}}, 0x0) [ 1904.930603][ T26] audit: type=1804 audit(1579065298.406:1016): pid=8044 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1532/file0/file0" dev="loop1" ino=1291 res=1 05:14:58 executing program 3: sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) socket$caif_stream(0x25, 0x1, 0x5) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0) r2 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x1, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r2, 0xc06864a2, &(0x7f0000000000)={0x0, 0xfffffffffffffc63, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000038d8091c6df2e8e900005072e8f952c7cf3a00"}}) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1905.006521][ T26] audit: type=1804 audit(1579065298.406:1017): pid=8048 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1532/file0/file0" dev="loop1" ino=1291 res=1 05:14:58 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x1a01}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1905.100981][ T8060] device syz_tun left promiscuous mode [ 1905.114046][ T8060] bridge1105: port 1(syz_tun) entered disabled state [ 1905.136393][ T8060] bridge1106: port 1(syz_tun) entered blocking state 05:14:58 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0xe4280, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) write$FUSE_NOTIFY_POLL(r1, &(0x7f0000000000)={0x18, 0x1, 0x0, {0x9}}, 0x18) r2 = creat(&(0x7f0000000100)='./file0\x00', 0xf4) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1905.146228][ T8060] bridge1106: port 1(syz_tun) entered disabled state [ 1905.153653][ T8060] device syz_tun entered promiscuous mode 05:14:58 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xfcfdffff, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1905.357818][ T8069] device syz_tun left promiscuous mode [ 1905.410007][ T8069] bridge1147: port 1(syz_tun) entered disabled state 05:14:58 executing program 3: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)={0x6, 0x0, 0x4, 0xb4a5ae028ad15c94, 0xfffff3ee, {r1, r2/1000+10000}, {0x1, 0x8, 0x0, 0x20, 0x1, 0x3, "dfcfe80c"}, 0x9, 0x3, @planes=&(0x7f00000000c0)={0xfffffffd, 0x4e69, @mem_offset=0xffff, 0x730}, 0x59b, 0x0, r3}) ioctl$CAPI_INSTALLED(r4, 0x80024322) socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x400, 0x5, 0x0, 0x0, 0x0, 0x1, 0xfffffffe}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r5 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0) ioctl$FS_IOC_GETFLAGS(r6, 0x80086601, &(0x7f0000000340)) ioctl$SG_GET_RESERVED_SIZE(r6, 0x2272, &(0x7f0000000300)) fchdir(r5) r7 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r7, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1905.457238][ T8069] bridge1148: port 1(syz_tun) entered blocking state [ 1905.485562][ T8069] bridge1148: port 1(syz_tun) entered disabled state [ 1905.499173][ T8069] device syz_tun entered promiscuous mode [ 1905.524369][ T8072] bridge1148: port 2(bridge_slave_0) entered blocking state [ 1905.563073][ T8072] bridge1148: port 2(bridge_slave_0) entered disabled state [ 1905.588977][ T8072] device bridge_slave_0 entered promiscuous mode [ 1905.621482][ T8077] __nla_validate_parse: 5 callbacks suppressed [ 1905.621494][ T8077] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:59 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe04, 0xa, r8}]}, 0x28}}, 0x0) [ 1905.798050][ T8087] device syz_tun left promiscuous mode [ 1905.803995][ T8087] bridge1106: port 1(syz_tun) entered disabled state 05:14:59 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x2000}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1905.847750][ T8087] bridge1107: port 1(syz_tun) entered blocking state [ 1905.866468][ T26] audit: type=1804 audit(1579065299.376:1018): pid=8090 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1533/file0/file0" dev="loop1" ino=1293 res=1 [ 1905.915570][ T8087] bridge1107: port 1(syz_tun) entered disabled state [ 1905.956312][ T8087] device syz_tun entered promiscuous mode [ 1905.997085][ T8089] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:14:59 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000000)={0x81, 0xff, 0x1f, 0x2a, 0x4, 0x3f, 0x68, 0x7, 0xff, 0x0, 0x63, 0x7, 0x3, 0x1}, 0xe) 05:14:59 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000140)='/dev/vcsa#\x00', 0xffffffffffffae73, 0x2080) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r1, &(0x7f0000000500)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000300)={0x1b4, r2, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@NL80211_ATTR_MAC={0xa, 0x6, @local}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_MEASUREMENT_DURATION={0x6, 0xeb, 0xfff}, @NL80211_ATTR_SCAN_SSIDS={0x38, 0x2d, [{0x5, 0x0, [0x1d]}, {0x7, 0x0, [0x5, 0x1f, 0x18]}, {0x9, 0x0, [0x19, 0xa, 0x8, 0x3, 0x5]}, {0xe, 0x0, [0x1c, 0x16, 0x2, 0xb, 0x1e, 0x14, 0x9, 0xd, 0xf, 0x7]}, {0x8, 0x0, [0x1a, 0x19, 0x15, 0x19]}]}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0x3}, @NL80211_ATTR_IE={0x146, 0x2a, "2f5437fc075e7666af6cc73e4e10f13404647f9c54b43f909647a6a72d2922066f915c52cea8939ce9c424fa2963636b478a6b414dfe237f6f7395484d77a5ba599973722df639173dffc85e12d50a0e93b4a146e9f1fcba44c469bd9e5065b289c8c99156de41b7af9a6a3ee6e5d5d823b35133adb7ba5e6b73b9c9c27b65070c4f6a0e66bfcb55258447343683442198c7123699c626978a1fe66a90681f0b192189ef95ea68cdeb9107d20ac01cf8bd0b7a0cdc58aa2269c9f5f6788c8a093499b177664cfa20e5f5a4084d0fac643bc3942d39c26681c5f3c25c83ec242fa0d9803e79e131c3eeaf30f30061e3f0a8fa23d9bed656e5312772b47175b8e7518ee012af9b8254f07b564cba99ea4cfb8a86773fbd91c0f01a5481d397d16e356fd6433af7d9ec21f441988f4b0c527b429deb7e6a884a0393dfe1d4993bb500f7"}]}, 0x1b4}, 0x1, 0x0, 0x0, 0x4040000}, 0x4000814) sched_setattr(0xffffffffffffffff, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1906.133723][ T8094] device syz_tun left promiscuous mode [ 1906.153043][ T8094] bridge1148: port 1(syz_tun) entered disabled state [ 1906.213549][ T8094] bridge1149: port 1(syz_tun) entered blocking state [ 1906.241055][ T8094] bridge1149: port 1(syz_tun) entered disabled state [ 1906.266287][ T8094] device syz_tun entered promiscuous mode [ 1906.295022][ T8095] device bridge_slave_0 left promiscuous mode 05:14:59 executing program 3: r0 = socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, &(0x7f0000000000)=[r0], 0x1) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0x4080, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r3, 0x28, 0x2, &(0x7f0000000140)=0x100000001, 0x8) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) setsockopt$inet6_tcp_buf(r3, 0x6, 0xd, &(0x7f0000000300)="ab83fe3f93638cd6729a582f988985b29ce6f9da4d82f0c2bcf50c2f0242ab498a6a87170e824306a5f3118154062117682adf33531226c84bf3787c2e1102a363f8d9be1b111fe58880fc69789a6a9bab33deab44355674d390", 0x5a) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) ioctl$TIOCEXCL(r4, 0x540c) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r5, 0x330f, 0x0) ioctl$FS_IOC_GETFSMAP(r5, 0xc0c0583b, &(0x7f0000000580)={0x0, 0x0, 0x9, 0x0, [], [{0x1, 0x5, 0x0, 0x1f, 0x3}, {0x200, 0x1, 0x5, 0x0, 0x1, 0x4}], [[], [], [], [], [], [], [], [], []]}) 05:14:59 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xfdfdffff, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1906.345650][ T8095] bridge1148: port 2(bridge_slave_0) entered disabled state [ 1906.382598][ T8095] bridge1149: port 2(bridge_slave_0) entered blocking state [ 1906.398143][ T8095] bridge1149: port 2(bridge_slave_0) entered disabled state [ 1906.478692][ T8095] device bridge_slave_0 entered promiscuous mode 05:15:00 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) r1 = accept(0xffffffffffffffff, &(0x7f00000007c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000840)=0x80) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000880)=0x2958, 0x8) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r4, 0x84, 0x4, &(0x7f0000000200)=0x6, 0x4) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='overlay\x00', 0x1000000, &(0x7f0000000300)=ANY=[@ANYBLOB="78696e6f3d6f6e2c64656661756c745f70654df75a968cd23c6a732cc6fc7461636f70793d6f6e2c6e66735f6578706f72743d6f6e2c776f726b6469723de91f7189595ed2f823af092d487765726469723d2e2f66696c65302c6e66735f6578706f72743d6f66662c6f626a5f757365723d7468726561646564002c00"]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1906.527000][ T8098] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:00 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe08, 0xa, r8}]}, 0x28}}, 0x0) 05:15:00 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x2200}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1906.803113][ T8121] overlayfs: unrecognized mount option "default_peM÷Z–ŒÒ0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x2803}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:00 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe0c, 0xa, r8}]}, 0x28}}, 0x0) 05:15:01 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xff000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1907.522874][ T8143] device syz_tun left promiscuous mode [ 1907.560521][ T8143] bridge1150: port 1(syz_tun) entered disabled state [ 1907.629758][ T8143] bridge1151: port 1(syz_tun) entered blocking state [ 1907.652082][ T8143] bridge1151: port 1(syz_tun) entered disabled state [ 1907.684070][ T8143] device syz_tun entered promiscuous mode [ 1907.718593][ T8149] device bridge_slave_0 left promiscuous mode [ 1907.724902][ T8149] bridge1150: port 2(bridge_slave_0) entered disabled state [ 1907.784896][ T8149] bridge1151: port 2(bridge_slave_0) entered blocking state [ 1907.813437][ T8149] bridge1151: port 2(bridge_slave_0) entered disabled state [ 1907.851057][ T8149] device bridge_slave_0 entered promiscuous mode [ 1907.931918][ T8153] device syz_tun left promiscuous mode [ 1907.957725][ T8153] bridge1108: port 1(syz_tun) entered disabled state [ 1907.984359][ T8153] bridge1109: port 1(syz_tun) entered blocking state [ 1908.019377][ T8153] bridge1109: port 1(syz_tun) entered disabled state 05:15:01 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000040)={&(0x7f0000000300)={0xbc, 0x0, 0x2, 0x2, 0x70bd25, 0x25dfdbfb, {0x7, 0x0, 0x7}, [@CTA_EXPECT_MASTER={0xa0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, {0x5, 0x1, 0x84}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, {0x5, 0x1, 0x88}}, @CTA_TUPLE_IP={0x2c, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @rand_addr="2fc8f8aebdb32fb3b3f46f668af9890a"}}}]}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1}]}, 0xbc}, 0x1, 0x0, 0x0, 0x8002}, 0x100) [ 1908.053720][ T8153] device syz_tun entered promiscuous mode [ 1908.081690][ T8156] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:01 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) setsockopt$inet_buf(r0, 0x0, 0x10, &(0x7f0000000800)="9377891a16024e15bc5036bb23a7646f62c20268f17245b010fa062089babad840b9cea934908bf1ef3c34d6494bc1ed8b8c8ca292ef02dded9ab9778a78674fddf843530230bcb30e820db25af5f26de23714ecacfb0b2dffde8f634c1082960c509652972f4eafb0f88bd16f252274f63c0d534931fd6e7435cc7435dd86a07ab046f34d4128b88cddb51a4224faa7f5278cf48ea4821bc6845daec5679e5ec4d597b60d4edd5c5ca5d9b0978a6e627921feaa7ad3b42928c2519999b7d6965bbda8abbf4043d607c256765ab54109bb4278d114a87c94daec131b842d61e0e28a8c", 0xe3) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$FITRIM(r3, 0xc0185879, &(0x7f0000000400)={0x883, 0x8, 0x800}) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14, 0x800) getresuid(&(0x7f0000000180), &(0x7f0000000200), &(0x7f0000000280)=0x0) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@loopback, @in=@multicast1, 0x4e22, 0x4, 0x4e22, 0x1, 0xa, 0x80, 0x20, 0x3b, r5, r6}, {0x800, 0x994, 0xf3, 0x4, 0x4, 0x9, 0x40, 0x100000000}, {0x0, 0x9, 0x4, 0x3}, 0x3, 0x6e6bb1, 0x1, 0x1}, {{@in6=@remote, 0x4d6, 0x2b}, 0xa, @in6=@rand_addr="bc354d764e90decf2c1c8d762fd54c9e", 0x3505, 0x3, 0x0, 0x6, 0xf36, 0x4, 0x5}}, 0xe8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r7, 0x330f, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480)='nl80211\x00') r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000900)={0x1, 0x5, 0x4, 0x80020, 0x80000000, {0x77359400}, {0x0, 0xc, 0x8, 0x5, 0x80, 0x4, "ecdcb354"}, 0x6, 0x4, @fd, 0xfffffffa, 0x0, r7}) r11 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r11, 0x84, 0x6d, &(0x7f00000003c0)=ANY=[@ANYRES32=r12, @ANYBLOB="76000000e64c772ff3d61ac642b6a108c69349d4b005dab21dda9f6e7688b89d179a2f8b59e30d89278d1f419f1d2065eeb4634d16618eda264d4502f4cc9c9c5dea5b347af89000000000000000000a4aae8e8ccf4c942cd6e1abd23f05f0ef0b15ba8c62135b218b34347007b09ab532f508356ea5738fd331207bb65971a2fa661b4b9be46013d5bbeed70dfd3a1ba99903a62b4d4ab056bf63796386d8383b02063da9"], &(0x7f0000000140)=0x2) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r10, 0x84, 0x7c, &(0x7f0000000980)={r12, 0x7ff, 0x8001}, &(0x7f0000000a00)=0x8) ioctl$VHOST_SET_VRING_KICK(r9, 0x330f, 0x0) ioctl$FS_IOC_GETFSMAP(r9, 0xc0c0583b, &(0x7f00000005c0)={0x0, 0x0, 0x6, 0x0, [], [{0x7, 0x1, 0x6ac8, 0x800, 0x8, 0x6}, {0x200, 0x9, 0x10001, 0xffffffffffff7f97, 0x4, 0x3}], [[], [], [], [], [], []]}) sendmsg$NL80211_CMD_SET_MPATH(r7, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x4a100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x2c, r8, 0x400, 0x70bd25, 0x25dfdbff, {}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000044}, 0x20000000) lchown(&(0x7f0000000000)='./file0\x00', 0xee01, 0xee00) 05:15:01 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x3c00}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1908.141602][ T8153] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:01 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000180)=0x0) prlimit64(r2, 0x1, &(0x7f0000000200)={0x2020e, 0x400fb}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) ioctl$SNDCTL_DSP_SYNC(r4, 0x5001, 0x0) r5 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r5, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) ioctl$DRM_IOCTL_INFO_BUFS(r3, 0xc0106418, &(0x7f0000000140)={0x2cb9, 0x9, 0x14f3, 0xffffff28, 0x10, 0x6fee483f}) 05:15:01 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe10, 0xa, r8}]}, 0x28}}, 0x0) 05:15:01 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x2, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0xd, 0xffffffffffffffa0}, 0x0) syz_open_dev$radio(&(0x7f0000000140)='/dev/radio#\x00', 0x3, 0x2) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1908.373256][ T8172] device syz_tun left promiscuous mode [ 1908.421999][ T8172] bridge1151: port 1(syz_tun) entered disabled state [ 1908.488220][ T8172] bridge1152: port 1(syz_tun) entered blocking state [ 1908.521596][ T8172] bridge1152: port 1(syz_tun) entered disabled state [ 1908.559335][ T8172] device syz_tun entered promiscuous mode 05:15:02 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xfffffdf9, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1908.681556][ T8175] device bridge_slave_0 left promiscuous mode [ 1908.690215][ T8175] bridge1151: port 2(bridge_slave_0) entered disabled state [ 1908.712067][ T8175] bridge1152: port 2(bridge_slave_0) entered blocking state [ 1908.778273][ T8175] bridge1152: port 2(bridge_slave_0) entered disabled state [ 1908.822577][ T8175] device bridge_slave_0 entered promiscuous mode [ 1908.870319][ T8181] device syz_tun left promiscuous mode [ 1908.880818][ T8181] bridge1109: port 1(syz_tun) entered disabled state [ 1908.897898][ T8181] bridge1110: port 1(syz_tun) entered blocking state [ 1908.904699][ T8181] bridge1110: port 1(syz_tun) entered disabled state 05:15:02 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000300)={0x0, 0x0, @ioapic}) lstat(&(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000140)) fchdir(r0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:02 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) sendto(r1, &(0x7f0000000000)="ce493d92443e80595ffb0dd0d2143712b4835076cb5e71f03be9844bb6004967f26d20d02235c74313edb1c9cbc7983e003c22518b73ca8dd0d61e6c3574e864", 0x40, 0xc0002, &(0x7f0000000140)=@isdn={0x22, 0x20, 0x7c, 0xa2, 0x7}, 0xfc79) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)={0x0, r2}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1908.946391][ T8181] device syz_tun entered promiscuous mode [ 1908.969493][ T8183] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:02 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x3c01}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1909.042102][ T8174] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:02 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe14, 0xa, r8}]}, 0x28}}, 0x0) [ 1909.104717][ T26] kauditd_printk_skb: 10 callbacks suppressed [ 1909.104742][ T26] audit: type=1804 audit(1579065302.606:1029): pid=8194 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1502/file0/file0" dev="loop4" ino=1304 res=1 05:15:02 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) syz_open_dev$sndseq(&(0x7f0000000340)='/dev/snd/seq\x00', 0x0, 0x402) clock_getres(0x7, &(0x7f0000000200)) r1 = socket$unix(0x1, 0x1, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0xa, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000380)='/dev/snapshot\x00', 0x11803, 0x0) ioctl$VT_SETMODE(r4, 0x5602, &(0x7f0000000300)={0xff, 0x9, 0x90d3, 0xedbc, 0x7}) ioctl$sock_TIOCOUTQ(r1, 0x5411, &(0x7f0000000140)) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r5, 0x330f, 0x0) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r5, 0x84, 0x13, &(0x7f0000000180)=0x9, 0x4) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1909.248405][ T8203] device syz_tun left promiscuous mode [ 1909.271094][ T8203] bridge1152: port 1(syz_tun) entered disabled state [ 1909.334098][ T8203] bridge1153: port 1(syz_tun) entered blocking state [ 1909.385431][ T8203] bridge1153: port 1(syz_tun) entered disabled state [ 1909.416245][ T8203] device syz_tun entered promiscuous mode [ 1909.470816][ T8207] device syz_tun left promiscuous mode [ 1909.493671][ T8207] bridge1110: port 1(syz_tun) entered disabled state [ 1909.545177][ T8207] bridge1111: port 1(syz_tun) entered blocking state [ 1909.588154][ T8207] bridge1111: port 1(syz_tun) entered disabled state [ 1909.607038][ T8207] device syz_tun entered promiscuous mode [ 1909.643095][ T8197] device bridge_slave_0 left promiscuous mode [ 1909.652722][ T8197] bridge1152: port 2(bridge_slave_0) entered disabled state [ 1909.688912][ T26] audit: type=1804 audit(1579065303.196:1030): pid=8216 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1596/file0/file0" dev="loop3" ino=1306 res=1 [ 1909.727207][ T8197] bridge1153: port 2(bridge_slave_0) entered blocking state [ 1909.734563][ T8197] bridge1153: port 2(bridge_slave_0) entered disabled state 05:15:03 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xfffffdfc, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1909.792666][ T8197] device bridge_slave_0 entered promiscuous mode [ 1909.802898][ T26] audit: type=1804 audit(1579065303.286:1031): pid=8198 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1537/file0/file0" dev="loop1" ino=1305 res=1 [ 1909.830334][ T8209] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:03 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000000)={0x1, 'rose0\x00', {}, 0x3}) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x34, r3, 0x909}, 0x34}}, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) write(r4, &(0x7f0000000300)="4a0618ce61b9a0e0de8d6bf4dbf21a7f602ae118b20558d9f4d2398d587957768b267785ba1eb2d5fc647f34bc400cdc30c177b12f7d8181008dbf3c275a3d456841bf24067bb2ca844572238ded20e872379ce07375a068994b650667c6806686028c750ec2be746d75e7a824b8ff7876493a6ad6d11d07a9bcb4ebf3542d49c30e6acdcda52263bb214a30eb1739261f99252e151c58744b7b4d12bbab0825a71ca65e3ce244ec4beef5e3c0d2e86ede5f3ad0b9959c0d5c8c75ff9e39b967e6f5b3e74eeedf9b7bd53249edb3b233a0d5ea2dd5efba8d", 0xd8) sendmsg$TIPC_CMD_GET_LINKS(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xc43e6f80699306f8}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x24, r3, 0x400, 0x70bd2a, 0x25dfdbfc, {{}, {}, {0x8, 0x11, 0x7f}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:03 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x3f00}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:03 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe1c, 0xa, r8}]}, 0x28}}, 0x0) 05:15:03 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) fchdir(0xffffffffffffffff) r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1f, 0x9}, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1910.049105][ T26] audit: type=1804 audit(1579065303.556:1032): pid=8211 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1503/file0/file0" dev="loop4" ino=1307 res=1 [ 1910.089231][ T26] audit: type=1800 audit(1579065303.586:1033): pid=8213 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=1307 res=0 [ 1910.106445][ T8229] device syz_tun left promiscuous mode [ 1910.114403][ T8229] bridge1111: port 1(syz_tun) entered disabled state [ 1910.175553][ T8229] bridge1112: port 1(syz_tun) entered blocking state [ 1910.208813][ T8229] bridge1112: port 1(syz_tun) entered disabled state 05:15:03 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000340)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) fcntl$getownex(r2, 0x10, &(0x7f0000000140)={0x0, 0x0}) prlimit64(r3, 0x0, &(0x7f0000000280)={0x9, 0xa0}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r4) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180)='/dev/cachefiles\x00', 0x14801, 0x0) r5 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r5, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1910.255911][ T8229] device syz_tun entered promiscuous mode 05:15:03 executing program 3: r0 = accept4(0xffffffffffffffff, &(0x7f0000000300)=@pppoe, &(0x7f0000000200)=0x80, 0x1c00) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380)='nl80211\x00') ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'team0\x00', 0x0}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000600)=0x14) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r5, 0x330f, 0x0) ioctl$CAPI_GET_PROFILE(r5, 0xc0404309, &(0x7f00000000c0)=0xfffffbff) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) accept$packet(r4, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000680)=0x14) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000780)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0xa08}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000125bd7000ffdbdf251c0000009033000005000000030000000c0899000000000004000e450a492c9bf6c6000008000300", @ANYRES32=r2, @ANYBLOB="08000300", @ANYRES32=r3, @ANYBLOB="08000300", @ANYRES32=r6, @ANYBLOB="0800010000000000"], 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x4) r7 = socket$unix(0x1, 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000000000)={'ip6tnl0\x00', 0x4000}) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r8 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r8) r9 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x44bc1, 0x0) sendmsg$NFNL_MSG_COMPAT_GET(r9, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2006010}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x50, 0x0, 0xb, 0x8, 0x70bd2a, 0x25dfdbfe, {0x1, 0x0, 0x5}, [@NFTA_COMPAT_TYPE={0x8}, @NFTA_COMPAT_NAME={0xd, 0x1, 'threaded\x00'}, @NFTA_COMPAT_NAME={0xc, 0x1, 'nl80211\x00'}, @NFTA_COMPAT_TYPE={0x8}, @NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_COMPAT_NAME={0x5, 0x1, '\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000000}, 0x2c044013) r10 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r10, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r11 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000980)='/dev/autofs\x00', 0x10200, 0x0) recvfrom$inet6(r11, &(0x7f0000001a00)=""/4096, 0x1000, 0x1061, 0x0, 0x0) [ 1910.328351][ T8231] device syz_tun left promiscuous mode [ 1910.350628][ T8231] bridge1153: port 1(syz_tun) entered disabled state [ 1910.402677][ T8231] bridge1154: port 1(syz_tun) entered blocking state [ 1910.423372][ T8231] bridge1154: port 1(syz_tun) entered disabled state [ 1910.436444][ T8231] device syz_tun entered promiscuous mode [ 1910.453547][ T8236] device bridge_slave_0 left promiscuous mode [ 1910.474551][ T8236] bridge1153: port 2(bridge_slave_0) entered disabled state [ 1910.510670][ T8236] bridge1154: port 2(bridge_slave_0) entered blocking state [ 1910.521461][ T8236] bridge1154: port 2(bridge_slave_0) entered disabled state [ 1910.529937][ T8236] device bridge_slave_0 entered promiscuous mode [ 1910.571018][ T26] audit: type=1804 audit(1579065304.076:1034): pid=8227 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1538/file0/file0" dev="loop1" ino=1308 res=1 05:15:04 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x4000}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:04 executing program 1: r0 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) request_key(&(0x7f00000000c0)='blacklist\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000180)='/dev/vga_arbiter\x00', r0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x3, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x28400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@mcast2, @in6=@dev}}, {{@in6=@loopback}, 0x0, @in=@empty}}, &(0x7f0000000040)=0xe8) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) ioctl$RTC_WKALM_SET(r4, 0x4028700f, &(0x7f0000000400)={0x0, 0x0, {0x15, 0x6, 0x16, 0x1a, 0x2, 0x2, 0x2, 0x56, 0xffffffffffffffff}}) 05:15:04 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe24, 0xa, r8}]}, 0x28}}, 0x0) [ 1910.831597][ T8258] device syz_tun left promiscuous mode [ 1910.840919][ T26] audit: type=1804 audit(1579065304.346:1035): pid=8241 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1504/file0/file0" dev="loop4" ino=1309 res=1 [ 1910.854366][ T8258] bridge1154: port 1(syz_tun) entered disabled state [ 1910.921622][ T8258] bridge1155: port 1(syz_tun) entered blocking state 05:15:04 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xfffffdfd, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1910.962469][ T8258] bridge1155: port 1(syz_tun) entered disabled state [ 1910.973260][ T8258] device syz_tun entered promiscuous mode 05:15:04 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, &(0x7f0000000140)=0x1) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1911.030125][ T8262] device syz_tun left promiscuous mode [ 1911.058799][ T8262] bridge1112: port 1(syz_tun) entered disabled state [ 1911.065647][ T26] audit: type=1804 audit(1579065304.566:1036): pid=8253 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1598/file0/file0" dev="loop3" ino=1310 res=1 05:15:04 executing program 3: socket$unix(0x1, 0x0, 0x0) r0 = syz_open_dev$vcsu(&(0x7f00000000c0)='/dev/vcsu#\x00', 0x9d9f, 0x2) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000140)) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x1}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x2, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) socket$inet(0x2, 0x1, 0x9a) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000180)=@sack_info={0x0, 0x7, 0x4}, &(0x7f0000000200)=0xc) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000280)={0x1, 0x20, 0x0, 0x1000, 0x3, 0x10001, 0x3, 0x2, r3}, 0x20) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1911.127014][ T8262] bridge1113: port 1(syz_tun) entered blocking state [ 1911.135600][ T8262] bridge1113: port 1(syz_tun) entered disabled state [ 1911.155591][ T8262] device syz_tun entered promiscuous mode [ 1911.170075][ T8254] device bridge_slave_0 left promiscuous mode [ 1911.176702][ T8254] bridge1154: port 2(bridge_slave_0) entered disabled state [ 1911.204645][ T8254] bridge1155: port 2(bridge_slave_0) entered blocking state [ 1911.240426][ T8254] bridge1155: port 2(bridge_slave_0) entered disabled state [ 1911.274724][ T8254] device bridge_slave_0 entered promiscuous mode [ 1911.335626][ T8264] __nla_validate_parse: 3 callbacks suppressed [ 1911.335637][ T8264] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1911.418336][ T8278] device bridge_slave_0 left promiscuous mode [ 1911.448427][ T8278] bridge1155: port 2(bridge_slave_0) entered disabled state 05:15:05 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe2c, 0xa, r8}]}, 0x28}}, 0x0) [ 1911.493696][ T8264] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:05 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000002700)={{{@in=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast2}}, &(0x7f0000002800)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002840)={{{@in=@multicast2, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@ipv4={[], [], @loopback}}}, &(0x7f0000002940)=0xe8) syz_mount_image$msdos(&(0x7f0000000200)='msdos\x00', &(0x7f0000000300)='./file0\x00', 0x2, 0x7, &(0x7f0000002640)=[{&(0x7f0000000580)="0caf470c22985d9e8b150ae1dcdd185ae2037073e531a2cc00d8cac5dbead2cbbb2e8b8df2e7ff603f73b01e9e0b8038e76c983d61783f3ace66e30320033a359611b8e6592077e0e523818867e47bdf7069971991625e17e5a1660be988a1351d1661fce803e78ecc4ff6131c43383f2c8875af9dae3522128d6965f31d0d53c7dd22e689a28b16bd11931d9514bfe9880b36d6baba4a6e6739a07ba034197b13299c1003b9b1bf28f77395b80bf25c8c2164da9cf28997a91d434d2307357a15a9249c1270d35a562e9c6666aac154896257f6a8967f85d816a4d3f822ae04f775dec36865abfbaf6fdb1fad2b900b4d240a20805fa185745fa56e7a27025a8d548b69c3b9594a3eba0c32aeb295dd6b3c0f8e471714a1b3a3916f8fa0ecf6e3d2268987ff5a038745e01d5c8dd97e531307a7c3126460006ff8cf640bcbe3964c21cced389949e08a5645012e37759323c7a531515c3e757e723dd31dd81f5c17763b06a9ee4bda86e366b6501797cd87711e49e2c919b4db2ba5b7ea3b82c5d404e991168c5b623c0ceca9c9a9788bea059a75cadae2f635914bb47ca9e4e517454534523aa4a5110383a512c114332c2ffb0b24607090e9645d6a35640af57cf799ea6252e7c3cf63233142117eb0f2f012caf262223f21222d0274bd73e20ef1b61cd52414324ab0d94dc97e35f19a2e46d445eabc8dfdeb7d63a8525da2533157a624c41cef7c210019aa2a0866ac7e22842663cabeb297e2a9f3cfab3406fa3e676eab8c33b9d3d107314a907f8b1b3f26a0a49909a0d869b8481b2ca9f3da5ad19d512fb09c9d16811828cdc2ae37aba021b15e9fa4ba44e45bf94325db2fea3e8eefe85480604e1bec78bb22cc8a5c6da976ef24a44bbe50881cd3c5591463054942098c64facab1372222ef5d116661d1505bc245402df0e4fe408a44d15fbbecabbf0678bef82f2f5c194e7d31d6a792691f460b1dec0c4747de2b952918fff2b32dc087fc81a1a27590936b2b95471f8565742c3557413e95d85cd3d979b455091f33d23eb842c25d457e19e4ac7067448b4dd2c5510d6645915f8daa32ff850513b40193a3885505df7e062dcd4a30bc6d3a32ca44074e253fb28b4991935881b9f85b19fe8c6a47590d8bfca3d4e7f384a2d78cccf3b53541065e4f84a5d29c5308e5bf859549546951b3145bba7323c58f550b183d8473b6214d17fb64fa6cef18acd668f77a38658034697701522fa38be6eff0ee07e25b8e4856125cc7adfd3404c2a84c29076fe7cd00d7766aa9437885345fd57c1ab96f112afe9efa1a31e6188a415c2759926351e902b1172b203e79b69116084eb831c4b8388096dd43a52971d33c23de15669cb372fac90c6709ec2cb36bdc253a649854bdabd47ae7a18119df20eab721c3626d4e448e380055c51ef335eba7435dc35e18ffaa0be99c50566b63cf7a79be8e88b65760f696fc195ffdd9ed60fb5b76a017309c17803d9e56fb8719cdd631a39d1384f57ac0da1b891c724add2a67ff411978f9fc26ce53b0d99572eb26dc34a423c98f8e2951f362232de7a6f7bc830bbb807e901242b05525c3678cd963a0709b21c7c42aa1b08f7f5cc6256c6c7a73d0e5adde625d5fb7f721399861e7a9887cb30060b79d0c6d7af06756b063c128d275c79a59e0169cb578fe4adc67a6bcca205059bad5a15d6f9c566b7f6d933c2791a1ff80a19ec7d17e8ec37085bc2125e1f68601e8f1e8c25c59f6a46e7affb8bc3dd299cb04b6deea8dff159776feb68efc2f3c2de2af09c31f2b416594c1283bf04e3e7814bd4e229105f6c08e9a06ab68ca51f5ba3c62b2aaada50ee7a788a90a8eb71df89a00a04e7df466860be736b6028cac73f5973a1cf129aa0b1d51688d15ae9319d3cbded0905c444cacb280bc8449f994a4be40da044ab48767a4a9cea3422be497ea7833c724fee95155eb3cecca440cf55d73e8a73f64ac3203f3a281bc86bbae1ce9a42033f8691e47b8d931813aea2baaac577a9ec0362d2d4e4f54699c5d9203c345d0a764781de246988c29aeeb2ed93aebb46b297ea120c48c3f7167ac0a54e9d5bbebb4d70a3d7ac1448b66908fb6d960ea52b8dbcf7dec8ff3ba06ab9a34eb63c9dd716f52752265804b1fff638c5a05466e26c2759db1a82d1555b8230b311cb28f934f97724067118cb72ea6d357704937bb78c61a9d89ac6f7b678d798690bf1342c15aa251b57197a34aac06ddc589e28cbb44b6bbb19ea40ec6521682f13eb58b185961e0a18e6b73b20c08b78613ed20a365ab5d8ca6219a4fff078dba53c2d93d3dbe04a0649f5b8ae171d7d92e229a9e0081f202bc2a699b087d7641bfd8e201bfb6f96e635cd70fd72166c7cf87333a829740b4ffffd4ebc4c11d987e56d36559f6bddd79a55cff80bfea6a3c8d2a6f339d61d6aacfda0410f140c7c4170c9a1ac3e888b7e121f62b661b0e42286627a8f0ea5824a2ea1d87b0f071c2d1fb4058827d4d4691c774258b9c41142c9f9942c73dbcbf6061bbb5db8aa4e1ae15e28c95ed0a6303b7b227c0619d9c1f23cf77281340e7b22b7f0024621be0cff3dc9ea810238a95616329e9d37d342e8e427a16df234e3d9b59289793ddda21598a71d2b3ebeecb86bdcf1536ad33a3494d4095512fe0077f31012f99bd7cd47cbaa9101427de9bdbd7b2b2b23b6061aa80c5e7c993578198f68b82bf55cd95a9a5853738f48f699e5e324299686b69e4ff5328440e1cf775abdbb6f1f62313d4dfec0353c5fef89479a9049c21e332de3a0902c5601fa489f4e9f9f3b28e3a767bc51fd94ea1efdbd06184dae70629c43f9e0e6569453d9cd013150b3c423a91856f60c91bd95e8c16c834076a108207286da7d1d1b6e3ee5977e9d06ce978a5bc7c8860c9e66e4b9094efc73f100b2cb60350222c7ccaafc10711961d8951f72e0df1e958cb4e43ba36d9844c6d99abc2598b3704de9140fc97144d9c5aa69ee1b79c7c5f6f6e3dffe5839cda4b00e3ce27237be1014383aac90132e83dc7f3e0c081fd62bb98352505589fe3f4374d42d44699c197590269513843724fa2230423169c3b2afacb44fc694749385950ed5c41e8d6989d2ff075b433d81df7823d6134c9d37a90a982b3933c05e443b73a8b4a8ffae79848948137bff0e4bd6f1bf90ea229ff7b2f6b65c1d221d528d877fdb82296780a8ae44dd7c599c0e92b83f5977cc9c51d4c73f179dcdbc37575141caf15c81bae4951d8e6cd86c1e3e8611f2b844b7713e26f1961530dfa13e8d85ade5f0a98c0725c81d5b68c571da5477aecd9d90e9ec1db282320d845f0789f1ef8490dfbb66bca6b264b471d68da0345d7d87e95a6056687335661c9fa3fe0a9f4593bc0d129f2db70287d8960e36f64152ddee4b8f6ab6a2b9ece0860976a09d4c1e415e718364a677480b3e814ebebe56a2456f9bc2c5324b677a0dee49d1b023aeb78c653f3dc9046216a91e3c2c0102cd7a11f5aff06ab61677c6644c3d3b363aadaf9c2abb24d50b8d960fd604aa0716e95c26ffb4634721f528e3e3403c3a1faab9772baed2517a0b67ece5eae36adb1ff1669bc26e7403003a4e87eac3aa699c03bc82829e27000ee98546218707513c1b027f3557407b1b89f1ef264e48ba4ef0007cc680c14e247708fadf8332c00f97490d3e05cbcbdb51b5c4355df561e17aa6ed4f1335f6213d775e7ffe814236b88cd34ff73915bc9259148ab17a98f6184007c5058a03fda6eb7bc6809be3fa90b61bde2a3b03889b517e6c08742a9a99479febc0148281fff8fa45bf22d8d3258a14e0fcfb4e11a5eab6e7623e948b596f55441a0c0111d3ebf9c3a9762aa59b5c63977796b91224d600be53bf12d1a25c9240038939f2f6f470444d0161f420f1fc804513145f026a3d2a7e46108c7982cc0348aa6c1c27592614b9ffeccf477dc6e24356e4ff9076c2ba0970c454e2f07de705abf5d2785e24ab3760d202a6abe7cbb66e75443a5d2e0aca86a5cac0a45a92a1464eb6e28bb1801070e8a201e6c6d8e3b2ee90b20e88d661acaa50b8359deaba6f67da6e09f52dad1a81b3c631e5f4ece0e23d789eb919715b130d2b5d9a61acdf9523fb286b1732f6220a244f319dea4659a53c246119ac81457001c68e392992f07562efd91d29a6050476b70a122ddda8e18989ead9da50028449e230c755b16d14af462f0454fa17fefbbfd7c889702890b5d1f699193d3227b83a8a2aa9ff7f4f205bdc520131ad5e511d0344f9f079b00c6da51d905b52b065a46693078d2e42e04128eb71109b70184c47fe4ea0147a0a712ae63858b7693486bb9ff6a57d9e1ddca2c3bcc6eae64a82e0d89d2c23bc46c48b6fd1720e719ed1570ca0b1ec1b441061d801e16001f1c058cdd9d34b679ad5dbedba301ba2292d95993a5dbe567da7f97c313cbc9bb74407fc5ebd7fa228e5f4b8c816b6957048c4842becefdbc2ceb03020c2872e0faa92e1a227eb1f25ea4ea96fed35121aa105c26f286ad0be2703f45c7c80dcc91f048404f56e523b272527129b978fbb63f61d5823fee658d809e96b1c96cb012d3237f06b7e0f6db3d0d08efde0303ef374dd429d7ddf7c31a887250d37c2edd408a455ad880aa0aec7e4c62bdc46a5f108d3598c7279b8f6b36430693e883a8a95638e459ec43d97289b1a05abf4ef6d90520a5fb1f865f434d45c62fe52c5982e2326afc792642e8b0682dfa89d42ecd2f461d71f1ab0c718d86133662f739b519c2fb510fe85713ae02e226dd994bdc3a16835ff62c0c0ea85ed96ff531fe01fe8e02f5d5edd4051f2ed05819f9c352b0da8449ff8005d912c29aa195d3168147ae2a1212a38e0d98ab6c69d47d25a3d4437f0dedd9ad76a5f1a489f4708d189f9855db91cef370d659106cd491256f9bee36cdfcc6c3044d241a44f5db19158d2fe4a51777511f18b347e19b2189b8eef07959f6927d8cb03c6a108048f70815f13ac42a9f3ed5b45086a8d49896c0d32474622eafa79bbf18adb2052fda00326b1026dfc03a3d08db432ed787a7b51eb14fb6a3e1a5cab8d85320497a4b73629d232e077da5c8d5e018e8ab68d5fb2c81295eee7fe40709c38303e09ba4621ccf4db971b7855d4a933c3f3dbd3ea2e59195e07f13fbe6cac00c9928625ecbc12418cbff9d3fba722eea50033d9cb70068e6dbd7b2b70141ec9d7ebdc228d0dc839cc00d6bc8bbd72ae282bb82e9874b53cdebc753aaac8db6c26d88f083b280727736879a376c5248f25fab864ae7ab44743a436b4d8a33e924d92848d1a53487c530ef8a250e91ce8f839cfa6761574bfee1624463552124dcbac196cbb8d3106f2a4b54366723af10bc322b58542f0777e7cf0d107d1b7b1994746688df00237a5a86e021f90de8d125adbb6f3bd6b4abfe8c6d40d8d3b9a5afdfe95aca3524682fac7f1eb2d2a8b7572338b198488b740026ca972d3b26b4951688a960418759aa09f96c62536b80476d3fab3298b49675540122bba0502624c3e56694dbcaeb8123598684986b1acbe81e3b63eb671f37515fe18c00385ecf7d5cbf7eea6b645f02199b67696ee62752eb8f5716f9f58d6c19dd5642eb60457af438024947a4dcd41e6758ae70dd9f06d3cdbdc804d16d6393a9dfcb2cb8e890aa884876ad3a492717716db903423ed3eb9b827fb9d1c5b0f56438d12c702557b37baf0f825e1085f051fc018e8eb037e7399ffb531e5c04f9cadc59c838042dbf43f8ed84e209b5c37d", 0x1000, 0x4}, {&(0x7f0000000340)="d524cd37f1762049e56e1e272dc601c7d0fc6bba5ac276de8c598b1a9b41d168a249bbae7e5ec22a0ccfef3cb8379f1b41c78a82509e9f65a04c7dc2ce892ead497d84b6ea8759b0942b7a001e85764840de9da8db76358e3e2b97e47ffeab6a9a84452a808e63c8233e5deb8b644633929d010e9627b4f627b76d192109385258ec0014ca53dfe620a42bec71c6c2f74eab2664b26744f17627", 0x9a}, {&(0x7f0000000400)="1e94de2724f0cf053218ba0a0502649f8fe2e0cfd00ba24e1c0eb57cbb262d6189b15c8912fcdf18b35957820000fbbc78051c7ade3079b03b62b3ae2ba7403ac702dd6d25642f9ddfb2c3fb16a1bb9aba117289a5f73c661d244c27e38b77a7ee3c61bf2575024eb1d1fb051036f7400aac9367e0014658763dadabcac0692828486a9cbc06d934ad7e68d55dd79c2175592ad9c9b3f8", 0x97, 0x3}, {&(0x7f0000001580)="f87071ce026920acb0e3bbc7975643efb78c4aa1fe1071687aaaa2144c25cc41e584169248a667e3766711e53d945ee80635cfa9ae5a2d0e827bf6e71443af9df8ccda29750fbcf14c2363dd22ae3892e2b299745abed34c4b487410ac33df066d2ae660bdd9076867ad177810a2ee83694c73e880604a7d76539d9d3386f2243dc88bf602182030ed2e4e546c85fa18e5ab4cf415bc8b2b984782213f7ed4ec9053d371fba9e6f80dcff226c3f92920df43830ea7b94244cc884c4f8f6301ea6e7962bfe3e0ec39a01b3149dc34b78d13c01e9c77abe73de67008b51439d8fcd279c0c47d5818d6657f29a3add2027d3c1838aaa77b21ad57d5353b0c180c44113c1cc87786dec37ed4ebf7b70526aaa6f05df6b10b1fe32a97bae6b0847cdec5dc5a81927430ba4de9c8c94213269311e2efd1ed0b1c466fcff32c807e65c78a4ff07d270c1c571a516b339f4be3cbdfbf575c7914af229298a125acabdde5db6036505fe11784e177c3742f31aa27474bc78e3b330f96a79345fcf70e4e581eee929e680fc413a1b5b0892998cd26b6dbc99a8c29cc1757a49c687576be4c70d2ac60bf699b724c3c726f930640cc3b3b7a372462eed76f35b9705161fce1b8fdd76236cba91149fea0075995656689fe5b438fb4ec8f87bd29e6c6975ae4ef9d717a258aa7c7569ac95f371539d4b84a7fdc3e5c899286a0e1dd52d87a42b7031a1518cce0514b3788f93722bac8decc4e8f521d7e1a299bf9381e9b909d52942dbeb6d6802232db69b5ecc0bb731ecf88eee973757712c42676750cd38fbc3a2b5a6daa12f67a1d4d5b01dd5602e8ffa91a56f1c015e949d06b2c8aaedb3b518d59c699c15f054d60387cef9a947226013460d04a922f838c0f9afb738fab5ede1035a31786fdb978839056f6558eed9840f8961d468f979cc4cdd935c5f291053fa9491b193bbb82be16ad08a0fe0a46061f93b6e7bac04d1ea2730daef6219c37112ccb568586adc9133fe5652e2be658c381492065e79cd48d4bb9a32e14f45d5bb0e4d9bdd611966cc0af40903c928737b1b53f0ed8bc09dd0c01c9278bbc7a852454976178c7a5d67bf95a853b12c1cf5a11acda9786185c380c2941418b32703f561f355ae4d56dd628a45e7031a5699e1467923a917defc5bd8decde9406470249daf63c67d449778a10a8f5e5d2d58f576acbaf5959730e22673f05c820a134b43eead5418770523554cc98473e64e57debf7bf3410bdf8cd5f70cca893a8918a977cf84dce22c08f84729b2fcc1c52e98655f0e5f901f61e81a47e6bbf4d15ee3797facb3c10b0a415844aed7e54586badb1dce12e69f393e401355aa5e83717975f7e347c504d9a54f9beb0d76b21c272e9cb82a5d762970353c0c94f678795ead51671c56c5b71707ff8ae818628c73c7d5a3e870c2a0c20133c9d51f1d223027c80474f101dd93c05a1c3e1dc74fcc3cc1be91807d25cb1585d9d488d796c5aaa7b9edfadc29e96279c841be65ccededc5f41ab6dc7bb1841cfeb562f11656a015b9ac892289976d76cbbd263d094cf7bd719baadc4ba4113c20bfd9fb5e1a3a154a9907c2dd601348e951a3e204eded9e30e602201f087e9fa57fe15e507b0c7607520d1786cec2ff9bb91061e089d5ca36fc3dbf6504cbf9df59c762e4863a4a34be7d658f806804d99c2b10d2ad7816866f7c6bf8ce06612a3b41816b771fa11155d1d0388050a0269bb7532c9471beb8ecf78c3dc46b2d8cfe67a82a7bf2b624e13fcceb726f1eb00c2e584cd248272db3e9fa2206401843757cba14102f7ff18553514cb0b2b5a43bce4a7badec2ca9feac31dcbcf5ea2d9d50da7ca824a7ae4fd57ec388bdc3eb560c9d699d242464f2c2a6666cdab1cf9dfcbca368cb4eef5ae6b1c084b55d3572207e5517343bd6477d594f2c10293e641f7b767f548437def35a61f407c2584da58b062bb3a276c06c888571842bfc00559943f8439beb87b364ba54ef71a9fc19c2a4c99eb58dd64e68e0559cbc30002934ff9fed9c477b83a6506f841a46fcb2cce981413fdfdbff6f9c0380c486e3bf7664b15adc2efd749fb145879ae5107999601ae302f22d256eb63f8d2b295124c00ca463f69b9b18f07484fe1e2a5eb386409fdb0115b50091a4f5ba55cab4dd8d3bc641f4daeebee44b7a5aeee038caf364ef2dfd82d8148c8f9cc4086ff2bf3fc3f195cf746ef375d72c58e0f7944f6d019b44dcd1fbc5fefef8c4ba68e1de75ec16fe8b30cbc879cd6e5c5599e80079206b3e6f37501d8783d1b88f22548f42be7cef48a0d7495aed1f862c575c2b5f37b3410315b84c29258779e1a6d1154c50b0c36d80619c8671f7eb4c7dba66227731be47b6a2643f264e71ee271cfd202944ef485216f8d7f04ddc5869663d3271f75d6f27e247df5a61abb4da20f810d713968bc8d79edcdfaf4c6a162ac5b464425f8bb2212d83a83fe52d0ad66eca047c80fa550f34bc2d792f18d449c31549d26e9ae2c94a8e05407ecd77f1b1a80c7ada0fcf832a80221d0a93e1f5d5b02ab3dcd854575ab7a241eb751a21ca267a84904f4364b85d0ce04cfaa41755ebd435b04ebc6bfb214a3259e5ef5f4c69e9045179be01c8a1615e1784c6973a1b48244e2c3f1ab5ea701d769fdb169224995feb3fe48aa16a4846875ccae0aefaf09a9989375d092617e2f9a3b9b826a8075c6aef52eb271fa1d34b6537a37e8ed974d52850531802f35ca9aaea6a67198b32809d929d5424b3eb9bb750479b42475d70c59fdf60480400670abc78d1b3b1d67b853e1b3cb9c35233f3f28fabfe3c8ac61d5c2560244e53db487a7bc419acb7de4b137595e7e887b19f2924990393a3321ec0a3682501ba256f28fd7eb2a5376eb616767faafd996ab5ca2abeab294daaa9ebcef2b683a2d19177a16c3a61759ffbc5d8e71c0d39dcd08593cb2a416d87826c78c37e9c9a0b664bd8e76280383c4be9d56c7fa63850743492d58cf9c405672ebe936da72ba3d249a41475d19a29290afdfef164cb0c66d8961a0713b74d6e18091731071c4ef75f8a2062fc866a1de82ac2e05270d3f147f92528434c293ceb18ea2618769db44706295aa5d7f005f418cce5614fa24392fae39774c991b7fdb024e8067c7abe0bef9a49bf26a621ace93a5d578a3cce66e7c80966f2e9813d8a4462313d33dad517cc0caf0fe8468ee8abe21c39a048f2d09e3b4b6aff94ed77a4bc366a65d8ac1654b25882fb9425c97b5872ee129ec5562ff0aa029686985e45ca0c994e34d6b24b85cecfd963717a9bc265d01cf7cc3d55c07cc101522cf36c9f4be266e7a6f46ddfa6d257ec819124f0f7bbb2dfb01eee3134eed31f15345371b02505c875f63ae1f7c3d3d4fa593eb58aa1bf95d81f544f29ae627d7065a5a1334040269892cc948ba3f690d2d06624114406f30eb565f4a8acd51679e35c1d22bc66b34084631e3c94c5e73ea3ca5b742ffb545b8121618ee3f43f20aa034d02e7ef7d5a251f7ce75ff98642af2a7d2e8dd935aeaada8ae458afed7ea61f4240513df6868d8fdf65c1e23c7c6499f6358ca27b7e53a6a571743848a996ebaf3eb5e48ab359ea297ddc08822241ac6897c211c62037689c1fd9488b6396017f68e9f8cf079709d1c72587c4a1d518092c309d40c482b0780084ed2588e19eea1631188763805702785b1c14c7c2db45170d71800c30080172d8e1289fe9b636bb2d2adbcd2ec19368a3a4e98584df410b1aeacfe32491643fa27dbf93ed1fc2686c3337373449b5c4c9aa38466781b2eb1020c5ba53cd0df213266319964ef2ce1cba52cbf627e63cd4e8beebe653024573309b5626115cd231fbf495d2116177280234f86ff6f30ba81d0f2d2f9b78180f4eb813742c233434ce119f69e021897d7538bfcf1dd7114e769808419661c3144275ffabb5d32b9f0ecd55569aa26cd340e98197ae5c7d718a2c61768c5ceed109778596e16ee30f8406425739a2d502801da5ca8117b2c5fae574adf3690995a85fb6dfa070d4b0a6c55ef6374946600b7268809f5f87e8db6c1e34c3bb13b68a0b6801bba27d67f0099c6c8f01bf8cd62da650f250846e6d16e20b423914cdbbe031fd2f7b95ff3a3d47cb5eebea595fc1823eaa60340905ff2a2faf75927553ff749d04c686c61bd73bb2f6dd9541f7c7ca282363d05a0fb7f44e9736be70fc6a61ba275cd50ff3fde34f5803275b3ba69191080920a606f64dd487ac1336cdda544cbf20a17e258d74d2c0deb85825e75ad008a7d73ad590e2059df175906083fe15b3c673e664e07b645eb91e29c7930a52b9e267e1764d711fb20ec268279c7aa3093d3071a0aac664b38f34de5e539c9513d8ceec95d6a57cc45830be483ec88055657062a3799b83f033ba378c3edd46af0642b6fd2339e8ec7cd5e8db89c61f3610d3b0317502f9d3f270f8413d65522b297e85fa124b38c516d3c14306650efd1229ccf9d0acf37aab130d9cb3773bdef6911dc3dc125fd47b2c879a145432a6aae5113e8ed0c919c5b6bb0cc77fcbaf8d2192ead39a06f80ddb06d20407c229a64cc1729fa1ba754253e95cc999334d800079e97982c290532e021b2ecb32f537ab9e559ad36da6f008466e050e9e0273ea5ba67be4f685abeee92dd03b17ee0acb0d9def3721085c1e2ff33c8a15fbf0ab6ca550d6ce66a43c5ec52db91bbf8c2463d61c1f92712936c4ad200c61a604e54d80ddca61dcdb8e839661d7c8c8480d8cfe354085ae5dd5a5f6f7fdd65766a3e6fabbbb31f5b357fcbd8bda9319da9541844289c49b594016d26d21746bb3925ddc92eb8f56c2d37a7fd6d456c10e39028c4c6984dbaa2963eee8c0e626afd824b27e7ea05c8440cb5d438317bca3a747e312d249a92adb37fa02a4e3922e93b08d4cc3a4742d7c30b674c93b6e2cf5119c77402918b79ab13478650a22ae14a9d8549ae3e39a100fc98eb6b8aed38f3ab73144d1ae8abc7dc3ad5d65933930b18d8fca72e349756c45d2a21364994a0632d22eebc41afde6a0f8086e7bbe54cab5922dce67c6dd1a8a54e6a172d0f09f6a88902ed19dff67f556beb124d0323b5a23f0a73e946ff49ef16cbb9257831adaf5a09b309533b46ae141e0709f72e32dd03ade8713ee3639e51db19ccb5d18d7761009fb13dd2f8fc7de948581bc1b8ef5623bd35db177a34d102ab1ac2542f89307af1e9ba121de0c7be82f8ffaded921b93ded0c687192a769265b97028b9e4e026ed406bbdcfa3a8a322dff6aa47b1d0bbec67f03b6b1c011daf465eec52580469796e525cd7e2bd6e464dca2ff33e7b0054ffc78ddb79987521c5c7b1e8a8558159ef6a7acc340ca95bf4ff14316c981295ccb02469217e00410785a6f406e48d43899f48223c5ae4190962c24d9dce926f99f21cffab8ba2204c87fc75a674ca310cba029d423982421734aea18ed5b3081ffa01a96b089b3e8d07e87d63d81979736dacdf9ad9f7f2f7cb32996cfec36372f7e5194a5f92feb3b9d10c26501332aa533d172b3fb09a24827f269ae3486ae2762924d38e38e20b9e59227ae97e3650a226e97afbec63fa6f9a610c2f4d47aad1f3793a5c534303d1ce90429b7578bb2b25f69908dc08d0f8e0d37497ff8122c037958d4dda40cb340eee6f4d197081695e623d3347d8e86b3bb68111f9d6a7a6f95944272a7f29ddf3f3bad7c9bbf795067c6887fadf1f4812d8cf925a499efc204e0565877495687d455e9133a4437f30c5", 0x1000, 0xd9c}, {&(0x7f00000004c0)="2cd01b4dabb06ecf10c7e85b7c8ac19f601de844056485fb2ecc02972582be55b303d20db69b89adc4707a0adf21b6dcf09bb3e7d73b7f4261ced2981fc17a0a", 0x40, 0x2}, {&(0x7f0000000500)="bb104086972e60bc5a", 0x9, 0x8}, {&(0x7f0000002580)="d0474ee3ff652a2e03368fa07bfce3659657ddaa2d7828af9dd16249d9f67f8fbfa086e52e54fb62845c677c4fec150046b411db2b1c49bc15e3579ae518a28e58645d3b3104ab93ef83e6b69f8fc4477422a8bea18557357536b1bff4b834137695325c8cedfe44930a4f4c98e3933340df629b3d9bc4e6fb02e290bac3da2003aa237ed6cb850e4db59a817eaf31f2faecb4504801f7b8f6", 0x99, 0x7}], 0x8000, &(0x7f0000002980)={[{@nodots='nodots'}, {@nodots='nodots'}], [{@euid_gt={'euid>', r1}}, {@smackfshat={'smackfshat', 0x3d, 'trustedwlan1\x00'}}, {@uid_eq={'uid', 0x3d, r2}}, {@fsuuid={'fsuuid', 0x3d, {[0x32, 0xad8598f8160ce341, 0x33, 0x38, 0x6, 0x63, 0x38, 0x66], 0x2d, [0x35, 0x30, 0x38, 0x33], 0x2d, [0x61, 0x64, 0x34, 0x30], 0x2d, [0x66, 0x63, 0x56, 0x39], 0x2d, [0x0, 0x32, 0x37, 0x32, 0x34, 0x33, 0x64, 0x39]}}}]}) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$UHID_INPUT2(0xffffffffffffffff, &(0x7f0000000140)={0xc, {0x25, "9647b500b9cdee368a55757d2fef79aa54b8dd481e8d3a166f6bea6526569ece6118c4ca10"}}, 0x2b) write$cgroup_type(r4, &(0x7f0000000280)='threaded\x00', 0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000040)={&(0x7f0000002a40)=ANY=[@ANYBLOB="440000000201000129bd7000ffdbdf250f00000630000e002c00010013000300fe800000000000000000000c0000ff1787142d00bb1400040000000000000000000000ffff000000002f9755754535b622185eb99cd0b6560ea3cef6fb608606a006369e532b"], 0x44}, 0x1, 0x0, 0x0, 0x400c0}, 0x2000) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1911.592282][ T26] audit: type=1804 audit(1579065305.096:1037): pid=8285 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1599/file0/file0" dev="loop3" ino=1313 res=1 [ 1911.606003][ T8284] device syz_tun left promiscuous mode 05:15:05 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x4800}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1911.662327][ T8284] bridge1113: port 1(syz_tun) entered disabled state [ 1911.698709][ T8284] bridge1114: port 1(syz_tun) entered blocking state [ 1911.725373][ T8284] bridge1114: port 1(syz_tun) entered disabled state [ 1911.753842][ T8284] device syz_tun entered promiscuous mode [ 1911.787502][ T8288] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:05 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="7400020401ed01000270fff800"/22, 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000680)=""/129, 0x81}, {&(0x7f0000000740)=""/223, 0xdf}, {&(0x7f0000000840)=""/246, 0xf6}], 0x3, &(0x7f0000001a00)=""/110, 0x6e}, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000001a80)=0x10000, 0x4) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000300)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000280)='asymmetric\x00', 0x0, &(0x7f0000000340)="04", 0x2, r3) r4 = request_key(&(0x7f0000000200)='logon\x00', &(0x7f0000000280)={'syz', 0x3}, &(0x7f0000000500)='selfselinux\\\x00', 0xfffffffffffffffb) keyctl$instantiate_iov(0x14, r3, &(0x7f0000000140)=[{&(0x7f0000000000)="e63be431ee8a6190a3e8ef93946977b92c8c99560d156b182c9ec709f27899c9", 0x20}, {&(0x7f0000000a00)="c252afaca6b21898cc08f97276dc83e29699961d2567ff752ddae9962f7c5754c9b5a02e04bf4a3c0e4c99a1e5843575033b460b548523bf8e2b3b5b41b38732067e43665635018a1115f3bf18d76b5077a2610c1d85f45d21311976673553839409d00790343e48b476f114cb72ac9d764df9b7cf9166285d35537122cff15a2a80bcd3737130ff14667460c7ffb131ea4451865841a2c83e7a12c1a29d1a5d9a443eb8461e573ce65f95d14b884dde9a2745c2332ac3d00fa84283935a71dc4c2d9e6e7ffdc2de4a048013e9c5a675f48249795ee674f23071e1d4c124d765c0aa8fda56557d7ee6e86112ccf27642ddc916963ffe73cef43f7ab19ab91989bdb77386fe98d02a7730d685831c0eaf43051aeea570d1ea4654a9df18a63a6406c7c62d47339efa43950d10eb11510f9ad6b9ccd234a9d1b5de8ad7b9b7008e660492d4662bec37609718de7fec371796f288f10384bf759914c8d0a8f009270f8662c74fbf8ed96eb8c617aea4b844b684a15d919ef45fc77eb6d821fb6d1cb0823e3be369c2977aabcc0b2b7c84e6f952dd59ba4873ca36c5f4a257bba154ab10863c3a8a50fcb5896f2fa2abb20cb11f9e48345b1c16dd4c1b8b9fc6c6ac4df910e62220b36a63edc747e95d8bf03f69839843703223e6695be73a00a09482455b0edd1c8f99c7d664f1ac3206ad20c68c5565c92b791531ff069c733bfd4f1f7fc449e3058f0169f96d6b17eb37ce226c11e270bbc0f37c36fd2ce568a1ffd6d672b799764f481b008f90b62b95611a6677d38def10a770212df627f582fd24384a70ba233d651f5644044550569c7c70ab0105f2f529d930e225172bfa69459f2ea41b1c8c7d93863fac2bd2a0c1a5a4872f4f35bcb3574ff69306f982fa57b2a51cdbdb02ab601f9b5d56707158f68d92c0072851c3b6060dbeb2af8a653db9338fbcd384e029840d79c30b18f60d1ca4c22fe7722ecf00d764f52f471681272e7d73a4d18ccf61e7fd4c633cfa47b1df788949119fb65eea16dab8b570fb3df709736f46895ac923e6eb328ad8d3cbb34f7fe5cd13d997068ec790a1f25e7fd374bc0511d8aa024b8ee952d62594e1b2ee0db3153743ec8cc7ddf337646c90eb0ea54f05c5748f20c2d35b5d24484f35592b8ca7c12af0c1b3681bec40f1f5bdcc500bd5f90882ee206d69d24b14bb7749e388187cdfd0f1fd1dce0e0e10036e44d12f6a25005eb4fe34c66fff8434449f760662e027729fe6e690d86787d3ebbacd497951c1683a08e4159359b32384dac6ac90e13638d8525de5d775eacbf3bead3f89e8db9486faf6c9457ded2fbdb84f316d98a8f92dfd83eb1a9f59d46c635009552bf4e6af7c1c3ae5cbb8dfb8cd71d26b4f42a783e26b6814be388294493b21c3bc6cc28a669bc1b2084d55f73f7c3ea60c7efc21de883fde9b5f10063da07c9b57830839b140d341c190a7b32f90d2e35ef435a21155969fcf357b04d3a2781702ff8bd5ea52cd33a1e804d45c41c8356e215bc9216368dda27f562c51e8c4537e251b9cf4ba163bb3cd475a86f7ca2006f80e1f625c6bb8f2cad8055a4f728a81764c3c09e9549d317a21e6dfff9223e65cfd8b9a66d6c545d6f7ebde15c64f7ee0b60356127cf1f3ceffa678a9def0e973ef5f62fd6713b891fd943ffd0311af377a3c1ea3b38253e595cdf8b0a2686319bdba9d26f0338b1c1cd4d8d5dbaf001fe8a659cf23acc043e003bb990dbcad7aeb79b5759f343d7e5dfc94a8737ecc6ede04da52dcc00a4ccb439c718ce479c37a813c162627efc181e5b313011ecf918b76e4e9a136ebb803d2362512aa6a575a6c2fe188eac3e8bf2426d3615fb2bfdb33ee759190e78115f38e1cb318ce61e9a1b0a2083e2fdedf0e48cc885290384442b553ee40b16e33a6ac36b6d82d152ca963845b089932a1bb168c09a2ca09449d08b432904dd47dc7130e64aace6e031319fc21b909c265308b2e055797757dc05ff6c4fb0e950b50176bbd88796fa26a6b71febde3e98ccbf7847fd7f86c610fcccbd0b22774084677c8167ff18029785aedb2c1925754d99e281bc869c2cebcef6396f0b8bf61bc4adf38bcd673bfce8de9a88b34932f9bd105135e7e16b4f35eca08f8e7610238c2413955b504473161bf2a52abd64089f0dbfb75c00e497577065ca3151f7e3a34e5809ac7c9bf88f9cf04408fbf2467233f7a3d9f5007d7896ac753a2a2a18c95f93eb1a25a42be9e578950c969155e2eafe0708490ec503c7255108c84d61f8b867295d08d5923caf53289a0c275714628d10d5b354fdeea37c51d9941e6d04ce970679700ab55f29f5401c6c8d9516a8b2567a95943ee66e730c2a20e96c17254647479f33f9e23c7d3667b65c25d39dcbf3bad940b962481acb18a2a4413c3c1a485d0078bc46b3884c37d00796395ea5397f63dbc3262af8ae33bb43d33d9314b0125664e6922c529dcc6afab40d1112eb69c8d7615e00adb9c593439a845b0f6fdd16d7517f1c5ddc189e5f54236c552e88d2f4165d514417e3741a3393a93445f8f7ec8e69b673ae8c032f3570f0f9481bab07018581d7cc48470c3e00130fc28b78acabc4c299e04d1009e353509770a1f805e1c117a18949c94acb2d0bb945a33ff112966639944d20d6989328ca542265b033e0d6b2b1d41a495ac9659d33c65b6a27fbf7221880558650da3ae49232673339acb832f3b83dbbc676e1da4f3c892fbf4906e255fa1811cde8dfaa6f4adbe35f4f2110884d5ae0c6f94efb4ec51d93d6f1a808a46e42be65a9fcc636f8f14a494789ec9d198fac88d71f9942105fa51d62f836994a5a1e5c861df88e277a227ad5fe7c03771d2ffc2ab8f99a7263ef7e187dfc7be85e6ff302cc488ef6a337c42e2c2780435922b6d0a4c454469b6a89c5387d6d3d58b1b4261555cad215d3ab84a3258f2a822ee3e3747cb6bf4797ffe0201a8b157b40c95e6158f7a3e6c7e298755218565d43860766e5e2c0f67b1c0dc3bcdc46add1e9d8dcc3154687c74892fc306ae6451489d6eb3276d0ce6e4fd0e11acbbdc660cb8eb1196728d6d8d2ce986c6c42ba6e5fa06e15feb7d6931d2f254d4f9a4983aeb174e8d2984b4e33866e67fb2e477a0a7650090768206e100e9249aa8474a20529766fd1022a0b727a7e09d2387cafb32441034fb703a6a9734cda08f9a714b321997613e7b49e8b8be5f450ba23c62571cc55302d5b6414a75324d3c9d3430389f6bcb473c31d51c63339151e9c9f9c3f1d14a58f7f5f7e87a6786f504aff6c1575de43b8225e80a4bdd6b118812bff473ac5781146fc65d7d730e1fa25362bf4f65fe68f86b8f6008dd9e02e5915c5146dd1261e7b3836fee6416ab6a5a176e26c957eb5c50cc86d51db904050e165831d12bc0d3316310f16aabc7e057a857ad0335e11d7cff3d1a8bd6312ba0470de9e8394efc5729da55878b98c4cadc1b047dec7e6bdc86424d0be9718d514b0ba7aca8c02896dd4a9b002b51c04d01d2340b42b7d28645ef6c1541dc4ddcf6b6ab6ba262c6c520779ac968a37bedd79fe08d335a6ea4d5351b6408236b56d9b94fbd8a29d1763e7927e4bee78cbe1af052c2ba00c00bab335c7db722eaa9a3c52853571c2079a1ef9ced7a757dd024998f5540da6d9c8a708643381ef0cc3c68bbec7fe935d3fc188db57111b26dda21d3fc8fce233b1d25443eab80f2a1160d4fe90d24a7f04c163fcf9c24e8e5c18916cecc7c9464f5663266694c3e96c722bb6b0dc0a204ed200eabf18e90205077ae8d7e4d1d0de9ad43495d54e9ce96e09f796e2a5b9d7a013fc33c2ee537352d22786378bb7a80b12f760df06dfd2a528a63aafce51d9c627d1acf534eabefd8d7d801113d9d1f0d0da2ae8fa208eb6f865b784e9db783530119d01e435994e2c742dd2fcf54f10afe618d944a61e8dd814079b0c49f76c78aef5dadbca642f008dde60fdeb4afa55fa696a25e2d6580f1e2393c07a10b9458f726fe6d0afc3b2b25637abdd8a148cf3a100240790369a9c350b014d733bf3d26d2d38f3bff55ff1c2afa331e8cba77d3c0144d15c5f7e727fe648564869258917b48b422dab6781a304a567c0caf4ad12186eee2a8b35a6126c4728c4c70cdb85b6efb34581f809fa68fe68b0f38fd7abd7aa15015c323050e93bde46a67215169ffa74b8ee6469de16795ebfd82dfdec622bf42897b0b34da4b2b3fea6f164622784b856b501be14f064db2a47280371fd462640420aa0298d442a0ae1078b9698fe74b5f9973bb3d96ca9cf59eded74afbbe8a667ecb0191da87f92e469189f9515e267cec5b6dbee58c4ae2c3d27361eaff07b1e99cb19e0fa5bcfe4aa58af856f06000998b33990cc24d9178aa9ad373da64c1a8a6ce882a3fdd503c1238de8cef1718e4f7dc1ebf54ea0d4e2346493e2969f54f128a46fb717297b39e36ba4dd2680617baa128be703098e21010b465f257e80209d03751c4f86ca99dc5479e57137b38099b3b9460fdfdd3b306d64b3b389c130bff89dc63e2a39dee6f8b70e77b71e8c0b3d432ceda0aaea6ccd25ba1be59decf53c28857e2013d527b02ae0881cb9f49d7b16faf21a51cd57f93600f13a726bb28a2f10b3ad2b21d72c6b0f5b2dcb3ae284fb5e12c4df15ad50d535e7d2bff12e2e59834459d34621b062f33f4b889f62e794c5507aa5ebd9f79674e8979064f056aa40229ac60dea2c7af96efdf88c19ec2dbacc4ca0ced54199b5edcd086f5048137c346a092917ab816cd6f4789ea83fd587f30e84e9d9fcd29edd7f59924708de35ecbb2983e80f305e46b59fe2cf99925b02117f75a34d9197a38e8f7faf3de30607cc5f0d9360f2270ee9213276d4bf42a65413be4adc787185a7c25fc594c506c93bc3af986d966873a8d9c2f36fabcfbef9c1b70af83d985ac735810be185996546d62402115867e7b74d2f8009d190464924c0e7302f091b0352601709b23fbfc9173d531ee8e94673227c662b8897c1b73d02cdbec67000a7600b8bcbc0c9a4b936e43c3d4b59eec64719df3497a8331c87d12283ec572bc70c3bed07aa58b3f77c0a5df17c4ecbada94e89f0cb757a69b2d97fd7729149b10898b5972057c5ad542c657e401e6be754342329b4cd3b8e57f6adb7677a134ed128b7b5d8551ad7779d797f12b506ac45007e3551a2d408f840c9f6bf30c9554f6afcb083ee2af6bbd81528aca797ad2742a94ffa17df1f46f8aaca9ea86329638e1b0988ad27aa25374c33ab79f303e73021a19a13a79e2df8143c403cf7d8aa02676326c2f93a33a512afc55418cc42dfa387d888a2f367d73f58708de667d7ea230516211710e2f11561259030ce83ec23c04fc21f9d0447aac7d2ac6317a3e274f3f1c6b1fb86140b84bd3e371f336b38def8ae7a4fa3a3b151e7574f8ca34c55f7ca15c856f1af815d646473e5cba9b6f4029c6315c4c40384027d793e196bd8b9018f12a59b99f5eae6cdcf14ebeb2db0f5331c94c2f18d3aa427f12bd872527cbcf9271ed479b700ba96c59bde44104c8b28dfc0c351950fe40b5c971145671875844daa06d27d34f02e2ec1e169472a7b403acbb59119bede9a64901c778accbc3e71e8386e943c3765acebb81bcdf0817bbbac83ff241ec278e94c962e48ffe776cec1221607449a96f297bb799c09be28d468afd6f2b44778e2a83bf21d868dd044f200fb38217f8f67179a5eced247bc752acf2dcd8dd2ab38032e5980e8d708fdd33cacb531205", 0x1000}, {&(0x7f0000000300)="aa74220c3b0b083b2810c391d18056ca03f5cbe786df55073a5b519c9cf1e8cac33463788106eed17d8efb0668f77c655d2b37933b2658a4317e2fc7d58e0abba7f976140c3364fb85958bc5ae7753f1077b6ee7a99fc5388ff3ec89492ee3835a7b6ea24f005aee006fd9367d66dc1d7cb5bbaa53f204bdb2143115ebfa8f5e5ab36328dffee007386b9efd649df275a96f0677230fd8ef82b0f69cd4a71c8c43f913f99f7ccc9ded615fbb65aa47e047fd1a645ac532349fd7e46d3d9252e5d14539aa2bb8fc711ec1cb68553e", 0xce}, {&(0x7f00000000c0)="82a2ff7d91f9030c50f9f5bdf2609eae532179e6cef9beaabc5d6d9e2a8da95b558578f7f56aa621b5178f", 0x2b}, {&(0x7f0000000400)="f43400b1afc7ea72bdb40d8f57e282eff4f421a78e3bceaf438c530c19d25d4484c43c725471b515d27a30e2597a036e676df386c58af2141ee3d3a1550a75e0bb279a2f33b434f79d1fddfb598d060949e2f73892802cebc53b3ee05fa9206a89a5956af9cf4d99ff74a51262fd41f91849baf710ffd46f75e71546207dbcc297b8ebf5e570854f51feeb5558ed7edc251be5437b190a5899a796190bda55ecb028847e5aa8ec5b0807555a381ce665a4b26bc4e28c116913385d6d0927bf682c224bc5cdf156d2674df0d524220603663c42cd91ee06596999f210cd4a415cdab49d2956022a4d5215a83de39c07f32817", 0xf2}, {&(0x7f0000000580)="6104527fa7ee80d4c76de60e663b5e9c33b2bda99963a23e1e112555d8c4fe291cb4fc931d295639c60cfea68eb5bc891c8158acb3b89784a7fde103a59da54f59c1d52586fd48da4fec7d14545b18028ddd9f06fbbbb1cc088aa7c5533627a0c39168c16873f001bee2d5b4bd0503739e896714d6ffcfb2df00ea6e7f707cf0d82454d45bc541af53e60bbd4dac337816eea6ed04e21bae17fa2120c2ef7f310cc92980cf2db22ae7f73a841e91fa50af7e05de2f325cc8822d47f32c966c28f96d25ebfcf4dfa367ff6ac01f210d14e3e6ff6a821294eb7004dce4e2ddf519bff61484", 0x1a2}], 0x6, r4) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1911.845907][ T26] audit: type=1804 audit(1579065305.356:1038): pid=8297 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1540/file0/file0" dev="loop1" ino=1314 res=1 05:15:05 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4803000}, 0xc, &(0x7f0000000200)={&(0x7f0000000580)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="efadd0b77000fedbdf250800000008001900e000000208001800ac1e00010c001600080000000000000006000300089200000c000f001afeffffffffffff0500120069000000060000000000000008001100000000006dba02201019bd21a53b34d9f92af0250ce1971ec71fc4023d70ddebeffbbe12d5fda3e2f9cf3fdeba686574b560d889523bc58d02a2e0f245fbafc32828aee43dcee8a07b0a9df7d9a1ee97f9aa20f310bb750437a21047d88326eb1891925875e3c89ca1c66a544808569a46bb8837da3a50b0bb4a8916644ad8047a0a4b8441955421d5865df156009473ca01bb5b9f360bf5b40f9d"], 0x5c}, 0x1, 0x0, 0x0, 0x90c0}, 0x20008196) fchdir(r1) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x4e21, 0xc858, @mcast2, 0x735}}}, 0x84) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:05 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1911.938848][ T8298] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1911.952648][ T8301] device syz_tun left promiscuous mode [ 1911.978619][ T8301] bridge1155: port 1(syz_tun) entered disabled state 05:15:05 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe30, 0xa, r8}]}, 0x28}}, 0x0) [ 1912.024637][ T8301] bridge1156: port 1(syz_tun) entered blocking state [ 1912.041182][ T8301] bridge1156: port 1(syz_tun) entered disabled state [ 1912.057662][ T8301] device syz_tun entered promiscuous mode 05:15:05 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xffffff7f, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1912.079318][ T8296] bridge1156: port 2(bridge_slave_0) entered blocking state [ 1912.089720][ T8296] bridge1156: port 2(bridge_slave_0) entered disabled state [ 1912.098489][ T8296] device bridge_slave_0 entered promiscuous mode [ 1912.139736][ T8303] FAT-fs (loop3): bogus number of reserved sectors [ 1912.172636][ T8308] device syz_tun left promiscuous mode [ 1912.199200][ T8303] FAT-fs (loop3): Can't find a valid FAT filesystem [ 1912.210182][ T8308] bridge1114: port 1(syz_tun) entered disabled state [ 1912.237141][ T8308] bridge1115: port 1(syz_tun) entered blocking state [ 1912.244048][ T8308] bridge1115: port 1(syz_tun) entered disabled state [ 1912.255375][ T8308] device syz_tun entered promiscuous mode [ 1912.264712][ T8315] device bridge_slave_0 left promiscuous mode [ 1912.275390][ T8315] bridge1156: port 2(bridge_slave_0) entered disabled state [ 1912.310487][ T8314] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1912.354673][ T8308] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:05 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f0000000040)) perf_event_open(&(0x7f000001d000)={0x1, 0xfffffffffffffe21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r3, 0x8982, &(0x7f0000000000)={0x6, 'vcan0\x00', {0x2}, 0x6f16}) semget(0x3, 0x1, 0x1) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)=@getspdinfo={0x1c8, 0x25, 0x421, 0x70bd2c, 0x25dfdbff, 0x74b, [@algo_aead={0xd4, 0x12, {{'aegis128-generic\x00'}, 0x440, 0x80, "b9e0e2e172b1d450b178b062a7d1e22a0984a9f4714a79dfc6e6e9695120ad659fcfda4ddf667b12807f919be3014019b9e972a9130c28f0f2525bab92b81cb3de7ee8836fb3a92eb33c72224de766aae27b53f6573fecb1678f13d7634aa6e277fe6a81f049408cc84a59c8bd19ea8711038d133dc07b75ec6ebad4e1ef4bf8fb6e1847c3f6db95"}}, @srcaddr={0x14, 0xd, @in6=@loopback}, @srcaddr={0x14, 0xd, @in6=@dev={0xfe, 0x80, [], 0x30}}, @ipv4_hthresh={0x6}, @algo_crypt={0xad, 0x2, {{'ecb-aes-aesni\x00'}, 0x328, "e9693c4ab2406249ed4562ad4c1d8c5209f783147d7cbf18187bbca7b28f3e6057322dec6936782da2fc392d9c5e67f58aa54bb72912f4e3e13cdfbf3f9a803cc214395d39ccc478eada4b4286783f8cbadd5e7a8cacf37ff8d5671bfb72f53b8b0a351ae4"}}]}, 0x1c8}, 0x1, 0x0, 0x0, 0x4000000}, 0xecf9ac803a8cc3a6) 05:15:05 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x4c00}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:06 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe34, 0xa, r8}]}, 0x28}}, 0x0) 05:15:06 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vga_arbiter\x00', 0x40900, 0x0) fsconfig$FSCONFIG_SET_PATH(r2, 0x3, &(0x7f0000000140)='\x00', &(0x7f0000000180)='./file0\x00', r3) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1912.670842][ T8331] device syz_tun left promiscuous mode [ 1912.711585][ T8303] FAT-fs (loop3): bogus number of reserved sectors [ 1912.721566][ T8331] bridge1156: port 1(syz_tun) entered disabled state [ 1912.769986][ T8331] bridge1157: port 1(syz_tun) entered blocking state [ 1912.785591][ T8303] FAT-fs (loop3): Can't find a valid FAT filesystem [ 1912.795726][ T8331] bridge1157: port 1(syz_tun) entered disabled state [ 1912.803304][ T8331] device syz_tun entered promiscuous mode [ 1912.854522][ T8328] bridge1157: port 2(bridge_slave_0) entered blocking state [ 1912.870347][ T8328] bridge1157: port 2(bridge_slave_0) entered disabled state [ 1912.895115][ T8328] device bridge_slave_0 entered promiscuous mode [ 1912.955800][ T8335] device syz_tun left promiscuous mode [ 1912.961524][ T8335] bridge1115: port 1(syz_tun) entered disabled state [ 1912.981149][ T8335] bridge1116: port 1(syz_tun) entered blocking state [ 1912.995603][ T8335] bridge1116: port 1(syz_tun) entered disabled state [ 1913.023010][ T8335] device syz_tun entered promiscuous mode 05:15:06 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000380)) sched_setattr(r2, &(0x7f0000000000)={0x38, 0x6, 0x3, 0x38, 0x7ff, 0x10001, 0x8, 0x1, 0xc8, 0x988}, 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$LOOP_SET_STATUS64(r3, 0x4c04, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x6, 0x6bc3, 0x0, 0x9, 0x4, 0x1, "e76f561b4b2d612d7c33d69f0da5d3a8f7433d95a526cf029be3b7d17242ba73f89c19137dfd5c12f1f02d9b1523b2afb2827a6253bf6f0e2ed04df83f825b17", "c4c409ee98f54770ddf1b826b55de51d56cab7411aca0991a8ed651e6d24744bcb5b2e873620479bc7720795b458268da99314b9e0adfc16fa90133a2fafea9a", "cc77b81d59151adbe07078d49bc911633ebe2a79554182ee19c528516ac6710b", [0x8, 0x400]}) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1913.065540][ T8337] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:06 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x5865}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1913.140445][ T8330] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:06 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xffffff8c, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:15:06 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) write$P9_RCREATE(r1, &(0x7f0000000000)={0x18, 0x73, 0x0, {{0x48, 0x4, 0x2}, 0x6}}, 0x18) 05:15:06 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe38, 0xa, r8}]}, 0x28}}, 0x0) 05:15:06 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000140)={0x7, 0x1}, 0xc) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000180)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x2) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) ioctl$VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000300)={0x10000, 0x8, 0x4, 0x80038000, 0xa56, {}, {0x3, 0x4, 0x2, 0x3, 0xd1, 0x2, "aed61277"}, 0x6, 0x1, @offset=0x2, 0x86, 0x0, r4}) [ 1913.477306][ T8357] device syz_tun left promiscuous mode [ 1913.483036][ T8357] bridge1157: port 1(syz_tun) entered disabled state [ 1913.507588][ T8357] bridge1158: port 1(syz_tun) entered blocking state [ 1913.529660][ T8357] bridge1158: port 1(syz_tun) entered disabled state [ 1913.562978][ T8357] device syz_tun entered promiscuous mode [ 1913.578116][ T8359] device bridge_slave_0 left promiscuous mode [ 1913.596468][ T8359] bridge1157: port 2(bridge_slave_0) entered disabled state [ 1913.661821][ T8359] bridge1158: port 2(bridge_slave_0) entered blocking state [ 1913.699778][ T8359] bridge1158: port 2(bridge_slave_0) entered disabled state [ 1913.739514][ T8359] device bridge_slave_0 entered promiscuous mode [ 1913.777556][ T8360] device syz_tun left promiscuous mode [ 1913.783388][ T8360] bridge1116: port 1(syz_tun) entered disabled state [ 1913.803166][ T8360] bridge1117: port 1(syz_tun) entered blocking state [ 1913.817906][ T8360] bridge1117: port 1(syz_tun) entered disabled state [ 1913.827525][ T8360] device syz_tun entered promiscuous mode [ 1913.845840][ T8361] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1913.882869][ T8359] device bridge_slave_0 left promiscuous mode [ 1913.898232][ T8359] bridge1158: port 2(bridge_slave_0) entered disabled state [ 1913.919083][ T8360] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:07 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x6000}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:07 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r2, 0x89e7, &(0x7f0000000000)={0x52}) lsetxattr$trusted_overlay_nlink(&(0x7f0000000040)='\xe9\x1fq\x89Y\x1e\x923aK/file0\x00', 0x0, 0x0, 0xc8a72bc3e1cb206e, 0x1) 05:15:07 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe3c, 0xa, r8}]}, 0x28}}, 0x0) [ 1914.173721][ T8380] device syz_tun left promiscuous mode 05:15:07 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140), &(0x7f00000000c0)=0x5) [ 1914.219347][ T8380] bridge1158: port 1(syz_tun) entered disabled state [ 1914.282361][ T8380] bridge1159: port 1(syz_tun) entered blocking state [ 1914.318760][ T8380] bridge1159: port 1(syz_tun) entered disabled state 05:15:07 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xfffffff6, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1914.365112][ T8380] device syz_tun entered promiscuous mode [ 1914.460038][ T8383] device syz_tun left promiscuous mode [ 1914.484505][ T8383] bridge1117: port 1(syz_tun) entered disabled state [ 1914.554087][ T8383] bridge1118: port 1(syz_tun) entered blocking state [ 1914.597352][ T8383] bridge1118: port 1(syz_tun) entered disabled state [ 1914.644088][ T8383] device syz_tun entered promiscuous mode [ 1914.699025][ T8375] bridge1159: port 2(bridge_slave_0) entered blocking state [ 1914.717863][ T8375] bridge1159: port 2(bridge_slave_0) entered disabled state [ 1914.742954][ T8375] device bridge_slave_0 entered promiscuous mode 05:15:08 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x6201}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:08 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe40, 0xa, r8}]}, 0x28}}, 0x0) 05:15:08 executing program 3: socket$unix(0x1, 0x0, 0x0) shmget(0x0, 0x2000, 0x1000, &(0x7f0000ffb000/0x2000)=nil) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000140)='nbd\x00') sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB], 0x3}, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) r5 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x101000, 0x0) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r6, 0x330f, 0x0) ioctl(r6, 0xa5c1, &(0x7f0000000380)="d92376973bfb0594131172cdfb56a8d6e745883d638f068fa3fc8106b5ec5422f278a96b37f662ab687e4e36e347fc1d0d312cd01874348595c6805d1b1983e4c7db5fb97fc85f2a2e70e11277eb1f5d41480a864acf8f640b25df1c96c300") r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r7, 0x330f, 0x0) r8 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcsa\x00', 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x208001}, 0xc, &(0x7f0000000180)={&(0x7f0000000300)={0x74, r3, 0x10, 0x70bd25, 0x25dfdbfd, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3}, @NBD_ATTR_SOCKETS={0x24, 0x7, [{0x8, 0x1, r4}, {0x8, 0x1, r5}, {0x8, 0x1, r7}, {0x8, 0x1, r8}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x1}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x1d}]}, 0x74}, 0x1, 0x0, 0x0, 0x2}, 0x18000) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1914.935513][ T26] kauditd_printk_skb: 9 callbacks suppressed [ 1914.935538][ T26] audit: type=1804 audit(1579065308.436:1048): pid=8384 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1544/file0/file0" dev="loop1" ino=1321 res=1 05:15:08 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000300)={{{@in=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@multicast1}}, &(0x7f0000000040)=0xe8) socket(0x10, 0x2, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) r7 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r7, 0x202002) keyctl$chown(0x4, r7, r5, r6) lchown(&(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', r3, r6) [ 1915.071405][ T8400] device syz_tun left promiscuous mode [ 1915.077518][ T8400] bridge1159: port 1(syz_tun) entered disabled state [ 1915.098045][ T8400] bridge1160: port 1(syz_tun) entered blocking state [ 1915.117140][ T8400] bridge1160: port 1(syz_tun) entered disabled state [ 1915.132588][ T26] audit: type=1804 audit(1579065308.636:1049): pid=8389 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1509/file0/file0" dev="loop4" ino=1322 res=1 [ 1915.135561][ T8400] device syz_tun entered promiscuous mode 05:15:08 executing program 4: socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4040ae79, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="4000000010000108000000000000000000000000c0c42338c68169ae4306c8b9aa30139596182a2eae1f0becff893aea374aca4ff65605b5920000000000000000b69b17f9912df49fb11c9c4618c56d5139", @ANYRES32=0x0, @ANYBLOB="000000000000000018001600140001008d00030000000081000000000000000008001b0000000000"], 0x3}}, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x100000000011, 0x0, 0x0) bind(r8, &(0x7f0000000140)=@generic={0x11, "0000010000000000080044944eeba7502f6c59e7f202738f6e3d2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027eccaf3f6db1c000100000000000000497400000000000000069e735ecc326d3a09ffc2c65400"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0}, &(0x7f00000002c0)=0xfeeb) sendmsg$nl_route(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="240000001800010000000000000000001d01000008000a00", @ANYRES32=r9, @ANYBLOB="080009003b000704001275989499f23065175660ee0559e1fb32bc53b4405774c31069dfb8e2b272f19b8a97d707b36399db", @ANYRES32=r6, @ANYBLOB], 0x24}}, 0x0) r10 = syz_open_dev$sndctrl(&(0x7f0000006000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r10, 0x40045532, &(0x7f0000000000)) openat$audio(0xffffffffffffff9c, &(0x7f0000000280)='/dev/audio\x00', 0x140202, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) [ 1915.175545][ T8402] device syz_tun left promiscuous mode [ 1915.182755][ T8402] bridge1118: port 1(syz_tun) entered disabled state [ 1915.214835][ T8402] bridge1119: port 1(syz_tun) entered blocking state [ 1915.235595][ T8402] bridge1119: port 1(syz_tun) entered disabled state [ 1915.270969][ T8402] device syz_tun entered promiscuous mode [ 1915.318300][ T8405] device bridge_slave_0 left promiscuous mode [ 1915.324624][ T8405] bridge1159: port 2(bridge_slave_0) entered disabled state [ 1915.422013][ T8405] bridge1160: port 2(bridge_slave_0) entered blocking state 05:15:09 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x1000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1915.464736][ T8405] bridge1160: port 2(bridge_slave_0) entered disabled state [ 1915.542342][ T8405] device bridge_slave_0 entered promiscuous mode 05:15:09 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x6558}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:09 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe44, 0xa, r8}]}, 0x28}}, 0x0) [ 1915.837171][ T26] audit: type=1804 audit(1579065309.346:1050): pid=8430 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1602/file0/file0" dev="sda1" ino=16788 res=1 [ 1915.910451][ T8428] device syz_tun left promiscuous mode [ 1915.918379][ T8428] bridge1160: port 1(syz_tun) entered disabled state [ 1915.953069][ T8428] bridge1161: port 1(syz_tun) entered blocking state [ 1915.972022][ T26] audit: type=1804 audit(1579065309.476:1051): pid=8415 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1545/file0/file0" dev="loop1" ino=1323 res=1 [ 1916.008235][ T8428] bridge1161: port 1(syz_tun) entered disabled state [ 1916.034090][ T8428] device syz_tun entered promiscuous mode [ 1916.048942][ T26] audit: type=1800 audit(1579065309.516:1052): pid=8407 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.1" name="file0" dev="loop1" ino=1323 res=0 [ 1916.073221][ T8431] device syz_tun left promiscuous mode [ 1916.079029][ T8431] bridge1119: port 1(syz_tun) entered disabled state 05:15:09 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0, 0x9, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1916.103834][ T8431] bridge1120: port 1(syz_tun) entered blocking state [ 1916.121411][ T8431] bridge1120: port 1(syz_tun) entered disabled state 05:15:09 executing program 1: r0 = syz_open_dev$video4linux(&(0x7f0000000000)='/dev/v4l-subdev#\x00', 0x100000000, 0x9e89b5b9d227f177) ioctl$VIDIOC_G_INPUT(r0, 0x80045626, &(0x7f0000000040)) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r2 = syz_open_dev$vcsu(&(0x7f0000000200)='/dev/vcsu#\x00', 0x4, 0x400000) ioctl$VIDIOC_G_OUTPUT(r2, 0x8004562e, &(0x7f0000000280)) ioctl$SIOCAX25ADDUID(r1, 0x89e1, &(0x7f00000000c0)={0x3, @bcast, 0xee01}) fchdir(r1) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/dlm_plock\x00', 0xa7bf998b598ebec3, 0x0) ioctl$VIDIOC_DECODER_CMD(r4, 0xc0485660, &(0x7f0000000400)={0x4, 0x2, @stop_pts=0x5}) ioctl$SIOCX25GDTEFACILITIES(0xffffffffffffffff, 0x89ea, &(0x7f0000000380)) r5 = syz_open_dev$sndctrl(&(0x7f0000000300)='/dev/snd/controlC#\x00', 0x7a7b, 0x800) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r5, 0xc008551b, &(0x7f0000000340)={0x3, 0x4, [0x48b]}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_uring_setup(0x64a, &(0x7f0000000140)={0x0, 0x0, 0x1, 0x2, 0x2dc}) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1916.134376][ T26] audit: type=1804 audit(1579065309.636:1053): pid=8417 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1510/file0/file0" dev="loop4" ino=1324 res=1 [ 1916.172609][ T8431] device syz_tun entered promiscuous mode [ 1916.201034][ T8424] device bridge_slave_0 left promiscuous mode [ 1916.210416][ T8424] bridge1160: port 2(bridge_slave_0) entered disabled state [ 1916.230748][ T8424] bridge1161: port 2(bridge_slave_0) entered blocking state [ 1916.241311][ T8424] bridge1161: port 2(bridge_slave_0) entered disabled state [ 1916.249909][ T8424] device bridge_slave_0 entered promiscuous mode 05:15:09 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000300)='/dev/snapshot\x00', 0xe439a3edb1b2582f, 0x0) ioctl$SNDCTL_DSP_GETIPTR(r1, 0x800c5011, &(0x7f0000000340)) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) getsockopt$XDP_MMAP_OFFSETS(r4, 0x11b, 0x1, &(0x7f0000000140), &(0x7f0000000200)=0x80) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:09 executing program 3: r0 = socket$unix(0x1, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000000c0)) sched_setattr(0xffffffffffffffff, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x3, 0x9, 0x0, 0x0, 0xfffffffd, 0xffffffff}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101000, 0x0) ioctl$VFIO_CHECK_EXTENSION(r3, 0x3b65, 0x4) fchdir(r2) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0x76656f) r5 = syz_open_dev$cec(&(0x7f0000000200)='/dev/cec#\x00', 0x1, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r6, 0x330f, 0x0) accept$unix(r6, &(0x7f0000000300), &(0x7f00000003c0)=0x6e) ioctl$VIDIOC_G_OUTPUT(r5, 0x8004562e, &(0x7f0000000280)) bind$l2tp(r4, &(0x7f0000000180)={0x2, 0x0, @broadcast, 0x4}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0xffffffffffffff88, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r7 = getpid() sched_setscheduler(r7, 0x5, &(0x7f0000000380)) write$FUSE_LK(r2, &(0x7f0000000040)={0x28, 0xfffffffffffffff5, 0x8, {{0x0, 0x40, 0x2, r7}}}, 0x28) 05:15:09 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe48, 0xa, r8}]}, 0x28}}, 0x0) 05:15:09 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x6800}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1916.480936][ T8456] device syz_tun left promiscuous mode [ 1916.508985][ T8456] bridge1120: port 1(syz_tun) entered disabled state [ 1916.537602][ T8456] bridge1121: port 1(syz_tun) entered blocking state [ 1916.594890][ T8456] bridge1121: port 1(syz_tun) entered disabled state [ 1916.621644][ T8456] device syz_tun entered promiscuous mode 05:15:10 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xedc000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1916.724783][ T8450] __nla_validate_parse: 6 callbacks suppressed [ 1916.724794][ T8450] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1916.740351][ T26] audit: type=1804 audit(1579065310.226:1054): pid=8462 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1604/file0/file0" dev="loop3" ino=1327 res=1 [ 1916.818356][ T8467] device syz_tun left promiscuous mode [ 1916.824091][ T8467] bridge1161: port 1(syz_tun) entered disabled state [ 1916.851488][ T8467] bridge1162: port 1(syz_tun) entered blocking state [ 1916.873651][ T8467] bridge1162: port 1(syz_tun) entered disabled state [ 1916.903996][ T8467] device syz_tun entered promiscuous mode [ 1916.938251][ T8469] device bridge_slave_0 left promiscuous mode [ 1916.970902][ T8469] bridge1161: port 2(bridge_slave_0) entered disabled state [ 1916.998301][ T8469] bridge1162: port 2(bridge_slave_0) entered blocking state [ 1917.025580][ T26] audit: type=1804 audit(1579065310.526:1055): pid=8451 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1546/file0/file0" dev="loop1" ino=1325 res=1 [ 1917.068838][ T8469] bridge1162: port 2(bridge_slave_0) entered disabled state [ 1917.101208][ T8469] device bridge_slave_0 entered promiscuous mode [ 1917.113110][ T26] audit: type=1804 audit(1579065310.596:1056): pid=8455 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1511/file0/file0" dev="loop4" ino=1326 res=1 [ 1917.150697][ T8472] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:10 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) write(r3, &(0x7f0000000140)="65ec705f7edd423aea83e0ed97591b85b0c3e5e9924c5676e3dd99ddf532bb784f4ad4e708493f890886bee6ffe6f7bf11274fc29d8865409f1f4ef8cdbd8edd9b9b7130d28b83", 0x47) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000200), &(0x7f00000000c0)=0x1ff) 05:15:10 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x6c00}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:10 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe4c, 0xa, r8}]}, 0x28}}, 0x0) 05:15:10 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0x76656f) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f00000000c0)={{0xfffffffffffffffc, 0x2, 0x2, 0x3, 0xfa}, 0x9, 0x1213, 'id0\x00', 'timer0\x00', 0x0, 0x9, 0x5, 0x3, 0x81}) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x10) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, r2) getsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, &(0x7f0000000000)=[{}, {}, {}, {}, {}], &(0x7f0000000040)=0x28) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:10 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x3b4, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x1d3}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x1) [ 1917.485090][ T8490] device syz_tun left promiscuous mode [ 1917.510836][ T8490] bridge1162: port 1(syz_tun) entered disabled state [ 1917.520475][ T8490] bridge1163: port 1(syz_tun) entered blocking state [ 1917.527369][ T8490] bridge1163: port 1(syz_tun) entered disabled state 05:15:11 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000140)={0x2, 0x1, 0x4, 0x800, 0x1, {r2, r3/1000+30000}, {0x6, 0x2, 0x9, 0x9, 0x9, 0x7, "a291fde1"}, 0x2, 0x2, @fd, 0x3, 0x0, r1}) accept4$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast2}, &(0x7f00000000c0)=0x10, 0x80800) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1917.534736][ T8490] device syz_tun entered promiscuous mode [ 1917.547518][ T8494] device syz_tun left promiscuous mode [ 1917.553100][ T8494] bridge1121: port 1(syz_tun) entered disabled state [ 1917.617904][ T8494] bridge1122: port 1(syz_tun) entered blocking state [ 1917.624702][ T8494] bridge1122: port 1(syz_tun) entered disabled state [ 1917.698494][ T8494] device syz_tun entered promiscuous mode [ 1917.742797][ T8485] device bridge_slave_0 left promiscuous mode [ 1917.751367][ T8485] bridge1162: port 2(bridge_slave_0) entered disabled state [ 1917.777982][ T8485] bridge1163: port 2(bridge_slave_0) entered blocking state [ 1917.785315][ T8485] bridge1163: port 2(bridge_slave_0) entered disabled state [ 1917.829675][ T26] audit: type=1804 audit(1579065311.336:1057): pid=8486 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1512/file0/file0" dev="loop4" ino=1328 res=1 [ 1917.856068][ T8485] device bridge_slave_0 entered promiscuous mode 05:15:11 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x40000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1917.879582][ T8488] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1917.911990][ T8510] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:11 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x20000, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x22, &(0x7f0000000180)=0xfffffffb, 0x4) 05:15:11 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x6c02}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:11 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe50, 0xa, r8}]}, 0x28}}, 0x0) [ 1918.212639][ T8517] device syz_tun left promiscuous mode [ 1918.225641][ T8517] bridge1163: port 1(syz_tun) entered disabled state [ 1918.269816][ T8517] bridge1164: port 1(syz_tun) entered blocking state [ 1918.344653][ T8517] bridge1164: port 1(syz_tun) entered disabled state [ 1918.386272][ T8517] device syz_tun entered promiscuous mode [ 1918.400456][ T8521] device bridge_slave_0 left promiscuous mode [ 1918.428329][ T8521] bridge1163: port 2(bridge_slave_0) entered disabled state [ 1918.470707][ T8521] bridge1164: port 2(bridge_slave_0) entered blocking state [ 1918.493879][ T8521] bridge1164: port 2(bridge_slave_0) entered disabled state [ 1918.505674][ T8521] device bridge_slave_0 entered promiscuous mode [ 1918.568643][ T8522] device syz_tun left promiscuous mode [ 1918.598493][ T8522] bridge1122: port 1(syz_tun) entered disabled state [ 1918.623034][ T8522] bridge1123: port 1(syz_tun) entered blocking state [ 1918.645523][ T8522] bridge1123: port 1(syz_tun) entered disabled state [ 1918.668818][ T8522] device syz_tun entered promiscuous mode 05:15:12 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f00000000c0)={0x3b0000, 0xffff, 0xffff8001, r1, 0x0, &(0x7f0000000000)={0x35e, 0x10001, [], @value=0x7f}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x34, r4, 0x909}, 0x34}}, 0x0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, r4, 0x380, 0x70bd29, 0x25dfdbfe, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1918.700731][ T8524] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1918.776575][ T8519] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:12 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x7400}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:12 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe54, 0xa, r8}]}, 0x28}}, 0x0) 05:15:12 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000000)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x400, 0x0) r4 = getpid() sched_setscheduler(r4, 0x5, &(0x7f0000000380)) r5 = getegid() r6 = getpid() sched_setscheduler(r6, 0x5, &(0x7f0000000380)) r7 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) r9 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r9, 0x202002) r10 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r13 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r13, 0x202002) keyctl$chown(0x4, r13, r11, r12) r14 = getpid() sched_setscheduler(r14, 0x5, &(0x7f0000000380)) r15 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r15, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r18 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r18, 0x202002) keyctl$chown(0x4, r18, r16, r17) stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r20 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/thread-self\x00', 0x101000, 0x0) r21 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r21, 0x330f, 0x0) r22 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r22, 0x330f, 0x0) r23 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r23, 0x330f, 0x0) r24 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r24, 0x330f, 0x0) sendmsg$unix(r3, &(0x7f0000000500)={&(0x7f0000000140)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000000200), 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=0x0, @ANYRES32=r5, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r6, @ANYRES32=r8, @ANYRES32=r12, @ANYBLOB="00009a0000000000000001", @ANYRES32=r1, @ANYBLOB="1000145bd89a28660000000000001a000100020002004000cf2d1f4960fb05", @ANYRES32=r14, @ANYRES32=r16, @ANYRES32=r19, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32, @ANYRES32=r0, @ANYRES32, @ANYRES32=r20, @ANYBLOB="30000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32=r21, @ANYRES32=r22, @ANYRES32=r23, @ANYRES32=r24, @ANYRES32=r0, @ANYRES32=r2], 0xc8, 0x2008800}, 0x1) 05:15:12 executing program 4: r0 = socket$unix(0x1, 0x5, 0x0) getsockname$packet(r0, &(0x7f0000000840)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000001ac0)=0x14) socket$inet6_sctp(0xa, 0x0, 0x84) socket$unix(0x1, 0x0, 0x0) r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000980)={'syz', 0x0}, 0x0, 0x0, 0x0) keyctl$read(0xb, r1, &(0x7f0000001a00)=""/126, 0x7e) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0xa, &(0x7f0000000880)=[{&(0x7f0000000300)="a6bd231eaf8e34291e7ea63944710d48438c5b18f4f5785a5a7abb251ae5970d1ca704d05233eb111540adc1ed8986128cd164a383e8fe8949c8760efe172c6a83c8a83d533b6a8df8e290df59f8f7219070d2777904b3a1949bf70b5d0ed93ad422ec3e2f25076313218b38e7d9db55ccfea637f74257e40322cc61a66dc02cbf3f8bd30180b6fe9f98c2014205d0108cd7d31acdeb183a48de0a885fde17ba400a9c36d5f5da786533a3b950394df8ec355388d4661400574e7ebd1f6bbad1f5408592443114511e1b", 0xca, 0x9}, {&(0x7f0000000200)="96e741eafa6a8b92bac45f33cbab0c276103a7c746f078494da8054c53111a23a16a710fc8f55a97aa1b304c0b", 0x2d, 0xd14}, {&(0x7f0000000a00)="12a5a252210d8ff5ea6523d200714487288280b851aa6c4ecf69628560bc83236247c2c0d6f6eb9d552ac9605f2e2f59c84afe6beeb2d05b076a07a62bd678af6bcc3ac545774b028fdcfa7ce8ec019ed7d1dcc75e83acd4960b38f83c47f988bb0263de6042406609969439e25c19db505fe59e739011335bd7887b5dd0b048912f03615f84be646447c74efe5a99345517ecab05bf9506897ca086adaffc87a1651578d544a4ea1b452d430adf3cea63a0e9b6e0b94f5301fa43753699bf5f49e722c24d0539e53dc0547774d436053a94770fe5930074485ca8253a6d09e95e3dfa7c38d19669b9adbaee43ffe8a9f5026e1ea42620bb75391fb6b8e458e24fb7e63e68eda9a601167dd9c8678683dd9fd74ec3c3b4cf5f468d93cc8349b1e43a1f57c9f996f54684ac5acd00c68d8ced70db2a98ad90b72c6220771b3c31c7b9cbc0271a9a69dccf0c409a3100cb750ffbcbaf9042f1bfb2fba90b1c15201c7e0a21396ccbf061f1232cedb5a1530376287dc3f7505c0d0d66e66dce6e2f1bfe20d228f9a29e05c07a0b635c5af910073e02798bee412c0d841a8969e89116e5f646a4fde126765bf4198a6051912298707286af7f780d07835c6812434f0cefd9d190bb0f1c52a8313ab88d7ec2811549c8300d31f924c89355f82ad2d59dfc96ba14b5a48c4c1c76751052a852c769c55a5b4f8bd77356e38fe41d784ddc98bcbe58f21e0df1c9c2f31dcde5af30ce7405aa23be9ee686a9c10addb8a59ec4527f83c93be1664788778d360edb6ca89952237405bd564a2c74a1bd7910db35f3bd2f3bb2d032219e72e96c76d3dce3ea18cbe9458ccda961a5bf178b127118611dd83f862c57e385fb1b4fa43da39c365ccba5ba9a59c37684e971d8039ac536fe73af95a586d76ec6149c27367a1a690e85f954aa090c66a6e2dc0bc5c64bcc837ac48e7d1e26896d078b07bf62f3ad55c950d17731af54316184e90c938676d1b5c615880fa14165b982ed94aff18e4c61a2ef6af4da238f0b68d60ff28577a84dee729540ec1792b0915f28ec8aa89b7aaabc2d09eca224240dda49b7dde19b9fff3aa61ca199ee6f2008dbeec64f9c78a8452008343ef88ddc2c2e975390c10ae408fc5e3bfe1d9640e3f33916d33713843d833e0e6cc3e596206d196625d223b9ddbf6b11386f7489676e124a5497e450f7280a51d85657414fc68bc2215305758f46a34a82290c459a69b1486724e08d0fe673e476517e65018978c2f40055619b011f061e4385b0ff65f10ba0619621404cd2e8f7e5e250ceeff045da912820633079164d01d7e2a781d4c2167c14bcb64e3019cf958a1cac243d6d14e6c29441326854dc41e603d7ed82bb033ac9062322967688ae3328b10893cfc4b6450441f52a6ee687ec6562e6163088f0343b2f9ea2c507a1fb9822750ee3d14c985bd03389fe062d85759efce22850674a1e7847ae9ffd0201b27014cac797e05888c498c83a6ff6860b9eae44e01bc0cf3cdd2cc4f291f648691681f0cfd1e8edb81189a0b4837c168ee8e7d6dfc18022af9051154fa01c8cecd74307cf09ac89025de9f1cc45f5233cf07f94ffc7cc76c41376cd4c0c8d07c5ea392d04c8eaee1b6f752dfb5c03888d416d32111418755b1ff24b4b7bbf01fec0da9be5c9d09d49f1726e705be0525924aad2da5da57a6ead30d9dabb0d1863f4189a36dfefbb9be80d31b615ebe42e5a4fc174c9e08c7c2f9bf6dfd9c5b3bf0772b3b9b977ea5faba9f9053c9d4b5b5e2b22fdde4ab09aae4a029115c863f72b2831e3b302b5c2b94dc42c320e2d03578569bc399a9d6ad302e2dd3068b16e81318259f9052e5fa787e9f005b784ee471f065913f98348f3b873ebc97a5f5c1a9133bb8968ae41d11e19dc844187a792030b986b4b92a9e61a7643d9a889f0d8a0c5b87a60805c56adf2af3e0f3d94c8c509576c8155cf23661e30c5d3d1506b88d224c1d2b17ec072b2cb6aa3ceeab8234f003cdb6e2b9fad8399be4199a8fa5ad458e438d2531b8b0384baef49686cd224ef7cad209471fcc446c6b221a11faf6df42e621b0ab5507b5c04c852b3cca661015bbf7cca815bf2a7089350e5b7d211b6751f41287e4ea114235e75b224f97d541b50982aac7e92f0ea1fee1a4b4f71fc8e076a13ca28605093ecab0b79ffea4760c8be6b10e96794c1bc2ad92895f27ea3fb2fde9c3c57be1f166b895c04ed8694c30c51823dfe719f39df35f7daeecb0f59fdc43e1e275972b5e0c24331c1bbacbda4dddf74e3207d80d9aa1da0e6dce503a663dc6f197c705e1e27ecbac81520c57ff9a4054cf0b13fc2ada9938da137c40a1967eca08d264cde6ffeaf68eee5910e8fab856443c1b20ce46ba8f320e829937fb53f620716d5d08290d13995d906e862a431daa4a047dc21ac73a22d9c06b07d7d62c90a3ceaee1220b4af35c1a4262f81829d88e90c8d3decf9ab29eb49dbeb40ae574eab90219152eae426cfea7a601aca9a1cd4245c368dc0de4724b89a8a9d1beeedd13d7812c41d2acea209751744a4031b5dac4fa0241336c9361b63a77941a07c80a6eb8528ea09bb5e30785f79921b3084d2d673fb0fbda6fd7e22b8fb7b423a0fea953e611ad7cc15bff3ac0e41b03c21d6ad0beb741575be61805e2ba4a1162eaa833130875d2077826d7966be4d49e422cc9f596f14c21b4e2526818df552a7352e09ccafeca19bbb0dfdd1dad86a0886a9f901326bf15793d2e0adc461e984495a9ee776415e6c7bd3799a2b823bb0a0c5a822558ab4f659633e1096e019b4dddca4e7b6cb0eaff1d5d3e49c928fdd0d3a599af3d971077223e7a1334e082bb7f645613cfae7045a757b98c347169045391cec2742c95fa13d96eb1e4e540c1e8dc909b2af5bf4444d0b866161b59ff2de98c232125831be142b68c00007e3b05f1c4685149189b3e6e4036be9a810d08ba35839a17edba058f6ad1ba73e8ffa84fb6c7963d8f795a9ce368e6c2d5afd04e08dd21766d37fd3bed46f914329cce1270ad5bc753d7dcc9047933963d25983acc62305001ba7610ab5bd7d6c6050ac29a446f5a88527a0a7637fff948b876b26e4ba7afbfa987f4c1bf8344a20e848ec2bc2ee17affc71b25591e5de695ef4773fce53266212dfafe9b4a8f399cec8b263eb6aab7a765307445c879159778b8537745802d3ba0a3dbf8429b9dbbc7d390903e2be021501cf6c06770fbb379c61ee545de31098da2abbfacb5eeb60c8caee26bd1bcf4704e2c7c6c2ef9ce83f393cabe04c61a4c2ca6e4f6c9d9f8e05ff4c7267d3fd58ed95ad0648ea1471ed4c15f1ae00db649e26925bba95383162de8d3c607068560173c048387b63eb3011bb4bc08791911f46e9247c3d6ad210c9feb7a1b96f49971762d78befef796c053a419ff391a12445d2e70fb909bddeac96cfdf64319306db9cd1ee013f36c3a83861edf326a7df9b23a6ba0e7f20c5cc40bb8790bbee458e8dcc355521cef334614138ac782f5a9d57f6a71389ed8f24fe9ceecba9cf8c456e36fd8c16666e212277ad85f9a09cd49539af2fc7878057352415f3bee1b7dc1897ee324085b57e6b75f53952d5f6ae94cdeffc5915d683d82fb2c95ee31274553d357bfeb009ea2078dab47533861479a8df77cd788d26f007b98f3d3778a66601de49abdae79ff326e36e46213f8ec9fb0e74a20ab74f880fd8b35b50e036eada714ada724e4e05cf06bf11a6eced910f9d4599f1b439c36ba6b5ccde9da6a74bd91b30496bd2fb1110d278837400d763df6f9f4f95b38b4fd329a6788528b1bc90208a956136e6374eba04898ab4f743107dfcc3322f219b3ae488cf76152990d3140c8301539f57215b108eac1afd1e0f5e2202f5fe091db7762a45c0a231905a7a6c0d995547049d0a720ada4202eca35eddc28f1268171f32ad9a47005394ce3ab632ae6411b020108c3d2dd3d44ce20e1a8971e1415a8ca435c4874b4079ac595a4d8d15522c5515dc3e93fc28fd31ce49c6636cd68a23552ac83aca70003a38ee58fdc59a480a8d494875372a90baba052813f1a3d5e5e58447f0ab95400bc9ac3e6ca5a3e6f2e94b357a9b30b6385caba23c3c74c3ebd5061588b4b354ff392dd82bf1e5a3b708598ea90cf613e979aa3549b84563e40d2b65192206204ef3e08d9baba53950ae8e449f18836b51c952ec73ee7346a7b71006fc4bfc2fbf74682dd5ed7ae223cb76a816603aa5cd3ee71c4dff0a401191a4a7a60ff2880efed78f08303fa91148174f8b9389404a63384bb930252769cf9e79e57614f1ede295a06bc774550a46da8c366ba60ea34d5b7cffee209940dbfed1ccba9f09a203dd0ebdd2227a0705d48f62df42e78c3546e9728bb241f8fee569830232268a4834b7e885e383101df5c69cd004202f01c06faf33e9af3bc86e01248ecf19c3fb3fbba77f66980f37ba7af68478853c65de82c244d456b051cd5ea9d0d96531360db48d5cb54f7760088d29025c93cbccb1baff1bf99f33f540d134100dd55d955392d53cde28d12a2e6af4e21e1494f0fe97dc24bb7eecabfe6e7a89f2f4b52c3ba03b79be7905b95efcf38e5a997458651d6699582198efa9144ebeac14c1fe8852ef49101a13891419a77e73d1f8ad4e6d43937f12d2b7c19d773c4f1a61d4f99982a06774e16d58282dddba246eeaa6c7d08d63ae3a931650a260fb7a22afd15ccf9e4641f4506aabebcad9af68c406d20dc7f0d9f0314b953193709c61f943e03fba90504b6a09bfac86eed684670bc3c9509d03b5beb83dc6f064d35ae6346ed3c1e309bfc7069bd5f9dab128de84b19de8d9f33d44fb42c636fd25de97b26b9815712a6b8c8f605ad2ce0a337bfd712063e7d9a5a12943579a0296ccba25ae7f9963042c7d3db5095fa0c88f63bd67837812c30e56721e1689232ade402f6a3c7f0bae6838e07909ab3f2a5161ce78dcb03caa4f0ccee6b1a7e359d2a231900f4c3d0f29f27e532044d2968d6c33d10a34acf5283eef2e3cae9ec1c5d83ae918e8cdd0c160fc60b5faa8a1e3b3c16c87f5e70f2bf17455732a0d7998d7177bb44b6f877ab13c2cb1dd06c9b909cc1f5cdadf58d299f811badd53e7ad3f540f024c7001220880d628bbd4ba009944fd1065e1f91feae4ef35c077dcb81a08768b3ea5a74a904beea96dfe0821b562335df45a23e5be99d35674037db505ec4184bf62e1f811d45e22081e895b258125f74a57692850f613628df859536833e5f604e6f8f69a67c6135cba32978d29d5e269499fcd9b7f6244d87964c3cf1e64e6ea1021fac9d069a38f0f608fbcc3f2af11d6bb0035978a49e21071615f155cd59100b30a5899f7e80d3bae26835d30ab08eb71046ac4b3632d1a2f2be1fe090ee85d7e2056a9e3115bc233b2c46f160ed367ba7bc0cf77e9a7ef5ecd1e53fce6466fecc889ee67e4cec382d2fef47e150d6c087624c58aeb5df1c8c7415cbb696cf5f3e2e7b39f8f2daf4b94fcac97a3825f43b9e3a5f71378d5358ff933c69d78dac267781211ccf0e5e5c65ee1d803efecdf3b60e1ee4ea4e821b8f31231d2a4354e745069849d2f236b41bcd7f9087499531244a706f192a57f839e05c1df889ba3d4320fa29951647dc05e2cfd3593079cb7afd82eb6782f1518ccfcfd96c5720966d436545c1e8aa1424881bb4dc0dd4e66f60b97a0a0b4edf742285b08203b42488f96f25c18ed44ed5ed036c0bd6ba555339cf192eba307694c32ddc90f0d17", 0x1000, 0x4}, {&(0x7f0000000400)="a992e848828120ac6bd49375bf6d3485a174e22eac961981cff35c39d82229d241bf9c9730ad23f0bff997709f0ec7289624038e03ca531d96faf477e5cfbdf37f34fb1366f015621d32d115ef4e2def7523cfe6c580705221a4b5435af2bc19b9e85066bbbc848805b4dbce863bd96a7ebcddda962473766790778d92cb556ea12a84126e0cb2fd08e86c612462f017d1ab96cbda467975bc5b921bcfc2c54da619c79b1526c081bb8db8214562112d1c98c9d4b73bdb3b522c029d819cb58150ca7a0059f1f1e958c7ffa78dc9609b40a72e89057bb0a1d6603a542ea0be2a0f13786720a65f8a64933ea3f980557140ad2044c73b", 0xf6, 0x6}, {&(0x7f0000000580)="4d4c1d3b949221144613aedab26ea564a68c68ba79b14d2e6c9241a734a5fc184e7c95145d37d4debd6dd481048ae683bb329b34a0d5f96cc2add7fb18938f59ad4a764e1a81333a0cb5c42200bea7da13e9ec1e603304214f4d948374dbb5274a1161a13993e6f498e72acee1732c2d01e21ae7d73c4d4d012c71518fa343b254ff5b3c7cb15cefa4917bec8c560278f0bd1d35e387407bdb01a5dff09b0cf052123baccd582e6e5da6bd2fa0008a", 0xaf, 0x10001}, {&(0x7f0000000500)="8e0183e933a0caed3647fdf379a1d8a727bb76b20df0ec2584d63943ddacd3fe27405da8318444bdedccddfc7f28927a1503b31a074146c000", 0x39, 0x1d}, {&(0x7f0000000640)="a842025e96a3e03d4ae4d3329fd91d795a43436d1117ebb0287d613508908fb8dab91c14aee9c20283302eaa02fa6d9bee49e0a79e403c9cb9026a8c578693ddfff8b01d119b", 0x46, 0x6}, {&(0x7f00000006c0)="710bb9292d522c2fb48421445051df9b4d5ffc4919cdb364208bbadf0a937f07a9b58641fbb86816e99b225bd0b2d583683f7d0e1ab71e2a1a4c4e57d424d9836f6cfa70f2ec6be8004352797d95803f0ab52643c12775e1033cd236e43d5230f7ed30913e1ed7b0068a5a1e41875f7bb41daedeafc761e4e35b7deb6051e22d06084bbe160637c5012605c7a0c5b3d15510", 0x92, 0xb925}, {&(0x7f0000000780)="2601be564bb885fb2f28c90a56e735d4be7774c7596e0cefd25f4635d6030b0dec5775492e60072afd8f17b7e9434e77006bfb749158549695706fae988766a9cd2caf08ea80aac311e41456778c621e71d5d88c00e94b901f41e2f36edd5ae3127d05bea6393c895d435bb594fd990dea24a8d7384660df8f92e92963d26d628ce671bc62a510f7f37f220a84324647c40d30", 0x93}, {&(0x7f0000001a80)="f0b990795fc90a88ffd126b902ea9ef1e5100d5847fdeae39cbba9119e0881", 0x1f}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000140), &(0x7f0000000180)=0x4) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000001b00)={0xffffffffffffffff}, 0x400) r6 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r6, 0x84, 0x6d, &(0x7f00000003c0)=ANY=[@ANYRES32=r7, @ANYBLOB="76000000e64c772ff3d61ac642b6a108c69349d4b005dab21dda9f6e7688b89d179a2f8b59e30d89278d1f419f1d2065eeb4634d16618eda264d4502f4cc9c9c5dea5b347af89000000000000000000a4aae8e8ccf4c942cd6e1abd23f05f0ef0b15ba8c62135b218b34347007b09ab532f508356ea5738fd331207bb65971a2fa661b4b9be46013d5bbeed70dfd3a1ba99903a62b4d4ab056bf63796386d8383b02063da9"], &(0x7f0000000140)=0x2) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r5, 0x84, 0xa, &(0x7f0000001b40)={0x6, 0x0, 0x2, 0x20, 0x3, 0x2, 0x7, 0x200, r7}, 0x20) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:12 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x100000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1918.979401][ T8538] device syz_tun left promiscuous mode [ 1918.985121][ T8538] bridge1164: port 1(syz_tun) entered disabled state [ 1919.027131][ T8538] bridge1165: port 1(syz_tun) entered blocking state [ 1919.086458][ T8538] bridge1165: port 1(syz_tun) entered disabled state [ 1919.142972][ T8538] device syz_tun entered promiscuous mode [ 1919.192440][ T8554] FAT-fs (loop4): bogus logical sector size 697 [ 1919.222981][ T8543] device bridge_slave_0 left promiscuous mode [ 1919.227993][ T8554] FAT-fs (loop4): Can't find a valid FAT filesystem [ 1919.244210][ T8543] bridge1164: port 2(bridge_slave_0) entered disabled state [ 1919.306911][ T8543] bridge1165: port 2(bridge_slave_0) entered blocking state [ 1919.355539][ T8543] bridge1165: port 2(bridge_slave_0) entered disabled state [ 1919.366383][ T8543] device bridge_slave_0 entered promiscuous mode [ 1919.410423][ T8549] device syz_tun left promiscuous mode [ 1919.434902][ T8549] bridge1123: port 1(syz_tun) entered disabled state [ 1919.451334][ T8549] bridge1124: port 1(syz_tun) entered blocking state [ 1919.485532][ T8549] bridge1124: port 1(syz_tun) entered disabled state [ 1919.499020][ T8549] device syz_tun entered promiscuous mode [ 1919.524767][ T8552] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1919.587258][ T8549] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:13 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x7a00}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:13 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe58, 0xa, r8}]}, 0x28}}, 0x0) 05:15:13 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x3, 0x0, 0x0, 0x105, 0x0, 0x7ff, 0x0, 0x0, 0xffffffff}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x204000, 0x0) fchdir(r0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r4, 0x202002) keyctl$chown(0x4, r4, r2, r3) syz_mount_image$gfs2(&(0x7f0000000200)='gfs2\x00', &(0x7f0000000380)='./file0\x00', 0x3, 0x1, &(0x7f0000000400)=[{&(0x7f00000003c0)="31b5d00eef8179674e6cdc913d2ef2d6c6ddf8e7", 0x14, 0x1}], 0x1028000, &(0x7f0000000440)={[{@localcaching='localcaching'}, {@nobarrier='nobarrier'}, {@errors_withdraw='errors=withdraw'}, {@spectator='spectator'}, {@loccookie='loccookie'}, {@noloccookie='noloccookie'}, {@upgrade='upgrade'}], [{@fsuuid={'fsuuid', 0x3d, {[0x34, 0x30, 0x64, 0x32, 0x62, 0x1b, 0x63, 0x63], 0x2d, [0x36, 0x32, 0x63, 0x61], 0x2d, [0x61, 0x65, 0xcf48c3bf56c66602, 0x32], 0x2d, [0x31, 0x0, 0x63, 0x34], 0x2d, [0x0, 0x30, 0x0, 0x65, 0x30, 0x35, 0x66, 0x36]}}}, {@euid_gt={'euid>', r2}}, {@hash='hash'}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@func={'func', 0x3d, 'FILE_CHECK'}}, {@context={'context', 0x3d, 'root'}}, {@audit='audit'}, {@seclabel='seclabel'}, {@smackfstransmute={'smackfstransmute', 0x3d, ':user,-GPL(,$/%\\'}}]}) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) fallocate(r5, 0x0, 0xfffffffffffffff7, 0x0) r6 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$SNDCTL_DSP_SYNC(0xffffffffffffffff, 0x5001, 0x0) r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) readlink(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000300)=""/107, 0x6b) ioctl$VHOST_SET_VRING_KICK(r7, 0x330f, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r7, 0x10e, 0x1, &(0x7f0000000000)=0x8, 0x4) write$cgroup_type(r6, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000140)={{0x2, 0x8, 0x2, 0x2}, 'syz1\x00', 0x22}) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1919.979400][ T8577] FAT-fs (loop4): bogus logical sector size 697 [ 1919.999911][ T8568] device syz_tun left promiscuous mode [ 1920.005659][ T8577] FAT-fs (loop4): Can't find a valid FAT filesystem [ 1920.041869][ T8568] bridge1124: port 1(syz_tun) entered disabled state [ 1920.077842][ T26] kauditd_printk_skb: 7 callbacks suppressed 05:15:13 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x200000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1920.077865][ T26] audit: type=1804 audit(1579065313.586:1065): pid=8576 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1514/file0/file0" dev="sda1" ino=16810 res=1 [ 1920.129731][ T8568] bridge1125: port 1(syz_tun) entered blocking state 05:15:13 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) dup(r2) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f00000000c0)=0x5, 0x4) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r3, 0x29, 0xcd, &(0x7f0000000000)={{0xa, 0x4e20, 0x8001, @mcast1, 0x101}, {0xa, 0x4e20, 0x0, @mcast2, 0x7fffffff}, 0x3285, [0x834f, 0x5, 0x2, 0x4, 0xfffffffe, 0x0, 0x7fffffff, 0x1c7]}, 0x5c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1920.189140][ T8568] bridge1125: port 1(syz_tun) entered disabled state [ 1920.220642][ T8568] device syz_tun entered promiscuous mode [ 1920.345798][ T8570] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1920.427789][ T8573] device syz_tun left promiscuous mode [ 1920.438419][ T8573] bridge1165: port 1(syz_tun) entered disabled state [ 1920.458032][ T8573] bridge1166: port 1(syz_tun) entered blocking state [ 1920.478285][ T8573] bridge1166: port 1(syz_tun) entered disabled state [ 1920.501674][ T8573] device syz_tun entered promiscuous mode [ 1920.540543][ T8580] device bridge_slave_0 left promiscuous mode [ 1920.563694][ T8580] bridge1165: port 2(bridge_slave_0) entered disabled state 05:15:14 executing program 4: r0 = socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x6, 0x0, &(0x7f0000000180), 0x1000, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) ioctl$UI_SET_RELBIT(r2, 0x40045566, 0x0) fchdir(r1) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000180)='/dev/nvram\x00', 0x8000, 0x0) ioctl$GIO_UNIMAP(r3, 0x4b66, &(0x7f0000000240)={0x9, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}]}) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) ioctl$TIOCSERGETLSR(0xffffffffffffffff, 0x5459, &(0x7f00000004c0)) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r5, 0x84, 0x6d, &(0x7f00000003c0)=ANY=[@ANYRES32=r6, @ANYBLOB="76000000e64c772ff3d61ac642b6a108c69349d4b005dab21dda9f6e7688b89d179a2f8b59e30d89278d1f419f1d2065eeb4634d16618eda264d4502f4cc9c9c5dea5b347af89000000000000000000a4aae8e8ccf4c942cd6e1abd23f05f0ef0b15ba8c62135b218b34347007b09ab532f508356ea5738fd331207bb65971a2fa661b4b9be46013d5bbeed70dfd3a1ba99903a62b4d4ab056bf63796386d8383b02063da9"], &(0x7f0000000140)=0x2) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000300)={r6, 0xa3, "ac1ee9f16e2a3d7e17487949514b04b717532388ed19d7b5ff5a65e59b33dc74e09ffcf05999d94c0adf932fb802c78c419c81f258f9b441a7c4dafef427e9ff05379002f3842d03a83ae61de0d36f2eb0661e2b369402a72e6467e8d0804df5b617761cdce3f6e1efa9b6042153d1ec1aeeaa372f36108f346c96a0582d6928b1c4dfa858f1edab6af2aa653944ce94da41d8e5d9721364a90578909ded8b4f8cfffa"}, &(0x7f0000000140)=0xab) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r7, 0x330f, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r7, 0x84, 0x17, &(0x7f0000000480)={0x0, 0x0, 0x6, "6dffe2ecf160"}, 0xe) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1920.598535][ T8580] bridge1166: port 2(bridge_slave_0) entered blocking state [ 1920.645500][ T8580] bridge1166: port 2(bridge_slave_0) entered disabled state [ 1920.686321][ T8580] device bridge_slave_0 entered promiscuous mode [ 1920.742768][ T8570] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:14 executing program 3: r0 = socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) write$midi(r3, &(0x7f0000000180)="e8fffa06a6a40e8854ec83101499670da603", 0x12) r4 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x1, 0x47) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140)='nl80211\x00') getpeername$packet(r0, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r7, 0x330f, 0x0) getpeername$packet(r7, &(0x7f0000002400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000002440)=0x14) sendmsg$NL80211_CMD_GET_INTERFACE(r4, &(0x7f0000002540)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4028}, 0xc, &(0x7f0000002500)={&(0x7f0000002480)={0x44, r5, 0x100, 0x0, 0x25dfdbfe, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x8000, 0x3}}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x2}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r6}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r8}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x6, 0xffffffffffffffff}}]}, 0x44}}, 0xc000) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:14 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x7a03}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:14 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe5c, 0xa, r8}]}, 0x28}}, 0x0) [ 1921.022664][ T8600] device syz_tun left promiscuous mode [ 1921.028325][ T8600] bridge1125: port 1(syz_tun) entered disabled state [ 1921.055294][ T26] audit: type=1804 audit(1579065314.556:1066): pid=8585 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1550/file0/file0" dev="loop1" ino=1333 res=1 [ 1921.083800][ T8600] bridge1126: port 1(syz_tun) entered blocking state [ 1921.090571][ T8600] bridge1126: port 1(syz_tun) entered disabled state [ 1921.098343][ T8600] device syz_tun entered promiscuous mode 05:15:14 executing program 1: syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000040)='NLBL_CIPSOv4\x00') syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x90) fchdir(r0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x1a) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x8, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3fe, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x2) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1921.199755][ T26] audit: type=1804 audit(1579065314.706:1067): pid=8596 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1608/file0/file0" dev="loop3" ino=1334 res=1 [ 1921.226280][ T8608] device syz_tun left promiscuous mode [ 1921.232004][ T8608] bridge1166: port 1(syz_tun) entered disabled state [ 1921.290049][ T8608] bridge1167: port 1(syz_tun) entered blocking state [ 1921.324057][ T8608] bridge1167: port 1(syz_tun) entered disabled state 05:15:14 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 1921.365422][ T8608] device syz_tun entered promiscuous mode 05:15:14 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x300000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1921.413059][ T8610] device bridge_slave_0 left promiscuous mode 05:15:15 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000000)='trusted.overlay.nlink\x00', &(0x7f0000000040)={'L+', 0x5}, 0x16, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) syz_mount_image$minix(&(0x7f00000000c0)='minix\x00', &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x3, 0x5, &(0x7f0000000480)=[{&(0x7f0000000300)="61e551057662d03e8db7b9d3d47911fd95fc739efd2727926184f20a7cf9b2b70260f4be3fcd6417fb0bd555482bfe2ed4e1cd4ab368fbdd26be22c120cfd5e04036c996b61885f335247810f42bd5e8cdd266094bc58cf05a008079927c521c221bbbda5589884daf94619c5243ef815e0a12adf8fc7aa3f02ef2f947414d655fda3283d40077fc7f4539", 0x8b, 0x8}, {&(0x7f00000003c0)="f66444d1389c354f698b7b7d50c9bca455372217bd879ed7de44ea6009b4bf09af6e0b1974f25486ee1739b56347de28a069537775d9bf9135c71e3f973bbb569cc79dd31f6862721befd1d9f71d30400f7c154a47db8c4e8784669b44719724c944a63f608319a536032656c8a5c4db3f45bccf2b60eae37afafd85e46a56777fd4c86adb", 0x85, 0x8ac9}, {&(0x7f0000000180)="923da23f9d78963713547e1f2251cc1a9e72585db10a4c736f908794f177837be83a23", 0x23, 0x20}, {&(0x7f0000000200)="7942a86455acadf16ac6636585f05711fb363e7bab708ca70bfb72ad78ed9be615c9abdef74318397b22fbea855258f4cd7f42", 0x33, 0x85}, {&(0x7f0000000580)="8bfba859d68cede9c2254a49fd3bf343ad69103df1364a9d9dcd589e9818502b55b7886df204d24da837a99ecbf2bd7471dd73aab0f7043cfbb6c228f89b56c42151f76f12b58d293fbb31744dcb41c1cf8bce29658f127ce3c007de4a2071ed4d322f1e007a28efcdb05edcc02aea67bc9d1cefe3f433e15921f8d983e6305a1783620e60e801f0be153ce87c4d9303db5dc4e17450b391b6b1e4b9779b7447c376632c41d0345466234a4122e099e7fb212f03117738d2ba1926a21a44bf1cf7f88ba9ced5cfff88c04ae83ad10b056a910468beda27f969cc0e7d2ff77e1d", 0xe0}], 0x200, 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1921.481038][ T8610] bridge1166: port 2(bridge_slave_0) entered disabled state [ 1921.528094][ T8610] bridge1167: port 2(bridge_slave_0) entered blocking state [ 1921.555575][ T8610] bridge1167: port 2(bridge_slave_0) entered disabled state 05:15:15 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe60, 0xa, r8}]}, 0x28}}, 0x0) [ 1921.579233][ T8610] device bridge_slave_0 entered promiscuous mode 05:15:15 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c90f55693fa10a66d6b66732e6661000000000000", 0x16, 0xc4d2}], 0x410, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:15 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x8100}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1921.913884][ T8629] device syz_tun left promiscuous mode [ 1921.974533][ T8633] FAT-fs (loop4): bogus number of reserved sectors [ 1921.994405][ T8629] bridge1126: port 1(syz_tun) entered disabled state [ 1921.996502][ T8633] FAT-fs (loop4): Can't find a valid FAT filesystem [ 1922.046135][ T8629] bridge1127: port 1(syz_tun) entered blocking state [ 1922.053023][ T8629] bridge1127: port 1(syz_tun) entered disabled state [ 1922.077796][ T8629] device syz_tun entered promiscuous mode [ 1922.106014][ T8631] __nla_validate_parse: 2 callbacks suppressed [ 1922.106025][ T8631] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1922.143092][ T26] audit: type=1804 audit(1579065315.646:1068): pid=8619 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1609/file0/file0" dev="loop3" ino=1335 res=1 05:15:15 executing program 3: socket$unix(0x1, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) write$P9_RRENAME(r1, &(0x7f0000000000)={0x7, 0x15, 0x1}, 0x7) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) write(r4, &(0x7f00000000c0)="c5944bc9f9147fcb23bcb464982df3f0e963ea45d6e26cf6cffe48213b1182abf4032c8d6f8b62f3300d1e44192bdf15a8e6b50d5f9c75e68c162d", 0x3b) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_bp={0x0}}, 0x0, 0xfffffffffffffff7, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1922.239809][ T8637] device syz_tun left promiscuous mode [ 1922.263419][ T8637] bridge1167: port 1(syz_tun) entered disabled state [ 1922.300303][ T8637] bridge1168: port 1(syz_tun) entered blocking state [ 1922.315505][ T8637] bridge1168: port 1(syz_tun) entered disabled state [ 1922.339480][ T8637] device syz_tun entered promiscuous mode [ 1922.409930][ T26] audit: type=1804 audit(1579065315.916:1069): pid=8626 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1552/file0/file0" dev="loop1" ino=1336 res=1 [ 1922.435098][ T8640] device bridge_slave_0 left promiscuous mode [ 1922.458218][ T8640] bridge1167: port 2(bridge_slave_0) entered disabled state [ 1922.490800][ T8640] bridge1168: port 2(bridge_slave_0) entered blocking state [ 1922.522521][ T26] audit: type=1800 audit(1579065315.946:1070): pid=8641 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.1" name="file0" dev="loop1" ino=1336 res=0 [ 1922.545548][ T8638] FAT-fs (loop4): bogus number of reserved sectors [ 1922.552126][ T8640] bridge1168: port 2(bridge_slave_0) entered disabled state [ 1922.588636][ T8640] device bridge_slave_0 entered promiscuous mode [ 1922.595140][ T8638] FAT-fs (loop4): Can't find a valid FAT filesystem [ 1922.614629][ T8631] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:16 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x9, &(0x7f0000000740)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}, {&(0x7f0000000000)="51762dd13fcd7e5623a261103128891406151b57a1abcb7e3917c2b780783dd03c335f6c53a295e626be09b1a6e993e48ef218d1a5e733da8a141f8d28fdc132eb7b871e11c321632c0f0217eaf3b23ccbe9c949bd689345d5718fbfac14bba970cd117af54d5c3c03801508e128913f7a806fdb78c9af7fe8bc1f7e", 0x13f, 0x401}, {&(0x7f0000000140)="cbd76d1f725038c5563f10a15a128cb1c13cdfc8cafa9c5b1c30a74f5854850421d90d903694505b49711143d17c6d911cae2f206c61bd7374a99c02176158862634e9f51f1d4f534f93b00e454590764825b486ff6717e8d31551a6ce3237e911b4d25f8a7cd3180120b5c5", 0x6c, 0x1}, {&(0x7f0000000300)="93b93714089f6b32c813f594c2869dea9c61c7626fcda61d494a548c43ba4e1ae2151ede44c0e27c18632d6aa796a098e55cabb3911c6539b42133919fe001a090be41ce48a436f316d140373c54e6650c7169b7efe36ef57738041ca19900c9544466c169d1c25b52e4f65eb8e56411bee4068a4d734d1db2d639c62958caabc5920037a184ba0ac7b5d08e940e20d373a61f51ae1da9dff998128c3307229b8e706ac0", 0xa4, 0x7ff}, {&(0x7f00000003c0)="7d03feaf54992302eb2ead8b0f5f32d02493c65bc266b350d67161def42f582ebc0716ebbe8850a068a78bf5230f3adb6d568e0078822bb03c50836e24812e0cc4dc2890e3c3488b3986a60858b2ebae8586fc95d6eea814e835751be839fd0a15c6b79fb4e93a257fd83dede23998ae0646b9e195ec7130449da5a60a953cc715c55384741a869c1fe7dce6e571ab9a9f14bed23fc615c3224e16535db9e7cb0c60675885a48f6d61cfd7904de1bc88b281b7a5daefc0db91447e26a0c11922b7b4586bff0fe5fb81937adccb22c79beb45d0656079ecb10c7c", 0xda, 0x6}, {&(0x7f0000000200)="719b50adc5dbc2b6a34832c577027a0f953fe437c8837dbe1fc0c9ed", 0x1c, 0x7fffffff}, {&(0x7f0000000280)="af96bd", 0x3, 0x1}, {&(0x7f0000000580)="7df3fcb0d52782d06b1aa7cf61145a2f00378eb3a09fad50946e3f2572e69b0df5f088cebd4abb8dbfd0c292bcaff443678ada595e7c06b3db750051b14782ef4cf2de81b132f049a3a4f28a801f64bce0d5fe5dddb70d88921732292649f186fa78469756cb1ab845e72400725dafcf1cda554f3ac0bfe2f03cd9fee440c1c4f4aceaeb9a0b85ecc94b53eb8b02", 0x8e, 0x8}, {&(0x7f0000000640)="16e4d714061045ee149bb0f3208f9aad2ed89397ea86e1a343259d1e196c3c5e8d81ae8ec97a2d05d371d1976d89dd54a5ddfeacde0935ca5d3c842a2c10140a0816463020f62c09fe56bc025a917b0e80f8a9ba1973fcb3566075a1b04eefb766ecb397f9cd0aece859e525b0c0b86d8058185d880bc3d11b5bb84d62f987fe48749fb30ec779caf878fc59003f5d146a5518bda6595d5158dc603277e1e36bcc9e226123ece69183284e6ae66a12fcc265579c4f6a078baff34752f98cae820b93696be45e8faedca04feeda99dc771f63e8d86d76ef848822ce30a5ac", 0xde, 0x9}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:16 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x400000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:15:16 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe64, 0xa, r8}]}, 0x28}}, 0x0) 05:15:16 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x8c00}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:16 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) open_tree(r1, &(0x7f0000000140)='./file1\x00', 0x5d76e7ab6a800b11) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1922.900109][ T8659] device syz_tun left promiscuous mode [ 1922.901414][ T8660] FAT-fs (loop1): invalid media value (0x20) [ 1922.913551][ T8659] bridge1127: port 1(syz_tun) entered disabled state [ 1922.921823][ T8660] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1922.932287][ T26] audit: type=1804 audit(1579065316.436:1071): pid=8643 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1610/file0/file0" dev="loop3" ino=1337 res=1 [ 1922.932809][ T8659] bridge1128: port 1(syz_tun) entered blocking state [ 1922.991825][ T8659] bridge1128: port 1(syz_tun) entered disabled state [ 1922.999639][ T8659] device syz_tun entered promiscuous mode [ 1923.102944][ T8662] device syz_tun left promiscuous mode [ 1923.124839][ T8662] bridge1168: port 1(syz_tun) entered disabled state [ 1923.164325][ T8662] bridge1169: port 1(syz_tun) entered blocking state [ 1923.174604][ T8662] bridge1169: port 1(syz_tun) entered disabled state [ 1923.188002][ T8662] device syz_tun entered promiscuous mode [ 1923.188046][ T8660] FAT-fs (loop1): invalid media value (0x20) [ 1923.203070][ T8664] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1923.229372][ T8666] device bridge_slave_0 left promiscuous mode [ 1923.265089][ T8666] bridge1168: port 2(bridge_slave_0) entered disabled state [ 1923.287127][ T8660] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1923.318111][ T26] audit: type=1804 audit(1579065316.826:1072): pid=8673 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1553/file0/file0" dev="sda1" ino=16739 res=1 [ 1923.366603][ T26] audit: type=1804 audit(1579065316.866:1073): pid=8669 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1517/file0/file0" dev="loop4" ino=1338 res=1 [ 1923.394295][ T8666] bridge1169: port 2(bridge_slave_0) entered blocking state [ 1923.425537][ T8666] bridge1169: port 2(bridge_slave_0) entered disabled state 05:15:16 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000140)) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$netrom_NETROM_T1(r0, 0x103, 0x1, &(0x7f00000000c0)=0xf7ce, 0x4) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1923.433699][ T8666] device bridge_slave_0 entered promiscuous mode [ 1923.469966][ T8672] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:17 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:17 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0xcc00}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:17 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe68, 0xa, r8}]}, 0x28}}, 0x0) 05:15:17 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) socket$key(0xf, 0x3, 0x2) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) fstat(r2, &(0x7f0000000000)) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:17 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x500000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1923.713989][ T8684] device syz_tun left promiscuous mode [ 1923.731468][ T8684] bridge1169: port 1(syz_tun) entered disabled state 05:15:17 executing program 3: socket$unix(0x1, 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x1, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r1, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400020}, 0xc, &(0x7f0000000380)={&(0x7f0000000580)={0x238, r2, 0x812, 0x70bd2c, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x1c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3f}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xe0, 0x1, [@TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x911a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x7fffffff, @remote, 0x80}}, {0x14, 0x2, @in={0x2, 0x4e20, @multicast1}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3f}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0xfffffff8, @rand_addr="456fd5ec9d2d6601ac4ffcfae092db62", 0x3}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x3, @dev={0xfe, 0x80, [], 0x12}}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}]}, @TIPC_NLA_NET={0x4c, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7fff}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x19c}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9ee1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}]}, @TIPC_NLA_SOCK={0x28, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x400}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}]}, @TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x937b}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}]}, @TIPC_NLA_BEARER={0x14, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'gretap0\x00'}}]}, @TIPC_NLA_LINK={0x58, 0x4, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x29}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xc0000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}]}]}, 0x238}, 0x1, 0x0, 0x0, 0x20010000}, 0x20000000) r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140)='NLBL_CALIPSO\x00') sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2200000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x3c, r3, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x4) sched_setattr(0x0, &(0x7f0000000040)={0x2ca, 0x2, 0x8, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8001}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r4) r5 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r5, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1923.800602][ T8684] bridge1170: port 1(syz_tun) entered blocking state [ 1923.845518][ T8684] bridge1170: port 1(syz_tun) entered disabled state [ 1923.876355][ T8684] device syz_tun entered promiscuous mode [ 1923.993370][ T8695] device syz_tun left promiscuous mode [ 1924.005760][ T8695] bridge1128: port 1(syz_tun) entered disabled state [ 1924.029399][ T8695] bridge1129: port 1(syz_tun) entered blocking state [ 1924.046017][ T8695] bridge1129: port 1(syz_tun) entered disabled state [ 1924.062380][ T8695] device syz_tun entered promiscuous mode [ 1924.080570][ T8693] device bridge_slave_0 left promiscuous mode [ 1924.095745][ T8693] bridge1169: port 2(bridge_slave_0) entered disabled state [ 1924.128384][ T8693] bridge1170: port 2(bridge_slave_0) entered blocking state [ 1924.145966][ T8693] bridge1170: port 2(bridge_slave_0) entered disabled state [ 1924.167483][ T8693] device bridge_slave_0 entered promiscuous mode [ 1924.193199][ T8698] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1924.218041][ T8684] device bridge_slave_0 left promiscuous mode [ 1924.236945][ T8684] bridge1170: port 2(bridge_slave_0) entered disabled state [ 1924.261895][ T8695] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:17 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0xcc03}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1924.341536][ T26] audit: type=1804 audit(1579065317.846:1074): pid=8691 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1554/file0/file0" dev="loop1" ino=1339 res=1 05:15:17 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe6c, 0xa, r8}]}, 0x28}}, 0x0) 05:15:17 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9, 0xe0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:18 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) ioctl$TCFLSH(r2, 0x540b, 0x0) [ 1924.587319][ T8714] device syz_tun left promiscuous mode [ 1924.593035][ T8714] bridge1170: port 1(syz_tun) entered disabled state [ 1924.617553][ T8714] bridge1171: port 1(syz_tun) entered blocking state 05:15:18 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x1, 0x420000) setsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, &(0x7f00000000c0)=0x100, 0x4) r2 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000300)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000280)='asymmetric\x00', 0x0, &(0x7f0000000340)="04", 0x2, r2) keyctl$setperm(0x5, r2, 0x802) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1924.634511][ T8714] bridge1171: port 1(syz_tun) entered disabled state [ 1924.643299][ T8714] device syz_tun entered promiscuous mode [ 1924.654452][ T8717] device syz_tun left promiscuous mode [ 1924.660484][ T8717] bridge1129: port 1(syz_tun) entered disabled state [ 1924.673071][ T8717] bridge1130: port 1(syz_tun) entered blocking state [ 1924.679898][ T8717] bridge1130: port 1(syz_tun) entered disabled state [ 1924.687674][ T8717] device syz_tun entered promiscuous mode [ 1924.696878][ T8711] bridge1171: port 2(bridge_slave_0) entered blocking state [ 1924.704355][ T8711] bridge1171: port 2(bridge_slave_0) entered disabled state [ 1924.715537][ T8711] device bridge_slave_0 entered promiscuous mode [ 1924.723440][ T8712] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:18 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0xd200}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1924.741997][ T8724] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:18 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe70, 0xa, r8}]}, 0x28}}, 0x0) 05:15:18 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x600000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1924.879326][ T8729] device syz_tun left promiscuous mode [ 1924.885240][ T8729] bridge1171: port 1(syz_tun) entered disabled state [ 1924.895134][ T8729] bridge1172: port 1(syz_tun) entered blocking state [ 1924.902087][ T8729] bridge1172: port 1(syz_tun) entered disabled state [ 1924.910630][ T8729] device syz_tun entered promiscuous mode [ 1924.923512][ T8729] device bridge_slave_0 left promiscuous mode [ 1924.930223][ T8729] bridge1171: port 2(bridge_slave_0) entered disabled state [ 1924.974014][ T8729] bridge1172: port 2(bridge_slave_0) entered blocking state [ 1924.982643][ T8729] bridge1172: port 2(bridge_slave_0) entered disabled state [ 1924.991288][ T8729] device bridge_slave_0 entered promiscuous mode 05:15:18 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0xe600}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1925.031684][ T8738] device syz_tun left promiscuous mode [ 1925.043933][ T8738] bridge1130: port 1(syz_tun) entered disabled state [ 1925.063054][ T8738] bridge1131: port 1(syz_tun) entered blocking state [ 1925.084785][ T8738] bridge1131: port 1(syz_tun) entered disabled state [ 1925.114642][ T8738] device syz_tun entered promiscuous mode [ 1925.142392][ T8735] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1925.214143][ T8738] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1925.231540][ T8743] device syz_tun left promiscuous mode [ 1925.245143][ T8743] bridge1172: port 1(syz_tun) entered disabled state [ 1925.289120][ T8743] bridge1173: port 1(syz_tun) entered blocking state [ 1925.301938][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 1925.301958][ T26] audit: type=1804 audit(1579065318.806:1077): pid=8715 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1555/file0/file0" dev="loop1" ino=1342 res=1 05:15:18 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe74, 0xa, r8}]}, 0x28}}, 0x0) [ 1925.311442][ T8743] bridge1173: port 1(syz_tun) entered disabled state 05:15:18 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) bind$rds(r1, &(0x7f00000000c0)={0x2, 0x4e24, @multicast1}, 0x10) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r0, 0x0, 0xe8, 0x96, &(0x7f0000000300)="24aaa518510a37914655d2ac2a957ba89f38a063e63bdc1386e358de95d1e1c191c1384198724c4a34ed7b607d4c4c96947f716bf24351e07a85f2c7f98f55b886d4a5b6016b55480bccedd46bc173542037ddab80ee3baa9a446f26a44691a95c008a47799a20825a5087ee615e30c1da6766830b67c529d784b7d984face4b29199de2e917689be70bff8288567ed73a9c5e0183a37d55c9a4722b37680c3038b245dd565bc3459773c94434d4328baad01d1c19f9cb494fc17ebd8b5505aed4d4a2468bbfd286fb2a707a3654efb22ba149b90dbdf0d8be87ca98ae7e53d78c7c9a54ea763f2b", &(0x7f0000000400)=""/150, 0x6, 0x0, 0x6e, 0x0, &(0x7f0000000140)="b4c4550398ea840f82a8383a074697bb1b2ed3505d54cfcb33ef7f49bb1941066b2eed355cab4e6a16dc0dcce6172699ecfe5bc5592aa29714396ae6314b686147223c03191f0a92e866fd1922a9a402a65a195b71be82b14beb62b01466898d22728df10c7777eb64f6084eba8d", &(0x7f00000000c0)}, 0x40) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x8, 0x0, 0x0, 0x0, 0x81, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000000), &(0x7f0000000040)=0x4) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='./file1\x00', 0x0, 0x0, 0x0, 0x2) [ 1925.386354][ T8743] device syz_tun entered promiscuous mode [ 1925.413035][ T26] audit: type=1804 audit(1579065318.916:1078): pid=8745 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1519/file0/file0" dev="loop4" ino=1343 res=1 [ 1925.468687][ T8740] device bridge_slave_0 left promiscuous mode [ 1925.484108][ T8740] bridge1172: port 2(bridge_slave_0) entered disabled state 05:15:19 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000180)=[{&(0x7f0000000140)="5ec355aeee338a0e333b079d05b208cabbfb043bf0b80485aeb5e8faffb3ede1b50b1d7b7f7c035170090186805f74d382ff7ae3", 0x3, 0x2}], 0x91007, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f0000000200)={0x2, {0x0, 0x5, 0xffffffff, 0x0, 0x7ff, 0x5}}) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1925.562715][ T8740] bridge1173: port 2(bridge_slave_0) entered blocking state [ 1925.578548][ T8740] bridge1173: port 2(bridge_slave_0) entered disabled state [ 1925.589907][ T26] audit: type=1804 audit(1579065319.096:1079): pid=8728 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1613/file0/file0" dev="loop3" ino=1344 res=1 [ 1925.598652][ T8740] device bridge_slave_0 entered promiscuous mode 05:15:19 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f00000003c0)=ANY=[@ANYRES32=r3, @ANYBLOB="76000000e64c772ff3d61ac642b6a108c69349d4b005dab21dda9f6e7688b89d179a2f8b59e30d89278d1f419f1d2065eeb4634d16618eda264d4502f4cc9c9c5dea5b347af89000000000000000000a4aae8e8ccf4c942cd6e1abd23f05f0ef0b15ba8c62135b218b34347007b09ab532f508356ea5738fd331207bb65971a2fa661b4b9be46013d5bbeed70dfd3a1ba99903a62b4d4ab056bf63796386d8383b02063da9"], &(0x7f0000000140)=0x2) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000000)={r3, 0x21e, 0x2, [0x6, 0x8]}, &(0x7f00000000c0)=0xc) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000a00)={r4, 0x1000, "2af2267a470810ff8c80a4536e279fecbd82e15db6e1192b62ca4d2c9ece44859c083b46ac9da7c75ec072a8f1c4919f1a550f53094ab78435cfb8bc70e506b747c2e95f6cfe25e77b73fab37e5fb5dde6dcc44d3919d23ecbd142e570d580c1c274a8ef1aa3c983d69b2fe38b59aa55ab201432fe4c9baa1364495d1214a6a7f17406a815599d0029e4658fd224b2131f6ce7f69bcaa76191d967f4f3ef27b0593e20f1b626566b432e233db8481e152a807593a3b71b9fbfab4c38123161e36080a278815247c2ae4170458f23bbfb535d37a65b9dd7efcff1b3476ffeab46c9e3efe6a06b9fda9cfd3f4355e8e202e98752fa1160e92895b3f811fe74d9cc09aa21ed8a5068b843b518c6653aab00c07c160f2d409692ef64af6cafe8cb36db856141c95eb12425c5876da4d8785c5997f7d3c4cf4dbee1baeda8c99eab0808345847301c6732cd04625272d633fca773e2bfc7ace932a1bbbd01441e1eb960131330044374135903db4aac24bb11a112e3e5d6d5943d9430220f83fe50bf9edbe4e2f72986afaad04d61197b9c189c165573758ded87ec79773da0f907acca0f0dff05179cb5b1f5beb9d4e47c38df1a55a96178091a7fd5f7a4123d9345774044097cb81556fc60266210148fda7bff00bc43469253a468891cb66e6fbe6c1bb706751c98b7958383e22c8ceba5ad77a717e011d6c65bbe520a90757a520d7ef27af7cff8e20eaa6461611a9c09db9343525ebe84687fc0b5cc18b877d3b96f90104b1e9a806aa6ea2aa2d87a4d29693cce945a330b2714b54b2f48552e818134e2ebe93ce87433f384cd121ae92be73c8d0af6d0faa54316be2d45ba5defceed29c8d7ac75b2450e2b28e40bdc3c4171ca111e6fd6dea72f7918f1a9571adc588f827e9cf2fe06d814d3159d6b14ad2eee2caeaebb7e628dbe462033e3db8576c1719a7468fbe72df59d55d7ed898f5d4718d7566886f4da2e8e55a53fac87096f4d2bfbe0b6afb882febc923f658c734355176228ba45bd3877b7bc804f81a81516e047bb3809f85c4069818f2a541252d01c7d2991fc7876d2543c44e4ce695d3e367d19f47ffb0b52af8aa4d382129531126fb78d5ae37792c3fefd8a7e0cc4a5a58133a9f00545efd4b3ca31f115ebae220d69711eed5a294d1f44301950dd393434d00866570b33114b3fb5d47c4543d511d29c6d44f1f9a6df23944dd4c6de73ae13b0bd097bf8d9457bd906de1b695e6a9bda61b1be13f31be6629d823b29c342949c6515d451914d02ef11af1d5ed03c7eadebafa1b27f1da69f6cf55f0b94e17bc0e1b4ff95791cda56bd443e6e5acc1524b8e87114bb0f37019cbf618a8debb06b623f875249674752906de045e1698f10d9be3b814f7b311a4a6f6a6cdcc60cf908a7d7b313d05897a4f41da203683335af47985648154c9e3853176a6dd12f1e4fb54c5b4f8c1b5f3977cbd64751fdefeb230d49e6f402e5188c8e4d46686b18b3bdf48b219d79fc8a3a4f0b37f9259b330cbcb35f9220e6e8f78b0846d9a2edf5001ae614f3ccbcd73030ef0ffa908e5b71e780ae6458bda74e73153bb71f7d01cea60c95afbbb7d7a0338563db2dd4658922336fadffea6a16293a04ded441c58c54968e4044509e6b16955cce69a852b1441ca7bfcf8423f49b069bb9b1b2a0707cb4cd69498ddcfa0055db8f86bed69fe24550d70ca944e70d151ad07f5b32e4115620984c797266d17ffa63ca579bdb5879fca08123aa1fef5ee2d46796e8ee92501fba8fdf49399c191b98456f86c6eef7e6f7abdd0e6666b8166c631a62a5e4ee2d359edbfc7f6cefc1d55824f97e43a2018f38a369a9c5f7d22708aca76e21c9db255a8f585be2a6af6f23b1d6ec34ab47a2edfba59f503052f3312e938f4d2534eebd74f83bc8a8856f6a9f656cd36e2359d79a25356f676c29ef108967c4970b5238dbd03d7f8584f3457a607861690a923a39c49c45d90696851ddaaa79f6e73adef00056c44b476e50f32f1fb5a2b5d2715ea07ca54aca2cd7d0005de45667e675a300693770176d551ff692692394f1fd9661a2d97303ef3f44c85298bc8bcbb112875f516b80b5aae10cf0f8057107fae9fbae8f95c28e00306c6f2de9c6ff8f93d3c87ebf9b608152468aa0116dc55afcd4a84530fa96582724865c6814c14d69224cd4c1852c901c03d4baa0fe65363a9b5d0af9db7141ba6380d18d0948e1c91049eea6606238e16ae2ef70450d40a5fec3c8be6dbc692b58ad9f487ca03a92f0c34154988529e0752ce5963a818df5c810a53579b58eba54b2c722fa3fb81112f10bb7b86a18db3396b0ab8b0e3850675e8ac6eeef0bf93754038307838fc47313a77cd22b31b92a965dd8890720c7e88b5e0b25ea5b45f34905c995828f488fd16bb5455bba3241e8dd92bbc0a41df2737e732737ea56ee9c9effd34fa8d53795283c4f30c3a4ceeb86076a8ab51b29b199554a54f76f6d61878646b65799551243ec632b3752e1b18cd5a89683b3876ece19784d1222c3c33f6e7ab75236f7d4fe20c081552fc707cbac3f206b92502f62ef910487c300142ada384adea9a16cdd045da5c8dc96bbf9cd2e8b6c8ce800a8d07bc7f821cffc330e2bd4ec8ade9adce356b32ceff246a5863f277d48f8567b58c0fca08b86591a13cbd95c897534ff660ad2da87389854c9b133e222bad7e8dddfc116bf4955608cd0e59d90ac49053a3512a0e1e56c004b26f47e3563c443f970035ac54878bc92c7467c1902b033e47a8f89c0b2c7b729236d1cb47dfe39d8df346b4499057fe9e5f39b745a72f902666db24bcf4f06a8920d886c717c6e2ed2d44e9d4e47e16d42497bb672edfce1c39b47278f22033d59b714f815fb5d0e183bfb37afc607f4bb1e3a831cbedee687ce6d09b42ce6d35f784eb4d9d148010fffc61d815fc35677f033f2f1a19be2a53be594b3f81a9ce13233d95731019f935ed6344cc4a4c0cdbd1e3f5467bf4431fd1a3fac700da1d485d1c13323cbd77aafda50764eaeb9478d90a095cd1700845018a46040fa19780214f8e7802edad74b8c3d080a255d1192fcf36ba97e483f17a280a239c6a599118a9c53740872f79e3df98f84b57cec60866ef8a518dc7f99e4cff12e0ef713543b4429a7e6ad9a084ade7279e9b268dc7e2ea689b5f242f80f9fdb49b10af71d4403d3e538e8f27266eaa0d3d20d2b21d1fc8019f9405a048e7934ac1f6a7563106341d0f821cc1ee13b7095ec99bfe8ffa3ca80b0a269d36d3d1f8d58c3b4603b2cf79a31061d72255ba6532bba23084e8549010d9732d3a4940808672de12d0c5ca48bf7e6379cab52f53b7f605239cb89ec9b1d65cbcab0b7e6d8994d575071a5ad238037914320dd02ebdf885826bcc99631448b58cfdea25741fbeedab21fe1cff7bda8050c1319b98b1a326356acb565c5848c809f2823f901d753e87d1ee4f3147af9103838727dd548f17a869b683630585e25238e303f340af4a46aa97fc573fdd8d820246b290c41dad070deb079290ef07f74908276c7439be54bfe39068e6794b358b859f43bd681ef94aef04dd8206efa92534c56a01ff901aa5735c1c4136944b5cad6f1f03fe7b1f27c131474b573b155df930328be0f06dc9d7da2035890d7d41707439f763eb650d4969ef09d9874cfbdf4abacfbbdc8ac75c001b730e06c8171f3dbea75aa765ce47f4aa06dbb817fc43a75f978d8176631e0844aa935a1c602607deecd556b91d48d648c090806ff4dd40ae9bf3e01a6db969ade33548a1eec60011b9873df0da511836bda62e4eaa0c712d327fc64963004e6666418ea56d474e79ec2a51107bd734cb358acf72b77e4e38b771c774c48ce8c0207d20e0073047feeee5282350a3e4cdc748229f1c485ab2326b9dde468c631a804e53c0cb2988c9c24542ee13e6ae384d7a6ac55d95a92bae070937a300165554a170d378be2d10b1d0b5987184fdadaa093022985bc0400e7523bec37a6bafa224f7cfb33520dedda26ec850b430758f59b88e673f251f4a96e5bfb53a77cd7d8900adab95dc77db927df99a9f5d9fbf88be4fafaa59ffb55eb0d87c0255042c239d963bb35cf619237c1170afb6135ec12090e0422eed6b181b5a7bdcc289692277a2b5af32836a3e3474f2b2497a77565272fb2f568694979a1eb69499d7a5112ff903d9603913379352f201c9f04cc30e39b0ebb4d81eb19f682ac6a96cceaeaf017097ad0c213cf433315deffd08d5fa2eda2cb467adcc805a116da360985798e3d0a7d11c655890f899acd8bb6358485652fab9a64ef0dd24dc6327e5e7ee8dfe4c85630daab5bf62fe36731bdb4703b9c68cb17db00c2750206dec3d8b379b32794aec946dbb8c31a9db0cfc8eba1c40c7eaa195088bf71ebbe11d26eeca8f3403f682e2776990209eba07f9d45d2225e2610fee677bbd136cf6abaec643c40afd1ec95dee206dd8a9ad49a05b6738fb9f6be5d8d7199135f95adffbac5c4e7201647c1651468d2893e5cbcc62e06f7371f059f23f36b8fbc0f2ddcc887e1e798228ee0de13c0d5856ab3ea0b35d292c3cbb38f7b6a4be06710a466493a6df6e5fb8ba91ad657abca1011f6a0d5f0e93dec14638f0114751ec9b0bc3324187e8f4da4e7deeebbd5aab39a45116c6a642e051c5138c2ba203f8d8134f0ce20da5ad917495c0a01148fc012e5d60a761457c9ace1a7f723a73efd6f6a3890c270afa0e7b9052e82f77f4153bb385adc6a78ac3fd2efffb89c2be0ce59d3ae28ae76a40b463ea5b7a1b055a295aa1598fecd9bd2220e970913330b50f6cab4530aae40f71c1bf1d042ea86aa445a806765c56bd6ec7d311ef2143055cfbc55326fc20c04ac38b45e1e1ea29c05f4554daa5b13673b6ad370632531bb33955639e1b194e783594ad30538b2e828d4546cdce13ec18935c9214796abbbf6ad440f364df89a1521b32c62eb6371d9535c437cfb07ea625a9b8bff689739a789c74f1c4330144a07724863a142615832994c473184b60d305890a73ff4511496236cfba2c508ae84b2f8e9405c2d850120b1bbe915269835760084c1fa57dfd0c0fa8d1dd1996ef5763a56bd1cfd40f89832af127ae76295cd33240e59785d41b2e91a74f6bd0528780f4237f96b848e58348dde223e6f364c780468e2d3001492f47dc723cbadce6a8e38f69b3d0eaa3aefef727a58d31dde66d349c84982f7d3348ef974341cc735f43890c5001eba5e1a3fed6d255434f82549dc30750af19d498deac3418fb104d6794ec6b1587867799708c192cdfa141b0ad5a36cd58d11951badcdd4a06b3ba7abe26a45c0ad21d3c92c0c562887bac78bf798622b9e1743649342c94f76c26e153dc45300d690be863b49cf383e73020473cf1f2ae01380e569bf649521f02e1512f3df5c4a69b52fc656548419cf9260f9e4c376bf6f1797b774be416f8d21cb95d2f1f7b4c0a9377a313529700aec58206dd930651017c1fdb661c65051a3ded8a99e89caab17181f9147f6c8e3984fd0b82e5b53ae338e66f56c9b79376008c57ac7aa0a8aa64c46730573a4f111cc366605769f6daa9e8f5a335d029fd6e6149d8381ddd43dac3b3947231c80d220185f1fd4cde20c91e3f8b464faec99d59e7ec61f1f8a9c1628bce55027bb1809849fbd7b0ccb7228d800deaebfcb5705907fe8c656f4765b8783ba51d1892ebbdc37390216df9096d531b88edde5d8e62e939d5680ecc29e77fb7e3422e6269346f8"}, &(0x7f0000000140)=0x1008) r5 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r5, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1925.738693][ T8749] device syz_tun left promiscuous mode [ 1925.755251][ T8749] bridge1131: port 1(syz_tun) entered disabled state [ 1925.771092][ T8749] bridge1132: port 1(syz_tun) entered blocking state [ 1925.791379][ T8749] bridge1132: port 1(syz_tun) entered disabled state [ 1925.839868][ T8749] device syz_tun entered promiscuous mode 05:15:19 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe78, 0xa, r8}]}, 0x28}}, 0x0) 05:15:19 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0xf203}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:19 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x700000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1926.039984][ T8768] device syz_tun left promiscuous mode [ 1926.045777][ T8768] bridge1132: port 1(syz_tun) entered disabled state [ 1926.055296][ T8768] bridge1133: port 1(syz_tun) entered blocking state [ 1926.062695][ T8768] bridge1133: port 1(syz_tun) entered disabled state [ 1926.073508][ T8768] device syz_tun entered promiscuous mode 05:15:19 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe7c, 0xa, r8}]}, 0x28}}, 0x0) [ 1926.126978][ T26] audit: type=1804 audit(1579065319.636:1080): pid=8754 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1556/file0/file0" dev="loop1" ino=1345 res=1 [ 1926.172608][ T8774] device syz_tun left promiscuous mode [ 1926.194701][ T8774] bridge1173: port 1(syz_tun) entered disabled state 05:15:19 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x4, &(0x7f0000000400)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0xffffffffffffffaa}, {&(0x7f0000000000)="106527e8ff3b0e544796d1cf8c970d80cfd11df1d53dbe4f2457d4e26df6894c048146e7683e3715da1579cc33572625583254b51dc02f1c9afcb35c4b456b6ee751b44ca5e0ed2c954a3deed7708396a2afe9a1fe", 0x55, 0x6}, {&(0x7f0000000300)="79d1d37a4a1156272a6f962f37b6797edb03163f363bc19f3037df4a228bdc1c6fd18fe1518528a185937bc8677fadb697a3658eb7960a2464fd9939102fa6737dc58252cc49978e8c83f759c5afff88dce83fec8531355822805e589902510a79ed41fc2f0da2bad50b678caf052627668e58b78c224434f0fc49aeed060df3a095550069e8d90abfae207beb5ef30ee97ebebc6b1b273724b945e81efbcbb4ddfe645d8a44246081e09409e0116baa5e079b28dac73eace2ce87386de479bbe6f432f48ccf54a6475314f8eb83595785ea4b53f177ac7d4f746e6fc820f3cf27f79cbe9821778989504bdaecb719cd55168eba30650f40a1aa8fc200", 0xfd, 0x9}, {&(0x7f0000000140)="c0132a20f6edb7f5db420453ba6aa9920214aa05a57d4623acd10a64f41b2f1b4bcda43abfdc5e62b9d650321f07bc14f0d42e61dc8dd9138482ad8006f4f73559eb85896d2016da3f7c5d93a9d970d1bde225a55b729b1df3b2ae5b4d3513e284996b9f3f53cbc6bae1248d0d930c4c8e18749fd3f8b40b8f555f4082d74c", 0x7f, 0x3f}], 0x205006b, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) setsockopt$inet_sctp6_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f00000005c0)=0x8001, 0x4) getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f0000000200)={'nat\x00'}, &(0x7f00000000c0)=0x78) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r4 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000500)='/dev/mISDNtimer\x00', 0x101000, 0x0) ioctl$FS_IOC_GETFLAGS(r4, 0x80086601, &(0x7f0000000580)) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xffffffff80000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r5, 0x330f, 0x0) r6 = accept4$packet(r5, &(0x7f0000000480), &(0x7f00000004c0)=0x14, 0x80800) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r6, 0xa75b6000) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1926.230593][ T8774] bridge1174: port 1(syz_tun) entered blocking state [ 1926.245597][ T8774] bridge1174: port 1(syz_tun) entered disabled state [ 1926.293545][ T8774] device syz_tun entered promiscuous mode [ 1926.364158][ T8777] device bridge_slave_0 left promiscuous mode [ 1926.387391][ T8777] bridge1173: port 2(bridge_slave_0) entered disabled state [ 1926.423335][ T8777] bridge1174: port 2(bridge_slave_0) entered blocking state [ 1926.445161][ T8777] bridge1174: port 2(bridge_slave_0) entered disabled state [ 1926.464599][ T8777] device bridge_slave_0 entered promiscuous mode [ 1926.474003][ T26] audit: type=1804 audit(1579065319.976:1081): pid=8786 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1614/file0/file0" dev="loop3" ino=1346 res=1 05:15:20 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180)='nl80211\x00') getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000380)={@loopback, 0x0}, &(0x7f00000003c0)=0x14) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0xb0220504}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x60, r1, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'team_slave_0\x00'}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x2}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x1f, 0x3}}, @NL80211_ATTR_IFNAME={0x14}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0xffffffffffffffff}]}, 0x60}, 0x1, 0x0, 0x0, 0x1}, 0x10d0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x81, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2610, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1926.534085][ T8780] device syz_tun left promiscuous mode [ 1926.551953][ T8780] bridge1133: port 1(syz_tun) entered disabled state [ 1926.574641][ T8780] bridge1134: port 1(syz_tun) entered blocking state [ 1926.595541][ T8780] bridge1134: port 1(syz_tun) entered disabled state [ 1926.619240][ T8780] device syz_tun entered promiscuous mode 05:15:20 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) modify_ldt$write2(0x11, &(0x7f0000000000)={0x0, 0x800, 0x400, 0x1, 0x1, 0x0, 0x1}, 0x10) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:20 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x40000}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:20 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe80, 0xa, r8}]}, 0x28}}, 0x0) [ 1926.879920][ T8794] device syz_tun left promiscuous mode [ 1926.892180][ T8794] bridge1174: port 1(syz_tun) entered disabled state [ 1926.907965][ T8794] bridge1175: port 1(syz_tun) entered blocking state [ 1926.947348][ T8794] bridge1175: port 1(syz_tun) entered disabled state [ 1926.980718][ T8794] device syz_tun entered promiscuous mode [ 1927.019473][ T8800] device bridge_slave_0 left promiscuous mode [ 1927.062175][ T8800] bridge1174: port 2(bridge_slave_0) entered disabled state [ 1927.138598][ T8800] bridge1175: port 2(bridge_slave_0) entered blocking state 05:15:20 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x800000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1927.184805][ T8800] bridge1175: port 2(bridge_slave_0) entered disabled state [ 1927.219705][ T8800] device bridge_slave_0 entered promiscuous mode [ 1927.295677][ T8802] device syz_tun left promiscuous mode [ 1927.308617][ T26] audit: type=1804 audit(1579065320.816:1082): pid=8789 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1557/file0" dev="sda1" ino=16786 res=1 [ 1927.323469][ T8802] bridge1134: port 1(syz_tun) entered disabled state [ 1927.380602][ T26] audit: type=1800 audit(1579065320.816:1083): pid=8789 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.1" name="file0" dev="sda1" ino=16786 res=0 [ 1927.394287][ T8802] bridge1135: port 1(syz_tun) entered blocking state [ 1927.450787][ T26] audit: type=1804 audit(1579065320.846:1084): pid=8808 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1557/file0" dev="sda1" ino=16786 res=1 [ 1927.453562][ T8802] bridge1135: port 1(syz_tun) entered disabled state 05:15:21 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsa\x00', 0x80, 0x0) mmap$snddsp(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0xfffffffffffffc01, 0x4000) [ 1927.541803][ T26] audit: type=1804 audit(1579065320.936:1085): pid=8813 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1615/file0/file0" dev="loop3" ino=1348 res=1 [ 1927.573194][ T8802] device syz_tun entered promiscuous mode [ 1927.602860][ T8806] __nla_validate_parse: 6 callbacks suppressed [ 1927.602870][ T8806] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:21 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f0000000380)) prlimit64(r1, 0x0, &(0x7f0000000280)={0x0, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, &(0x7f0000000140)) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:21 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) sendmsg$NFNL_MSG_ACCT_DEL(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x3c, 0x3, 0x7, 0xc06, 0x70bd29, 0x25dfdbfc, {0x1, 0x0, 0x5}, [@NFACCT_FILTER={0x1c, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x7}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xa08}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x8}]}, @NFACCT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x800) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1927.640547][ T26] audit: type=1804 audit(1579065320.986:1086): pid=8814 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1521/file0/file0" dev="loop4" ino=1347 res=1 [ 1927.670096][ T8802] device syz_tun left promiscuous mode 05:15:21 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a29}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1927.726406][ T8802] bridge1135: port 1(syz_tun) entered disabled state [ 1927.857776][ T8821] device syz_tun left promiscuous mode [ 1927.863370][ T8821] bridge1175: port 1(syz_tun) entered disabled state 05:15:21 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe84, 0xa, r8}]}, 0x28}}, 0x0) [ 1927.990670][ T8821] bridge1176: port 1(syz_tun) entered blocking state [ 1928.033923][ T8821] bridge1176: port 1(syz_tun) entered disabled state [ 1928.060389][ T8821] device syz_tun entered promiscuous mode 05:15:21 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/schedstat\x00', 0x0, 0x0) ioctl$VIDIOC_DBG_G_REGISTER(r1, 0xc0385650, &(0x7f0000000180)={{0x4, @addr=0x8000}, 0x8, 0x1, 0x7ff}) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1928.095533][ T8824] device bridge_slave_0 left promiscuous mode [ 1928.131038][ T8824] bridge1175: port 2(bridge_slave_0) entered disabled state [ 1928.157569][ T8824] bridge1176: port 2(bridge_slave_0) entered blocking state [ 1928.179644][ T8824] bridge1176: port 2(bridge_slave_0) entered disabled state [ 1928.212672][ T8824] device bridge_slave_0 entered promiscuous mode [ 1928.280124][ T8831] bridge1136: port 1(syz_tun) entered blocking state [ 1928.307891][ T8831] bridge1136: port 1(syz_tun) entered disabled state [ 1928.379011][ T8831] device syz_tun entered promiscuous mode 05:15:21 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x900000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:15:22 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)='\x00'/10, 0xa, 0xfffffffffffffffe}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1928.445591][ T8833] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1928.482720][ T8831] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:22 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a2a}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:22 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe88, 0xa, r8}]}, 0x28}}, 0x0) [ 1928.643937][ T8850] FAT-fs (loop1): bogus number of reserved sectors [ 1928.663776][ T8850] FAT-fs (loop1): Can't find a valid FAT filesystem 05:15:22 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000000)='./file0\x00', 0x0, 0x8}, 0x10) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1928.703940][ T8852] device syz_tun left promiscuous mode [ 1928.723484][ T8852] bridge1176: port 1(syz_tun) entered disabled state [ 1928.811010][ T8852] bridge1177: port 1(syz_tun) entered blocking state [ 1928.854594][ T8852] bridge1177: port 1(syz_tun) entered disabled state [ 1928.879147][ T8852] device syz_tun entered promiscuous mode [ 1928.924757][ T8849] device bridge_slave_0 left promiscuous mode [ 1928.958645][ T8849] bridge1176: port 2(bridge_slave_0) entered disabled state 05:15:22 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_PDEATHSIG(0x1, 0x5) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1929.030140][ T8849] bridge1177: port 2(bridge_slave_0) entered blocking state [ 1929.055589][ T8849] bridge1177: port 2(bridge_slave_0) entered disabled state [ 1929.065950][ T8849] device bridge_slave_0 entered promiscuous mode [ 1929.087265][ T8856] device syz_tun left promiscuous mode [ 1929.092903][ T8856] bridge1136: port 1(syz_tun) entered disabled state [ 1929.118327][ T8856] bridge1137: port 1(syz_tun) entered blocking state [ 1929.135236][ T8856] bridge1137: port 1(syz_tun) entered disabled state [ 1929.153454][ T8850] FAT-fs (loop1): bogus number of reserved sectors [ 1929.163325][ T8856] device syz_tun entered promiscuous mode [ 1929.183696][ T8862] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1929.201192][ T8850] FAT-fs (loop1): Can't find a valid FAT filesystem 05:15:22 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a2b}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1929.233227][ T8855] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:22 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe8c, 0xa, r8}]}, 0x28}}, 0x0) 05:15:22 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16, 0x3}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) umount2(&(0x7f0000000000)='./file0\x00', 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1929.462747][ T8878] device syz_tun left promiscuous mode 05:15:23 executing program 3: socket$unix(0x1, 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@mcast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f0000000000)=0xe8) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) pidfd_send_signal(r2, 0x1b, &(0x7f00000000c0)={0x23, 0x9, 0x7fffffff}, 0x0) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000400)={{{@in=@loopback, @in6=@ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x4e20, 0xffff, 0x4e21, 0x0, 0xa, 0x80, 0xa0, 0x2c, 0x0, r1}, {0x100000001, 0x1ff00000000000, 0xfb1, 0x10001, 0x8, 0x7fff, 0x0, 0x7}, {0x1, 0x3800000000000, 0xf8e, 0x9}, 0x670c, 0x0, 0x1, 0x1, 0x1, 0x4}, {{@in=@loopback, 0x4d6, 0x3c}, 0xa, @in6=@mcast1, 0x3503, 0x0, 0x1, 0x9b, 0x2, 0x1ff, 0x80000001}}, 0xe8) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r3) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x1042, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0xb60957e829e49794, @perf_config_ext={0x0, 0xa54}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:23 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xa00000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1929.505692][ T8878] bridge1177: port 1(syz_tun) entered disabled state [ 1929.543547][ T8882] FAT-fs (loop1): invalid media value (0x02) [ 1929.553975][ T8878] bridge1178: port 1(syz_tun) entered blocking state [ 1929.565577][ T8878] bridge1178: port 1(syz_tun) entered disabled state [ 1929.572348][ T8882] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1929.616451][ T8878] device syz_tun entered promiscuous mode [ 1929.638517][ T8875] device bridge_slave_0 left promiscuous mode [ 1929.660555][ T8875] bridge1177: port 2(bridge_slave_0) entered disabled state [ 1929.690432][ T8875] bridge1178: port 2(bridge_slave_0) entered blocking state [ 1929.705583][ T8875] bridge1178: port 2(bridge_slave_0) entered disabled state [ 1929.729818][ T8875] device bridge_slave_0 entered promiscuous mode [ 1929.740591][ T8882] FAT-fs (loop1): invalid media value (0x02) [ 1929.767530][ T8882] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1929.769901][ T8884] device syz_tun left promiscuous mode [ 1929.787885][ T8884] bridge1137: port 1(syz_tun) entered disabled state [ 1929.828760][ T8884] bridge1138: port 1(syz_tun) entered blocking state [ 1929.854872][ T8884] bridge1138: port 1(syz_tun) entered disabled state 05:15:23 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0xffffffffffffffe0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) epoll_create(0x7) [ 1929.896698][ T8884] device syz_tun entered promiscuous mode [ 1929.960032][ T8887] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1930.024366][ T8881] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 05:15:23 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6, 0x3ff}}, 0x0, 0x9, 0xffffffffffffffff, 0x2) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:23 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0xe90, 0xa, r8}]}, 0x28}}, 0x0) 05:15:23 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a2c}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1930.240375][ T8904] device syz_tun left promiscuous mode [ 1930.246274][ T8904] bridge1138: port 1(syz_tun) entered disabled state [ 1930.255803][ T8904] bridge1139: port 1(syz_tun) entered blocking state [ 1930.262578][ T8904] bridge1139: port 1(syz_tun) entered disabled state [ 1930.270248][ T8904] device syz_tun entered promiscuous mode [ 1930.343452][ T8904] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1930.360987][ T8907] device syz_tun left promiscuous mode [ 1930.387947][ T8907] bridge1178: port 1(syz_tun) entered disabled state [ 1930.423467][ T8907] bridge1179: port 1(syz_tun) entered blocking state [ 1930.451263][ T8907] bridge1179: port 1(syz_tun) entered disabled state [ 1930.496145][ T8907] device syz_tun entered promiscuous mode [ 1930.531786][ T8911] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1930.554559][ T8905] device bridge_slave_0 left promiscuous mode [ 1930.581776][ T8905] bridge1178: port 2(bridge_slave_0) entered disabled state [ 1930.629326][ T8905] bridge1179: port 2(bridge_slave_0) entered blocking state 05:15:24 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0x2, r8}]}, 0x28}}, 0x0) 05:15:24 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x1000000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1930.673922][ T8905] bridge1179: port 2(bridge_slave_0) entered disabled state [ 1930.704281][ T8905] device bridge_slave_0 entered promiscuous mode [ 1930.745484][ T26] kauditd_printk_skb: 8 callbacks suppressed [ 1930.745505][ T26] audit: type=1804 audit(1579065324.246:1095): pid=8899 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1561/file0/file0" dev="loop1" ino=1355 res=1 [ 1930.764425][ T8907] device syz_tun left promiscuous mode [ 1930.807722][ T8907] bridge1179: port 1(syz_tun) entered disabled state [ 1930.874034][ T8924] device syz_tun left promiscuous mode [ 1930.886006][ T26] audit: type=1804 audit(1579065324.246:1096): pid=8903 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1561/file0/file0" dev="loop1" ino=1355 res=1 05:15:24 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080)='NLBL_CALIPSO\x00') sendmsg$NLBL_CALIPSO_C_REMOVE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x34, r2, 0x400, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x59589ea006b6bade}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x34}}, 0x4000000) sendmsg$NLBL_CALIPSO_C_LIST(r1, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x804008}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x34, r2, 0x200, 0x70bd29, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000800}, 0x4) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r3 = syz_open_dev$vcsn(&(0x7f0000000140)='/dev/vcs#\x00', 0x72, 0x5ebe81dd4c37ebbe) ioctl$SG_SET_FORCE_PACK_ID(r3, 0x227b, &(0x7f0000000180)=0x1) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r4) r5 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r5, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:24 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ptrace$peekuser(0x3, 0xffffffffffffffff, 0x10000) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:24 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a2d}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:24 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) openat$cgroup(r0, &(0x7f0000000140)='syz0\x00', 0x200002, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f0000000000)='threaded\x00', 0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f0000000180)='./file0\x00', 0x80) setsockopt$ax25_int(r3, 0x101, 0x7, &(0x7f0000000200)=0x40, 0x4) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) r5 = dup(r4) name_to_handle_at(r5, &(0x7f0000000040)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000300)={0x8c, 0x5, "c3aea87c7276a75949bb73ff88521bbf15b95c98cd3abf3d0382abad2a76ebe560a42fe70f6a5e9d590668776073ba63a4c02a502046551c19afbb9742221ba4a7d11b75a1eb0839697017b4acf00f99e023d6d1141680ad847adf591b9b6cb097516255d499d1d26388e8c930436ce516931fd4d1a2a2f50ae153e15bdc97fd0e1788e3"}, &(0x7f00000000c0), 0x1400) [ 1930.924106][ T8924] bridge1139: port 1(syz_tun) entered disabled state [ 1930.957498][ T8924] bridge1140: port 1(syz_tun) entered blocking state [ 1930.997557][ T8924] bridge1140: port 1(syz_tun) entered disabled state [ 1931.023060][ T8924] device syz_tun entered promiscuous mode [ 1931.089774][ T8929] bridge1180: port 1(syz_tun) entered blocking state [ 1931.113379][ T8929] bridge1180: port 1(syz_tun) entered disabled state [ 1931.134344][ T8929] device syz_tun entered promiscuous mode 05:15:24 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0x10, r8}]}, 0x28}}, 0x0) [ 1931.165544][ T8935] device bridge_slave_0 left promiscuous mode [ 1931.186339][ T8935] bridge1179: port 2(bridge_slave_0) entered disabled state [ 1931.240487][ T8935] bridge1180: port 2(bridge_slave_0) entered blocking state [ 1931.262756][ T26] audit: type=1804 audit(1579065324.766:1097): pid=8940 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1562/file0/file0" dev="loop1" ino=1357 res=1 [ 1931.325203][ T8935] bridge1180: port 2(bridge_slave_0) entered disabled state [ 1931.377493][ T8935] device bridge_slave_0 entered promiscuous mode [ 1931.381185][ T26] audit: type=1804 audit(1579065324.816:1098): pid=8932 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1562/file0/file0" dev="loop1" ino=1357 res=1 05:15:25 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = accept(r0, &(0x7f0000000000)=@l2tp={0x2, 0x0, @multicast2}, &(0x7f00000000c0)=0x80) fcntl$setsig(r2, 0xa, 0x20) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1931.452365][ T26] audit: type=1804 audit(1579065324.956:1099): pid=8938 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1620/file0/file0" dev="loop3" ino=1358 res=1 [ 1931.470472][ T8944] device syz_tun left promiscuous mode [ 1931.537730][ T8944] bridge1140: port 1(syz_tun) entered disabled state [ 1931.580631][ T8944] bridge1141: port 1(syz_tun) entered blocking state [ 1931.593524][ T26] audit: type=1804 audit(1579065325.096:1100): pid=8949 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1525/file0/file0" dev="sda1" ino=16816 res=1 [ 1931.621850][ T8944] bridge1141: port 1(syz_tun) entered disabled state 05:15:25 executing program 3: r0 = socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = dup(0xffffffffffffffff) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) uname(&(0x7f0000000140)=""/96) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r2, 0x0, 0x48b, &(0x7f0000000000)={0x0, 'team_slave_0\x00'}, 0x18) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r5, 0x330f, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00004de800000000"], 0x48}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r9}}, 0x20}}, 0x0) bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x10, r9, 0x1, 0x7, 0x6, @broadcast}, 0x14) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) r12 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r12, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r12, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r13, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00004de800000000"], 0x48}}, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r13}}, 0x20}}, 0x0) bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x10, r13, 0x1, 0x7, 0x6, @broadcast}, 0x14) r14 = socket$netlink(0x10, 0x3, 0x0) r15 = socket$netlink(0x10, 0x3, 0x0) r16 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r16, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r16, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r15, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r17, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00004de800000000"], 0x48}}, 0x0) sendmsg$nl_route(r14, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r17}}, 0x20}}, 0x0) bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x10, r17, 0x1, 0x7, 0x6, @broadcast}, 0x14) r18 = socket$netlink(0x10, 0x3, 0x0) r19 = socket$netlink(0x10, 0x3, 0x0) r20 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r20, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r20, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r19, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r21, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00004de800000000"], 0x48}}, 0x0) sendmsg$nl_route(r18, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r21}}, 0x20}}, 0x0) bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x10, r21, 0x1, 0x7, 0x6, @broadcast}, 0x14) r22 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) accept4$packet(r22, &(0x7f0000001b00)={0x11, 0x0, 0x0}, &(0x7f0000001b40)=0x14, 0x80000) r24 = socket$netlink(0x10, 0x3, 0x0) r25 = socket$netlink(0x10, 0x3, 0x0) r26 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r26, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r26, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r25, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r27, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00004de800000000"], 0x48}}, 0x0) sendmsg$nl_route(r24, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r27}}, 0x20}}, 0x0) bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x10, r27, 0x1, 0x7, 0x6, @broadcast}, 0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000001b80)={'team0\x00', r27}) r29 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r29, 0x330f, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r29, 0x8933, &(0x7f0000001bc0)={'team0\x00', 0x0}) r31 = socket$netlink(0x10, 0x3, 0x0) r32 = socket$netlink(0x10, 0x3, 0x0) r33 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r33, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r33, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r32, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r34, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00004de800000000"], 0x48}}, 0x0) sendmsg$nl_route(r31, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="2000000011000100"/20, @ANYRES32=r34, @ANYBLOB="00af416f4f000000"], 0x20}}, 0x0) bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x10, r34, 0x1, 0x7, 0x6, @broadcast}, 0x14) sendmsg$TEAM_CMD_OPTIONS_GET(r5, &(0x7f00000020c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000002080)={&(0x7f0000001c00)={0x47c, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {}, [{{0x8, 0x1, r9}, {0xb4, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x5}, {0x8, 0x4, 0x2}}}]}}, {{0x8}, {0x44, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x5}, {0x8, 0x4, 0x23c539c9}}, {0x8, 0x6, r13}}}]}}, {{0x8, 0x1, r17}, {0x264, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x5}, {0x8, 0x4, 0xfffff800}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8, 0x4, 0x4bf50002}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x5}, {0x8, 0x4, r21}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x5}, {0x4}}, {0x8, 0x6, r23}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8, 0x4, 0x1000}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x5}, {0x4}}, {0x8, 0x6, r28}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x5}, {0x8, 0x4, 0x9}}}]}}, {{0x8, 0x1, r30}, {0xec, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0x7cd6}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x5}, {0x8, 0x4, r34}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x5}, {0x8}}}]}}]}, 0x47c}, 0x1, 0x0, 0x0, 0x5}, 0x4000000) dup2(r1, r4) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1931.637153][ T8944] device syz_tun entered promiscuous mode [ 1931.667519][ T8945] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 05:15:25 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a2e}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1931.722898][ T8944] netlink: 'syz-executor.0': attribute type 16 has an invalid length. 05:15:25 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x1f00000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:15:25 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) statx(0xffffffffffffff9c, &(0x7f00000008c0)='./file0\x00', 0x9700, 0x1, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f0000000200)='./file0\x00', 0x8aa6, 0x9, &(0x7f00000007c0)=[{&(0x7f0000000300)="c87f36265fb2ae070ba0fc1e43f55c0d81a0a907a5", 0x15, 0x3ff}, {&(0x7f0000000340), 0x0, 0x6}, {&(0x7f0000000380)="dcab7528d5d164cea05a948736f6bbde37d29c673b994989bcd72cdf97a5b6cec4f3b08bc8c0e8463babf29c0fd72c08af4ebfab081e933b7311519ed471183b7ff6f9d6e1adb86e5b2e1b66ce1ec5390943307dba4a28091500c56832cb1bf3d23d1bccc8", 0x65, 0x4}, {&(0x7f0000000400)="f8d0458a87022ea9a0f3df29d436951051c9e282902401c4b007fb1502616ad9af63900ddb0544a289dec602", 0x2c, 0x423}, {&(0x7f0000000440)="9c0aa3d7b202d9d16976a44f82135231caae9b790c3063e29e52ea68fc48bd3030a13f3553ec17b722c9b3e186103d69a56247ef8fba33937e05731be79250", 0x3f, 0xfffffffffffffffa}, {&(0x7f0000000480)="7325bbf88d4e6170a92ae7a7431068cb0055c7696c3741b691dbd2cd0db1d8d8119dbf9d50c9eeacfb912661b59ffdbb79b275cde356dc8158628adb68fe32506256024de96cebe44000cca15f3360a17eafacf317768ac0973fe649952c421b3ebbfd085ed7d440ca53d0804bef00d1c65686f53c9f2fa3b15cc88462bfedf3bed204e394eec4fb758191488354e43a8b7f5147050386852e0b", 0x9a, 0x7ff}, {&(0x7f0000000580)="39605541145a932e4a183f8600d2535af14dac5ad870d8421fc448a6c55d2fa58ad67c8e44e6389bcb308a469324a227691d81843cd4bff9b4bd730215b45f00f4", 0x41, 0x7}, {&(0x7f0000000600)="5dad859da07a2f1199bb4cc60caf83a14ead398c30071ff41a4820c5685d22f44679d2faffc7d1f10f70eb24c60e7568715e76c41dc9059b2d18ba29b57b47d0c85f337afca706d67b11fc3da4f8bd1b487f6b9e6f2de0418eedd96a040e3d6cce94d5cd42652bd63874491f9aec4ba1c8c0a229bcae004f56fabd586393aa8e47eb1b2a9e614300b99fc3b37fb5f329a1e5", 0x92, 0xfffffffffffeffff}, {&(0x7f00000006c0)="023f199862ceec7cc51f9d69a99a63b3b7ac01495230c98f8f2c288e29730eb2d445da13c200b29f6827b4f2b2519cd5380e3174dc03879ab51b382279b786b69d08ee928c47cd5da78ac66270a5c94fcb60b20049b5581cae0a519af8afa709866a7d60ec94e74739abc5b1c9d60ee39b3c1d519a59c288ff0a53de7529c827cc51510d7f14b041bb49669e3d477b26040567c6ccf87babcb683d754192833e5590bc11e27e8fdaa6bc1cef042960775ae61c86051b4c4b321e71b9b801213aa74a5b040bd83a9e31ee33535c7680291f70fb528e7ae7", 0xd7, 0x8}], 0x20000, &(0x7f0000000900)={[{@user_xattr='user_xattr'}, {@noacl='noacl'}, {@noacl='noacl'}], [{@obj_role={'obj_role', 0x3d, 'systemcgroup'}}, {@smackfsroot={'smackfsroot'}}, {@pcr={'pcr', 0x3d, 0x3c}}, {@euid_lt={'euid<', r1}}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}, {@appraise='appraise'}, {@subj_user={'subj_user', 0x3d, '}\xcb'}}, {@smackfsroot={'smackfsroot', 0x3d, 'vfat\x00'}}]}) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f0000000140)={0x30, 0x5, 0x0, {0x0, 0x2, 0x6a}}, 0x30) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:25 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0x14, r8}]}, 0x28}}, 0x0) [ 1932.081209][ T8968] device syz_tun left promiscuous mode [ 1932.087100][ T8968] bridge1180: port 1(syz_tun) entered disabled state [ 1932.096129][ T8968] bridge1181: port 1(syz_tun) entered blocking state [ 1932.102978][ T8968] bridge1181: port 1(syz_tun) entered disabled state [ 1932.110848][ T8968] device syz_tun entered promiscuous mode [ 1932.132161][ T8964] device bridge_slave_0 left promiscuous mode [ 1932.175724][ T8964] bridge1180: port 2(bridge_slave_0) entered disabled state [ 1932.190036][ T8964] bridge1181: port 2(bridge_slave_0) entered blocking state [ 1932.197601][ T8964] bridge1181: port 2(bridge_slave_0) entered disabled state [ 1932.210758][ T8964] device bridge_slave_0 entered promiscuous mode [ 1932.295616][ T8973] device syz_tun left promiscuous mode [ 1932.301261][ T8973] bridge1141: port 1(syz_tun) entered disabled state [ 1932.329419][ T8973] bridge1142: port 1(syz_tun) entered blocking state [ 1932.341700][ T8973] bridge1142: port 1(syz_tun) entered disabled state [ 1932.350037][ T8973] device syz_tun entered promiscuous mode [ 1932.362839][ T26] audit: type=1804 audit(1579065325.866:1101): pid=8954 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1563/file0/file0" dev="loop1" ino=1359 res=1 05:15:25 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a2f}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1932.474856][ T26] audit: type=1804 audit(1579065325.866:1102): pid=8958 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1563/file0/file0" dev="loop1" ino=1359 res=1 05:15:26 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0x25, r8}]}, 0x28}}, 0x0) 05:15:26 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x1) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) ioctl$SIOCNRDECOBS(r2, 0x89e2) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1932.638496][ T8982] device syz_tun left promiscuous mode [ 1932.644171][ T8982] bridge1181: port 1(syz_tun) entered disabled state [ 1932.666928][ T26] audit: type=1804 audit(1579065326.176:1103): pid=8974 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1526/file0/file0" dev="loop4" ino=1361 res=1 [ 1932.742193][ T8982] bridge1182: port 1(syz_tun) entered blocking state [ 1932.755471][ T26] audit: type=1800 audit(1579065326.216:1104): pid=8966 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=1361 res=0 [ 1932.775602][ T8982] bridge1182: port 1(syz_tun) entered disabled state 05:15:26 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f0000000300)={{{@in=@broadcast, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000180)=0xe8) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r6, 0x330f, 0x0) r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r7, 0x330f, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in=@loopback, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@initdev}}, &(0x7f0000000200)=0xe8) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r9, 0x330f, 0x0) ioctl$VIDIOC_SUBDEV_S_SELECTION(r9, 0xc040563e, &(0x7f00000007c0)={0x2, 0x0, 0x2, 0x2, {0x4, 0x8, 0x7, 0x80000000}}) r10 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r10, 0x330f, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000500)={'batadv0\x00', 0x0}) r12 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r12, 0x330f, 0x0) ioctl$sock_bt_hci(r6, 0x400448e1, &(0x7f0000000740)="e14ccea23845adb10fd9582b3f47bbfdb2b51506da373f2afb7434f57c1cc7de0d7c9d7cfc92ac5ad373122a171b2920da206005d9d75679a2a09ff53d3c7aecb936551b03bdf7434fad9f6a151c87c5628c278c68b7d8ba3f86dadb67af043b710e99d43604471ed4c00072ee0f40d3bba0c734e345c4") getsockopt$inet6_IPV6_XFRM_POLICY(r12, 0x29, 0x23, &(0x7f0000000580)={{{@in=@remote, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000680)=0xe8) sendmsg$nl_xfrm(r3, &(0x7f0000000700)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="04130000140042012cbd7000fddbdf25fe8000000000000000000000000000bbac1414110000000000000000000000004e2200204e24007f0200a08067000000", @ANYRES32=r5, @ANYRES32=r8, @ANYBLOB="b26b6e0002000000e4000400fe8000000000000000000000000000aa000000000000000000000000000000004e20ffff4e210c250a00804093000000", @ANYRES32=r11, @ANYRES32=r13, @ANYBLOB="fe80000000000000000000000000001a000004d52b00000000000000000000000000000000000001090000000000000000000000000000000100008000000000040000000000000003000000000000000000000000000000512c000000000000ff01000000000000000400000000000006000000000000001f00000000000000050000000000000005000000ff0f0000060000002dbd7000043500000a0003022000000000000000481003006c7a6a680000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000034ef82219929ae474b92ae28ef5c901f0239a5848d7905226538b9206f6141206f2e04f82d91f8cc9c8311656761abb09c9188bc626f4bf0ad1c8a36dc4bedd537629c36035c1dedb65c9d488ce953cdc04326af9ec4140859d047a80a1451801f27bf287d687acefca1ac3ccd333ca42500b5ff929c5a9b5a1af0262ae1694aed71d3fa1b2f5b69395fd179297886f04d5b6a6e493da27ddf2d6ff8faf5987ab7b35b834f88ac2486eacbdaa5050ed614ced9b31a435a94f97e766f0840d6bc04e3e253ed03944a0142d2732b3daffff29eb7d1851136a8f1585529412f12d5bf5c7faff78ae1f1fb7e6fcfcb29ececcf290e3b0398534587327b60be04fa1f9bdf87748a84c3bc94797f8b6409f73a0cbedb0f4620da678784800ff1e1baf8d1ff8c5c9f798deee4ea38e3be922cbc4d541322441cf9d8474831a452cf7fbdf239f09741e6e98b1c4816a08f848a9e0a3dad7ecf8b492e71296ab8403d71bbf7092e118c65e50f05b84f9a7286b8db1f1f139e0a3425abf9c20ce63b3df0179f4b90237c9ce7aae84d2a89af6316ef166e1ef9ce499738f5ac7fb58e71e6afc3f97a5aa5817bbe681a6e78cd35fab521226e140c58b0ef10ef0f728214dcadd9f6592b69780b8273c51aa3f71aaa3be12301bbb96d1442510daeda37fe0ea001c6efb724e2bbfe3d8b3c6ba980f0e818f31ea8854584084f589a26e19558e0c1154d643765a374a4de3ba65ed51951a35cc66e436e0f1980015742589cef32c977b7e1e7956d7d91e5fe0f6cdb9e294ca53753a18830ce8814dc8756a0cf2981f2b2ed994de3aa11c343e07d98bf4d96ae4fa404a834ee10862814f97559be8e8d5f47a77ed294c11f525914d05c73f49d8ebb8b92874a47bfd8befbb3a62809231740300200c12e0a287347e7ee8ca82708f393c78d95c7738406d59c384d51b3a42156eb374e9593f50b9ee23fa6f2e9a8181eba89d58eb0c3788d1fb61adce04aec7d8626ac90bd2bdda5beb802ad8ef5ecc7c414659c63eb4584616498adb41d1ceb15d74ea12387d753beef5bfb6b3439f5c7609b2cac83366041faa79b73766e3031690bf21b323f2bef6c6daf9bc867a892f99cf21a4d43e634911e3486afb371d7b9115c5275827f089be2d081493df21d3e5fd5e60e3f3f7eb15e85cc552fdd82792c4cf7e4a8b0428d9f52902db685ed936add8d2302e478b85b2c1e22d928c865c96890118c1ef1b0657d699ca56881e55a19412e443bcfc82e7380f92e3418806b3580a29751286ff37d1d465c5d29db470a5faf7a43c7a5e0c699be4ad97d53a9dedd13138b5f3a438bff3174ad9f1aa878ff4c3549109d36b020fa357e03c98f8ddd4a36ff45fbd53af07f5420a231206f9ca4661a95d5574e3db27289af6ffcb3c6ed9aa89a507b06cbaeeb66834ecdfa20d81549396db25476c6daba7186c9b69a25516c5bf71cca098882c6e1207afa028db453089d466408c732e0b3146c620dbd445e907072413542682186190b1e0a2dac808da89ca8c0396e20ae1c7beb1251b7c02f67ca51a475da74628ac984e61ec53d09234eb4a0f4641b29613749183381d7fec95bb7f38c654838e1e5cac0d26a280d2379dd354a843bd6ff763f17519a1fdaf915d3aad49ab665e609801207f8382151f1e62f0ae0a940d4ed0b4d402d1302153b8e153dc2f20e6b643006f20d89e41ec8d0eb47d9f28034dbc7ca596105a68492d33edc85c7054e114e659c46e9a66d05f85231af572164602a9810ec4e09227d7f563045391645366f37cdc337e1e8a12eabed04d79dd1e361ef2c77f888df5f9bfd8fe5954446147a7913b2712275d4fd14f60608ec8eb13725df32730c0b4ad459f58ef7f419b0d04e5241a6c2281d275f522d7ef9d5ba2ea5e2806b70e9a407ddf92e36804948286f49b2f9bad7023dc712a60bde6d7de4b7264ab5aa77d2ea7d079df615c65352965c19b6681cfee167a7fe3c01493d383f425172c3eff4fa27723da17a36d55d4d579119d1387fe229d9b21d3091330165bab83bc5c0a48114e590cd3dabb17a2e5025a5cc5d415ab0ef668b58d7d4f4419310fe3a499b326d91af5ad8da4e1df60e9530ced4f713cc6d109e48718392f0fded6e599aea233fae8fd932696ec0da1253b3f3e9e8173ea00ac28cc02413834b5822712474a1601f9aa4f24549e3ad24768896bf908096320de85fd3d3f2c4b013f86df7afc47c6916a83a0cfd4ddb8cfac74964598886cc7e3e66f1cd76bee9fbdcf63e2fe9d64bb8b0ccc7cfdb07bb2cb9d8223e1aceb8b4a0bc4affe34dc1b60ef0d7a10cc649d8872c58677f716c795352f0dbdab1b0e8500b82286010dbbaaa26db5e3423d0c885560c674866ecc3df1b6098b4339592ebbef621e8ae0517c0819b892357044e14a8f916191f2bf8c15e147444767901b92e75f4c9adb027236e271535e716379e6c3da294c6abbb1e21b327d07cf1cd865a4f1a666e912e6f2ae3a8a2e76624768451f29599e9350ebf4a801a2d1f58d0ad2074bc00072656c82f77fe540193192ef0f02b0590d43c403af55fe839121bd9cd0d143c0e2a1c0c2892cf5c1cfa13377021398f0b99b96572f001f62cc1370c9b37955ec7da03eac6e3afb9cc0594849c6104448120dcc5986cdad6da235581af28bf087fb3b59938be3ba9b34df8e6d1c479f60033d883c4d4b603cd52c516dd8f8d5fa3df865e9dc534cf40a7dd6abb5276b352817dd34403be86514ec25b103b0d2ae65733c8bf6875ae62cc1334061e903261ffd29784d95135fe0f2c8125dece4069e0a23830fef14b1370167f81c78b26c76790406c097ddce65239e8aa76e2d7181e7f0d15ae4e43ba9347bc2fac68bdffab00a8a9c5d17c99845408b75357505225fbcf64cc9500beec957b5e9aa30c25acf2b30a8928edba8cebf103e532be168f0e86dc6c62f19794ebf527ea0323d23ff8f0033b5f3c6dba4385bb0312367d79f35350952fb08505f4a07a5b11a8b17bceedd2de2150c38e9255a8afe44f9ca491013939cdfa717e159bcb92d6e47e07497429b9546eb79bacccb9c4892909f8a0d03389502019758dd2142b6b195a6b28eab7254c014e7f0dce3732115fae2e78bb032ed90a3f011b892aec43c856a0305506d9362d6302885d34e96c51e86fefa93991a09a0e853c84e9a54f3ab9bd3392130bb0a134647b98a8e2d866e0728e6c9fa02d4da56ca8464ff3dccf9af739dfa5cae2e4d5a5513ddd185a6dd5c02c9c32cc1dd5caae2c4e1fd172824813840f43a8420e01771a0b6f28485434491b1ac93f713e2559f8299397acdd7934b0c2aeade953be1eee3a108d599551426adc99a523c660e33e9577519cfc6c8c393ed46bc34f0955b21414375b19ce0843fd64d03222e3dcbc8345d3b57524d9e5ccf69922070d8c57e3a8dfcfe50e9a137207f9157069cad31deef35494c3c35e13c0357f7ce151822809a98933f45e55efcd66de1806e203a92f3c76937f8af41128dd04b42d9583cab2eaf4c27c0c3a68134283e97b5be95a21ade06c84c0f3b47eef946dedd39c19147605f219401bd05748dbf04911cf36eb1f952ae85e45d2705e277e9c67c7b9815d1dc226cdc0f8471b7945b0e8da585c6e4abc6ca758b07583021be5f62f512ced11dc63ea4cb40e35f4557e17f79cd3fa4f0fbbc58a8723461b57915e41a39f766fc4fcf942c671fcf0a3e705da1ee6784b584052ea13a26a21bd4ab5ecf6e8cea1ee22675b9d0a6a6b813b9ed011afb84381c6c1bb4e878cbeecaecfcebf697792cc043260c138588bba9bf8827fcdac03a225078b16ae6635822aac4f8f20012ad10eb617afa9f0e50582d5f1fd831b523baec24b28cdefb7a2a69938ac59148c1337118b2d4af6d7763343304f5d89cf73c9c680642168b13b852728a31faad7ea652591263ecf0fade37aa6b044808f5f5d422ad2f6a349296f56df0769fc7e4359611948004a686680b7f1f2a6c52674635623c7d27d48dc4739450e42c8c0322b5c519141161d11a1217b19f77b27cb99977d60c0bed728baf9afa07eab612f8149322a285194c0c339a491967c4509bc35d8e79053e1c5483942b83741e520196dee1ce0bf40ec6b76030bc85b51e902a6779e454c786cf956aa403af70c77cbe1db858df8cae346a7f8615715550b00b5f50e6e21ac49d88a32920d274154e48fe324bcd12d95666941c6e0bdfd975d48f4ec1a6c3fee5a34ea0634df342143f2c0aff9ff129b7f621d7d800e89b0ec1cdd81c76cfde4038b26d92f2d6ede0edd39875d37d81a0558441696733f9aadc338525cbd4bf1fe65a3af5acdb384beb331f739d4bc500c73ff0e43df8ffecd4d72422605fe96fc0482a3dc9b87a3809dbf37095667c338309367bb233544f31e11cf81d5830be53d3b908ffc6e410bb568d5a99cae203989309abf13d54a8ec71ca2884fd031288af326eeb43e6cd77c2e20020a9891ae22919f2781fd52c8711d639fe3db26e39bc82ff8da38b4d44f5a85d43aa2f684f0f27d3b8906c73d5568fecca9505c42874b98d8c6d95105427b660a5ec4934eb3a9180b587f82a6cfa3858fde8f774a5360299581ac1ffeb8e5fe5686ee7b8d2b4699be7761fae2ff40473cb7ecc06a4d2286f512db8ee34cde15da522798dc860af48632cf94e59af4e7ee92ba03c755e76517c1444d50c572e14242c2cdc7f06227cbac09624609dbffe6f07662ea441f5823cff3c710597bbd38fe7b31da2c53e02cab0e516a0101e19fbb91eceb60d4b212920d9a6a84454f9e908366868bee7f101f5ccc8336875e79f2c51d76199099973e572faba8101cedf1b651e8197c99ec1429a2c2fb43009e4be6e0caf431d467e7b428af1a025f7abdf47d485eb4bfab20a6d14c51af1b43ab625cf0339170289cb988116f809150606a1395e718e2141ed09687dd2a0cbaeb240dcc916ce059f07999ef95ec8345d0cafbed4e5e2985e76bafc575572b4bcff2e7d1386b8090caef2cdbbd84ce40079b326863af799c4a1edc43d85a4c37869bff230f19171bc887b424c9bfb0b91b28216d081bc8221558a29544b18d4e82311d02b1f69607ffcd4c5407b9d4fff98bf6c507c2a067ac7fdfe3eddb422a35e37fbc0106820d9b891d2fa3895e1878d697452f776a26512dbb5ea2d6a20dea8281cc293a484dc3a31a7fb52dc0333543d2907628d379273c247c1eea3722eb87b2556bbc593474b7a93f82324d57050f1f115e5bedf79d2ca747c1ea8335fdc9d9bb83ee44bb1a61b286b42658b7f1cc9ce520ce5084fee647502d1108e02091929e890e0796538aa812b5fe2d16537dd22f5e3193625743410a0df88c6721f6ad96b57e5704bd9c3ffe20fa2b66edc676d8c3b5a60a97922c8244bc50779063ddbab4fc8740759c231ebe3f65abfb19eab2cc2724709b4a2d84c74e4e8e48937374ce32b14ace35575b7b4208133cfdbf48484bb50e68fab04b954ff58cecb9f643e78eb7b3423a632cc103b59451cebf05c7f58cb5dd306fb7238a77f1d37b9dec2c958f2b6a9e7d81d18319e4d0b849722e5105f45626ea235ab514b1a9972d17b0ce4ba36cee4c7ef7db22359e1d62dfa94be90543c521aa4163d109e9f1fa80e5116d800538962c8d108914b8644f65a903ff6417e6e5e80e129f4b7d0f42b576ba658edb2d92ef614afffa96717aac1a23fa1bbff54ca356b69c78fd3448c66132987a1680f25c0c6c724a5b9e3e0b4b742977aa8ee891ae3c3ed7c88b0001006e68706f6c79313330352d617678320000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018020000c320a39b02d50cb0e1a4f9c5d39610a5110b230149caf951cf09e67c1ead8115e9343ac2704b941e584381c1d3f7b798b57dfbccb2a78ed70524cef7b3c9db80fe95d6001c000400feff4e244e200000ffffffff00000000000000000000000014000e00fe800000000000000000000000000027cc0003006c7a6a68000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200400000c34c1335ed19b15edbbfb68c55805c2a27af1dd2fb40d3da05d35d95036f7234cd13a59390558181dda63e52b59858f60f4c534a07c4adf80362af75037beadc19638022f1e74973a3079a0f150c30731659b16ce45d58f4fa0b9de4a338dcb00a9b0da986cea8249c7e66874586ed36935cfd6a40da1881c45a6224e2a36a6bdc7b446"], 0x1304}, 0x1, 0x0, 0x0, 0x484}, 0x20000010) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1932.794040][ T8982] device syz_tun entered promiscuous mode [ 1932.823407][ T8981] device bridge_slave_0 left promiscuous mode 05:15:26 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x2000000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1932.870027][ T8981] bridge1181: port 2(bridge_slave_0) entered disabled state [ 1932.921134][ T8981] bridge1182: port 2(bridge_slave_0) entered blocking state [ 1932.945854][ T8981] bridge1182: port 2(bridge_slave_0) entered disabled state [ 1932.985558][ T8981] device bridge_slave_0 entered promiscuous mode 05:15:26 executing program 1: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e008, 0x0, &(0x7f0000000240), 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1933.087958][ T8992] device syz_tun left promiscuous mode [ 1933.093705][ T8992] bridge1142: port 1(syz_tun) entered disabled state 05:15:26 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x4040aea0, &(0x7f0000000000)={0xe0, 0xe1, 0x5, 0x0, 0x9, 0x14, 0x0, 0x80, 0x5, 0x7, 0x5, 0xa6, 0x0, 0x0, 0x2, 0x7, 0x40, 0x6, 0xee, [], 0x3, 0x100000001}) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1933.169115][ T8992] bridge1143: port 1(syz_tun) entered blocking state [ 1933.219866][ T8992] bridge1143: port 1(syz_tun) entered disabled state [ 1933.251656][ T8992] device syz_tun entered promiscuous mode [ 1933.277895][ T9007] FAT-fs (loop1): bogus number of reserved sectors [ 1933.284499][ T9007] FAT-fs (loop1): Can't find a valid FAT filesystem 05:15:26 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a30}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:26 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0x35, r8}]}, 0x28}}, 0x0) [ 1933.526030][ T9015] device syz_tun left promiscuous mode [ 1933.539653][ T9015] bridge1182: port 1(syz_tun) entered disabled state [ 1933.568993][ T9015] bridge1183: port 1(syz_tun) entered blocking state [ 1933.589149][ T9015] bridge1183: port 1(syz_tun) entered disabled state [ 1933.608420][ T9015] device syz_tun entered promiscuous mode [ 1933.689034][ T9018] device bridge_slave_0 left promiscuous mode [ 1933.697590][ T9018] bridge1182: port 2(bridge_slave_0) entered disabled state [ 1933.738892][ T9018] bridge1183: port 2(bridge_slave_0) entered blocking state [ 1933.769699][ T9018] bridge1183: port 2(bridge_slave_0) entered disabled state [ 1933.795375][ T9018] device bridge_slave_0 entered promiscuous mode [ 1933.831203][ T9019] device syz_tun left promiscuous mode [ 1933.839909][ T9019] bridge1143: port 1(syz_tun) entered disabled state [ 1933.853967][ T9007] FAT-fs (loop1): bogus number of reserved sectors [ 1933.869117][ T9007] FAT-fs (loop1): Can't find a valid FAT filesystem [ 1933.882313][ T9019] bridge1144: port 1(syz_tun) entered blocking state 05:15:27 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) mount$9p_virtio(&(0x7f0000000140)='syz\x00', &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='9p\x00', 0x1000, &(0x7f0000000300)={'trans=virtio,', {[{@version_u='version=9p2000.u'}, {@nodevmap='nodevmap'}, {@aname={'aname', 0x3d, 'vfat\x00'}}, {@msize={'msize', 0x3d, 0xfffffffffffffd62}}], [{@subj_user={'subj_user', 0x3d, 'vfat\x00'}}]}}) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1933.909634][ T9019] bridge1144: port 1(syz_tun) entered disabled state [ 1933.946175][ T9019] device syz_tun entered promiscuous mode 05:15:27 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x2010000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:15:27 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) connect$pppoe(0xffffffffffffffff, &(0x7f0000000000)={0x18, 0x0, {0x2, @random, 'ipvlan1\x00'}}, 0x1e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) pread64(r2, &(0x7f0000000140)=""/73, 0x49, 0xfffffffffffffff7) [ 1934.007953][ T9020] device syz_tun left promiscuous mode [ 1934.013616][ T9020] bridge1144: port 1(syz_tun) entered disabled state 05:15:27 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a31}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:27 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0x46, r8}]}, 0x28}}, 0x0) 05:15:27 executing program 1: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) [ 1934.309172][ T9041] device syz_tun left promiscuous mode [ 1934.314903][ T9041] bridge1183: port 1(syz_tun) entered disabled state [ 1934.402363][ T9041] bridge1184: port 1(syz_tun) entered blocking state [ 1934.426135][ T9041] bridge1184: port 1(syz_tun) entered disabled state [ 1934.437335][ T9041] device syz_tun entered promiscuous mode [ 1934.458301][ T9037] device bridge_slave_0 left promiscuous mode 05:15:28 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r5 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r5, 0x202002) keyctl$chown(0x4, r5, r3, r4) statx(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x400, 0x200, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r10, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00004de800000000"], 0x48}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r10}}, 0x20}}, 0x0) bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x10, r10, 0x1, 0x7, 0x6, @broadcast}, 0x14) connect$can_j1939(r2, &(0x7f0000000200)={0x1d, r10, 0x2, {0x2, 0xf0, 0x2}, 0x1}, 0x18) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000400)={{{@in=@empty, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f00000000c0)=0xe8) semctl$IPC_SET(0x0, 0x0, 0x1, &(0x7f0000000140)={{0x0, r3, r6, r11, 0xee01, 0x20, 0x7}, 0x7fff, 0x8}) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) munlockall() lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1934.507696][ T9037] bridge1183: port 2(bridge_slave_0) entered disabled state [ 1934.567074][ T9037] bridge1184: port 2(bridge_slave_0) entered blocking state [ 1934.583387][ T9037] bridge1184: port 2(bridge_slave_0) entered disabled state [ 1934.602973][ T9037] device bridge_slave_0 entered promiscuous mode [ 1934.634653][ T9046] bridge1145: port 1(syz_tun) entered blocking state [ 1934.645585][ T9046] bridge1145: port 1(syz_tun) entered disabled state [ 1934.677491][ T9046] device syz_tun entered promiscuous mode 05:15:28 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a32}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:28 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0x4f, r8}]}, 0x28}}, 0x0) 05:15:28 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000140)) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1935.078953][ T9068] device syz_tun left promiscuous mode [ 1935.084609][ T9068] bridge1184: port 1(syz_tun) entered disabled state [ 1935.115087][ T9068] bridge1185: port 1(syz_tun) entered blocking state 05:15:28 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x3f00000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1935.135084][ T9068] bridge1185: port 1(syz_tun) entered disabled state [ 1935.165212][ T9068] device syz_tun entered promiscuous mode [ 1935.194906][ T9062] device bridge_slave_0 left promiscuous mode [ 1935.211309][ T9062] bridge1184: port 2(bridge_slave_0) entered disabled state 05:15:28 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000300)={0x1, 0x4, 0x4, 0x10, 0x101, {0x77359400}, {0x5, 0x12, 0x81, 0x1b, 0x3, 0x1, "aa8eb160"}, 0x9, 0x3, @userptr, 0x10000, 0x0, 0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000040)='gtp\x00') sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x34, r2, 0xc694d42685586125, 0x0, 0x0, {}, [@GTPA_MS_ADDRESS={0x8, 0x5, @dev}, @GTPA_LINK={0x8}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast1}]}, 0x34}}, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x992b5835df4cb49a}, 0xc, &(0x7f0000000200)={&(0x7f0000000380)={0x48, r2, 0x10, 0x70bd27, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_NET_NS_FD={0x8}, @GTPA_FLOW={0x6, 0x6, 0x1}, @GTPA_FLOW={0x6, 0x6, 0x1}, @GTPA_TID={0xc, 0x3, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x48}, 0x1, 0x0, 0x0, 0x28}, 0x80) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvram\x00', 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='wchan\x00') renameat(r3, &(0x7f0000000040)='./file0\x00', r4, &(0x7f0000000140)='./file0\x00') r5 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r5) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r6, 0x330f, 0x0) ioctl$VHOST_SET_VRING_BASE(r6, 0x4008af12, &(0x7f0000000480)={0x0, 0x2}) r7 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r7, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1935.237571][ T9062] bridge1185: port 2(bridge_slave_0) entered blocking state [ 1935.259540][ T9062] bridge1185: port 2(bridge_slave_0) entered disabled state [ 1935.277752][ T9062] device bridge_slave_0 entered promiscuous mode [ 1935.295803][ T9069] device syz_tun left promiscuous mode [ 1935.301520][ T9069] bridge1145: port 1(syz_tun) entered disabled state [ 1935.364095][ T9069] bridge1146: port 1(syz_tun) entered blocking state [ 1935.383685][ T9069] bridge1146: port 1(syz_tun) entered disabled state [ 1935.420331][ T9069] device syz_tun entered promiscuous mode 05:15:29 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a33}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:29 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x2c03c0, 0x0) write$cgroup_type(r0, &(0x7f00000000c0)='threaded\x00', 0x9) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:29 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0x3a0, r8}]}, 0x28}}, 0x0) [ 1935.803509][ T9090] device syz_tun left promiscuous mode [ 1935.809354][ T9090] bridge1146: port 1(syz_tun) entered disabled state [ 1935.825177][ T26] kauditd_printk_skb: 12 callbacks suppressed [ 1935.825198][ T26] audit: type=1804 audit(1579065329.326:1117): pid=9092 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1529/file0/file0" dev="loop4" ino=1368 res=1 [ 1935.858719][ T9090] bridge1147: port 1(syz_tun) entered blocking state [ 1935.865569][ T9090] bridge1147: port 1(syz_tun) entered disabled state [ 1935.872955][ T9090] device syz_tun entered promiscuous mode [ 1935.881919][ T9091] device syz_tun left promiscuous mode 05:15:29 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r2, 0x80585414, &(0x7f0000000140)) fchdir(r1) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1935.909988][ T9091] bridge1185: port 1(syz_tun) entered disabled state [ 1935.967342][ T9091] bridge1186: port 1(syz_tun) entered blocking state [ 1935.974066][ T9091] bridge1186: port 1(syz_tun) entered disabled state [ 1936.026292][ T9091] device syz_tun entered promiscuous mode [ 1936.049701][ T26] audit: type=1804 audit(1579065329.546:1118): pid=9094 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1567/file0/file0" dev="loop1" ino=1369 res=1 [ 1936.083177][ T9086] device bridge_slave_0 left promiscuous mode [ 1936.113292][ T9086] bridge1185: port 2(bridge_slave_0) entered disabled state [ 1936.151656][ T9086] bridge1186: port 2(bridge_slave_0) entered blocking state [ 1936.178720][ T9086] bridge1186: port 2(bridge_slave_0) entered disabled state 05:15:29 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) renameat2(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', r1, &(0x7f0000000040)='./file0\x00', 0x4) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f00000000c0)={0x8001009, 0xffffffff}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:29 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x4000000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1936.204855][ T9086] device bridge_slave_0 entered promiscuous mode [ 1936.220740][ T26] audit: type=1804 audit(1579065329.726:1119): pid=9088 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1625/file0/file0" dev="loop3" ino=1370 res=1 05:15:29 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0x3af, r8}]}, 0x28}}, 0x0) 05:15:29 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0xfffffffffffffe57, 0x2, 0x0, 0x0, 0x5}, 0x0) socket$unix(0x1, 0x1, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0xd) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:29 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a34}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1936.553183][ T9113] device syz_tun left promiscuous mode [ 1936.581141][ T9113] bridge1147: port 1(syz_tun) entered disabled state [ 1936.617355][ T9113] bridge1148: port 1(syz_tun) entered blocking state [ 1936.629491][ T26] audit: type=1804 audit(1579065330.136:1120): pid=9121 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1530/file0/file0" dev="loop4" ino=1371 res=1 [ 1936.639416][ T9113] bridge1148: port 1(syz_tun) entered disabled state [ 1936.678960][ T9113] device syz_tun entered promiscuous mode 05:15:30 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f0000000300)={0xf67, 0x3f, 0x1, 'queue1\x00'}) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) gettid() r5 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x1, 0x0) r6 = getpid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x9, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40, 0x3}, 0x100, 0x0, 0x3, 0x6, 0x0, 0xfffffffc, 0xfffd}, r6, 0xffffffffffffffff, r5, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:30 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f0000000000)='threaded\x00', 0x100000000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1936.815410][ T26] audit: type=1804 audit(1579065330.316:1121): pid=9110 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1568/file0/file0" dev="loop1" ino=1372 res=1 [ 1936.825844][ T9122] device syz_tun left promiscuous mode 05:15:30 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0x1037, r8}]}, 0x28}}, 0x0) [ 1936.888949][ T9122] bridge1186: port 1(syz_tun) entered disabled state [ 1936.903916][ T9122] bridge1187: port 1(syz_tun) entered blocking state [ 1936.915541][ T9122] bridge1187: port 1(syz_tun) entered disabled state [ 1936.956411][ T9122] device syz_tun entered promiscuous mode [ 1936.972988][ T9124] device bridge_slave_0 left promiscuous mode [ 1937.103178][ T9124] bridge1186: port 2(bridge_slave_0) entered disabled state [ 1937.134293][ T26] audit: type=1804 audit(1579065330.636:1122): pid=9130 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1569/file0/file0" dev="loop1" ino=1375 res=1 [ 1937.174540][ T9124] bridge1187: port 2(bridge_slave_0) entered blocking state 05:15:30 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r2 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/renderD128\x00', 0x500000, 0x0) fsetxattr(r2, &(0x7f0000000040)=@known='security.apparmor\x00', &(0x7f00000000c0)='\x00', 0x1, 0x1) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x15a6, 0x5}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1937.234392][ T9124] bridge1187: port 2(bridge_slave_0) entered disabled state [ 1937.284150][ T9124] device bridge_slave_0 entered promiscuous mode [ 1937.319359][ T26] audit: type=1804 audit(1579065330.826:1123): pid=9123 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1626/file0/file0" dev="loop3" ino=1373 res=1 05:15:30 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x4000080000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1937.405506][ T9134] device syz_tun left promiscuous mode [ 1937.411234][ T9134] bridge1148: port 1(syz_tun) entered disabled state [ 1937.475346][ T9134] bridge1149: port 1(syz_tun) entered blocking state 05:15:31 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1937.522068][ T9134] bridge1149: port 1(syz_tun) entered disabled state [ 1937.560302][ T9134] device syz_tun entered promiscuous mode [ 1937.611681][ T9124] device bridge_slave_0 left promiscuous mode [ 1937.630318][ T9124] bridge1187: port 2(bridge_slave_0) entered disabled state 05:15:31 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a35}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:31 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0xa}}, 0x0) [ 1937.705140][ T26] audit: type=1804 audit(1579065331.206:1124): pid=9133 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1531/file0/file0" dev="loop4" ino=1374 res=1 [ 1937.766427][ T26] audit: type=1800 audit(1579065331.276:1125): pid=9148 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=1374 res=0 05:15:31 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r2 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000180)='/dev/video1\x00', 0x2, 0x0) fchdir(r1) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000300)='threaded\x00', 0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x3, 0x0) r5 = syz_open_pts(0xffffffffffffffff, 0x10040) ioctl$FICLONERANGE(r5, 0x4020940d, &(0x7f0000000200)={{r2}, 0x6, 0x400000000000000, 0x7fff}) ioctl$VIDIOC_G_CTRL(r4, 0xc008561b, &(0x7f00000002c0)={0x98f909}) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000140)={0x8, 0x1, 0x6}, &(0x7f0000000580)=[{}, {}, {}, {}, {}, {}]) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1937.940633][ T26] audit: type=1804 audit(1579065331.446:1126): pid=9142 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1570/file0/file0" dev="loop1" ino=1376 res=1 [ 1937.974817][ T9160] device syz_tun left promiscuous mode [ 1937.980577][ T9160] bridge1187: port 1(syz_tun) entered disabled state [ 1938.012720][ T9160] bridge1188: port 1(syz_tun) entered blocking state [ 1938.034301][ T9160] bridge1188: port 1(syz_tun) entered disabled state 05:15:31 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setpipe(r1, 0x407, 0x101) lsetxattr$trusted_overlay_nlink(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0xfffffe27, 0x0) [ 1938.059868][ T9160] device syz_tun entered promiscuous mode [ 1938.091591][ T9161] device syz_tun left promiscuous mode [ 1938.097467][ T9161] bridge1149: port 1(syz_tun) entered disabled state [ 1938.133833][ T9161] bridge1150: port 1(syz_tun) entered blocking state [ 1938.143140][ T9161] bridge1150: port 1(syz_tun) entered disabled state [ 1938.171732][ T9161] device syz_tun entered promiscuous mode [ 1938.237460][ T9156] bridge1188: port 2(bridge_slave_0) entered blocking state [ 1938.244946][ T9156] bridge1188: port 2(bridge_slave_0) entered disabled state [ 1938.296324][ T9156] device bridge_slave_0 entered promiscuous mode 05:15:31 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0xf}}, 0x0) 05:15:31 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a36}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:32 executing program 3: socket$unix(0x1, 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00004de800000000"], 0x48}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)={&(0x7f0000000100)=@newlink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r4}}, 0x20}}, 0x0) bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x10, r4, 0x1, 0x7, 0x6, @broadcast}, 0x14) bind$packet(r0, &(0x7f0000000000)={0x11, 0x16, r4, 0x1, 0xff}, 0x14) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r5 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000300)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000280)='asymmetric\x00', 0x0, &(0x7f0000000340)="04", 0x2, r5) keyctl$restrict_keyring(0x1d, r5, &(0x7f0000000140)='id_legacy\x00', 0x0) r6 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r6) r7 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r7, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:32 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x20, 0x5, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r3, 0xc0205647, &(0x7f0000000180)={0x980000, 0x8000, 0x9, 0xffffffffffffffff, 0x0, &(0x7f0000000140)={0x980921, 0x401, [], @value64}}) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r5, 0x330f, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000200)={0x0, 0x100000, r5}) r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r7, 0x330f, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000300)={r6, 0x80000, r7}) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:32 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x4800000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1938.502352][ T9175] device syz_tun left promiscuous mode [ 1938.508405][ T9175] bridge1150: port 1(syz_tun) entered disabled state [ 1938.518256][ T9175] bridge1151: port 1(syz_tun) entered blocking state [ 1938.524980][ T9175] bridge1151: port 1(syz_tun) entered disabled state [ 1938.532894][ T9175] device syz_tun entered promiscuous mode [ 1938.615976][ T9181] device syz_tun left promiscuous mode [ 1938.642045][ T9181] bridge1188: port 1(syz_tun) entered disabled state 05:15:32 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x10}}, 0x0) [ 1938.734021][ T9181] bridge1189: port 1(syz_tun) entered blocking state [ 1938.765881][ T9181] bridge1189: port 1(syz_tun) entered disabled state [ 1938.842206][ T9181] device syz_tun entered promiscuous mode [ 1938.895819][ T9187] device bridge_slave_0 left promiscuous mode [ 1938.935396][ T9187] bridge1188: port 2(bridge_slave_0) entered disabled state 05:15:32 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2800012, 0x810, 0xffffffffffffffff, 0x3d50e000) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x39}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:32 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bsg\x00', 0x800, 0x0) write$vhost_msg(r2, &(0x7f0000000300)={0x1, {&(0x7f0000000140)=""/127, 0x7f, &(0x7f0000000040)=""/31, 0x3, 0x7}}, 0x48) [ 1939.029000][ T9187] bridge1189: port 2(bridge_slave_0) entered blocking state [ 1939.060988][ T9187] bridge1189: port 2(bridge_slave_0) entered disabled state [ 1939.098703][ T9187] device bridge_slave_0 entered promiscuous mode [ 1939.165792][ T9198] device syz_tun left promiscuous mode [ 1939.176010][ T9198] bridge1151: port 1(syz_tun) entered disabled state [ 1939.228276][ T9198] bridge1152: port 1(syz_tun) entered blocking state [ 1939.239453][ T9198] bridge1152: port 1(syz_tun) entered disabled state [ 1939.256241][ T9198] device syz_tun entered promiscuous mode 05:15:32 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a37}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:33 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x25}}, 0x0) [ 1939.632993][ T9219] device syz_tun left promiscuous mode [ 1939.648418][ T9219] bridge1189: port 1(syz_tun) entered disabled state [ 1939.672369][ T9219] bridge1190: port 1(syz_tun) entered blocking state 05:15:33 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) write$FUSE_STATFS(r2, &(0x7f0000000140)={0x60, 0xfffffffffffffffe, 0x4, {{0x5, 0xfffffffffffffffb, 0x7, 0x2933, 0xff, 0x8, 0x10001, 0x8}}}, 0x60) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r1, &(0x7f0000000300)={0x12, 0x10, 0xfa00, {&(0x7f0000000000), r4, r2}}, 0x18) r5 = syz_open_dev$mouse(&(0x7f0000000340)='/dev/input/mouse#\x00', 0x9, 0x8000) r6 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r6, 0x84, 0x6d, &(0x7f00000003c0)=ANY=[@ANYRES32=r7, @ANYBLOB="76000000e64c772ff3d61ac642b6a108c69349d4b005dab21dda9f6e7688b89d179a2f8b59e30d89278d1f419f1d2065eeb4634d16618eda264d4502f4cc9c9c5dea5b347af89000000000000000000a4aae8e8ccf4c942cd6e1abd23f05f0ef0b15ba8c62135b218b34347007b09ab532f508356ea5738fd331207bb65971a2fa661b4b9be46013d5bbeed70dfd3a1ba99903a62b4d4ab056bf63796386d8383b02063da9"], &(0x7f0000000140)=0x2) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r5, 0x84, 0x6, &(0x7f0000000380)={r7, @in6={{0xa, 0x4e23, 0x8, @loopback, 0xffffd961}}}, &(0x7f0000000440)=0x84) 05:15:33 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x4c00000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1939.710655][ T9219] bridge1190: port 1(syz_tun) entered disabled state [ 1939.748671][ T9219] device syz_tun entered promiscuous mode 05:15:33 executing program 4: r0 = socket$unix(0x1, 0x3, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000140)={0x0, 'ip6gretap0\x00', {0x3}, 0x5}) fchdir(r1) ioctl$VIDIOC_ENUMINPUT(0xffffffffffffffff, 0xc050561a, &(0x7f0000000300)={0x6, "603cfd245814bebfcc43903e3428811991b17e7f4c02d5e86d88f18dcffa628d", 0x3, 0x80, 0x2dc2c5b7511a402f, 0xffffff, 0x2000018, 0x4}) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1939.835030][ T9220] device syz_tun left promiscuous mode [ 1939.849343][ T9220] bridge1152: port 1(syz_tun) entered disabled state 05:15:33 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x10000, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r0, 0x5386, &(0x7f00000000c0)) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) creat(&(0x7f0000000000)='./file1\x00', 0x40) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) read$dsp(r2, &(0x7f0000000140)=""/32, 0x20) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$TUNGETFILTER(r3, 0x801054db, &(0x7f0000000a00)=""/4096) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1939.877219][ T9220] bridge1153: port 1(syz_tun) entered blocking state [ 1939.890382][ T9220] bridge1153: port 1(syz_tun) entered disabled state [ 1939.919146][ T9220] device syz_tun entered promiscuous mode [ 1939.944965][ T9216] device bridge_slave_0 left promiscuous mode [ 1939.953751][ T9216] bridge1189: port 2(bridge_slave_0) entered disabled state [ 1939.985064][ T9216] bridge1190: port 2(bridge_slave_0) entered blocking state [ 1940.061948][ T9216] bridge1190: port 2(bridge_slave_0) entered disabled state [ 1940.136255][ T9216] device bridge_slave_0 entered promiscuous mode 05:15:33 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x46}}, 0x0) [ 1940.235625][ T9219] device bridge_slave_0 left promiscuous mode [ 1940.250504][ T9219] bridge1190: port 2(bridge_slave_0) entered disabled state 05:15:33 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0xaaaaaaaaaaaaac1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x1000, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x8}}, 0x0, 0x0, r1, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:33 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a38}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1940.421542][ T9243] device syz_tun left promiscuous mode [ 1940.440661][ T9243] bridge1153: port 1(syz_tun) entered disabled state [ 1940.469961][ T9243] bridge1154: port 1(syz_tun) entered blocking state [ 1940.497259][ T9243] bridge1154: port 1(syz_tun) entered disabled state [ 1940.522517][ T9243] device syz_tun entered promiscuous mode [ 1940.588058][ T9242] device bridge_slave_0 left promiscuous mode [ 1940.610659][ T9242] bridge995: port 2(bridge_slave_0) entered disabled state [ 1940.659398][ T9242] bridge1154: port 2(bridge_slave_0) entered blocking state [ 1940.694013][ T9242] bridge1154: port 2(bridge_slave_0) entered disabled state 05:15:34 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r0 = syz_open_dev$audion(&(0x7f0000000400)='/dev/audio#\x00', 0x4, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r0, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1a421240}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x4c, r1, 0x8653611ddf58038, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffff}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x101}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x33}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x44080}, 0x24000) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$VIDIOC_QUERYBUF(r3, 0xc0585609, &(0x7f0000000380)={0x7, 0x5, 0x4, 0x20780c, 0x7fffffff, {0x77359400}, {0x8, 0x1, 0x5, 0x40, 0x1f, 0x7f, "7ecb4293"}, 0x3ff, 0x0, @offset=0x80000001, 0x1000, 0x0, 0xffffffffffffffff}) fsconfig$FSCONFIG_SET_PATH_EMPTY(r2, 0x4, &(0x7f0000000300)='threaded\x00', &(0x7f0000000340)='./file0\x00', r4) r5 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r6 = creat(&(0x7f0000000100)='./file0\x00', 0x0) fcntl$getownex(r5, 0x10, &(0x7f0000000000)) r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r7, 0x330f, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r7, 0xc040563d, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4, {0x1, 0x1, 0x1ff}}) write$cgroup_type(r6, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_GET(r5, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x2c, r8, 0x1401, 0x70bd2b, 0x25dfdbfc, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x2000014) [ 1940.732772][ T9242] device bridge_slave_0 entered promiscuous mode [ 1940.769010][ T9247] device syz_tun left promiscuous mode [ 1940.774781][ T9247] bridge1190: port 1(syz_tun) entered disabled state [ 1940.821902][ T9247] bridge1191: port 1(syz_tun) entered blocking state [ 1940.833467][ T9247] bridge1191: port 1(syz_tun) entered disabled state [ 1940.850594][ T9247] device syz_tun entered promiscuous mode 05:15:34 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x6800000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1940.869260][ T9249] bridge1191: port 2(bridge_slave_0) entered blocking state [ 1940.895634][ T9249] bridge1191: port 2(bridge_slave_0) entered disabled state [ 1940.916275][ T9249] device bridge_slave_0 entered promiscuous mode 05:15:34 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) pipe(&(0x7f0000000140)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:34 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x4f}}, 0x0) 05:15:34 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a39}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1941.273231][ T9270] device syz_tun left promiscuous mode [ 1941.279035][ T9270] bridge1154: port 1(syz_tun) entered disabled state [ 1941.286893][ T9270] bridge1155: port 1(syz_tun) entered blocking state [ 1941.293669][ T9270] bridge1155: port 1(syz_tun) entered disabled state [ 1941.304136][ T9270] device syz_tun entered promiscuous mode [ 1941.329217][ T9265] device bridge_slave_0 left promiscuous mode [ 1941.335896][ T9265] bridge1154: port 2(bridge_slave_0) entered disabled state [ 1941.352726][ T9265] bridge1155: port 2(bridge_slave_0) entered blocking state [ 1941.362747][ T9265] bridge1155: port 2(bridge_slave_0) entered disabled state [ 1941.376838][ T9265] device bridge_slave_0 entered promiscuous mode [ 1941.389515][ T9272] device syz_tun left promiscuous mode [ 1941.395143][ T9272] bridge1191: port 1(syz_tun) entered disabled state [ 1941.419342][ T9272] bridge1192: port 1(syz_tun) entered blocking state [ 1941.445526][ T9272] bridge1192: port 1(syz_tun) entered disabled state [ 1941.463476][ T9272] device syz_tun entered promiscuous mode [ 1941.477471][ T26] kauditd_printk_skb: 12 callbacks suppressed [ 1941.477490][ T26] audit: type=1804 audit(1579065334.986:1139): pid=9276 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1630/file0" dev="sda1" ino=16641 res=1 [ 1941.483480][ T9271] device bridge_slave_0 left promiscuous mode [ 1941.570051][ T9271] bridge1191: port 2(bridge_slave_0) entered disabled state [ 1941.610646][ T9271] bridge1192: port 2(bridge_slave_0) entered blocking state [ 1941.641139][ T9271] bridge1192: port 2(bridge_slave_0) entered disabled state 05:15:35 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:35 executing program 3: sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c736d6b66732e666174010100000070fff8000000", 0x16}], 0x2030008, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) fcntl$addseals(r2, 0x409, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1941.669708][ T9271] device bridge_slave_0 entered promiscuous mode 05:15:35 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0xc0}}, 0x0) 05:15:35 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a3a}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1941.750022][ T26] audit: type=1804 audit(1579065335.256:1140): pid=9267 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1536/file0/file0" dev="loop4" ino=1386 res=1 05:15:35 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) recvmsg$can_bcm(r3, &(0x7f0000000880)={&(0x7f0000000140)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000000700)=[{&(0x7f0000000300)=""/220, 0xdc}, {&(0x7f0000000400)=""/190, 0xbe}, {&(0x7f00000004c0)=""/102, 0x66}, {&(0x7f0000000580)=""/160, 0xa0}, {&(0x7f0000000200)=""/8, 0x8}, {&(0x7f0000000640)=""/102, 0x66}, {&(0x7f00000006c0)=""/17, 0x11}], 0x7, &(0x7f0000000780)=""/197, 0xc5}, 0x1) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000900)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r4, &(0x7f0000000a40)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x4e035000}, 0xc, &(0x7f0000000a00)={&(0x7f0000000940)={0x6c, r5, 0x200, 0x70bd25, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @local}, @NLBL_UNLABEL_A_SECCTX={0x32, 0x7, 'system_u:object_r:systemd_logind_var_run_t:s0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, [], 0x27}}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @remote}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) ioctl$VT_ACTIVATE(0xffffffffffffffff, 0x5606, 0x80) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1942.032629][ T9294] device syz_tun left promiscuous mode [ 1942.042903][ T9294] bridge1155: port 1(syz_tun) entered disabled state 05:15:35 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x6c00000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1942.090247][ T9294] bridge1156: port 1(syz_tun) entered blocking state [ 1942.099896][ T9294] bridge1156: port 1(syz_tun) entered disabled state [ 1942.107883][ T9294] device syz_tun entered promiscuous mode [ 1942.117273][ T9296] device syz_tun left promiscuous mode [ 1942.123013][ T9296] bridge1192: port 1(syz_tun) entered disabled state [ 1942.134645][ T9296] bridge1193: port 1(syz_tun) entered blocking state [ 1942.141650][ T9296] bridge1193: port 1(syz_tun) entered disabled state [ 1942.149453][ T9296] device syz_tun entered promiscuous mode [ 1942.160472][ T9286] device bridge_slave_0 left promiscuous mode [ 1942.185785][ T9286] bridge1155: port 2(bridge_slave_0) entered disabled state [ 1942.221478][ T9286] bridge1156: port 2(bridge_slave_0) entered blocking state [ 1942.241314][ T9286] bridge1156: port 2(bridge_slave_0) entered disabled state [ 1942.262430][ T9286] device bridge_slave_0 entered promiscuous mode [ 1942.278289][ T9298] device bridge_slave_0 left promiscuous mode [ 1942.286904][ T9298] bridge1192: port 2(bridge_slave_0) entered disabled state [ 1942.318501][ T9298] bridge1193: port 2(bridge_slave_0) entered blocking state [ 1942.338561][ T9298] bridge1193: port 2(bridge_slave_0) entered disabled state [ 1942.359692][ T9298] device bridge_slave_0 entered promiscuous mode [ 1942.420885][ T9296] device bridge_slave_0 left promiscuous mode [ 1942.450059][ T9296] bridge1193: port 2(bridge_slave_0) entered disabled state 05:15:36 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0xec0}}, 0x0) [ 1942.461084][ T26] audit: type=1804 audit(1579065335.966:1141): pid=9300 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1537/file0/file0" dev="loop4" ino=1388 res=1 [ 1942.585783][ T26] audit: type=1804 audit(1579065336.006:1142): pid=9287 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1575/file0/file0" dev="loop1" ino=1387 res=1 [ 1942.621696][ T9314] device syz_tun left promiscuous mode 05:15:36 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a3b}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:36 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_GET_BEARER_NAMES(r2, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0x1c, r3, 0x404, 0x70bd25, 0x25dfdbfe, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8d05ea2f3f3e6ae7}, 0x4000000) [ 1942.631774][ T9314] bridge1156: port 1(syz_tun) entered disabled state [ 1942.679588][ T9314] bridge1157: port 1(syz_tun) entered blocking state [ 1942.704514][ T9314] bridge1157: port 1(syz_tun) entered disabled state 05:15:36 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x247, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000000)) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0xffffffffffffff5b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8, 0x0, 0xffffffffffffeec0}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fsetxattr(r3, &(0x7f00000000c0)=@known='security.apparmor\x00', &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x11, 0x1) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) ioctl$FICLONE(r3, 0x40049409, r4) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x101000, 0x0) [ 1942.729134][ T26] audit: type=1804 audit(1579065336.056:1143): pid=9312 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1631/file0" dev="sda1" ino=16796 res=1 [ 1942.740081][ T9314] device syz_tun entered promiscuous mode 05:15:36 executing program 3: r0 = socket$unix(0x1, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000140)='scalable\x00', 0x9) r1 = gettid() sched_setattr(r1, &(0x7f0000000040)={0x38, 0x1, 0x16, 0x4, 0x3, 0x0, 0x0, 0x7ff, 0x0, 0x9}, 0x0) getsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000), &(0x7f00000000c0)=0x4) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) ioctl$TIOCCONS(r2, 0x541d) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0x76656f) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r5, 0x330f, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x10, 0x810, r5, 0x85f5f000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1942.830748][ T9316] device bridge_slave_0 left promiscuous mode [ 1942.843693][ T9316] bridge1156: port 2(bridge_slave_0) entered disabled state [ 1942.871767][ T9316] bridge1157: port 2(bridge_slave_0) entered blocking state [ 1942.898263][ T9316] bridge1157: port 2(bridge_slave_0) entered disabled state [ 1942.921149][ T9316] device bridge_slave_0 entered promiscuous mode [ 1943.026789][ T9319] device syz_tun left promiscuous mode [ 1943.055526][ T9319] bridge1193: port 1(syz_tun) entered disabled state [ 1943.115276][ T9319] bridge1194: port 1(syz_tun) entered blocking state [ 1943.174238][ T9319] bridge1194: port 1(syz_tun) entered disabled state [ 1943.211006][ T9319] device syz_tun entered promiscuous mode 05:15:36 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x7400000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1943.249261][ T9322] bridge1194: port 2(bridge_slave_0) entered blocking state [ 1943.288568][ T9322] bridge1194: port 2(bridge_slave_0) entered disabled state [ 1943.315554][ T26] audit: type=1804 audit(1579065336.816:1144): pid=9330 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1538/file0/file0" dev="loop4" ino=1389 res=1 [ 1943.416881][ T9322] device bridge_slave_0 entered promiscuous mode 05:15:37 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x33fe0}}, 0x0) 05:15:37 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x3, 0x40, 0x0, 0xffffff7f}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0xfffffef8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x1046, 0x3, 0xfdffffff, 0x7f8dda886cb9ad62}, 0x0, 0x3, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:37 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a3c}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1943.665579][ T26] audit: type=1804 audit(1579065337.166:1145): pid=9328 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1576/file0" dev="sda1" ino=16811 res=1 [ 1943.781060][ T26] audit: type=1804 audit(1579065337.166:1146): pid=9333 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1576/file0" dev="sda1" ino=16811 res=1 [ 1943.829046][ T9348] device syz_tun left promiscuous mode [ 1943.834817][ T9348] bridge1157: port 1(syz_tun) entered disabled state [ 1943.859766][ T9348] bridge1158: port 1(syz_tun) entered blocking state 05:15:37 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x8a004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1943.898628][ T9348] bridge1158: port 1(syz_tun) entered disabled state [ 1943.915338][ T26] audit: type=1804 audit(1579065337.266:1147): pid=9331 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1632/file0/file0" dev="loop3" ino=1390 res=1 05:15:37 executing program 3: socket$unix(0x1, 0x0, 0x0) r0 = syz_open_dev$vcsu(&(0x7f0000000000)='/dev/vcsu#\x00', 0xfffffffffffffff8, 0x200100) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f00000000c0), &(0x7f0000000140)=0x4) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) connect$l2tp(r1, &(0x7f0000000180)={0x2, 0x0, @broadcast}, 0x10) r2 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f00000003c0)=ANY=[@ANYRES32=r3, @ANYBLOB="76000000e64c772ff3d61ac642b6a108c69349d4b005dab21dda9f6e7688b89d179a2f8b59e30d89278d1f419f1d2065eeb4634d16618eda264d4502f4cc9c9c5dea5b347af89000000000000000000a4aae8e8ccf4c942cd6e1abd23f05f0ef0b15ba8c62135b218b34347007b09ab532f508356ea5738fd331207bb65971a2fa661b4b9be46013d5bbeed70dfd3a1ba99903a62b4d4ab056bf63796386d8383b02063da9"], &(0x7f0000000140)=0x2) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000200)={0x8, 0x8001, 0x101, 0x7, r3}, 0x10) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r4) r5 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r6 = socket$l2tp(0x2, 0x2, 0x73) getsockopt$inet_buf(r6, 0x0, 0x20, &(0x7f0000000300)=""/188, &(0x7f0000000480)=0xbc) write$cgroup_type(r5, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1943.959675][ T9348] device syz_tun entered promiscuous mode [ 1944.013337][ T9342] device bridge_slave_0 left promiscuous mode [ 1944.023346][ T26] audit: type=1800 audit(1579065337.266:1148): pid=9331 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="loop3" ino=1390 res=0 [ 1944.037519][ T9342] bridge1157: port 2(bridge_slave_0) entered disabled state [ 1944.072030][ T9342] bridge1158: port 2(bridge_slave_0) entered blocking state [ 1944.098289][ T9342] bridge1158: port 2(bridge_slave_0) entered disabled state [ 1944.141854][ T9342] device bridge_slave_0 entered promiscuous mode [ 1944.179093][ T9355] device bridge_slave_0 left promiscuous mode 05:15:37 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x200100, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f00000003c0)=ANY=[@ANYRES32=r2, @ANYBLOB="76000000e64c772ff3d61ac642b6a108c69349d4b005dab21dda9f6e7688b89d179a2f8b59e30d89278d1f419f1d2065eeb4634d16618eda264d4502f4cc9c9c5dea5b347af89000000000000000000a4aae8e8ccf4c942cd6e1abd23f05f0ef0b15ba8c62135b218b34347007b09ab532f508356ea5738fd331207bb65971a2fa661b4b9be46013d5bbeed70dfd3a1ba99903a62b4d4ab056bf63796386d8383b02063da9"], &(0x7f0000000140)=0x2) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000180)={r2, 0x100, 0x1ff}, 0x8) r3 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r4) r5 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r5, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1944.194526][ T9355] bridge1194: port 2(bridge_slave_0) entered disabled state [ 1944.250990][ T9355] bridge1195: port 1(bridge_slave_0) entered blocking state [ 1944.288919][ T9355] bridge1195: port 1(bridge_slave_0) entered disabled state 05:15:37 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x7a00000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1944.353837][ T9355] device bridge_slave_0 entered promiscuous mode 05:15:38 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x200000e8}}, 0x0) 05:15:38 executing program 1: perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x800002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() clone(0x6e002100, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) semget$private(0x0, 0x0, 0x204) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, 0x0) wait4(0x0, 0x0, 0x0, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080), 0xc, &(0x7f00000001c0)={&(0x7f0000000700)=ANY=[]}, 0x1, 0x0, 0x0, 0x20004}, 0xa3520225a8cedb24) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='io\x00') r2 = socket(0x100000000011, 0x0, 0x0) write$nbd(r2, &(0x7f0000000140)={0x67446698, 0x0, 0x2, 0x0, 0x1, "d69ac0bf18b4a48a4e4cacff30ff01335461be1b6b0e551ca560243ba6b8f22fa1999c87e15170d2df3394593d32bbfe45f5a1c8d4a0baccc13cce"}, 0x4b) read$FUSE(r1, 0x0, 0x0) write$FUSE_POLL(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0x76656f) syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0xffffffff, 0x440082) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1944.483921][ T9353] device bridge_slave_0 left promiscuous mode [ 1944.517844][ T9353] bridge1195: port 1(bridge_slave_0) entered disabled state 05:15:38 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a3d}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1944.592896][ T9378] device syz_tun left promiscuous mode [ 1944.601944][ T9378] bridge1158: port 1(syz_tun) entered disabled state [ 1944.652134][ T9378] bridge1159: port 1(syz_tun) entered blocking state [ 1944.684346][ T9378] bridge1159: port 1(syz_tun) entered disabled state [ 1944.723681][ T9378] device syz_tun entered promiscuous mode [ 1944.761488][ T9381] IPVS: ftp: loaded support on port[0] = 21 [ 1944.864366][ T9387] device syz_tun left promiscuous mode [ 1944.880843][ T9387] bridge1194: port 1(syz_tun) entered disabled state [ 1944.901587][ T9387] bridge1196: port 1(syz_tun) entered blocking state 05:15:38 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x7ffff000}}, 0x0) [ 1944.963761][ T9387] bridge1196: port 1(syz_tun) entered disabled state [ 1945.015333][ T9387] device syz_tun entered promiscuous mode 05:15:38 executing program 4: socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x80, 0x1, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={0x0, 0x9}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000140)) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x4699de5a09a1a8f, 0x0) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r3, 0x4, 0x42000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002, 0x0, @rand_addr="00000100"}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000001, 0x0, 0x0) pipe(&(0x7f0000000680)) setsockopt$inet6_mtu(r4, 0x29, 0x17, 0x0, 0xfffffffffffffffa) getsockopt$ARPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x60, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, &(0x7f0000000100)) open(0x0, 0x4b1c9221bc78eec1, 0xbc6f48921b709c00) write$P9_RREADLINK(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) open(0x0, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/snmp\x00') preadv(r5, &(0x7f0000000940)=[{&(0x7f0000000200)=""/42, 0x2a}, {&(0x7f00000008c0)=""/106, 0x6a}], 0x2, 0x0) 05:15:38 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) creat(&(0x7f0000000100)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f0000000300)=""/165) open(&(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0xc000, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1945.180984][ T9384] bridge1196: port 2(bridge_slave_0) entered blocking state [ 1945.195099][ T9384] bridge1196: port 2(bridge_slave_0) entered disabled state [ 1945.214823][ T9384] device bridge_slave_0 entered promiscuous mode [ 1945.255017][ T9393] device syz_tun left promiscuous mode [ 1945.263174][ T9393] bridge1159: port 1(syz_tun) entered disabled state [ 1945.312104][ T9393] bridge1160: port 1(syz_tun) entered blocking state [ 1945.334087][ T9393] bridge1160: port 1(syz_tun) entered disabled state [ 1945.360797][ T9393] device syz_tun entered promiscuous mode 05:15:39 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = socket$bt_hidp(0x1f, 0x3, 0x6) r2 = getpid() sched_setscheduler(r2, 0x5, &(0x7f0000000380)) fstat(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r7 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r7, 0x202002) keyctl$chown(0x4, r7, r5, r6) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={r2, r3, r6}, 0xc) r8 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r8, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1945.560122][ T9382] IPVS: ftp: loaded support on port[0] = 21 05:15:39 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a3e}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:39 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x2}, 0x0) 05:15:39 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x8cffffff00000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1945.806553][ T9415] device syz_tun left promiscuous mode [ 1945.823775][ T9415] bridge1160: port 1(syz_tun) entered disabled state [ 1945.880363][ T9415] bridge1161: port 1(syz_tun) entered blocking state [ 1945.906803][ T9415] bridge1161: port 1(syz_tun) entered disabled state [ 1945.914911][ T9415] device syz_tun entered promiscuous mode [ 1945.964760][ T9419] device bridge_slave_0 left promiscuous mode [ 1946.032002][ T9419] bridge1158: port 2(bridge_slave_0) entered disabled state [ 1946.088352][ T9419] bridge1161: port 2(bridge_slave_0) entered blocking state [ 1946.100248][ T9419] bridge1161: port 2(bridge_slave_0) entered disabled state [ 1946.116171][ T9419] device bridge_slave_0 entered promiscuous mode 05:15:39 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x800, 0x0) ioctl$TIOCL_UNBLANKSCREEN(r3, 0x541c, &(0x7f0000000180)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1946.142939][ T9421] device syz_tun left promiscuous mode [ 1946.160530][ T9421] bridge1196: port 1(syz_tun) entered disabled state [ 1946.211465][ T9421] bridge1197: port 1(syz_tun) entered blocking state [ 1946.238758][ T9421] bridge1197: port 1(syz_tun) entered disabled state [ 1946.288666][ T9421] device syz_tun entered promiscuous mode [ 1946.336812][ T9422] device bridge_slave_0 left promiscuous mode [ 1946.345828][ T9422] bridge1196: port 2(bridge_slave_0) entered disabled state [ 1946.401114][ T9422] bridge1197: port 2(bridge_slave_0) entered blocking state [ 1946.408588][ T9422] bridge1197: port 2(bridge_slave_0) entered disabled state [ 1946.417521][ T9422] device bridge_slave_0 entered promiscuous mode [ 1946.462877][ T9419] device bridge_slave_0 left promiscuous mode [ 1946.470375][ T9419] bridge1161: port 2(bridge_slave_0) entered disabled state [ 1946.485857][ T9421] device bridge_slave_0 left promiscuous mode [ 1946.493359][ T9421] bridge1197: port 2(bridge_slave_0) entered disabled state 05:15:40 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x3}, 0x0) 05:15:40 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a3f}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1946.801956][ T9438] device syz_tun left promiscuous mode [ 1946.809987][ T9438] bridge1161: port 1(syz_tun) entered disabled state [ 1946.833999][ T9438] bridge1162: port 1(syz_tun) entered blocking state [ 1946.858174][ T9438] bridge1162: port 1(syz_tun) entered disabled state [ 1946.880216][ T9438] device syz_tun entered promiscuous mode [ 1946.906962][ T9439] device syz_tun left promiscuous mode [ 1946.912663][ T9439] bridge1197: port 1(syz_tun) entered disabled state [ 1946.938427][ T26] kauditd_printk_skb: 9 callbacks suppressed [ 1946.938467][ T26] audit: type=1804 audit(1579065340.446:1158): pid=9431 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1542/file0/file0" dev="loop4" ino=1399 res=1 [ 1946.972297][ T9439] bridge1198: port 1(syz_tun) entered blocking state [ 1946.988567][ T9439] bridge1198: port 1(syz_tun) entered disabled state [ 1947.012810][ T9439] device syz_tun entered promiscuous mode [ 1947.040781][ T9436] bridge1162: port 2(bridge_slave_0) entered blocking state [ 1947.068581][ T9436] bridge1162: port 2(bridge_slave_0) entered disabled state [ 1947.082830][ T9436] device bridge_slave_0 entered promiscuous mode [ 1947.112536][ T9437] bridge1198: port 2(bridge_slave_0) entered blocking state [ 1947.131829][ T9437] bridge1198: port 2(bridge_slave_0) entered disabled state [ 1947.151086][ T9437] device bridge_slave_0 entered promiscuous mode 05:15:44 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x3f, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16, 0x847}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:44 executing program 3: socket$unix(0x1, 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x78, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x2}, @request_death, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000140)={@fda={0x66646185, 0xa, 0x0, 0x27}, @fd={0x66642a85, 0x0, r0}, @flat=@handle={0x73682a85, 0xa, 0x3}}, &(0x7f0000000000)={0x0, 0x20, 0x38}}, 0x40}, @exit_looper, @clear_death], 0x1000, 0x0, &(0x7f0000000a00)="2f1177571369f9bdafe609d23d9bc88b5319a24d94edb5c52385fbebc8e634983aa4582ff65413a1761f01337570e3079653d775908071170f93cd2e611f1a04eb6c3fc81d795dda2dda40b9280fbc1c6d0c26fd7190bfa1dd4a7cf5cbd7469e46dfd73dd8290ae47f865740fd41431ca483a07fd56613781cb1b903f35d93b916c78dba67503083afc4aa6a5682feef5e32182938d5d10fd4de8e97efe9508e02a3fa52f5ad1f3c3855479f28f98f242e8925cab2c8754225301525b2e57536e6c541cbb86b541fbd1be3fe9af79746bf70cb52f6dc63e3fad45daac6e6124913e3750ebcc4960125f888f3a27615a8054e0fc7a09e694407af918fc949531066789765f2dc5a3d9a568d2ff82aea504e484f59b9b9d9900ca3abb04c092b26589a33e44bcfd430767f11c98f605a3aba9b067b4f81a2eba9a8b629662af2f35bbb6faa0cb694642c8973b6ef918e15b6a0928654ecef65a3d6ca2654ffbafdf2d089efc62c2719e19ff23aa5a5543245a1c7ffc1798025fa2dfd2afba276302e596e4acabd16ea4bfdd7f8ff820331350c287e74b7625db968d36c11f244869ad56562e5321a08cdbc77c15902020ba8b008c7ed4b2f5886fd467c1c00f7b26da1898f9a2c600d9425ee556ee5ce03430fe90c18b1aac253d1d56699952f031748c6f40010aaceaf026591e69965a277416b7aab8b3419e1f46f3647d001937a21c8afaccebdfce9f8e820cdce3c79fd7c17e4d9e27f3990d6c8a8a7c62e194e7cc9656f21b7413254f911e6f10da1637e5307e8189b33003dcd428ad4795fc0095d27cc4b099ca917d5b4e97e5fda3bc13993f70e6d467a63737cb6bd3bbe272ef8a6f04ea99e4bada807c21c8a0d17951e1ddc7bf24a9fdc8bba20d93d8fd69dd1be54d41bf645fc61729bdea90c8405cfffca3cd4257d182b38171a87ef9d74d545f7d1919037f922fb7cce0eb192c0d3d7f3a4d3f7524ab142989fa048eb7fede1f0f730aededd3d43bd5f1d9c360d205ff6ada57dbf4d29e1b3019fe4cad1c9505d48345a86fe3c2be897858d352f71fecad21f7ead3e99557b3728674571936127cac76d6f2894982fd6f5301c9feb7a772110e32dfe1d9a054304233e3f47d04f2d013d5574d5639f3e0cee8a19cec041d304b2168ffec0f7f93b2084d88c10cb7e19c02b89306fb89f7c7eadcfd1fdc53690114b3ba69ffd3d8fc553d2272b6f524c079c07936ca6a00e89067688b15fcadeb642f75ef511ed43e3a84a7969edb0ab68c9b0a61a1b7b13f82add19203ff7c0c59ffb26c89c8ed105c7f3afdbb65ea001aff0cf1ac9a52f3d9030fb2a31e7363567012076fa36cc00821caf99031abeb597448556e8edd2e5eab27eaf5b711d2bdcdc0738e533904bf6a557ea1d0c98f07a96452864b633d4f1f34f3e07bfa5eec25a6a4d1d2d1e1f629a925730e4daed3b24fff3577d43d0174e3980ac57234d6ab5a4b198278862d1a62f85a7d82ea5091b548c80d3464832284b5f81faef550e2ada6ef9cf422437500ecfd1eba1b4b47b20e5595c9bb261ef53379b0098fab59abf7840b933f79f767f7ecc83337909345c736d3ab68d416bb6000def8bdcdd65af3b32d5ba5c05d0dcf7d2170b100a3c0844e71e8ea661fc52618188e3aca597f231ef94dbd4028804e66c49936adc74af0f46fb680dc60087a7ea23a41b65236c85d70464566b88d6ec78db8582e21009e2938544e395a03a8c14f5655d9123ffa630267ca883bb71d284766863273e4fa3178f401450c5a52227f2321509a5ce5d43eca6d049c639470f994fdde7e456e61b2bdeb1df357185fb03dc2c38ec669893f7c62e4f052f2a78dd05022aa8f96111b5c3bf70f20626334d55eef232fd078e1fb81119fc78a9a8b65476534b55c3067e5c7854a94ed9a1f16a4ef24ed19b1c82c4e124f5507b02626e07224932ee4e35e950968bf0f79fdd66607727cf61b6725ef5cc893b062e0f2de051b3c84f7a3fc44476d4911dcbd7ca21a009fc003e223f127fed0c1ee09b490f35d606abd06b1288a4d486ca1cfc5bdea68214ad4cd6c1bce0ed2cf7f9362b4122f8901325e58e6acdf33a36b65692c87a40051ad0d668ed2e0f0a273dc05e2f0d383d1b22431ea7869cdbb1c9443b075f4d06eb31e994070800a15b80c8f3e206d8c098037329360044f06b2e46ceb7df085a511ce82c61cd8fcf75a0bab87471be434f8665ddb0e1ceb48a9b9608e2de32e1de95a100b964c8dd2332cc3dcf84385b62bec1f3aa04683a80684da416d0bd9873f0259ebf13e6007ebe7cdfa573f24128196052db305d75fdd225b0d9bdc7facb16d797bbf7c61198cfce826f7ccbb34f35fdba911d18e9bd001d643c0b2b21c11ebc63fb9485a463086c8b7e9dc1ef565ddad5a102d224a71f7896ffa9f44e46650462b2ff2352524d4f75651302f682e80363032796ee3ae7851309a6d234c2e9e042943ba9eb0c4dc2679d048385ec395f7dcae980708cb0216c04c600692caffd18202f8b8247fb5daf187c0e5d4de79af65a0890a78b7f25e35906735e979d67c995bfd7316947b4c9b1c7e8ebeed761cbc102071be36b06174a9771647375020e616b52a0380103f930202dd5f86ed5b6517f09ea041565e2477553959e4e64913d713eb04a19b82b8cfb26a3b49ecfd67df5846cfc829ba91892da8bd420df8ea1e15f88eedad827da81b6280b80d99608adfdec45e524bc74a179d3416fee0fd38d96c191745593b78761ef273f7b35b7a4e35f465473bb7ecd6e5d0cd821bcf996524d260a8d80b848dce39d7c4f55f93ef01bf12fb3b0ed8ce264adf447f9308d639d1c49146664bc6e22ae01ad24b868cdc7b6e317e308a60083c30f7871fcb7f59f5127fa30a2dacdab3a98c286bcf4b6559f44563c559a90bcaa23a956d6483487a0c2aa6705519687847d2bd29788f90de7c0d97c44f2cc03bcc5404ef9d00c2f58a3c9352583d58c86b794a994fe47036a7d3d0a587e261906e102ddbf5120656bcc0948e91f35eb9811779b928262a9de91e86f0a955677c09cca30a40dc4fa0db63b0f1ad6d5291139fe8f6f6f96ea2384e3ba050d6395bead8193fbd08b201f1123f441adfcdb91026398133cc8172adf186b647420d4df4cde3b489ea4621dc233182e710e96766c2afdec570c50204cba673d8043a7f974140a4cbf4f88eac0b1232cb83f3299aaafd9174976219e3aad507190dd30416b64a8b93e0c30cf236f9680c99657e19ee41974cfdc9dbec9bef9d9962914103ffb7585df4708a3eeb9bb4f579112a5ad87ad7e6d376e6e26d5b30dd886587064c0bf0d4174055aa9277680c777b93d1b420a377a4199e07a10cefb25ed023b83cfb4d920808fffc82c558667db7401a0d85de54ff9ace490af624f5c7dcd8900db0d5a69b3cbf0935b9a37f380444e21678c33ac29a86613cd86a78c3a499f14485ffbc210ceeb277e14da32e25c039364d31204bb8f3685f46a6994429b29f694a00951ed1231e30aa5668a18d472af235c31cd0ba0e5b86b4baa08fde3b755faccdf4bdffa2bf87395e9f4a84f28d30b1cb849ac956e0f7c26c4a58b80a287ba8267ae0b0895f3ce64d7d27f0570bda01c4d9d9d528442deee63ef26a22f035adeb0c61d02a84c4a7642b67ac6905f94f4b375fb3938579ea64732bb3e07eca7b83ae10a53b7838c3a707cfb345a1e897928db082ae9728d2f1d814a3bc8b68c3fc12d1992c0daaab2a9c9d1289bfe098ba98f761fd3550481ef17248598aaf7aea619d79a6e8ef7b5b4e5e4024bb4d2739553769b8bca0f9f8c03f63c098e70615d3fdb824c3049f3097d18c00033bedd5d42c67b4c2832d692014ce93e05702325336a265b3fcddd8a9e80dbaca19126226cfbcca31a53143abc02d8713de0c769f6c7185720c8862280320f1db5e56a3c7536037f0fb279a34c8967fdaa6706ed436acba79103bed3c1811d830520cdbf2fc535e7ae5f32d9f7a75f524ef9e8bbf1ffba15b85b0d6072869c0e5a014636bc173d4f63b388f6865d743ba46ae0b402fde5f9e97aca5f866555e9b6c6be01b102a88d64d3feca4dad3c9fbfc643b7350bd84e59080ef9b3d82cd9accf010e9dcbd75c7fd48449d2dde26796738e6bf098190e8d1053d9802ac9331f57751cdd8745c04442058e3a3e54660b74e0b40a59d145b341906603bd34574b98a8db9ed8bcfc5dfe4519f7805443d0e797fdded2c543797db93e6e764d8a166355721edf4eb70ba21c3a076c09db88aeeb8fd637ec5fffb48a07ba0151fad9c91373929e2e2b25a670125cc9d1236514e02c4d44212bfd238dac86a88dfa617d790ba8d2a1509bfb6c52165cab1317a52a1fac42f619f253c5bdf2cc190f76aa2ab5c692e473800406165d553df20927e09215b74236c3f99c7c9fd5864747c1222a60976cf576103f70eb0707dca3392d6d0db9989c5bc9abd04a531df940db13e05488901b2d476bfd1f56082f348b80c72ba07324a7f5163ac3996d41fc8b26046729d071ad33588694bf31b6dbd8925626303fc94c7fb282896f9972ef849dbbbd354243d2e35e12b13f85eae48b5ad6f5319996a610a70eea201b524d5c912773fea61a48fa6dd062f40ef781c5096f49b84eddafc156021e0ab7beadfb443f0671c3b66f9e408dfef70ae06b3a26534f14eb5e7418b0ed2b1cc904e1427223f2c9904a5dd4b68ff86fe6926b84a3ac75cf2ee11e78850bd3f1094ca43dc8961b78e6106c068d82bfcb3d57ef3d14207ddee9053b072686486d72f2d7736455c8193651e93c9ce90607d330af4eae66952c3efdf834e300f1088a0cfd71f95c3242a146fb8ea3a377aaa66cf2289705df0f9d48763aa8dd84bc6563317ac13ddf69efd6d72fec9c9838d512acdd3f29014c23baeb7893dfebe9a8e77c9ada4359cfbea49d4a4a002fc60e5839333cd2c695839b4be1dc12eadd1832bae599f7a1cc8d186a2a597aebcc88b2c6dcc881bf8d0c332a9bd4eefa2c282e4ff6e1e6f78f79921fb44f90417370c2338eb04f98d7b676f70004444a334f56791316c52b0c10485cba31a86d7f609aec793f50f6b70d09c71612240545f9fdf5c1f7c18cc4863a833bb38d78ddcd91fb90cd9ece07d8e5c5f60e488411c5162003b1a6bfab0a0eabac19824f1990d807b89fb199ea44347476e92291930234ae29595739367ddaf96587fa5d9c1ca2b22891a59e285c939ac14b966f91b91c161dde5d98c4831e4d7c500633c1af6e8a110dd7f4219fb3cf74ac8c721e7f1cd3cf08a0c16d4299ca2be87ee6f2c64b21a907e7fdf26c1a6e481b94534dc04f344d13905a56b0b0e3b7defb69f30d4cbd3aadc59814f0340e81651d13590e843dede02fab8ffeba67832169ad2ce20306e14d08163658c511d237d9ffdae66047d0496d84da1b89595512b583d01d34e1d3e90bf6c5a2b75803c81bc889d2aef67da1b34e9cd1550435e77518143d7ac2fe30417adaa135fbd93ed2972f9c7b8d40cfd41091bd478305840d408ef13051475601bbaa0a7f275c99449f191d721a79dc927b2934a2082a06e19278266db951d6cf2668179b537f715aeb66e9c1e07bbeac1e8439c89a28440b61ace9a85a2a3e5c3c82c9bf2573039973a5b487e2ef67d5f02b7388ef6c5db393454e2f6b81359dcc006b3aceae2bda8771fec4bd1a06392a9e3967a812eb933ffab9b378cb53f3a0f89f27eb8b9563b8ce563ec77e778d2e88ebc864fb1dfd55e96bba627d16e1"}) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:44 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x940f000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:15:44 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x4}, 0x0) 05:15:44 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f0000000140)={0xfee4, 0x800, 0x8, 0x101, 0x2, "2ef1d933796d33755ea080c094e1e92139f14e", 0x6, 0x4}) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:44 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a40}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1950.948616][ T9447] device syz_tun left promiscuous mode [ 1950.954284][ T9447] bridge1162: port 1(syz_tun) entered disabled state [ 1950.969671][ T9447] bridge1163: port 1(syz_tun) entered blocking state [ 1950.980901][ T9447] bridge1163: port 1(syz_tun) entered disabled state [ 1951.001804][ T9447] device syz_tun entered promiscuous mode [ 1951.052791][ T9455] device syz_tun left promiscuous mode [ 1951.071138][ T9455] bridge1198: port 1(syz_tun) entered disabled state [ 1951.114032][ T9455] bridge1199: port 1(syz_tun) entered blocking state [ 1951.154797][ T9455] bridge1199: port 1(syz_tun) entered disabled state [ 1951.200723][ T9455] device syz_tun entered promiscuous mode [ 1951.238090][ T9459] device bridge_slave_0 left promiscuous mode [ 1951.244383][ T9459] bridge1162: port 2(bridge_slave_0) entered disabled state [ 1951.300522][ T26] audit: type=1804 audit(1579065344.806:1159): pid=9463 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1636/file0/file0" dev="loop3" ino=1400 res=1 [ 1951.300856][ T9459] bridge1163: port 2(bridge_slave_0) entered blocking state [ 1951.415613][ T9459] bridge1163: port 2(bridge_slave_0) entered disabled state [ 1951.429917][ T26] audit: type=1804 audit(1579065344.936:1160): pid=9452 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1543/file0/file0" dev="loop4" ino=1401 res=1 [ 1951.442770][ T9459] device bridge_slave_0 entered promiscuous mode 05:15:45 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205647, &(0x7f00000000c0)={0x40000, 0x8, 0x4, 0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x990a63, 0x132, [], @ptr=0x5}}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) setns(r1, 0x40000000) ioctl$KVM_GET_NESTED_STATE(r0, 0xc080aebe, &(0x7f0000000a00)={{0x0, 0x0, 0x80}}) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) sendmsg$IPCTNL_MSG_CT_GET_DYING(r3, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x21}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x14, 0x6, 0x1, 0x200, 0x70bd2d, 0x25dfdbfe, {0x5, 0x0, 0x4}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1951.523725][ T26] audit: type=1804 audit(1579065345.026:1161): pid=9457 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1579/file0" dev="sda1" ino=16865 res=1 [ 1951.552908][ T9450] device bridge_slave_0 left promiscuous mode 05:15:45 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) write$P9_RWALK(0xffffffffffffffff, &(0x7f0000000000)={0x3d, 0x6f, 0x2, {0x4, [{0x4e, 0x4, 0x6}, {0x24, 0x2}, {0x8, 0x2, 0x5}, {0x10, 0x3, 0x4}]}}, 0x3d) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1951.568595][ T9450] bridge1198: port 2(bridge_slave_0) entered disabled state 05:15:45 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/btrfs-control\x00', 0x10001, 0x0) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000180)={0x1, 0x9, 0x7b, 0x9, 0x9, "8cb6c9833bdf8a42"}) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1951.598311][ T9450] bridge1199: port 2(bridge_slave_0) entered blocking state [ 1951.619744][ T9450] bridge1199: port 2(bridge_slave_0) entered disabled state [ 1951.643048][ T9450] device bridge_slave_0 entered promiscuous mode 05:15:45 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x5}, 0x0) 05:15:45 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a41}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1951.790704][ T9481] device syz_tun left promiscuous mode [ 1951.796474][ T9481] bridge1163: port 1(syz_tun) entered disabled state [ 1951.810573][ T9481] bridge1164: port 1(syz_tun) entered blocking state [ 1951.825562][ T9481] bridge1164: port 1(syz_tun) entered disabled state [ 1951.833196][ T9481] device syz_tun entered promiscuous mode [ 1951.845147][ T9486] device bridge_slave_0 left promiscuous mode [ 1951.854836][ T9486] bridge1163: port 2(bridge_slave_0) entered disabled state [ 1951.868082][ T9486] bridge1164: port 2(bridge_slave_0) entered blocking state [ 1951.885541][ T9486] bridge1164: port 2(bridge_slave_0) entered disabled state 05:15:45 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xf6ffffff00000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1951.898631][ T9486] device bridge_slave_0 entered promiscuous mode [ 1951.983858][ T9488] device syz_tun left promiscuous mode [ 1951.989628][ T9488] bridge1199: port 1(syz_tun) entered disabled state [ 1951.999342][ T9488] bridge1200: port 1(syz_tun) entered blocking state [ 1952.006410][ T9488] bridge1200: port 1(syz_tun) entered disabled state [ 1952.014066][ T9488] device syz_tun entered promiscuous mode [ 1952.026299][ T9488] device bridge_slave_0 left promiscuous mode [ 1952.032659][ T9488] bridge1199: port 2(bridge_slave_0) entered disabled state [ 1952.068336][ T9488] bridge1200: port 2(bridge_slave_0) entered blocking state 05:15:45 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x8}, 0x0) [ 1952.080441][ T9488] bridge1200: port 2(bridge_slave_0) entered disabled state [ 1952.097544][ T9488] device bridge_slave_0 entered promiscuous mode 05:15:45 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a42}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1952.299809][ T9495] device syz_tun left promiscuous mode [ 1952.324380][ T9495] bridge1164: port 1(syz_tun) entered disabled state [ 1952.332202][ T26] audit: type=1804 audit(1579065345.846:1162): pid=9499 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1637/file0/file0" dev="loop3" ino=1402 res=1 [ 1952.363031][ T9495] bridge1165: port 1(syz_tun) entered blocking state [ 1952.383180][ T9495] bridge1165: port 1(syz_tun) entered disabled state 05:15:45 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x10, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x47) write$cgroup_type(r1, &(0x7f0000000140)='threaded\x00', 0x9e5b39a685d0ce61) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1952.405955][ T9495] device syz_tun entered promiscuous mode [ 1952.419717][ T26] audit: type=1804 audit(1579065345.886:1163): pid=9482 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1544/file0/file0" dev="loop4" ino=1404 res=1 05:15:46 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000180)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$VIDIOC_G_DV_TIMINGS(r3, 0xc0845658, &(0x7f00000002c0)={0x0, @reserved}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) accept$inet6(r4, 0x0, &(0x7f0000000140)) ioctl$SIOCAX25ADDFWD(r1, 0x89ea, &(0x7f0000000080)={@bcast, @default}) [ 1952.504865][ T26] audit: type=1804 audit(1579065345.886:1164): pid=9475 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1580/file0/file0" dev="loop1" ino=1403 res=1 [ 1952.519721][ T9494] device bridge_slave_0 left promiscuous mode 05:15:46 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0xfffffffffffffe02, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1952.558370][ T9494] bridge1164: port 2(bridge_slave_0) entered disabled state [ 1952.590856][ T9494] bridge1165: port 2(bridge_slave_0) entered blocking state [ 1952.617922][ T9494] bridge1165: port 2(bridge_slave_0) entered disabled state [ 1952.631169][ T9494] device bridge_slave_0 entered promiscuous mode [ 1952.641262][ T9504] device syz_tun left promiscuous mode [ 1952.655634][ T9504] bridge1200: port 1(syz_tun) entered disabled state [ 1952.675321][ T9504] bridge1201: port 1(syz_tun) entered blocking state [ 1952.700821][ T9504] bridge1201: port 1(syz_tun) entered disabled state [ 1952.711721][ T26] audit: type=1804 audit(1579065346.216:1165): pid=9507 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1581/file0" dev="sda1" ino=16858 res=1 [ 1952.716318][ T9504] device syz_tun entered promiscuous mode 05:15:46 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x102) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x4, 0x70, 0x10, 0x0, 0xfc, 0x0, 0x0, 0x1000ffff, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, @perf_bp={&(0x7f0000000040), 0x2}, 0x1, 0x0, 0x100000, 0x6, 0x0, 0x2000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1952.768253][ T9505] device bridge_slave_0 left promiscuous mode [ 1952.776928][ T9505] bridge1200: port 2(bridge_slave_0) entered disabled state [ 1952.799985][ T9505] bridge1201: port 2(bridge_slave_0) entered blocking state [ 1952.813882][ T9505] bridge1201: port 2(bridge_slave_0) entered disabled state [ 1952.826551][ T9505] device bridge_slave_0 entered promiscuous mode 05:15:46 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x10}, 0x0) [ 1952.864418][ T9504] device bridge_slave_0 left promiscuous mode [ 1952.903166][ T9504] bridge1201: port 2(bridge_slave_0) entered disabled state [ 1952.930345][ T9523] device syz_tun left promiscuous mode [ 1952.936195][ T9523] bridge1165: port 1(syz_tun) entered disabled state [ 1952.959930][ T9523] bridge1166: port 1(syz_tun) entered blocking state [ 1952.967224][ T9523] bridge1166: port 1(syz_tun) entered disabled state [ 1952.974735][ T9523] device syz_tun entered promiscuous mode 05:15:46 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xf9fdffff00000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1952.985257][ T9525] device bridge_slave_0 left promiscuous mode [ 1952.992104][ T9525] bridge1165: port 2(bridge_slave_0) entered disabled state [ 1953.003347][ T9525] bridge1166: port 2(bridge_slave_0) entered blocking state [ 1953.010977][ T9525] bridge1166: port 2(bridge_slave_0) entered disabled state [ 1953.030344][ T9525] device bridge_slave_0 entered promiscuous mode 05:15:46 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a43}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:46 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x25}, 0x0) [ 1953.267819][ T9534] device syz_tun left promiscuous mode [ 1953.274745][ T9534] bridge1166: port 1(syz_tun) entered disabled state [ 1953.300239][ T9534] bridge1167: port 1(syz_tun) entered blocking state [ 1953.320356][ T9534] bridge1167: port 1(syz_tun) entered disabled state [ 1953.342465][ T9534] device syz_tun entered promiscuous mode [ 1953.381560][ T26] audit: type=1804 audit(1579065346.886:1166): pid=9510 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1545/file0/file0" dev="loop4" ino=1405 res=1 [ 1953.407081][ T9535] device syz_tun left promiscuous mode [ 1953.415829][ T9535] bridge1201: port 1(syz_tun) entered disabled state [ 1953.454969][ T9535] bridge1202: port 1(syz_tun) entered blocking state [ 1953.489442][ T9535] bridge1202: port 1(syz_tun) entered disabled state 05:15:47 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) ioctl$TCSETXF(r1, 0x5434, &(0x7f0000000000)={0x400, 0x0, [0x4, 0x20, 0xffff, 0x7, 0x3], 0xff}) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x30) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7ff, 0x7bd}, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:47 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x6, &(0x7f0000000180)={0x20000000000006, 0x5}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = socket$pptp(0x18, 0x1, 0x2) ioctl$PPPIOCGMRU(r2, 0x80047453, &(0x7f0000000280)) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$BLKIOOPT(0xffffffffffffffff, 0x1279, &(0x7f0000000300)) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) setsockopt$packet_buf(r1, 0x107, 0x8, &(0x7f0000000140)="dda3e83ab4f4583b7fa8b8a702de5b69f49257553c09b73b0767b1", 0x1b) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r3, 0x84, 0x65, &(0x7f0000000200)=[@in6={0xa, 0x4e21, 0x1ff, @loopback, 0xffffe375}], 0x1c) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) pread64(r4, &(0x7f00000001c0)=""/2, 0x2, 0x1f) [ 1953.500609][ T26] audit: type=1804 audit(1579065346.886:1167): pid=9518 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1545/file0/file0" dev="loop4" ino=1405 res=1 [ 1953.503845][ T9535] device syz_tun entered promiscuous mode [ 1953.588794][ T26] audit: type=1804 audit(1579065346.946:1168): pid=9516 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1638/file0/file0" dev="loop3" ino=1406 res=1 [ 1953.614258][ T9536] device bridge_slave_0 left promiscuous mode [ 1953.625148][ T9536] bridge1166: port 2(bridge_slave_0) entered disabled state 05:15:47 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) getsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000000), &(0x7f0000000040)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) ioctl$TIOCL_GETKMSGREDIRECT(r2, 0x541c, &(0x7f00000000c0)) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1953.656243][ T9536] bridge1167: port 2(bridge_slave_0) entered blocking state [ 1953.672630][ T9536] bridge1167: port 2(bridge_slave_0) entered disabled state [ 1953.700198][ T9536] device bridge_slave_0 entered promiscuous mode [ 1953.721168][ T9533] bridge1202: port 2(bridge_slave_0) entered blocking state [ 1953.735195][ T9533] bridge1202: port 2(bridge_slave_0) entered disabled state [ 1953.764058][ T9533] device bridge_slave_0 entered promiscuous mode 05:15:47 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x46}, 0x0) 05:15:47 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a44}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:47 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xfcfdffff00000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1954.038836][ T9558] device syz_tun left promiscuous mode [ 1954.065267][ T9558] bridge1167: port 1(syz_tun) entered disabled state [ 1954.096469][ T9558] bridge1168: port 1(syz_tun) entered blocking state [ 1954.125739][ T9558] bridge1168: port 1(syz_tun) entered disabled state [ 1954.133219][ T9558] device syz_tun entered promiscuous mode [ 1954.181497][ T9561] device bridge_slave_0 left promiscuous mode [ 1954.202088][ T9561] bridge1167: port 2(bridge_slave_0) entered disabled state [ 1954.221126][ T9561] bridge1168: port 2(bridge_slave_0) entered blocking state [ 1954.269254][ T9561] bridge1168: port 2(bridge_slave_0) entered disabled state [ 1954.306537][ T9561] device bridge_slave_0 entered promiscuous mode [ 1954.344342][ T26] audit: type=1804 audit(1579065347.846:1169): pid=9568 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1639/file0/file0" dev="loop3" ino=1408 res=1 [ 1954.411387][ T9566] device syz_tun left promiscuous mode [ 1954.428537][ T9566] bridge1202: port 1(syz_tun) entered disabled state 05:15:48 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) ioctl$IMCLEAR_L2(r2, 0x80044946, &(0x7f0000000000)=0x6) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1954.460604][ T26] audit: type=1804 audit(1579065347.966:1170): pid=9546 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1546/file0/file0" dev="loop4" ino=1409 res=1 [ 1954.490321][ T9566] bridge1203: port 1(syz_tun) entered blocking state 05:15:48 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) r1 = socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x640001, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r6, 0x330f, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000340)=0x800, 0x4) bind$inet(r5, &(0x7f0000e5b000)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r5, &(0x7f0000ccb000)={0x2, 0x4e20}, 0x10) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f00009ff000)=ANY=[@ANYBLOB="18000000030000000000000000a5000095002b0000000000"], &(0x7f00002bf000)='syzkaller\x00', 0x4, 0x436, &(0x7f0000000040)=""/183}, 0x48) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r1, 0x8982, &(0x7f0000000180)={0x6, 'bond0\x00', {}, 0x5}) r8 = socket$kcm(0x29, 0x1000000000002, 0x0) ioctl$BLKROTATIONAL(0xffffffffffffffff, 0x127e, &(0x7f0000000200)) recvmmsg(r8, &(0x7f0000003540)=[{{0x0, 0x2be, &(0x7f0000000300)=[{&(0x7f00000014c0)=""/4096, 0x1015}], 0x17, 0x0, 0x26a}}], 0x500, 0x0, 0x0) fcntl$getown(r4, 0x9) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r9, 0x330f, 0x0) ioctl$TIOCMBIC(r9, 0x5417, &(0x7f00000003c0)=0x3) write$FUSE_LK(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r8, 0x89e0, &(0x7f0000000380)={r5, r7}) sendmsg$rds(r8, &(0x7f0000002940)={0x0, 0x0, &(0x7f0000002800)=[{&(0x7f00000004c0)=""/4096, 0x1000}], 0x1}, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1954.519344][ T9566] bridge1203: port 1(syz_tun) entered disabled state [ 1954.558965][ T9566] device syz_tun entered promiscuous mode [ 1954.567898][ T26] audit: type=1804 audit(1579065348.076:1171): pid=9552 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1583/file0/file0" dev="loop1" ino=1410 res=1 [ 1954.614359][ T9567] device bridge_slave_0 left promiscuous mode [ 1954.638942][ T9567] bridge1202: port 2(bridge_slave_0) entered disabled state 05:15:48 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0xff, 0x0, 0xf5, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x800000000001, r2, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='./file1\x00', 0x0, 0x0, 0x0, 0x0) [ 1954.658856][ T9567] bridge1203: port 2(bridge_slave_0) entered blocking state [ 1954.687144][ T9567] bridge1203: port 2(bridge_slave_0) entered disabled state [ 1954.727278][ T9567] device bridge_slave_0 entered promiscuous mode [ 1954.791355][ T9566] device bridge_slave_0 left promiscuous mode [ 1954.809875][ T9566] bridge1203: port 2(bridge_slave_0) entered disabled state 05:15:48 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x4f}, 0x0) [ 1954.905306][ T9575] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 05:15:48 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a45}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:48 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xfdfdffff00000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1955.176487][ T9590] device syz_tun left promiscuous mode [ 1955.202367][ T9590] bridge1168: port 1(syz_tun) entered disabled state [ 1955.240127][ T9590] bridge1169: port 1(syz_tun) entered blocking state [ 1955.287632][ T9590] bridge1169: port 1(syz_tun) entered disabled state [ 1955.334584][ T9590] device syz_tun entered promiscuous mode 05:15:48 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000340)='/proc/self/net/pfkey\x00', 0x800, 0x0) getsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f0000000380)=""/248, &(0x7f0000000480)=0xfffffe01) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f0000000840)={0x9f0000, 0xffff6466, 0xffffff48, r4, 0x0, &(0x7f0000000800)={0x9909d5, 0x6, [], @value64=0x1}}) getsockopt$bt_l2cap_L2CAP_LM(r5, 0x6, 0x3, &(0x7f0000000880), &(0x7f00000008c0)=0x4) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/autofs\x00', 0x86b2057224c5e7a8, 0x0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r6, 0xc0305302, &(0x7f0000000300)={0x8, 0x20, 0x3, 0xfecf, 0x7, 0x7}) 05:15:49 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0xfffffffffffffec9, 0x2, 0x0, 0x0, 0x5, 0xffffffffffffffff, 0x7bf}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x3, 0xffffffff, 0xf5}) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r3, 0x8982, &(0x7f0000000000)) [ 1955.438641][ T9588] device bridge_slave_0 left promiscuous mode [ 1955.466134][ T9588] bridge1168: port 2(bridge_slave_0) entered disabled state [ 1955.505092][ T9588] bridge1169: port 2(bridge_slave_0) entered blocking state [ 1955.516476][ T9588] bridge1169: port 2(bridge_slave_0) entered disabled state [ 1955.543307][ T9588] device bridge_slave_0 entered promiscuous mode [ 1955.572935][ T9593] device syz_tun left promiscuous mode [ 1955.581091][ T9593] bridge1203: port 1(syz_tun) entered disabled state [ 1955.629635][ T9593] bridge1204: port 1(syz_tun) entered blocking state [ 1955.673071][ T9593] bridge1204: port 1(syz_tun) entered disabled state [ 1955.734228][ T9593] device syz_tun entered promiscuous mode 05:15:49 executing program 1: r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x38, r2, 0x9, 0xfbde, 0x25dfdbfb, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0xfffffffffffffe8b, 0x4, @broadcast}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @loopback}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x25}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x8080) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1955.809506][ T9594] bridge1204: port 2(bridge_slave_0) entered blocking state [ 1955.848520][ T9594] bridge1204: port 2(bridge_slave_0) entered disabled state [ 1955.879342][ T9594] device bridge_slave_0 entered promiscuous mode 05:15:49 executing program 3: r0 = socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) fcntl$setown(r0, 0x8, r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:49 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x118}, 0x0) 05:15:49 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a46}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:49 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) r1 = socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.opaque\x00', &(0x7f0000000200)='y\x00', 0x2, 0x2) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000003c0)={0xffffffffffffffff}, 0x2bd, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000580)={0x9, 0x108, 0xfa00, {r4, 0x4, "18ab91", "89669b3baaf6b0682fc941416adb0114d4ba635eef2335d6aaab6eee5ff6fee610adb6eee2acc7250a21020978c261217c7ef3a30ff21a2f0ca2c9e1fa813b89d6ab80a9f6cae933cf7d0dbf34c25602bcfd2e5dae46aa0db3a387e129fd893fa215ddb9a6463bd5a054819fa48e7dc4ad08b9a8740d1e373f7fa0cf6ec9194551ade970d2b0fd2c1dba9e5a6c4c418173f45bcff279f2743d384a76e32c8005a4c621e0e1ee3bcb3d07a5788aa5f7ffaa65789d370f35f719d2a8a66ca2fcbc77b45307fcf33b38d56ca9a140097bfbb5b315a175a1d12531af2e34f4caf7685a43e2a05f32c4d3097c11c45ec740966a1236988b75066e5f5d22dc5eb87988"}}, 0x110) fchdir(r2) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x330f, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000100)) write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0x76656f) r5 = getpid() ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x330f, 0x0) getsockname$tipc(0xffffffffffffffff, &(0x7f00000007c0)=@id, &(0x7f0000000800)=0x10) r6 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000300)='/dev/dlm_plock\x00', 0x40, 0x0) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000340)={0x6, 0x3, 0x10000}, 0x4) sched_setscheduler(r5, 0x5, &(0x7f0000000380)) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000480)=r5) r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/snapshot\x00', 0x82000, 0x0) ioctl$USBDEVFS_BULK(r7, 0xc0185502, &(0x7f0000000500)={{{0x6}}, 0xe2, 0xe9c0, &(0x7f00000006c0)="7f352423d750c66221142b44a4d6e3f2d6054315e6cc11b31b59fac705e122bc7a952a6c2127d278bb97c022da1fb143f9d9834c3db6892e728a169f179aae49be6c69825826dd200746a56d9ed5d7506d4d35d094bec52aa65e338d24e89ca6080962be8002deff9372d7739bdd5f164e00d8680e56864c281485358c7f04888019685e4a19a860372edf5b5a107a0fb593ae58cc6ab6b9805a257bc4bad207ff8f8c46d3c45cbc57330789577bbaa4f522be3cc2ff8a807d0ad4f4c23f6658f890b89dd495a43ed927a76ea91bb33d45dce8ee0f2b068c94c9c5a9d347b4832bf2"}) sched_rr_get_interval(r5, &(0x7f0000000140)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r8, 0x330f, 0x0) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r8, &(0x7f0000000440)={0x8000008}) lsetxattr$trusted_overlay_nlink(&(0x7f0000000180)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x7) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:15:49 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xff00000000000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1956.323046][ T9626] device syz_tun left promiscuous mode [ 1956.342931][ T9626] bridge1204: port 1(syz_tun) entered disabled state [ 1956.408940][ T9626] bridge1205: port 1(syz_tun) entered blocking state [ 1956.439868][ T9626] bridge1205: port 1(syz_tun) entered disabled state 05:15:49 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0xfffffd93, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x240400, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r2, 0xc0046686, &(0x7f0000000300)={0x1, 0x95, "9604a5534c63e596d3d62db7459e8b4642b7cc518e17f9c9114d32db03207b13930df9e58f5faed232647e45a59b30f658871e2e3757722167383fb0f210832368663669a93197e62282ed353a0e9ca9b2caf30cb3e034d5ff8a9434c71169ae8ecb41d6c8b14c5482a7cb05f72e0e3bbc1bb799ec6eb6f9edbbf267708a3d76c22b9ec745dfead4a423d63504b0bc680fe509d82c"}) [ 1956.471241][ T9626] device syz_tun entered promiscuous mode [ 1956.516551][ T9625] device syz_tun left promiscuous mode [ 1956.522337][ T9625] bridge1169: port 1(syz_tun) entered disabled state [ 1956.583678][ T9625] bridge1170: port 1(syz_tun) entered blocking state [ 1956.612440][ T9625] bridge1170: port 1(syz_tun) entered disabled state [ 1956.641110][ T9625] device syz_tun entered promiscuous mode 05:15:50 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f0000000300)="bc8790b948bd7e754a0919517587cd7e395ef67b5e06e225d83853154ed718d6d54586939a4e59439008fc9359f8462edd972ca1e4c70a45d2594c2ca605c6ea00234e13c38ead109290041a2f1eca4a80e9bd8d229655860676cf6e411a19d562241e6c9f29aed2ff715d0f7e1ad056e6438ed4a63e4b9fa57fc2662776c365bb146665150bda83dc4eddc1bf1f14df67bbe6c93ea908e9989665620476d82373a1b768f94440183175a4f710d75d8fb71c94b5f8e07d2ff5aba9e466cc782f17d7", 0xc2) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1956.684003][ T9622] device bridge_slave_0 left promiscuous mode [ 1956.741631][ T9622] bridge1169: port 2(bridge_slave_0) entered disabled state [ 1956.789183][ T9622] bridge1170: port 2(bridge_slave_0) entered blocking state [ 1956.825496][ T9622] bridge1170: port 2(bridge_slave_0) entered disabled state [ 1956.849398][ T9622] device bridge_slave_0 entered promiscuous mode [ 1956.885203][ T9628] device bridge_slave_0 left promiscuous mode [ 1956.902143][ T9628] bridge1204: port 2(bridge_slave_0) entered disabled state 05:15:50 executing program 3: socket$unix(0x1, 0x5, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) getsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000000)=0xad, &(0x7f00000000c0)=0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x21000, 0x0) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000180)=0x2, 0x4) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getitimer(0x0, &(0x7f0000000200)) [ 1956.959445][ T9628] bridge1205: port 2(bridge_slave_0) entered blocking state [ 1957.019765][ T9628] bridge1205: port 2(bridge_slave_0) entered disabled state [ 1957.066542][ T9628] device bridge_slave_0 entered promiscuous mode [ 1957.085646][ T9645] device bridge_slave_0 left promiscuous mode [ 1957.091865][ T9645] bridge1170: port 2(bridge_slave_0) entered disabled state 05:15:50 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x300}, 0x0) 05:15:50 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a47}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:51 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xffffff7f00000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1957.519071][ T9658] device syz_tun left promiscuous mode [ 1957.525065][ T9658] bridge1170: port 1(syz_tun) entered disabled state [ 1957.558547][ T9658] bridge1171: port 1(syz_tun) entered blocking state [ 1957.581814][ T9658] bridge1171: port 1(syz_tun) entered disabled state [ 1957.603722][ T9658] device syz_tun entered promiscuous mode [ 1957.611041][ T26] kauditd_printk_skb: 10 callbacks suppressed [ 1957.611095][ T26] audit: type=1804 audit(1579065351.116:1182): pid=9643 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1550/file0/file0" dev="loop4" ino=1417 res=1 [ 1957.642775][ T9660] device syz_tun left promiscuous mode [ 1957.648657][ T9660] bridge1205: port 1(syz_tun) entered disabled state [ 1957.680681][ T9660] bridge1206: port 1(syz_tun) entered blocking state [ 1957.702694][ T9660] bridge1206: port 1(syz_tun) entered disabled state 05:15:51 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000a00), 0x1000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1957.729555][ T9660] device syz_tun entered promiscuous mode [ 1957.786840][ T9659] device bridge_slave_0 left promiscuous mode [ 1957.793861][ T26] audit: type=1804 audit(1579065351.296:1183): pid=9651 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1643/file0/file0" dev="loop3" ino=1418 res=1 [ 1957.813919][ T9659] bridge1205: port 2(bridge_slave_0) entered disabled state [ 1957.851597][ T9659] bridge1206: port 2(bridge_slave_0) entered blocking state [ 1957.883134][ T26] audit: type=1804 audit(1579065351.326:1184): pid=9653 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1643/file0/file0" dev="loop3" ino=1418 res=1 [ 1957.945324][ T9659] bridge1206: port 2(bridge_slave_0) entered disabled state [ 1958.016410][ T9659] device bridge_slave_0 entered promiscuous mode 05:15:51 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x324}, 0x0) 05:15:51 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvram\x00', 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000100)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x1c, r4, 0x1, 0x0, 0x0, {0x1, 0x9effffff00000000}, [@SEG6_ATTR_HMACKEYID={0x8}]}, 0x1c}, 0x1, 0x6c}, 0x0) sendmsg$SEG6_CMD_GET_TUNSRC(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8bdc54ae2af3ba6d}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x64, r4, 0x8, 0x70bd25, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x40000000}, @SEG6_ATTR_ALGID={0x5, 0x6, 0xff}, @SEG6_ATTR_SECRET={0x18, 0x4, [0x80000001, 0x5, 0x5, 0x4, 0x101]}, @SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_DST={0x14, 0x1, @mcast2}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x6}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x800}]}, 0x64}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) setsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000300)={0x4, "c76806"}, 0x6) [ 1958.179152][ T9676] device syz_tun left promiscuous mode [ 1958.195955][ T9676] bridge1171: port 1(syz_tun) entered disabled state 05:15:51 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a48}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1958.230246][ T9676] bridge1172: port 1(syz_tun) entered blocking state [ 1958.263774][ T9676] bridge1172: port 1(syz_tun) entered disabled state [ 1958.297597][ T9676] device syz_tun entered promiscuous mode 05:15:52 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x336}, 0x0) [ 1958.474018][ T9684] device syz_tun left promiscuous mode [ 1958.494214][ T9684] bridge1206: port 1(syz_tun) entered disabled state [ 1958.535341][ T9684] bridge1207: port 1(syz_tun) entered blocking state [ 1958.545574][ T9684] bridge1207: port 1(syz_tun) entered disabled state [ 1958.560881][ T9684] device syz_tun entered promiscuous mode [ 1958.605500][ T26] audit: type=1804 audit(1579065352.106:1185): pid=9670 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1551/file0/file0" dev="loop4" ino=1419 res=1 [ 1958.638054][ T9681] device bridge_slave_0 left promiscuous mode [ 1958.644417][ T9681] bridge1206: port 2(bridge_slave_0) entered disabled state 05:15:52 executing program 4: socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) ioctl$SIOCRSSL2CALL(0xffffffffffffffff, 0x89e2, &(0x7f0000000140)=@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}) 05:15:52 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xffffffff00000000, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1958.709398][ T9681] bridge1207: port 2(bridge_slave_0) entered blocking state [ 1958.763293][ T9681] bridge1207: port 2(bridge_slave_0) entered disabled state [ 1958.803419][ T9681] device bridge_slave_0 entered promiscuous mode [ 1958.909809][ T9690] device syz_tun left promiscuous mode [ 1958.941286][ T9690] bridge1172: port 1(syz_tun) entered disabled state [ 1958.978158][ T9690] bridge1173: port 1(syz_tun) entered blocking state [ 1958.984886][ T9690] bridge1173: port 1(syz_tun) entered disabled state [ 1959.039604][ T9690] device syz_tun entered promiscuous mode [ 1959.055698][ T26] audit: type=1804 audit(1579065352.566:1186): pid=9678 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1644/file0/file0" dev="loop3" ino=1420 res=1 05:15:52 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a49}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:52 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x339}, 0x0) 05:15:52 executing program 3: r0 = socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000580)=[@in6={0xa, 0x4e26, 0x3, @empty, 0x7}, @in={0x2, 0x4e22, @broadcast}, @in6={0xa, 0x4e23, 0xffffffff, @ipv4={[], [], @multicast2}, 0x3}, @in={0x2, 0x4e21, @loopback}, @in={0x2, 0x4e23, @empty}, @in={0x2, 0x4e20, @multicast2}, @in6={0xa, 0x4e23, 0x7fff, @loopback, 0xac}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x19}}, @in6={0xa, 0x4e21, 0xff, @local, 0x7}, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}], 0xd0) ioctl$GIO_UNISCRNMAP(r1, 0x4b69, &(0x7f0000000140)=""/52) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r3, 0xc008240a, &(0x7f0000000180)=ANY=[@ANYBLOB="0500000000000000000000006c24a08d92da4b2e00"/36]) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000300)=""/243, &(0x7f0000000000)=0xf3) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0x76656f) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) openat$vhci(0xffffffffffffff9c, &(0x7f0000000480)='/dev/vhci\x00', 0x800) ioctl$VHOST_SET_VRING_KICK(r5, 0x330f, 0x0) getsockopt$IP_VS_SO_GET_INFO(r5, 0x0, 0x481, &(0x7f00000000c0), &(0x7f0000000200)=0xc) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000400), &(0x7f0000000440)=0x4) ioctl$VHOST_SET_VRING_KICK(r6, 0x330f, 0x0) ioctl$FICLONE(r1, 0x40049409, r6) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1959.365122][ T9703] device syz_tun left promiscuous mode [ 1959.401279][ T9703] bridge1207: port 1(syz_tun) entered disabled state [ 1959.459775][ T9703] bridge1208: port 1(syz_tun) entered blocking state [ 1959.474951][ T9703] bridge1208: port 1(syz_tun) entered disabled state [ 1959.486374][ T9703] device syz_tun entered promiscuous mode [ 1959.499816][ T26] audit: type=1804 audit(1579065353.006:1187): pid=9698 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1552/file0/file0" dev="loop4" ino=1421 res=1 [ 1959.591041][ T9702] device bridge_slave_0 left promiscuous mode [ 1959.628659][ T9702] bridge1207: port 2(bridge_slave_0) entered disabled state [ 1959.654122][ T26] audit: type=1800 audit(1579065353.116:1188): pid=9696 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="loop4" ino=1421 res=0 [ 1959.693918][ T9702] bridge1208: port 2(bridge_slave_0) entered blocking state 05:15:53 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x4000, 0x0) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000180)) r1 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1959.760421][ T9702] bridge1208: port 2(bridge_slave_0) entered disabled state 05:15:53 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1959.812710][ T9702] device bridge_slave_0 entered promiscuous mode [ 1959.897994][ T9706] device syz_tun left promiscuous mode [ 1959.946015][ T9706] bridge1173: port 1(syz_tun) entered disabled state [ 1959.959763][ T26] audit: type=1804 audit(1579065353.466:1189): pid=9717 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1645/file0/file0" dev="loop3" ino=1422 res=1 [ 1959.997864][ T9706] bridge1174: port 1(syz_tun) entered blocking state [ 1960.020881][ T9706] bridge1174: port 1(syz_tun) entered disabled state [ 1960.071765][ T9706] device syz_tun entered promiscuous mode [ 1960.130334][ T9703] device bridge_slave_0 left promiscuous mode [ 1960.137497][ T9703] bridge1208: port 2(bridge_slave_0) entered disabled state 05:15:53 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a4a}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:53 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x8eb, 0x80) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0xfffffffffffffffa}, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r2 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000300)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000280)='asymmetric\x00', 0x0, &(0x7f0000000340)="04", 0x2, r2) r3 = add_key(&(0x7f0000000180)='pkcs7_test\x00', &(0x7f0000000200)={'syz', 0x2}, &(0x7f0000000300)="57bb2251a28f92a30488607f071e188bf95607b2e8db94c21ddf3a01bb692ea96667d55506263466a091e27bb8fd27f420d9de634fcc6a9e5252df3ea0ce27a3f0b61a20ca460da0738a03704ff2fadc9eb1ad27e24578d136802473037fabdb10e7d0f952abd4700cefb7bb02307249d8c4a148e5c42e13c2f23c77c633c4cb9c9502ca7abaf4a34a11194d8f6e3ac96205f19639d935c74cd4b1cdb2cde3c4c558d8f870201a787cfc824d2b4c86076e7a575e451a5d29f0d464ac630667d2f0a732a278cf252db1eb907d4b2e2581fbdcc910ef84a8f7dc1bd13b8d5740408d4c7704e10f66c6ddebf6f83dd11bcd7139b9f94149c9c4177f4107dd", 0xfd, r2) add_key(&(0x7f00000000c0)='blacklist\x00', &(0x7f0000000140)={'syz', 0x3}, 0x0, 0x0, r3) 05:15:53 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x3b9}, 0x0) [ 1960.310660][ T9727] device syz_tun left promiscuous mode [ 1960.334887][ T9727] bridge1208: port 1(syz_tun) entered disabled state [ 1960.353582][ T26] audit: type=1804 audit(1579065353.856:1190): pid=9720 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1553/file0/file0" dev="loop4" ino=1423 res=1 [ 1960.382208][ T9727] bridge1209: port 1(syz_tun) entered blocking state [ 1960.402376][ T9727] bridge1209: port 1(syz_tun) entered disabled state 05:15:53 executing program 4: socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_REORDERTO(r1, 0x111, 0x5, 0x1, 0x4) ioctl$KVM_SMI(r1, 0xaeb7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1960.435219][ T9727] device syz_tun entered promiscuous mode [ 1960.458180][ T9729] bridge1209: port 2(bridge_slave_0) entered blocking state [ 1960.495612][ T9729] bridge1209: port 2(bridge_slave_0) entered disabled state [ 1960.531506][ T9729] device bridge_slave_0 entered promiscuous mode [ 1960.619247][ T9735] device syz_tun left promiscuous mode [ 1960.653135][ T9735] bridge1174: port 1(syz_tun) entered disabled state [ 1960.675400][ T9735] bridge1175: port 1(syz_tun) entered blocking state [ 1960.708747][ T9735] bridge1175: port 1(syz_tun) entered disabled state [ 1960.751517][ T26] audit: type=1804 audit(1579065354.256:1191): pid=9732 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1646/file0/file0" dev="loop3" ino=1424 res=1 [ 1960.756270][ T9735] device syz_tun entered promiscuous mode 05:15:54 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) socket$unix(0x1, 0x2, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:54 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a4b}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:54 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x3be}, 0x0) 05:15:54 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:15:54 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) write$P9_RLERRORu(r1, &(0x7f0000000140)={0x12, 0x7, 0x2, {{0x5, 'vfat\x00'}, 0x9}}, 0x12) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1961.194022][ T9758] device syz_tun left promiscuous mode [ 1961.208780][ T9758] bridge1209: port 1(syz_tun) entered disabled state [ 1961.237461][ T9758] bridge1210: port 1(syz_tun) entered blocking state [ 1961.253179][ T9758] bridge1210: port 1(syz_tun) entered disabled state 05:15:54 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x3, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1961.298431][ T9758] device syz_tun entered promiscuous mode [ 1961.318389][ T9760] device syz_tun left promiscuous mode [ 1961.336929][ T9760] bridge1175: port 1(syz_tun) entered disabled state [ 1961.405205][ T9760] bridge1176: port 1(syz_tun) entered blocking state [ 1961.424136][ T9760] bridge1176: port 1(syz_tun) entered disabled state [ 1961.444774][ T9760] device syz_tun entered promiscuous mode [ 1961.474062][ T9754] device bridge_slave_0 left promiscuous mode [ 1961.481543][ T9754] bridge1209: port 2(bridge_slave_0) entered disabled state 05:15:55 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0xffffffffffffff38}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000000)=0x8a, 0x4) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1961.531183][ T9754] bridge1210: port 2(bridge_slave_0) entered blocking state [ 1961.572018][ T9754] bridge1210: port 2(bridge_slave_0) entered disabled state [ 1961.596328][ T9754] device bridge_slave_0 entered promiscuous mode 05:15:55 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x4, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:15:55 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x500}, 0x0) 05:15:55 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a4c}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:55 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="00004de800000000"], 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="2000000011000100000000000000000000000000d7569518fb60d8cabaa93461fafcf7687c837e0508a191b44247147de87fc88c50a8ced13fd104a3ce69812faf5b3c1a91ec91f16c34c788776aeffa7e7e44677ba186e93b70695852990cb7753695ca45ad922c546e9ffb025d2c72ee9cb4f0088805e52222d7899507de61e6aec71e109a7e7d6ea5603608f2591a77b43d45bb22d712ee1f75e4dc259a1ccfbf0eec3f9a8127ac9b7a0a97d97d6c4da93ab0cdb703cc0f015c338421d0a205a80b0b125ce8444e2472fce4be8480c3e81737c4f47e8348930944c597c278ba127ec9370c50f76fc3a6ef7eae7122e9d0857e", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x20}}, 0x0) bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x10, r3, 0x1, 0x7, 0x6, @broadcast}, 0x14) sendmsg$inet(r0, &(0x7f00000006c0)={&(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000300)="bc4edb1ed4154c1f3bdea5142608e40295657ff0aa2e85d9ac549dca8a8a6355444f7e0490c416029c0403ddd809655453b0a30548eeccf5253de8ab8c020b7916b7adcd2c3e8ea3bbc82c0266c16c3dcb9cbbf8dc31dcc662ba3f5700638889e783db26157af8850b5d6d8d9ed3f714cca1dd49407722c30721e471eb1f74e80d1691932173fa067dff1d09cc442506b768e0cb8fe928e274d6a0dc384d9bbe555df35a19d7d4a4ac46355456ff40a8b54bb77669de341445967b84c30c834033aa4656282de9b57e83696d7c6d3c1dcb188a410859dedfbe904337a6c32dea13e1810f03cb", 0xe6}, {&(0x7f0000000180)="a4ebc76165932de729c76fcc1347a68ceaef52", 0x13}, {&(0x7f0000000400)="4f11decd6a9713b851f83cb765eb7277c62cea2b724a75fa142980b0ff6052afe9c88065a23ebdf21386bce62ecea5ba82208ecf67c21de7ac58220a79ac474a7f6d2913c823b48ef5a4f73d59089c8025496d9df05c01e4ccef5a6eabc5cde9e3003057d05e4246e8a0e6968d34c222a79ec6eb960ddfb8a18df4f603f201d76eecef157f00a870660420535a16e3304c469dcdad27d66cdb84adf5c9b2b0abf27fe780b7a8155904be621aef9b414341b5827e13f178bce2276122905c70", 0xbf}, {&(0x7f0000000580)="c05426c5b96d125fb2ab7f9ee01fdadb416d3f2c43c03cb9c8dae5befb9f5158943fb7669c39d45e62bceb1d9133af93b304fa0a408496a83c0a77d5a05330c7bffbe83daef2ac808017b77b24a2adb17aa5325ebeadbfc908c693708b0cb62b2bcbb057bdebb0dc503bc88e55ecceae50f377b9fc5121b34404fa4c75bf66103164675162c7acc4713ffbea243f5376913a93e62652871c01e61b77d6823d73258c7106a8201fab956e94b4a9cf7e48802001ffe31bf23c3eb12118981866f61dcb7c5b23e155a691d1ce0d57552a1f8ff45d6ecd9e96a4eccbdf5c215d4603f36afaebb67a27a4b1b05c8b1eed768e3adf5de885dbbcbffeb9", 0xfa}, {&(0x7f0000000200)="cb2ac590a9948deafdc74095eec0635384ceb6d70a949ee87d75334424979f12c92cf0", 0x23}], 0x5, &(0x7f0000000680)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @rand_addr=0x3, @local}}}], 0x20}, 0x10040) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r4) r5 = accept$inet6(r2, &(0x7f0000000700)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000740)=0x1c) signalfd4(r5, &(0x7f0000000780)={0x3}, 0x8, 0x81800) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r1, 0xc0406618, &(0x7f0000000940)={{0x0, 0x0, @descriptor="3372c8af697c350d"}}) r6 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r6, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x81, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff, 0x0, 0x9}, 0x0, 0x7fffffffffffffff, 0xffffffffffffffff, 0x1) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r7 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r7, 0x330f, 0x0) futimesat(r7, &(0x7f00000008c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000900)={{0x77359400}, {0x0, 0x7530}}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1961.962530][ T9785] device syz_tun left promiscuous mode [ 1961.968433][ T9785] bridge1176: port 1(syz_tun) entered disabled state [ 1961.996856][ T9785] bridge1177: port 1(syz_tun) entered blocking state 05:15:55 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x5, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1962.011273][ T9785] bridge1177: port 1(syz_tun) entered disabled state [ 1962.046464][ T9785] device syz_tun entered promiscuous mode [ 1962.066857][ T9790] device syz_tun left promiscuous mode [ 1962.072463][ T9790] bridge1210: port 1(syz_tun) entered disabled state [ 1962.130478][ T9790] bridge1211: port 1(syz_tun) entered blocking state [ 1962.148763][ T9790] bridge1211: port 1(syz_tun) entered disabled state [ 1962.167632][ T9790] device syz_tun entered promiscuous mode [ 1962.191358][ T9786] device bridge_slave_0 left promiscuous mode 05:15:55 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x6, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1962.236493][ T9786] bridge1210: port 2(bridge_slave_0) entered disabled state [ 1962.351168][ T9786] bridge1211: port 2(bridge_slave_0) entered blocking state [ 1962.401178][ T9786] bridge1211: port 2(bridge_slave_0) entered disabled state [ 1962.431970][ T9786] device bridge_slave_0 entered promiscuous mode 05:15:56 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x600}, 0x0) 05:15:56 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x7, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:15:56 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x69a4d}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1962.685974][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 1962.685998][ T26] audit: type=1804 audit(1579065356.196:1195): pid=9810 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1648/file0" dev="sda1" ino=16867 res=1 [ 1962.842200][ T26] audit: type=1800 audit(1579065356.196:1196): pid=9810 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.3" name="file0" dev="sda1" ino=16867 res=0 [ 1962.842354][ T9823] device syz_tun left promiscuous mode [ 1962.872737][ T9823] bridge1177: port 1(syz_tun) entered disabled state [ 1962.881084][ T26] audit: type=1804 audit(1579065356.196:1197): pid=9811 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1648/file0" dev="sda1" ino=16867 res=1 [ 1962.921817][ T9823] bridge1178: port 1(syz_tun) entered blocking state 05:15:56 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x8, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1962.938237][ T9823] bridge1178: port 1(syz_tun) entered disabled state [ 1962.953232][ T9823] device syz_tun entered promiscuous mode [ 1962.970555][ T9824] device syz_tun left promiscuous mode [ 1962.976248][ T9824] bridge1211: port 1(syz_tun) entered disabled state [ 1962.997158][ T26] audit: type=1804 audit(1579065356.506:1198): pid=9803 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1556/file0" dev="sda1" ino=16887 res=1 [ 1963.039678][ T9824] bridge1212: port 1(syz_tun) entered blocking state [ 1963.065568][ T9824] bridge1212: port 1(syz_tun) entered disabled state [ 1963.093477][ T26] audit: type=1800 audit(1579065356.506:1199): pid=9803 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16887 res=0 [ 1963.117385][ T9824] device syz_tun entered promiscuous mode [ 1963.138083][ T9820] device bridge_slave_0 left promiscuous mode [ 1963.156592][ T9820] bridge1211: port 2(bridge_slave_0) entered disabled state [ 1963.170994][ T26] audit: type=1804 audit(1579065356.506:1200): pid=9826 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1556/file0" dev="sda1" ino=16887 res=1 [ 1963.213181][ T9820] bridge1212: port 2(bridge_slave_0) entered blocking state [ 1963.221468][ T9820] bridge1212: port 2(bridge_slave_0) entered disabled state [ 1963.229648][ T9820] device bridge_slave_0 entered promiscuous mode 05:15:56 executing program 3: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x330f, 0x0) ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000140)={0xffffffff, 0xc, 0x4, 0x40, 0x2, {0x0, 0x7530}, {0x3, 0x8, 0x6, 0x78, 0x12, 0x6, "0f7738c2"}, 0x1, 0x2, @userptr=0xa663, 0x3112, 0x0, r0}) ioctl$SNDCTL_DSP_GETCAPS(r1, 0x8004500f, &(0x7f0000000000)) socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000300)) ustat(0x0, &(0x7f00000000c0)) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:15:56 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x9, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:15:56 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x700}, 0x0) 05:15:56 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x200000}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:56 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) r4 = openat$cgroup(r3, &(0x7f0000000180)='syz1\x00', 0x200002, 0x0) ioctl$VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000300)={0x300, 0x3, 0x4, 0x2c539abd34c49c74, 0x1f, {0x77359400}, {0x5, 0xc, 0x0, 0x2, 0x7a, 0x9, "5b2955f7"}, 0x5, 0x1, @planes=&(0x7f0000000140)={0x41, 0x7f, @userptr=0x523, 0x4}, 0x2, 0x0, r4}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1963.539446][ T9842] device syz_tun left promiscuous mode [ 1963.559054][ T9842] bridge1178: port 1(syz_tun) entered disabled state [ 1963.612523][ T9842] bridge1179: port 1(syz_tun) entered blocking state [ 1963.664479][ T9842] bridge1179: port 1(syz_tun) entered disabled state [ 1963.686388][ T9842] device syz_tun entered promiscuous mode 05:15:57 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0xa, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1963.774493][ T9851] device syz_tun left promiscuous mode [ 1963.808629][ T9851] bridge1212: port 1(syz_tun) entered disabled state [ 1963.829791][ T9851] bridge1213: port 1(syz_tun) entered blocking state [ 1963.858873][ T9851] bridge1213: port 1(syz_tun) entered disabled state [ 1963.895737][ T9851] device syz_tun entered promiscuous mode [ 1963.922796][ T9853] device bridge_slave_0 left promiscuous mode [ 1963.948800][ T9853] bridge1212: port 2(bridge_slave_0) entered disabled state [ 1964.004577][ T9853] bridge1213: port 2(bridge_slave_0) entered blocking state [ 1964.018890][ T9853] bridge1213: port 2(bridge_slave_0) entered disabled state [ 1964.051058][ T9853] device bridge_slave_0 entered promiscuous mode [ 1964.114042][ T9851] device bridge_slave_0 left promiscuous mode [ 1964.142187][ T26] audit: type=1804 audit(1579065357.646:1201): pid=9852 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1557/file0/file0" dev="sda1" ino=16904 res=1 [ 1964.177197][ T9851] bridge1213: port 2(bridge_slave_0) entered disabled state 05:15:57 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x10, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:15:57 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x900}, 0x0) [ 1964.293469][ T26] audit: type=1800 audit(1579065357.676:1202): pid=9844 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16904 res=0 05:15:57 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x1000000}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1964.377726][ T26] audit: type=1804 audit(1579065357.766:1203): pid=9845 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1649/file0/file0" dev="loop3" ino=1428 res=1 05:15:57 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) r1 = socket$unix(0x1, 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) sendto(r1, &(0x7f0000000140)="91f5f315ac9fea783289c3acebb41157c10b33cc084e34effebbbaddd0ee54a2871895b63b5de6ccdb4faf0ebd71a0bfde9c66de078c6236fe2fffabe2bfa3561a12275a06e7d68c88858e32eb88ef5f4e4495162a5f5df8d9c4ac44fd9641bf24ad504e0d5d1a6807ece77aa9b12e", 0x6f, 0x80, &(0x7f0000000300)=@pppol2tpv3={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @local}, 0x2, 0x4, 0x1, 0x1}}, 0x80) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x5, &(0x7f0000000740)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}, {&(0x7f00000003c0)="ef9bb50f6a859f8b05c2e27f758dfb8d762e89ecbad2f0d2194367b016e2753f8e6ea1db0b1c2e48c4c5e55aebfea3ef57a2dd4224d6752d058ac249ec4e250fab22676b335b17401a9f60b6b97fd4e638f3b81d20bf580602331c062e90619ac680a0a610b98add41a4d9c978f0f23b5a61", 0x72, 0x3}, {&(0x7f0000000440)="c3b68ec717998463077871e4c2095512e5b6977b04dffd927a5be19f599f8bdd2599e814ccf4b5a3b116bc0cc8bd08cdfccfbe48fffee98153793f5eeb43731169ed30879480c0fa2a046d613658bc8cc68dbac8642a55b4a4a82477311ce0ea0849e303c5aadce80bce2b984f72df5e6f8bd329f811be04142ac73dc3ae6a58740086555b6b7b156677765fc20b30e47398920d7c5845f8", 0x2ea, 0x6}, {&(0x7f0000000580)="ab48bf5fa51a20d7f48eb28a28c25d5a3ae3d675ef6f8b156fd2bac335db4b07ebe13ee29c16410541b29461e2739e5afe6f643fda97eea9ad5a3a1f68c6ec99cf133775520420252d245021389454544d87578bdca9a562bf91ae829067a2d84076d7eb683eeeeb039983b3f8255b2c8a9196863000f9407e57d367c2e967fcf6c88ce6b513fbab24b9be", 0x8b, 0x8000003}, {&(0x7f0000000640)="c2be17286777afcf822849b9895bd4e0222f1fac5120e5240dc507a46a02c261a61064835ee40f94a03663510cb98418d76610d75b5ac08bb4481b31e6adf42490cfe9034a0222493d8bda3962cbe6688edc23f9f934e8b77ea47a7ca825af9b35a60442228abe48cf4d29068a8b80d7c73dfa917fd47cdd2830b83ffaee7f2faa7fc355f200f61a78c09d58645bb0718fc14d3789e9cd87c874d0f41baf212a56087cf0e8d258b47623b1bf5112b8fb111a45bb0ade45626aa5a50851f25bb193ad024e929754b6100af428676d97b4386e6d52e933d1606db99ebeaf679e25d0c2ea0b2e468de1dba88a6e", 0xec, 0x200}], 0x0, 0x0) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000100)=0x6a1) fchdir(r3) r4 = creat(&(0x7f0000000380)='./file0\x00', 0x4a) write$cgroup_type(r4, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x100000000, 0x7}, 0x0, 0x0, 0xfffffff7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1964.432842][ T9868] device syz_tun left promiscuous mode [ 1964.471313][ T9868] bridge1179: port 1(syz_tun) entered disabled state 05:15:58 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$KVM_DEASSIGN_DEV_IRQ(0xffffffffffffffff, 0x4040ae75, &(0x7f0000000180)={0x3, 0xc69a, 0x8, 0x200}) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000000c0)={0x0, 0xb7}, 0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) ioctl$UI_END_FF_ERASE(r0, 0x400c55cb, &(0x7f0000000140)={0xd, 0x4, 0x7}) openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x400, 0x0) [ 1964.520588][ T9868] bridge1180: port 1(syz_tun) entered blocking state [ 1964.527485][ T9868] bridge1180: port 1(syz_tun) entered disabled state [ 1964.535117][ T9868] device syz_tun entered promiscuous mode 05:15:58 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x48, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1964.576301][ T9876] device syz_tun left promiscuous mode [ 1964.598644][ T9876] bridge1213: port 1(syz_tun) entered disabled state [ 1964.634954][ T9876] bridge1214: port 1(syz_tun) entered blocking state [ 1964.655524][ T9880] FAT-fs (loop4): invalid media value (0x12) [ 1964.655546][ T9876] bridge1214: port 1(syz_tun) entered disabled state [ 1964.673687][ T9880] FAT-fs (loop4): Can't find a valid FAT filesystem [ 1964.699482][ T9876] device syz_tun entered promiscuous mode [ 1964.720243][ T9877] bridge1214: port 2(bridge_slave_0) entered blocking state [ 1964.745168][ T9877] bridge1214: port 2(bridge_slave_0) entered disabled state [ 1964.764737][ T9877] device bridge_slave_0 entered promiscuous mode 05:15:58 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0xa00}, 0x0) 05:15:58 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x4c, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:15:58 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x2000000}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1965.055269][ T9897] device syz_tun left promiscuous mode [ 1965.075673][ T9897] bridge1180: port 1(syz_tun) entered disabled state [ 1965.102474][ T9897] bridge1181: port 1(syz_tun) entered blocking state [ 1965.128136][ T26] audit: type=1804 audit(1579065358.636:1204): pid=9903 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1558/file0/file0" dev="sda1" ino=16908 res=1 [ 1965.137826][ T9897] bridge1181: port 1(syz_tun) entered disabled state [ 1965.186317][ T9880] FAT-fs (loop4): invalid media value (0x12) [ 1965.192382][ T9880] FAT-fs (loop4): Can't find a valid FAT filesystem 05:15:58 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x68, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1965.235544][ T9897] device syz_tun entered promiscuous mode [ 1965.309252][ T9905] device syz_tun left promiscuous mode [ 1965.330744][ T9905] bridge1214: port 1(syz_tun) entered disabled state 05:15:58 executing program 3: r0 = syz_open_dev$video(&(0x7f0000000140)='/dev/video#\x00', 0xff, 0x42002) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000180)=0x4) socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) open(&(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x4000, 0x2) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) write$capi20(r3, &(0x7f00000000c0)={0x10, 0x800, 0x82, 0x83, 0x7ff}, 0x10) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000400)='/dev/qat_adf_ctl\x00', 0x40400, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK/file0\x00', 0x14000, 0xb0) write$P9_RWRITE(r4, &(0x7f0000000300)={0xb, 0x77, 0x1, 0x734}, 0xb) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) syslog(0x1, &(0x7f0000000440)=""/119, 0x77) ioctl$VHOST_SET_VRING_KICK(r5, 0x330f, 0x0) accept4$unix(r5, &(0x7f0000000380)=@abs, &(0x7f00000004c0)=0x100000081, 0x80000) [ 1965.371764][ T9905] bridge1215: port 1(syz_tun) entered blocking state [ 1965.401104][ T9905] bridge1215: port 1(syz_tun) entered disabled state 05:15:58 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000000440)=[{0x5, 0x4e, 0xfe, 0x1, @tick=0x1c000000, {0x1, 0xe1}, {0xff}, @result={0x7fff, 0x3}}], 0x1c) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f0000000140)={{0x2, 0x4e22, @empty}, {0xe, @random="31c5f061fef5"}, 0x0, {0x2, 0x4e23, @loopback}, 'virt_wifi0\x00'}) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x330f, 0x0) readv(r4, &(0x7f0000000200)=[{&(0x7f0000000300)=""/194, 0xc2}], 0x1) write$cgroup_type(r2, &(0x7f0000000400)='threaded\x00', 0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1965.420051][ T9905] device syz_tun entered promiscuous mode [ 1965.442579][ T9906] device bridge_slave_0 left promiscuous mode [ 1965.464774][ T9906] bridge1214: port 2(bridge_slave_0) entered disabled state [ 1965.500068][ T9906] bridge1215: port 2(bridge_slave_0) entered blocking state [ 1965.519568][ T9906] bridge1215: port 2(bridge_slave_0) entered disabled state [ 1965.554120][ T9906] device bridge_slave_0 entered promiscuous mode 05:15:59 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x6c, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1965.617777][ T9905] device bridge_slave_0 left promiscuous mode 05:15:59 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x3000000}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1965.664745][ T9905] bridge1215: port 2(bridge_slave_0) entered disabled state 05:15:59 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0xb00}, 0x0) 05:15:59 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0xffffffff, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1965.812188][ T9927] device syz_tun left promiscuous mode [ 1965.818048][ T9927] bridge1215: port 1(syz_tun) entered disabled state [ 1965.831867][ T9927] bridge1216: port 1(syz_tun) entered blocking state [ 1965.838748][ T9927] bridge1216: port 1(syz_tun) entered disabled state [ 1965.846416][ T9927] device syz_tun entered promiscuous mode 05:15:59 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x74, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1965.859147][ T9927] bridge1216: port 2(bridge_slave_0) entered blocking state [ 1965.877611][ T9927] bridge1216: port 2(bridge_slave_0) entered disabled state [ 1965.934155][ T9927] device bridge_slave_0 entered promiscuous mode [ 1966.021532][ T9932] device syz_tun left promiscuous mode [ 1966.039529][ T9932] bridge1181: port 1(syz_tun) entered disabled state [ 1966.102860][ T9932] bridge1182: port 1(syz_tun) entered blocking state [ 1966.180135][ T9932] bridge1182: port 1(syz_tun) entered disabled state [ 1966.201174][ T9932] device syz_tun entered promiscuous mode 05:15:59 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x7a, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:15:59 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x4000000}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:15:59 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0xc00}, 0x0) 05:16:00 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240), 0x844, 0x0) ioctl$VFIO_IOMMU_GET_INFO(0xffffffffffffffff, 0x3b70, &(0x7f00000003c0)={0x18, 0x0, 0x0, 0xce}) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x4, 0xfffffffffffffe7d, 0x2, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000180), 0x4}, 0x0, 0x0, 0xffffffff}, 0xffffffffffffffff, 0xffffffffffffdfff, 0xffffffffffffffff, 0x6) sendmsg$IPSET_CMD_GET_BYNAME(r2, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40022000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, 0xe, 0x6, 0x800, 0x70bd25, 0x25dfdbfb, {0xe, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x8400) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:16:00 executing program 3: socket$unix(0x1, 0x0, 0x0) fsopen(&(0x7f0000000000)='logfs\x00', 0x3) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:16:00 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x300, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1966.637618][ T9957] device syz_tun left promiscuous mode [ 1966.643407][ T9957] bridge1216: port 1(syz_tun) entered disabled state [ 1966.673996][ T9957] bridge1217: port 1(syz_tun) entered blocking state [ 1966.705631][ T9957] bridge1217: port 1(syz_tun) entered disabled state [ 1966.755604][ T9963] FAT-fs (loop4): bogus number of reserved sectors [ 1966.762162][ T9963] FAT-fs (loop4): Can't find a valid FAT filesystem [ 1966.770042][ T9957] device syz_tun entered promiscuous mode [ 1966.816738][ T9960] device syz_tun left promiscuous mode [ 1966.822345][ T9960] bridge1182: port 1(syz_tun) entered disabled state [ 1966.877297][ T9960] bridge1183: port 1(syz_tun) entered blocking state [ 1966.946542][ T9960] bridge1183: port 1(syz_tun) entered disabled state 05:16:00 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000000880)=[{&(0x7f00000000c0)=""/4, 0x4}, {&(0x7f0000000140)=""/40, 0x28}, {&(0x7f0000000300)=""/95, 0x5f}, {&(0x7f0000000380)=""/107, 0x6b}, {&(0x7f0000000400)=""/213, 0xd5}, {&(0x7f0000000580)=""/72, 0x48}, {&(0x7f0000000180)=""/61, 0x3d}, {&(0x7f0000000600)=""/166, 0xa6}, {&(0x7f00000006c0)=""/234, 0xea}, {&(0x7f00000007c0)=""/139, 0x8b}], 0xa}, 0x2001) r1 = syz_open_dev$sndctrl(&(0x7f0000000c80)='/dev/snd/controlC#\x00', 0xfffffffffffffffd, 0x80240) r2 = socket$can_bcm(0x1d, 0x2, 0x2) r3 = pidfd_open(0x0, 0x0) r4 = socket$nl_crypto(0x10, 0x3, 0x15) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r5, 0x330f, 0x0) r6 = socket$rds(0x15, 0x5, 0x0) r7 = eventfd2(0x8001, 0x80000) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000cc0)={0xffffffffffffffff}) r9 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r9, 0x330f, 0x0) ioctl$VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000d00)={0xa, 0x10000, 0x5, 0x0, r9}) r11 = accept$ax25(0xffffffffffffffff, &(0x7f0000000d40)={{0x3, @rose}, [@netrom, @rose, @bcast, @default, @bcast, @null, @remote, @rose]}, &(0x7f0000000dc0)=0x48) r12 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r12, 0x330f, 0x0) r13 = socket$can_j1939(0x1d, 0x2, 0x7) r14 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r14, 0x330f, 0x0) r15 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r15, 0x330f, 0x0) r16 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r16, 0x330f, 0x0) r17 = accept4$netrom(0xffffffffffffffff, &(0x7f00000012c0)={{0x3, @netrom}, [@rose, @remote, @rose, @null, @netrom, @rose, @default, @bcast]}, &(0x7f0000001340)=0x48, 0x40000) r18 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r18, 0x330f, 0x0) r19 = openat$zero(0xffffffffffffff9c, &(0x7f0000001440)='/dev/zero\x00', 0x521000, 0x0) r20 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000001940)='/dev/ttynull\x00', 0xb809d6bb7afde6d8, 0x0) r21 = openat$userio(0xffffffffffffff9c, &(0x7f0000001980)='/dev/userio\x00', 0x100000, 0x0) r22 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r22, 0x330f, 0x0) r23 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r23, 0x330f, 0x0) r24 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r24, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r27 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r27, 0x202002) keyctl$chown(0x4, r27, r25, r26) r28 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r28, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r31 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r31, 0x202002) keyctl$chown(0x4, r31, r29, r30) getresuid(&(0x7f00000013c0), &(0x7f0000001a00), &(0x7f0000001380)=0x0) r33 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r33, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r36 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r36, 0x202002) keyctl$chown(0x4, r36, r34, r35) r37 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r37, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r40 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r40, 0x202002) keyctl$chown(0x4, r40, r38, r39) r41 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r41, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r44 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r44, 0x202002) keyctl$chown(0x4, r44, r42, r43) r45 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r45, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r48 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r48, 0x202002) keyctl$chown(0x4, r48, r46, r47) r49 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r49, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r52 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r52, 0x202002) keyctl$chown(0x4, r52, r50, r51) getgroups(0xa, &(0x7f0000001a80)=[0xee01, r35, 0xee01, r39, r43, 0x0, 0xee00, r47, r51, 0x0]) r54 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000001ac0)='/dev/vcsu\x00', 0x101000, 0x0) r55 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r55, 0x330f, 0x0) r56 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000001b00)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r57 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r57, 0x330f, 0x0) clock_gettime(0x0, &(0x7f0000001b40)={0x0, 0x0}) ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000001b80)={0x0, 0x8, 0x4, 0x207f002, 0x3, {r58, r59/1000+30000}, {0x3, 0xa, 0x20, 0x2c, 0x1f, 0xda, '@\tQ1'}, 0x6, 0x4, @fd=0xffffffffffffffff, 0x5}) r61 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000001c00)='cgroup.subtree_control\x00', 0x2, 0x0) r62 = openat$vfio(0xffffffffffffff9c, &(0x7f0000001c40)='/dev/vfio/vfio\x00', 0x10000, 0x0) r63 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000001c80)='cgroup.threads\x00', 0x2, 0x0) r64 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r64, 0x330f, 0x0) r65 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r65, 0x330f, 0x0) r66 = syz_open_dev$sndmidi(&(0x7f0000001cc0)='/dev/snd/midiC#D#\x00', 0x5, 0x980) r67 = socket$inet6_tcp(0xa, 0x1, 0x0) r68 = syz_open_procfs$namespace(0x0, &(0x7f0000002000)='ns/pid\x00') r69 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r69, 0x330f, 0x0) r70 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000003480)='/dev/btrfs-control\x00', 0x0, 0x0) r71 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r71, 0x330f, 0x0) r72 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r72, 0x330f, 0x0) r73 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r73, 0x330f, 0x0) r74 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r74, 0x330f, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000034c0)={0xffffffffffffffff}) r76 = getpid() sched_setscheduler(r76, 0x5, &(0x7f0000000380)) r77 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r77, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r80 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r80, 0x202002) keyctl$chown(0x4, r80, r78, r79) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000047c0)={0x0, 0x0, 0x0}, &(0x7f0000004800)=0xc) r82 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r82, 0x330f, 0x0) r83 = syz_open_dev$ttys(0xc, 0x2, 0x0) r84 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x330f, 0x0) r85 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r85, 0x330f, 0x0) r86 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r86, 0x330f, 0x0) r87 = socket$l2tp(0x2, 0x2, 0x73) r88 = socket$nl_generic(0x10, 0x3, 0x10) r89 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r89, 0x330f, 0x0) r90 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000072c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r91 = syz_open_dev$sg(&(0x7f0000007300)='/dev/sg#\x00', 0x5, 0x80000) r92 = syz_init_net_socket$ax25(0x3, 0x5, 0x8) r93 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r93, 0x330f, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r93, 0xc00c642d, &(0x7f0000007340)={0x0, 0x80000, 0xffffffffffffffff}) r95 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r95, 0x330f, 0x0) r96 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r96, 0x330f, 0x0) r97 = openat$autofs(0xffffffffffffff9c, &(0x7f0000007380)='/dev/autofs\x00', 0x101001, 0x0) clone3(&(0x7f0000008500)={0x40000, &(0x7f00000073c0), &(0x7f0000007400), &(0x7f0000007440)=0x0, {0x25}, &(0x7f0000007480)=""/52, 0x34, &(0x7f00000074c0)=""/4096, &(0x7f00000084c0)=[0xffffffffffffffff], 0x1}, 0x50) r99 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r99, 0x330f, 0x0) getsockopt$inet_IP_XFRM_POLICY(r99, 0x0, 0x11, &(0x7f0000008580)={{{@in, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@multicast2}}, &(0x7f0000008680)=0xe8) r101 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r101, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r104 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r104, 0x202002) keyctl$chown(0x4, r104, r102, r103) r105 = getpid() sched_setscheduler(r105, 0x5, &(0x7f0000000380)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000086c0)={{{@in6=@mcast1, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f00000087c0)=0xe8) stat(&(0x7f0000008800)='./file0\x00', &(0x7f0000008840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r108 = getpid() sched_setscheduler(r108, 0x5, &(0x7f0000000380)) r109 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r109, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r112 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r112, 0x202002) keyctl$chown(0x4, r112, r110, r111) r113 = getpid() sched_setscheduler(r113, 0x5, &(0x7f0000000380)) r114 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r114, 0x330f, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r114, 0x29, 0x23, &(0x7f00000088c0)={{{@in=@loopback, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @loopback}}, 0x0, @in=@multicast2}}, &(0x7f00000089c0)=0xe8) r116 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r116, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r119 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r119, 0x202002) keyctl$chown(0x4, r119, r117, r118) r120 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000008a00)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r121 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r121, 0x330f, 0x0) clock_gettime(0x0, &(0x7f0000008a40)={0x0, 0x0}) r124 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r124, 0x330f, 0x0) ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000008a80)={0x6, 0x7, 0x4, 0x14, 0x2, {r122, r123/1000+10000}, {0x0, 0xc, 0x7, 0x7, 0x3f, 0x7, "aa29f4b1"}, 0x3, 0x2, @offset=0x8, 0x1, 0x0, r124}) r126 = accept(0xffffffffffffffff, &(0x7f0000008b00)=@phonet, &(0x7f0000008b80)=0x80) r127 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r127, 0x330f, 0x0) r128 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r128, 0x330f, 0x0) r129 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r130 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r130, 0x330f, 0x0) r131 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r131, 0x330f, 0x0) r132 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r132, 0x330f, 0x0) r133 = accept4$unix(r132, &(0x7f0000009540), &(0x7f00000095c0)=0x6e, 0x100800) r134 = getpid() sched_setscheduler(r134, 0x5, &(0x7f0000000380)) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000009600)={{{@in6=@remote, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6}}, &(0x7f0000009700)=0xe8) getresgid(&(0x7f0000009740), &(0x7f0000009780)=0x0, &(0x7f00000097c0)) statx(0xffffffffffffff9c, &(0x7f0000009800)='./file0\x00', 0x4000, 0x0, &(0x7f0000009840)={0x0, 0x0, 0x0, 0x0, 0x0}) r138 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r138, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r141 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r141, 0x202002) keyctl$chown(0x4, r141, r139, r140) sendmmsg$unix(r0, &(0x7f00000099c0)=[{&(0x7f0000000940)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e, &(0x7f0000000ac0)=[{&(0x7f0000000280)="4f33e7a26f39d6db4646c51022088b25d8edf410f1744ae4b6c9285f", 0x1c}, {&(0x7f0000000500)="1006914522bcca86b85cbe2a2c8a61cb0de19a1253e8dd21ca3b0f9a04340f04070b3fc6f1fa52adc6069183e74f40cdb7", 0x31}, {&(0x7f0000000a00)="28447c44fd1e59e2e35827a16a553dc3db23b93d", 0x14}, {&(0x7f0000000a40)="0bf6455ed32402acbeb7d6c938b43205083a5a9d15835fc38cb06cb8ac3286814762e5889670d7552b9e68c6dbe98c4b65dbc8b835a1d976cbcec91641cb6a9bbe6bc93aa3bdb3e5b8b10c2312f5e1f549fdbeea1fd6acd200deb7bfbd25972f7c60ed3aea5a3776927464cc7ebf17", 0x6f}], 0x4, 0x0, 0x0, 0x4004002}, {&(0x7f0000000b00)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000000c40)=[{&(0x7f0000000b80)="bca94b8b73107d30aac5ebaf2c4ce56ac9fbb242afc1891da5075cf358c9b5bab008a1", 0x23}, {&(0x7f0000000bc0)="a1c37482b6e5fe66d4e9f47828d863bc8352ee5b6abe6c6b9ad5c34dd425254414c07902c5e58950c41379c8688ab7c26b80a9005376b55a3227c19f85f4e44f2efa2e49270baae7d3c95a0ee83600ec42682f701c2290f24539ad8bfd5e6a45648b0964", 0x64}], 0x2, &(0x7f0000000e00)=[@rights={{0x2c, 0x1, 0x1, [r1, r2, r3, r4, r5, r6, r7]}}, @rights={{0x20, 0x1, 0x1, [r8, 0xffffffffffffffff, r10, r11]}}], 0x50, 0x40}, {&(0x7f0000000e80)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001240)=[{&(0x7f0000000f00)="d8e0e5ac71107360884ac702ed73da5fcaec7f00e0a53bd3f8fe39ddf9bec202ba4378e8a5c07fbb870ff8a5fb63e638a347c62ddb78d39c3c8d6ddcb00c7362390e93ae873e90f2fb70c5021367ed18fe0a40db38b341afe2220254865c113c2bde55e20ef114e3c07908a340ae07aa5d6ab64a0c25d3cfab1e3281adfe740deffec23f58e66321472f15d0af9b7b19ba4ba3130a707759a40d2a14f5aa7f8d112c8b28b1228bc1fd18f5eeaae2f9cd15f6daa21bf2af5ae2e3e74d0c6ffba433", 0xc1}, {&(0x7f0000001000)="3a85807b73f8b261bfa6a7db435911300eb96966acab9bdcf68c6713df7573ba307bff47df2377811771171a8f2346fe8cc333e45e3dd4f69b6e2c05a1cc953a165511282016f200334e3fdf", 0x4c}, {&(0x7f0000001080)="c138edd1ed819f15ec70fbe7605ff27b5e5221fe8d61b76fccddacf7f6888e272a0124e0850d2c809a6070d216cd0ca8a102371bfe47ddb33d15d1fa4ca1f9fa4378a61dfd5fae53760852941dadaad30cf9752b53fe996b3ce339adbccb5a6b07958db4f28315ae", 0x68}, {&(0x7f0000001100)="50e1d5feb358021be94e54d19e944ceb1c0936d981550cc49c5b29e5714612385edf2f96171ee1bef2304d969d00ee1e7470ca78c8248c962861fb3d541e28bcbcefcd929fcd60f565eb8768874be4cd15df055df731c0ad81cdadfdbc7510909753e5ea567f7a8ff619e8a0296577c845d47c39bcdd90d14b10f2b33bd6b1c3ed12fbee1279ab8c7883716f493e2bb3752ed80c8011017a924055b6d224f419869fdecedc60523ccad27a6ac841ad3f4d2f108abeb5baf6d1a31717e174a07289001e26a965623fe078f4e98f6dc16b227750", 0xd3}, {&(0x7f0000001200)="d33cc6d56cd58f52735393d32d87a66c53eb07a64727b041eae3b25f092cabb4b134482352377665", 0x28}], 0x5, &(0x7f0000001480)=ANY=[@ANYBLOB="20000000000000000100000001000000", @ANYRES32=r12, @ANYRES32=r13, @ANYRES32=r14, @ANYRES32=r15, @ANYBLOB="24000000000000000100000001000000", @ANYRES32, @ANYRES32=r16, @ANYRES32=r17, @ANYRES32=r18, @ANYRES32=r19, @ANYBLOB="0020bc74"], 0x48, 0x5a6fc7e5bdd1ac25}, {&(0x7f0000001500)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f00000018c0)=[{&(0x7f0000001580)="9496f6ce45101b13c734f746ef9fa6633fb3f57977393c62daeed55bc2647c32b9d5972bfff34ac03de178095ba03fe1ee969b60b500b694051622d5aa54e4be56732d5533c7af0b53bdd75376cd27bc0daa066fe6b75f87f882aec537673edd76de313839d9a263cf3613a7408463be28ba74b089ae7f02dc7a375f6258d0704660eb3a3783dcbc962724008b35972a8bd8e2010fb9b559042cb951a07ae89dd889c96632ea75b9d1fb75c592bf3b", 0xaf}, {&(0x7f0000001640)="b600323a3e21850052c85b485f7a56c964ccd8f1b2a3d52206eee9a167e008f8c9f69d8f7e522eede30523e680ecabbe9a1192689b40ea7325d25467ab4b5c971d5be6779535eaccec8efeaa39295b189589d47397c0d7e2deaa68eddba85766d2c4ff60d4960d66f6da4e", 0x6b}, {&(0x7f00000016c0)="8a48f584de2b35c5efe50f15512eafa56f38f00ace04652fbc722d80cad4cf714eda1c71d7cf8faeeedbeff179a521475b03c90f7d942e9097dcde92b06ce05878ea45bc7c9ce72fe170d98285dc9f8943e63490d6c1b0418a422c372a232e6eac95e565d2dbb8493931c4104e244ec25114b850056e13450f928ad82f5d973ef5ffb3e6cd0bbadda37800e66abd5d68d1e520c421194975", 0x98}, {&(0x7f0000001780)="33e6decaa4d287b93cce3fdea37bbf64e10e804c09c84541c7f808ea9fd6154cfd6903ea4234faa897c5619eaf2aac97f181b885d9e752fe69d6553dab3176d26b29a22814f10fc9399599d5f26acd5c2ac71fa1395eb148", 0x58}, {&(0x7f0000001800)="02d048958dcace59fd754790d898a15c6c03be30ce0b8bdbe7bd8e270063a7f215261f03354710837b846e41032c316ceac23449deb61aa6fdf19ccb6dcc80a2c00ed87156039afb54b5dd52d20f1f99a8f5c48e23ce3156d01f0b6d63bdf5b9ffc11eb7cc9be7010e585eda1134842081ed23034c88d86a051c0448f59a65886fbe5f5c066e6532e3a4367e69ec17b5796603e6e501a55719a4e8fc6f999e2d92b260513d374da99ad347021d5a9ec47c19", 0xb2}], 0x5, &(0x7f0000001d00)=[@rights={{0x24, 0x1, 0x1, [r20, r21, r22, r23, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0x0, r25, r30}}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, r32, r53}}}, @rights={{0x1c, 0x1, 0x1, [r54, r55, r56]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, r57, r60, r61, r62, r63, r64, r65, r66]}}], 0xc0, 0x10000}, {&(0x7f0000001dc0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001fc0)=[{&(0x7f0000001e40)="ec3ae07dbe15670e3d3bfc668a49af6e0d0854c74ab3571fa1310d99341c401f3f75ff27f69a00e4e7b8011fb55ac3f1c562aef376a2a8812b7070f99ab642e86c2218d0fde4f341417d9421b9d5b02d8666be4d6d17fc4f5c598d094b54b74f9f5899547be58647e2d3ed83dfeecb49f4a0df881ed77cf473d6db8ee19e13182464d2e448b140bfc69a8302cc1cec73f1bde49af4c546f07b9ff07ad1e660c55cb81c4fcf5534432deda1bab96cc7e95005d5c3072d26cee3a6be0719ba4f9e42180c735e", 0xc5}, {&(0x7f0000001f40)="5eda05dd936686c065a3bf761af745177b427e75f452383aeb7fc45b388b82993ebb9c001a6b16928c40979b82e9091c1f8ebeb421987dd7333e08e1b600442321ff60c3f6e201a20b40fddc40551eeea53ec95cf04a4018d5b1b818ea5cee0a0abe", 0x62}], 0x2, &(0x7f0000002040)=ANY=[@ANYBLOB="24000000000000000100000001000000", @ANYRES32=r67, @ANYRES32=r68, @ANYRES32=r69, @ANYRES32=r70, @ANYRES32=r71, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32=r72, @ANYRES32=r73, @ANYRES32, @ANYRES32, @ANYBLOB="18000001000000010000000000000000aaf94419d2fc65534595c31d559e39a46590d376915ed4", @ANYRES32=r74, @ANYRES32=r75], 0x68, 0x4000}, {&(0x7f0000003580)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000004780)=[{&(0x7f0000003600)="c5023a857c2429043fb9851ad4019e3efd80bd70ef69c637151bd39e71d98da4d69f61193ef257a2a14a4b4efbb71c0cfa88d75e2b084d420a5b73d9b8127f8ac818536668af5c7fc061b38b7da950c21a17e3ada1727102da24ccbc9429b5", 0x5f}, {&(0x7f0000003680)="c08ee37ecf55600694993b130abee7e8cbe0f49cb6b26f4604e58024bf0380db42fb5d8b14efe58f82687e29e68a0e8adf10cd1aadbf52bd69a9b6551620b20bf7986779634dab45df5046e8ef42625e12f1a0db8b9ac36626429eaca4050fc8c6c37bf57f1cda192bc86c9c56b6ad31bf7b8fb32bb0006747a3c79b692b2c909b0a46fd10828c47f8fcd9b7e838da9950b50e6836f5b9c0a80bf1e8ebe03389841910232f89b8cd97ddc8b91f3049af280dfc0244ea901c27720df8f10bf88272dcb26ff9be6798131a09fbbc878472089281e64d255279f533c8304f4e4567fbdfeb0cfa9c5a27940d8296d161408d1bc512b10331b6d2a5e677642ddc5392dd7f80c00cfcf329119c999b7eebb1700da21f54adbbd309dd3aacfcd3cf0bd327a4ff91ce23881cb9f08433a265551b7149b9b6731205ab36754bbec3a9efc19cc5d54550bcada6d16e63ad15278113caa18df2e50655385f6501b9de727da661ee8268ec8c7e5b5e81c25317e0746d70bf90a4d0814b97f20884bd78a53cb32f7c3c07bf12c4f98032f4533c6ef31a5ca0c026cf4d741638f0ee67fe1be823d41bacc012cbe9e3f9b898c89abbce041e47da2b2202e81e71d5dc0bb00cdf544a9aa2e264d849ab337790e2f24fca6a23a008caac2c303363786fe708b15ef28038f9dbf7d38ab62961b480003a48777f253ad4af27b7fc02a245d9f596647b1298ea3cb542eb3bed79e715a32b5d1003cde947f82117c7c883752740558b12894c9576f64e051f58d8f2c808cd58e33152ac4cd3d97efbf6710204bd6a7ea881d9f915353474b837b31e9c80dec1d26f3e3846482be17963659819f1241241a1ae1f5c47450de9d19b780b78c65b4887558a381a5cd28341dfa6825798bbb769ce4ba493b610cd0071316a4787301bc3fd96e9c711d02ea337870b73ef7aebb3c41a24747b9254667ed9dea96179fa1474f6375bd631102598643cceaa8495c79a3c5947fc1c13e7dd7132c15e3d9fd0d94dcd92653f914ffa12fa0e1fe06674699e194c3874282f3d2f5720e24bafa78fa12fd0b19432c11b49a06033c4cc909049695d67f44fdaca5c640a3f468c880e9b2e26465f12aefa71d9219badd0ecb53ce2055fb92be2d27e31aec4c794a50b32e39c48c8fa52200942164d3553c21c5ea6e92e0012087808d465fef89a6e948afd47eb061a9eae184c79d4709f52f0fe44433c54f215fd001704a39520e4c002cc171b4fea247d974cdb849982ed86e6585ca3798c73c51248e8acb32d002284bfb7996146434b2ff4143749cce19842e7a674b8a19c07e49d33f503458c40b6ff2acab3f2b96838b7502707dae897dde3c3d9328f92e8eb7b1c4318f455573e0dda93940e1b6b9aead8fd116c1c0ce00de0575fc0c3444e4f6901393c0735906d66c14fac191ea42e7308061fcb534fb4faba948dea5ae4e35b2f38e2146abc6b6c45866624b7d50c70e99490272bf100076ff193893fdd6429ec06d170f580e80f36931da351ba87e30db648cd9ee62ab727fff25b06a0097c5fc4b579fcf00dcda12b02b54d51fe6ac9790b3258d040403227f39386c3bc77d6e4746c3c37f7665b031d758b24416c90b61f6c7a37f91b1c3ba7c31746a01a3367cbd499d3ba32da9f6ffe76c9d0b266543506fa38b9f32c5198f962e7b0d3d50ab80b19de8b1287ed1c073520d6c24537a4f3ab9dfe4538b3848d3274b07eab708e3073d0f83f965d736e386b4213d8fa81c2a1fcd2c3ea6094804cd6e2710819d469b3f6a81eb18502f74b4fc13fe3eced01215904e8f815b52bf2fc4e8fec031b94c18baa8a2bcbba254f96b28ee0c5ff7d51c3036788586d4396e9976aad89646a74f984654601408d9c3aeb8309527b3a0e0ecd21835fc25ad3a9da6a2ebd5ed76fceb7db4b5ac10da4a7013d402b5545c2664e75c2f005cc11b25c3eb156011ace87f7869f45d5ee055fe45825a6d12aa81e3d562086e5eff4bcd30534245b2b9f5dd442e4178dc7cc595ced4f8629e83340bde932eda7e7074a2fceaa00c3c991f780a5fa46ef4712ae618444745da9095e21c767790319084d257958661b65f678b51a9423d802257e4f34182d5d1517cc2c9bb823d138818053efc705fba44660b36b2531a4dfaf41eb1abbd5fb6cac9a9c1cd7532209dbe982b74228792db72184ce9bebcf1e63aa4d7597c7ecb371a44e84bdbb5ea311cbb3f5a6d41a57bb5e9d97fb9774d9de80c2947b1aa5714b82d9dbc406c484dbeca3edbd4659b0cb7c748e703078e1fe021ce3714e88b22723c87270d8441bf1880330752340bf012dd293fb2815bca21e2245d2427d2c0bce8e667733cf15cb6a88d05ef617c7aa912e73e93d2a37a97ca0e1bc7cf2fa11c914fb41d6739468d6d5bcb204ff26d9400e5e1435a2f53905b5f948b5331b99d137b2ccedd9750ace263769b8e099e100c47ccb84ef8e3d49bab52f77d3969def94d2553be6ef48c598829ce402f6e8d2fe063a272147025133ba44fc0cf5dd0054dfbdbe2a06c76014c02473e0154b38ad240af35a582ab2abc8eee71c24cab567bc82207901921329f8e626f85f836ae4e5e2302a960e53de8bef2897bb538e2288f89017c1b0c1f2cbae50845868f3a18b60c7fd10d49d2b87daaa477b0acf656da3265b6bde4c9209e78de24a3dd2aef43d2bfe94b1a317e3f575a0918305945aec696caba63989d0cf37acf2259034d468b8c06b4fb7ee9223d93125d577b3b2d2ac98fde184e6cf9e1a5461c8c9a5605502e3183b691316e7074ac28c27b6d04f1a01b4a7954366504acf01a39058d7f7a2dbdfd5ef264bdd3ae289b81e57e502b174e44b104eeeda8ba372f4713178e9e203b348a5b3e809c6cc3537a5bb30f3e20f28913120ddbb07c59dec5da54e25ac053db528e55835821dea736c00149d0e0d62a54f2b032e0a4c129d7fd0fbdf5a229e7fe1484226433b0f2baf059c08b369ab176242a591eaccde1b07fa48b99c6fc7029bdbada0a9bc31f3040f78de83d1d9f956556eb053d8ff9d8f9e01587344be162bc229d0d34054ee8c576baf9bcf0f5f6599bdb80fcd5cef219d90f160434b2b68ce05ea74a8f774ff6bf8db2c3d9c58f3a4abd87d8afca24a0624e24b8e96fffd68571d27cc7b84913b16399a1dd4a03f9a883928c74cef5fbab1f964d7a4d3cadb16a8cd77dbd031f7d00ac6b7a7495ec08542f4028d1be79241222ce91d60ecf10a6bcc86b43c096c734f5c776b891d6166ec09eca6764504cf6596d8492e462b6993ee235f6f240f723bff22100cdb604e11161cfeeb38e9cb998d9c4aab5f055b7b01a0e90231512537c6496b641863e426283a24e129b640c429fa6cfd4a1d86a29de0aade70e6b706e4a23727175c002181be0769a0281a6c38dbfb8ba51f4355cc78a2b5044b2122d274d6d23f24a850c833c3bed271399cd932de633ef089e54fcb21eb12a995200921f30c1e347c556fcd10ea158accc0d93d123a837b7e5620f895cc08b8aa4a3eb76ce392064fe50071094d32857942372ecf78b8228ffedab94a5284baa71b65107dde5c9aaa4d55c09c6b04065f88cb32075e37f0e45f731ad804ce9965eeba2acaa246bb9025bf2d4f7ee269c2753274b3d59d34496e37cb79cd2c1553e9674b80df72ad7bb363f0c6f0c7fb071417dff8ff33273e89f49fd41c431dec7d0d71e85bfa4edfe71e74945b34aa3b083a79921118006cabf35e71ca9d5aa923d3528c9e1e28d88e683bcd0784be0c640b2158600d7091833e6c327469b5c628799a804ab7a94d4da1df152285ff2b7c4471f4b81b824aec8cd85e72c46f79ed06854940a5e48274b22de728e55a633190d0248ee8cbd42612a0c015fa8e684f91b237688ff22bd12e2095246b09111d8ffccd97a6bcd72225556096a49e341511478e341275da9fcb37a86bef14ac075eb03ce6ac61851ff64d359cd6fde18cc6678bfb02e3c961e970bd220bf27cb17c512ac80a9ed9b7f13ab2e0b9f9a25c930715f26f256d713583bad988de0eb8c00c1e4abb8855492a3ec1f7e89705ceccbf2856c0b869328b81babbaf844019662bd1d54d04b9ab6dd3b19ec8a7f9987fa603af727eed759799d4b6ce6cc040fb1d80d2c987bbc7b1c7aaf117f7fa0c871b2e33c05c81a89f3c576a5d354e54c5c445e04f13254fee8be14774ab37f2c5b0d50c1c00a87326b0ba88280433a3e77283945d2c861f545c0c570f9d6047d4c8f83cebe8ec56e51a0a613e15fba12a8c3edd88d347f849d1d599708c2be39166cf0dbc4f0c9f56e8133307de3a0e47efaacc259b5b2a6aec22ba158435b52951bd5a1a29b7f5ec07384b27a3bdbbcad8a20e768139ea5a7f3dc5dbb53dba68e835bccf5983da29fb88e566333bda8b6280cd14ff24482a80d63e932ff974c93eea7be566d6ab0ac7a9c5fe4820d101d41e6047a417dd4d648689551473fa4331cd1890dd2a79d9bd5193078a1d2c0c327ca0e4bcec2440116700cc2256288c7bfdf27f453a1eb777b872ed1f0c12eb7f1b615afee5764873599a8849b35cc5ae1f3f2f2ffa44c483e615f2b0b3726c58c1ee0d88ab9bd1987b57e3d22807f57310a1bc36baee5b216491161b016c692c2806ac7d6c2bc2178e7317053d743babd7f686d620e8d75ff45a999c087054851eeb8f063b9877b55ad8a281cb4194913050b0a70f0e575214081578b5c5864de0a526ef50c996ad1c33da8ff34f6d01413100a153670aefa3a8cfecd2ccb63680db79a67ca82f89912c839b484d2119969243ef9eef80d3ebc5533f375725052497dc6b85ccf83f6380c3e0d4e7388ccf20441005014e0b86917bd1c5ef4c6efad7b76a951bb38b9e0b8caae7b0342224ebc6522d21a8fbeaf0dfdadb1734aac6b87ad58e655d786fa00af3edd8d113d5dc19c43171f7032f081fc862198797836c44e9da68177521aebdec4833186f07346cfbfe4335a54e49c3a41323257546d92978fd6cb606137b8810278888975fe9622e250b681982eca965590338818c2709ac250f74b9a76805d18ece212a923aeb38796249323d83dcd524b3b317268e7c36c7636b64a924a575c08a8e7f89cb8e134635e4a00f5b48d5301ddcacdfc904489a9c38df891335fbd0643386443c2a8546d29143bc990bbea9903ccbe5bc2d9f1909dca28e014988f560a9e2603fc1946072d3308b8a24819b9ec0da9b46a27dfb60808bd06246b88b2ed8812bc9313a45bf173c70043ec8847312b4f039eaea9a58a27e397d20d84fa4551f25ab1f5180982c073e6de82bc4efadef741d8031a17fd57d8c841d93c3a64b55af144a6e62b42669092839da1855659510ecf0581f3f549ca61a6c1acc9f9f2268c61e6397b5e36e78009a95221208a4f9bae847a46d7fc1b40b365cc21fb158c0bb5604f0ea925ace9919b943fa26e218a0c397d44afac489215605dd1927c3b9e3c437252285cff5bf3fa7e22ab6b6853648fa3e084d73142660864a6cc9b3a2659f253071fc2c3a23b03e6c24ea5271d443661ebe87ec1b5e1ad6ff3e226c1b96633dae715bf1aba37aff4e7bae8a88862f125df61ff063651a17d009a0010c9ce7f5e5054f2433a04e19854265595ca470ade37448a968f39f8715a58ca946332889da1a2b8d448dbd573074aa7ab70216a41d79d89088014ebd12fd7c7c10b82e8633ef8a5c0e0855e2820f15452d667ee08a163fc47596d3208a4c778a80d73e1e7ac83b3f8c85f54831014a65dbe39badc9f52e53", 0x1000}, {&(0x7f0000004680)="886df426de80127e19b99c71aecad4d499764ab635c405a4316d085fb3098c8561ec5c6a2e16859bc2da09f0480e4dc56928028f6d9de25cc1a3db28984b7ed0672f6ac215a0e7656e06a622d05fbd8bba8982ed55dbac12c534a52aa39540f43e0c8d4f7c8c5c0cbcc867f0c56ff8343e89b25548fb98cd2ba019d5041550193b89dcfb38551799754842962e4bab3b4b35acb57fcb11e481921ee5d938699c1e7db8c8a9968729b78075b8054274b249175270726574d34292b6bdb98f8d15b2b8da560ab979967716f0a9641bac83e95cd3d818c2b33629e6b47a5bbe55c0e0115b90400f5ea1c39fa252afc8b45e57939d", 0xf3}], 0x3, &(0x7f0000004840)=[@cred={{0x1c, 0x1, 0x2, {r76, r78, r81}}}], 0x20, 0x200048c0}, {&(0x7f0000004880)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000004d00)=[{&(0x7f0000004900)="55cf53c3ca6882", 0x7}, {&(0x7f0000004940)="ca3bac8b6589382392164ac5c9e75d9764fcc85e034e50d2271036dfbe2ce00e22028dbe16cca884e788273a30aa0fafaafc940c8686b99a26777a3eceb839b8773dee0e58a474ede5d6d97ea8bfa93fc84584b8abf44015ccf5c1e8eef65b516c1bcda0271cbf32178ba390008b7e5253a290133499f6a364bc367516a3535124d897c37b05ca32ece8df1bdd0586e2848179a8c577e594d55190599ef09d90c2dd1df9a4f2ce5dbe770dc5c89c36a8f0d2edc0b51b01506996509d2eb31fe40592cb759ef1738bfe8cbd6b57e683", 0xcf}, {&(0x7f0000004a40)="b571e4dfebeb2a1c4be70d44fa72bda5fbbe38a400fa3e429994f4436a54e6533e7be68e155a394feb1815d0c4f8f22e", 0x30}, {&(0x7f0000004a80)="b72571dab7854123e1fb5c70e2c54cb22ed34e9d4cb2b9eec700eb7c4d52bb33763a0dbe850d24284787d2be282a4e2a9bf588b420b5fa773430b91b0be7b4e547c1730aaacdaf06a1c5b3cc7697854e1f30d14803ac13b10d39b2b753aab6ec056f30956bd9b7bf6e5fa732b6a5bf", 0x6f}, {&(0x7f0000004b00)="cf98acf5a6e5b15aee3223f2e04a8ed50b2c3db4ca6343cc13f7183ec54c9ec08365754c523b4222c1", 0x29}, {&(0x7f0000004b40)="3faf90900909075a4347b8ca61a8bc22353223636b47294d5c159b64fa98f785bdcb345f4aca68cb1420f3167f005ad437ecf2858751e301fe7cc3794e85bf674e1e322e98dafc83c7b4a558355fc73f188202eef41d353b62269563fd5d59d08b2e77b2400ed910a304d8bd52596975c472485bc3e54dcab5a59e71d65cdc90b5fe9c4d726399736ae4dc70dea112a43e76d488b4b4c034034618107d40ff42d1a828e2b8afb062573393505e649ddc5ebc3b171437d5124fc3e2718fee7802fc0e8742c3e892c875fb0fa59daf80b2ae053dd89640cb4b98e49f7c82a9c074bc8cb1b51158bfe72550f56105eac72f78", 0xf1}, {&(0x7f0000004c40)="fc82a67b82839cfb4450e5269769c08ba6593ef4f512e481eb0671649c33f0a55dffcbef4839a309", 0x28}, {&(0x7f0000004c80)="5d4a52f2567af7eab94ee894eeb89c290aba56c1d7c40601dde2b874453b58971d4f3cb725726f31ffdf0302a6fdd0fe682cc603c703ea6b5622b852351b127cc1e30a505fad6c2bfa03ff5c3d54d04a1985a62fc81cd65f773f5623bcc3e524de13b5e5d35a50a3b9229b28538e06124e7594e98778", 0x76}], 0x8, &(0x7f0000004d80)=ANY=[@ANYBLOB="28000000000000000100000001000000", @ANYRES32, @ANYRES32=r82, @ANYRES32=r83, @ANYRES32=r84, @ANYRES32, @ANYRES32, @ANYBLOB="28180000000000000100000001001600", @ANYRES32, @ANYRES32=r85, @ANYRES32=r86, @ANYRES32=r87, @ANYRES32=r88, @ANYRES32=r89], 0x50, 0x40000000}, {&(0x7f0000004e00)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000007240)=[{&(0x7f0000004e80)="4c2d29e749067c24f881fb99a63d2f5e59c1f4ba1d0663d6f19e217b3bdd54ea6605f3df5689531d9455584bbdc4f485642db6953d2e772f4aef86b6c63c7158172d3a7d11ec54a1d0e8dc6b648c6c610aba396cc47589940baf5b3aba5e9bbf9921e7d7fe2931bf2d64bf0523933f21947fc53a9096723d49fcaeae6d877c54969914cc1331ee1e669e", 0x8a}, {&(0x7f0000004f40)="7f20d40d2ec5b645308381b3784e774744d878649d91c417bc8327da530ed5641bd76e27aef22c96375d8949baeeaae815c1ad66678c1fe1a54b82d596b380b3f366c0a585c2c56fe961e1d689df42a8ebc4746876601b7ec0d842a0121f3803f990ef6d97ee", 0x66}, {&(0x7f0000004fc0)="48fe2b5dec58343571735041c1a4d50cc2898040c5ef73fc6386b16f23e2f37437d49f5bba41fc0b0c2549053f76e9946bc9c2daee3daf27d77f4bdd127a2e60078f0075a7b81095ec36a3bdd9a5438a6211627968ed17a257deb614fca30882af3589a587", 0x65}, {&(0x7f0000005040)="1b004dfc4caf666cd15cec34514b8faa512cdb32455569d1694ca3cab2e3c352958f8dc58de6d3ae9f00f1cb8791dfb1977a3bcbdd8cd6711ae2d0877dc39a16f2863f1087c2ba3dd071cf7f7afbbc173114ff2d3fab71936c8c31497e0c9fcb6e902d120da6b800d177cac6b032635660dcd5c641fff463fc18f5381cb90e8d276ccc03ba67861a51152044303704f1af7e66e3e602f63efa465482f4a7ce42d55f9c0b3d33367263e75701e85a321acfb332b82de613647479268b048bd5f33f66c2e64e99fded2a06669ed34446c9a05558f9e021f31391c50bc79707c5400f88ff7787e43e869bd433a88917098546ac618b1c47bb603093b3c27c320fb62da40ce0fb46aa84a6a8b7853e2e823e5c74c241b76ab6c942c2fa0eb08c28e394b832ce129bdebdeefda1fb1570a8b8d7fabc445aca144addeaef78814dcd510aafa87649ef782b13ebcaadf3e24f0678fd40787d4c3744d2db202ab9345a58d6cb35e7053ed4a3539af1f14fa19fdeec020ff34d9d3d2a3d1b7378741db9e0aaf776e9935431e38162b62b7682382f61359a91baff970a9c048d6fbb777bdc69131cf8a7fdbe7966d49a635758c3a6b1fc0e8e37d46a93fcaca246acd070f4c8361bbed70e8c5ee6490fd90cb77f3cb3e4ec85abbe835fce009046e17b2f0b3e09ccb9145fe2cb5532d72b009b0056307c20edccb4498785c7312000bd4c7af997ee222ff1537deab0d478b1ef2e733ddf142fc2efbae159460371c63a3a8e64a67902b7a0fe2193049de94c5fb40063e096444941fce54cee7348b4260594ee7bb895ea9e54775c3f63586599f0252fc0c3a419527128619d9052f102e06a07c5f98d28e3b808a1bf10717648dfab84b2fd7b3c6e103eeff664a4d512f4346e7ac89cd9204bdc2b2fe6fa0954cf515be6c254766ac64cc552e934ef10992ab6a1452254753d687b6b83076b778eadf169405ca319902b06981e186ff7233136de0e1b35f0d53c0ac67252790f26d1d09dfd5cbecb728877dc822b931b45a6a980e8a6ec31d8d474ef45c07de56dde8aa4ecb3bb0b9edc12aab4ccd2cfded5b6cc875e210227ac6edcc81a7b33d81c2e2b4f1b094356c8f7103cd90487e26dd900c562c9c0dce4e8c0e5d7b50d04dae4bd9f5a23abb390e69ecc35f012a0c38963581e2987c898ba8096fc5fbeac4c404f07d4dda6fe840a0f02e08a75501dc93ba0bfebc4d618d01923cf8174403ddfca06b0f7deadfbcb9ccdc1fe9f2c7464b78010161a2bfe3b90f27a147dcbcc2f2bbf2367ee6b29c71aa86848d7a5da00035c0c43ee96da379000dc173e171128f61ac36e8cba0f449c963d3cc5d065782750459a78bce3c5f7896dba0ed60f3445d25cb9731b13577e3fe77032efd1c9478790b1efaef4ea2e08f9adcb4aa6db4311a3a6843b75d9025f0037f8c2d7f1a69c94b07a8404b1ac0e0c2495758fd2c45bbf328b962359112375ebec27a05249ea262995a23d1206ea489084c49652c58570214c1fabe57806c653e51942e3b176b4b9067709c2bec9ccd0f168d040a95124d2730e4d5feca197baac38a5e32e7237c63123e935de88b4d0b8e88dfcdd6a63aea5a5305fd48aea09bb02a5e358ccbe50f6ff41ff68851a21b39f9055fafbca5112ff78edaed9a7a11911b948e7c1aac1bc66c7692a720e0238fcd59ac4a8765eb516f777c8e2f2def8a81fd7218442a627945bce550e0c851c71541776a28cb4aab6abda2a9b5f80ae43448afde2ab7c055046423e78493b40844ab78c9cfdfb773b7447d463f70a46f6004721666619e4ecb7e05d0aca78c6a6b340320240ad41a68b9dcfc57d0347c7ab6ee1e091b008c8a1eacc639d8412bef83d50a6a8f29c1e1a1994327d63d62b6d163b6c71a2f920939a2a3884acc0c4a4e7d06432bf58e289b3778a9c9cafc71e9cc8087227fa207d2a28061cca92c867d132497b7a1df91bf972b78d3cb326c28ec14034238b8a8ef144ab40f70d96e66283b3f0690486e6dfcb9e762cc17729f3ad18245119aab9f883ab39654d6552094fbc9e50bf4171d66b0bfc835255c5103b84933a35cee7109a9764661f3587e9ded27b21542260f79c160dabb191d50c9886b8a7dfa9f23ccda5afdc4b7b73704920499ae82e1761eba6c120e11a854e1498e0ec9151730447b07b3521581ef761e4d5f2d3f33154779a468f482c1edb90789db96a256c82263d7f8cd957fcf1403d9904cc1b1f1f29b3d4d074e38740c5e05797a1900949218ee049ae7c06b128df13f6de6ffa95f92b707d6e97b64b836414ad445c9436c183ae32123e99e3f8873bfebe1d798e4e9df109f2321bb1bb5973111d5a0b21e4ba4811004979871332618042366f07f80bfe2511507a97d9386cf6e00d49a4a9986f679592b7d244d2ea9860670aa59a1b65e59ef348807b8683cf74a876505f20dbb56ce051a37b9e3339e0652dbb9b84a02068c419e0b59c2372219522c97db638c14b41e6cf0762d8cba65796a1157446c9ed05c35a31f3e10500af9742d3f9a8f91cb6b54af78af6950389c93be7398f73de412f407ba48bfc872ec28662831f63019d44947d1d2c487016ff971e85bd2ed01ee1f9d3ecba9f55125e5e9872ef1554bf9b13dcc3dccfd215d7ddad1998273fafc328178ef8f7e3964f579fc4a4362322d8e84dc4125653cffa63fc3f87f6fabdad7bc3893843c65f0745f2eb2104c7ea706b58634c0f303873a054621e1e3c6e60b4f485d45ba1d6d19a407cb7bfe9b5374afb0cf8c4d96ac1c02f46351e2eb42f7fdbb7f9e5b8de9132acb6e6f8ad05c47bcaf701a0c98fa2e808ec5c8edb2e6e13e3afc2bec36e567267db7caeb64f279d93a50527f90775ee67f3e3fa38743593e82cb4f27660501a4d4eda942e400f1216d043a1467186034dd07dfb4ee2c7f1ce8ac42b63ea9964d24b9faea9662a0d12f7c5df1fe7265e9c702fd1f4d7a9dc1b36c40bf16352cc3cce6209a9448e2b191d86a2cd6c7449055993d130da0eafacbcaf6d20451a1e8e284fba7f5ea7250dec81cbeb14eac6f1e654ed6341fd6960eb7e7c7bc05220a07ccc604ef6afedb85d8e045ee67f31f9c7bb96e74f2a364caffaee9f3981952f34abcd9b431f8993077bb3ca9b6bcbc6b0fa26569f00bbae10b93c216da18344de79475cc897270716b5b702326ddfcf9ec0d82ac8b77fd43e091ffad5b087a351fe5cd854b68245452f04f533764e7e66008efe30e601d5009ce63542ac1f87d65b788cf0477965d3c415598006ea35b334788776c08a999aa0b74abdc1e6232985e9dca086439001c3a59191a635e8736b0773c347e0aa3569e67442b0a415d5317b13daa7b13ff3026b63880468418397500f6c9ec01ffb22875265af4843ad52b088e624053aa352b3f6ea8101571d9c2dfbaf9e22c999e908faad9a4d4a104a558aa7d67b868c34ee937b5771a65eaa9d7f2ff082d973fce316bc4417a4e8dd0f56836306f9287ecd0477162eaec75beb7c5f6c37188cff5f491af20b8f6ae71d492f874e7fc1660d0c1bd09dc3cbd4730509435ab13f597b170a775fcaf0a287c29b330fe3214e39576e7605e9c26f3bcb3909ab0719a0d1dbc6cdb6cb3625ea43367ae20dcdc57550f603dc65bcf58a2cbb7022305fb87df3ebb2b3a11cabe27e4cf28b829b3a6947eca6c9d37fb761184bb36af252c08614e8040d10652122569b60db86af5c62eeea301898f8cf69f0486e8fdef4e578ccb3a251b71b18c5901e7fb590629c69f9d969fc18c0a9a1924fd7f38fffcfb59d904e534cf6cc459426bdb01a8f7809ef210c37bd7ae23e2d3484f2b24b982651e548943f086754e10e5b0a9f6016ca508b06497137b90dea64320fc3a9959f131e95a556fd81db4923847a249958ea7333e1e3f2e3574a5f4798e83afd3ee2cd5f3c7119902c226ab4f7fcb84043b862963b712785878ad6ecd180bfde0fee72d804a539948f0b7feac39cb283cc6b6c46929466c55c7c8944f129f3c709e7e2f17a47bade045253c3e37839e617baaf60ca815161f4d6aa35cbc6ca8bba353ef8744a1ad1dc90b5cfcdf8af2257b6ba8a37827311f320523d9c35dc229592a59b09b8eff4715c5a37c2d462a20a3ff9d29ed805eb93a03c51a8194f301ae626bbbf8c269eaa8641189268f553a4614744c537c6b8fe4009dc0667e58476ed4ca0c6210ceef5f519d4e6c4e5b4b6fbae564e8918d65976c180cf7a05c2e86930ffd349f7c4e741f30f696cb2155c8b89941fedc3f22b7d8be7464e130ea152970d802bf43c39e2f136c21e746eecd15d25d0e3cfc42dab525a37d16fb4245a75a6aedf590495dd0d39f3caa83eab13658907b36c95800b6aeb22db29b2e216855f5221fe4de3a5ab119370eb5ad41602b38f3d128f51095c961e95b792612ec427c09572f3e9b771de45afe718c412a3b5fd5d0c8a0da7cabe7ad51250f3327c884003b899fb3756cd20aa02a197e689a8776e75e47e9d18cb5af3341a20fe2aab863ff4b0ce12ec2edc2bb48a9a61d3cd85930bdeffc2d1f48285bab6dab8494b52d59ce8da55dc69b78d1742e665d77db95e1adc58e63e8863c4b8cb2d82ae50a805a5309ce99441355fdda22be14299fcec0aa1657a91cb02f96b81cbfa1cd8e86ce38f38c0a3499860dd8c179174a4453ea6d77b6617752875690d943db7a6b90fec37190fbaae64d731867f75e67bf01f17131180413f49b7733eddbf31fb2e5db1ee71c92fee654775819c564966424405569842ec43facd6e293da2753f24a9ce3eb1bcbe5393d6d5fb4ac4c40098e71bf97dc0a4425f048df60636eaa85a36f29b968c928d5b2d59dfbb60790f1ca7c81415857c47f714710c887ad703f0324d7936d161fb4393d94bd5cf5ef52dd7a1e9877848b8f5a6b66fbfd95a4717a064e86eb5919fec32a7126c944381cdc6e790092d93799f93afacd48c00e035a8528b38b31d005cc667c20a26554d29adf139d1d93a3d5a8590f888529c0225228bb427a6922433f74c10e2123ee10fae25e2d0419caab17ee5547963313ac5512c9ccc943bfd390d2920084294052fd2e645adda8f89286a9a19efaf74b9c5e8e4ff55058fabacfcccd0c9675350e8f150dc6bfcb1763d785516d43464ca9237803f388978af626f3c5bfb9ac74622f36efbea0416f624038bf956bf6a72e0f2ecb1d78afa970d0743380a6cc0f25bc6cc72a70077b46885df3bf540bfcb311af5acbac1970fb8e26e45238b2d674102c19f8292688090fb263b799af61f8a9fcb8aa0f8578d67ddbf7a81638e57a5232b718f38740c74ff829b44e81c8484855fe2c75ffab323a23547935d34784faa8dd129507e78f491e187c035d2db8c1e5ebf4bbd0817680f102a5a5c1f229531008a76f99b15a9eead27c92c5e90b7ab97ff37acab5437c8c0ccb951e0ea98e02e85820b1d9fc1f2d957a3b7933c0bd503832e421cc5e9060cc6fb324871a6cf894979e6d191a4187e98cae63f3bbdcb81889d0e454ad71b046da848d8a908380efba54fffa124cc7cd099b24181550f2a870ba5b27bce56890b6e3c3b5b92f705fd3119ca434f814520f83b67ee4f0cb53d3cd7efddfcde067b913ea6020f36708deea70491dd270babe899ca52100f41735b41e6fc5766f771ff3e9a8e07a599494b453bb692f4d4c5b16c0be88e97bfc1fe21c6d039cdde3dfcbef8382b4d9a756843a7f1c794aebdc26b6125aa9c23c4a38b4cc10ccddcb6561f2affb32e08e5389376febd", 0x1000}, {&(0x7f0000006040)="03b4a336c2fa196f4008988847510019bb0cae2b569e3ba02cca264ae7e7759558ba321693eb6b6638a00c7a6529b5e37ef904bde9fd0ed45c6980764b79fe951898346e943183b1f00c0b0589f12861ab09c74eeae2ad51ca39b9f7c8bc6f7ed1d9829efb35d4db90e14c38ae4eec84132db871533c54d8629b2edbe6687078bbe3f6014376f65b03c0c477401b510f884b8c4fdfa0e9203aed4d2d5651f5daaff60938399075a9166756670019820646afdfed457f0b2c7771370bffe35f4d316ab17a80f35671d445dc49bed52d", 0xcf}, {&(0x7f0000006140)="5e66af5a0967c276d62f551809d37dbb89295320f95536ff5360d336dad249efd2a2286c3ba6560b0bdcbc320955504d3fb49f7eb9a8dd9021dedb7c9a0032910b495aed6ca8a8b5150c87caed4502d89032b1b6810300277d49ec1c2f08f38d3382c020bc95b7b618000b46b1761950d491", 0x72}, {&(0x7f00000061c0)="59926580e9865ba459f138bacaa095bcfaaa8c21b4f33718f28d099a7efa82e2e5fe758ef0bf898829d0b2c41b7e29ba56e6ad800e2b88a58f3ba769c44656bf831b7e6118e1f22e6baa04559cd0cdc07042d452698fbeb31cf5c887491b6029862e803724485bbf9d22889f1271488c1bf815087b337ce91bb9873035fd700616d12aed066188eece8a6cc5437286f1878a9e892bca03f626199960ae726498453fb153d20d5b949b1224bd995fc4ade8fc3b903087dfe2c26b1441e3b269df97e73d086242b3a30893eadb465a39c704ed1947b4d3b0424c6d3e7a9ae01aae6ac96e854ed96507e904fa11bc804c2be947a81845de9bdaf17354b2de1ee4e45f20037725cde7fd0796435088bfe32cf5ed08633e08042ba70d956f7cc4b904fc0342146905f450d4fe3b35f11d36230eaf24bf75d8351fe0e402c85806ea8ff3f6f228e638e06c2388406452c1542b1ced9cf5ac92e0884703df72e9cd547eb17c4dd9db5ab81f5e25bc17722cc9b2f3c0e77700e1b8d99077a5269a4745231dfc454eb7c91f01fc4871f98471514969b20005d36ed100a9b2816d09ba68e1f4484f16c9471c137f72a6e8404e5c84d2338cdea923023644911b5df72ad56dc45053a291490ae629724a018762bd9657091f480745a201d47344655c3ab0aa9b49ca620589008e74becca429f4ea8170e09f9dda67e23985a48e2464dc7aa161e89a08ec7cb86d23e146f7da4a5a8a3b6b2bdf3458d73d4d55d5f8ef06788c0a860ee63ebba3055e3919deca693162adb1184e9b33f23a53ad8f6ee6a79e3924352d6eac92073d126d17858979c37f47a90ff2332de95685735dd1409a7eaebd816d857b0836397a80bea9127f8a4f283e9e01cd1273aaac68bf3b11f50eaeb1694ed8378a69e1aa433bc1a4c3029c0acb7d54793f6eaf3da3b2353fdb31d565e81319e7c69d3dabae071d3ed67bd923c99ab8a587fb380847f9f004a177e2b3526bb12704e29f58cc302dce40b6f166da58ced50e32259fb1a37ffff869d46882f626a98f34718b413988d7e22b38343ad3f62c098027a80e1e7a178e8d2fc1223472aa36fc7e4ba9622783298a629e9d79cb90cb5e7bd8372329a9442af17278738e22e7fcdfd138301c5228ce7c7a23cec2b9eefeef739cb4b3bfe4189b2c1b376728013bdb3f4ebe4bef33d28781cc4e724c476df9b16720f5a36d5e229f4a2134c01a2af1ecc8c4e69024c6749cc6e4ab8e8033de460fef3a6ecc8486536b520807c26348a9e89db15848181d5dd629c4b16ca94ac5ad0b94c88e53f593fdf3638d59ab92387d0804f794064ec201ddc0abc84ee5418a20f1eb93552d5570a376135ea75a5ec55f6c1ccd546ba39bc96c93dfde7316fef2ca751464d3eeac281097f50f2f6e11aa27f15042d2866988ca947b90de230caf424340c31f8183509d3e491cff994ef75fc973135f634d01dd95ad6c410f67065a5159974eb2f1400b149ab188ed2339ab8c67da81fb92c17ad3c5e8d153169d8c5603d36ac64585d34cba7d72ae3f40dea7a966897cccb911ce0b3ac080cd72232869d534701bd43aef04b490dbf75ffa3ffef8998ecb29558d97577746c1c0b3ed08b1d0fbabad2367318691185feeb9a49f2e31386bb9ee3cf9fdb7f639578458f6813d528b44d557b8aabbb8dd32950d8b0d9a9ea2f0269076b03006964e489e7543c4d0308658c9e101c865ff33337075e27e6bf4727088870954c21e0070622a7b05d5f27400f6fcc189b652c0978e77b06e9f6b01a24f06a54cd32046e9032326a7ba9a826f9032b83b8c2a2aee19be19e7e81c3cf62439812547933efb004156c6b2ceff28e2784cc50d3f95d59a084afd280bc0161947bf503991a338a4f53b4203f1b86a0a083674128c9e756e813c07a5993cb2ddcce12580cdba586c34d827abb03e6448cb898669e3f4f64cb2cc73d2eae665064e808dc8ff21083f69f06a1202594c3d897728b077dd13dcbb852bf3c96d66126521f92ecc12ad9dbd3b5b4d6fd3e2f077d53c05b48546b72b7e0309a1fe911cc4b25b23d8d2d6036baeade4bfd7b040ba689cf9ca7cdf6d65eadf8ab4db15d9fdbf48d8553aa200f4fc35e9bdfc7933ecd0b33c60cf59b97b47d9dcfeb6256d9f468636c2e68825e26d446b92ce8efbfb98decadc253d7d0972e9a8985b2d37df18fac6ad1c15816fec6e578c924f55cb94e0eaa6ff5bc854adf9627c3a9207c1ec63c4000a0ae9fedc38aa511b570b28772e61e3b89589e6c8c2ab8bbc4de69be65a81c2cfe2b532a0bd8bf5377afbfacc7a74782c84cb80943c75ad8ed411b40c98ed703d4650e4017f6512f5fbffb7d66db001aaad6f19ebebfdd47d2d12255aca3e4e033316b0264b71799dba218fd7cf396eaaba570446b7270681a2ed2a37560978d8adaf8d60ef1fdedbed95d1558e5382d312d4fb053c780e1564489832af5eba7e69e81e36e58a37d842475f8ed7a8c70ede422e2534a1a2ac387330a3c6ec94e428503bb89a6421d40ede175bff646858f313337d0be75cb85e05ab2c9e741925c4b3c1cd42192ff1240e39a87df9fae08c8b64ed5762cafd1ad75e1f56feeb176285445a82ebd67d308fc84aa3b5849899829a6d7ba4abf36b5eb1754b4fa8cdbcb9af8e835d2efb4d809fd67284abb1e9a0ce1989d9c8ec5bb47d1f130eb3732dc62146460b74d5704c5d791ad88245d74f9ae12a8a25280f42bf080ffe54394fa3ab5cefdcb53f8735489a6d56ddc372b552b7cbe5ad2b7a8703b5589cf3c617ef302bf268656bc96d76b0a139fe6f25607c0032da0543e13b165f1d8d748b127bc466183fd15b52eec0c1e3263bcd5b256d4a29aef89eeaa86958bca3bb74ac9c7d8a73a474859caf496ca97b71da9c53ce3ec23b62b2f1d290737ed7363e5b5fc2e062cbbe0cf9196e482569f1f8922a9da058f7f444ca21ce8180d3349ce080879ad6155f433007a7125cb6ce44d0ddcd1d3681a2fbead0d64f80669c0cbe7befdfd90d723aef66f78f3f2775e64bc52b98361bb85b332c98999d1fa1c133588d3d71156b184127485d09b90d0e3b81731ba9c34507dd3239c13d1be28d2fd62bd38c7ba57d3438b9ed6af3b7e9c3356b6e087a990225221ca21b2f26bf78a5550f43c11d282674547e2ad1c9789297846ca09ff63a7c7d790f9e117644bf0962fb6545cf0142991183101e3822fb2c67af63ecbcff6d78488bff312a6fe30b4cb9bba34bb3c07a8038912b4e75cbb0e235b17a261772c7e79f7622541f8a29b4be5da0174f48c2271ec701ab48135765ff5971e12355914c1da6e0e75be0b060822a8fcf378c29b0a62947e212de0fa6bc3c79c197b761aa6efef09bf6950b9568815755b0da022bd5b3e9be9020f1f9fbc635c6d1409b929604594c39990c936db1650ddd6a6cd4169397002d4d9746e49f3b1286efa0479f5bf5d1709480dcf60780407697a67cdc76c2b37b10ca44a778386f11dce5ad053d13c073a272c3efcb3676e683c4f98e27c7e10f6046bedfe90bae79dda393678cdd44f63eb4deca7715756787daf794e721574e945aeb8c858b6ddf4401a12182645887c5a689568c192b4434b612b5e1ddf49c2536c3189f69cec53ac32fd9d585f26665fcdcd59e17e5ef84e97788d87491797f0629e79863e4f88b5e2244ac3c8dbec4d7bd7d3e2bcc331115522f43e2ad42804efa8a31232dbae0f5826d4ae4bc8eaf5c991a61b1ff5e4700ce54ea70cb374a644a57a3e40946826a75aaadea2819efe3d25bc78442bfebaee3b8fff551de6337aceb64a6aad7ff38ed54e9c733e1aed5321dfaff7f438d97b3a456293aa14d629d1377a97c2a476df5fd4213ce71f7ffa91db5ea725e77d375ed2cb2f90c39cd0bfa0b8492a9121b5e97aec8891467ed842ff55524f0a026019d219aec8078b1cf878dbd1d529ac09b35afcaaf8625c02e77082b08a217feef0c153a4e1bbd311492d1261c516650582ee5089c6c427a4506dabc92f53a8e4259aa9ffd84fde9687c759451616dfef916994eb95082e1018f2c686427919de23263e45e88eb2b87216afa2a3aac5aa052606d52914dcc08b62d7cd6ed34602e1499985a883f91914b9487c871252e9f44763e8f5561fe22a7f8ba345109aa893cac58323b7154e22bcca8a8975037cb8a99e750328fc4bad77b34de3601afde179ccbda12f055916e97bc9636a43805b295f120cfade2ca1f6acd59562c7243a9e700a3ef63f1fb6f527bbcb2fa0a697a4678eb9318cd3bbd601861fc15e731f22eaff6d7acadd2246b08db1390e8c55c92f30a800054a8d607ce34b4f8169c12f76345bf516967a6af773ce488c5032c1fd6aef18e8120e0c9470c9f1660df80f6c617fdb3005a2f1288357099cdf6cf37ee953c38dbb4df91eafcd83b6592e037f09d4daa6e6e871b9a47a82933be6496bb6c242f7482143b963e5ff0bf0f822f550a77c710e5a720fb4211b16439039a8bfebf841b67306379764c5b9db677b807b70f5c8ae5bb0adcb3bfb02bef36783917f7132ed2215799dcbaada3660e6c4729d180894eebfaa8eebe2b841d28fb585a896e8a6ff31f961ade36728cef2260296a33f73a6e047413dcc1a21df0940f1a92d2354cc2f4953aa861dec3697098574fcac5b8a0640bf06034033c1bb96290a4acdecbcd23ea4b69aa448d1c86cc9457e29d671f7f83f87b22ee14df25c6d43dbffa861c9122d5b4b8fdb32fdf19e2e8be9a7b2b645bf01eba74f78e4980da7feb383050843678d6969a6b1869236e0dee0863429daf3c9699d79a42abe677c20dd8e576b2233c5ea7183fd49fe4d629554306533a57e7a5b049eef58accc24cf20d17bf64b2f17c9ff4bee3a29810fca9ec98dcc5b5dae44b54b350c671583af15e1a12236f03455c925e521ad7c102229a503d1b81d388144ef5c77cbfd8779e88407b67d196231f5a99b6c156e19a1b00d6037ae8073f0cd6b7032db2b68a68559e322938c61d874adeca49c74a8be7b461196b9c2d8bdf2c685d50c0cae614849c34d44341f110131ad8e6947480f93e4d6289b921f0a1aff6220ea69c423aadbdd2ecd9da25ee6598fbe0c8b5382eba6ad9984dd5d0bf2278f9a8cbacfab5fa57dc43c5570605ec66263d3f57862dbd5c9b58604a09bf5cf7fd0b74a36e6296de6b10d16334ad36e992a5f1a6c82c747f95edef08c424aa455faa4ed565aa7524cf9a46f7fd0690c9e4bca2ca764d4d3d2a479a228a4a96c3f5d138d449d85dcc2ac6c18e1649de35eb4163bf02a85fe535ac6b182d791bf7f40d87fbf076a4af8bd35ae1c44724d1251c8736a08783306077a9e24887585d3342bf1665b68230397cf13563ddc34d6f0ae5c213154e10a90fddf776497681570360be5ebabad5b8b34757da2f463bd5a47a924b70627097ddc3026d762e3c1631411ee30b69316cf8a39758632e9f18833811cf39751bc14700b69bc70b552c0bfa5b876d7b7d5e6fd3f536ae838be892ff1a77c06e9abce733268c0942072088cde40465f88a7f86a4c9f44d4c787dcaa0cc860cc9b65eef094c8522c2150f597a2e65c3b39110b7c3a3c0c2d7d924788c3694ff26a1882b8b65b271fe1e12659621b5ae7d9dc161c070b924b5af2d184046c2513ca069d9025827eee420e0d2b826ccdb8ed59859e9cabf46b9ef96d9e4b050347df8eae3ba00910d35195cf2ded329ad9f4295136826823d453b00cb53bcbf524e5ff5ee57d580b7901314e16220b37130613419", 0x1000}, {&(0x7f00000071c0)="09a7c89c2ec562e1f90bf7f13a87cf6c29250eb7947cf130d4b1ded76874e621c70fe4fd6d12db39e4e16cab5500e3a42e1a31cccb3ac27a25d8a845f90d1e3de6a6d69ef35686433ccf95e8fb9c5fd56216e0", 0x53}], 0x8, &(0x7f0000008bc0)=[@rights={{0x2c, 0x1, 0x1, [r90, r91, r92, r94, r95, r96, r97]}}, @cred={{0x1c, 0x1, 0x2, {r98, r100, r103}}}, @cred={{0x1c, 0x1, 0x2, {r105, r106, r107}}}, @cred={{0x1c, 0x1, 0x2, {r108, r110, 0xee00}}}, @cred={{0x1c, 0x1, 0x2, {r113, r115, r118}}}, @rights={{0x20, 0x1, 0x1, [r120, r121, r125, r126]}}], 0xd0}, {&(0x7f0000008cc0)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000009480)=[{&(0x7f0000008d40)="5f95ef706bc488d6ed4d5d1409c7bd2737d990c14ec1cbf8205c8f1dda806433ad512a30954bbbd88ac04a405c25a698e7376fcc1ba80ec6c33d5e196674760e14b7a5ff12e2233b5efbcff71da36d232583021a585e34371718e719eac8112fe01cdc98b4f659e8eb7c09ec9c0bd80fa938ad4ede9c119b1058945f1640cd9cdfb68589c26a555fd5cbc1a72804e7570a2ac17a968032e1b2e739b648f10db58fbda7aad9ff78374f88b4a035abe852f434f91390b0a65aeaec5468e4e59b513b9dfad843b13b81", 0xc8}, {&(0x7f0000008e40)="bb6791a8536cd0a3c64de711262a20425a0cdb3189cd33aa154ca0fee76dabfcbacea67bb995600e46ccbb07bfc67ba9d8be099cb7f1c27553c216ce9e441b367ef146484cd1de041348a361c35b6a27949df210b092331c9b42974f2fd9e2d1cbe510314fdfcad251ac4e865ab07daef26c26d46510685387e856fe8506fd08244727e22cb518e28521f4a92b6ae576045815f2a56fdc2c9a4cbca36fd511588d61198ae0d402bd26a0b9bdc7d567eb263bb247645921c6b2923e9fc8d185c9debaf7aac3959467968c331478b41ec0285887cd68119a230d91ace29bc9e09d7aafb413be097f5c161427566a53", 0xee}, {&(0x7f0000008f40)="495c999ac9c3b25aa92209798021487050778041b1f27d129d36652e9bf60f448c077e65aa27895cd86a7ef718c8131245f736609597e28137a964ed3c77bd02dae7ca17fa4916f4cea980c3237bfe1545a6a830006f01aa05687f1d3a319c6ee0246487ed46e4dd5869d62457d6e19adcc3e81552e5c1458c77bd982e64d46d71a861343fa074d8acb6a9fbeff06f3d9e1c005371a92f3e3b", 0x99}, {&(0x7f0000009000)="051afe884d5eef42c1a4884d49a9cb9678c7f980cb163c2a7eff9d7a5c17b4c4cc642f320ec54d3731fe3252715c9248871fa8484be24a2f9bc8eee25aa00563062f9e2f533105bf7a3b947a79b06f73738416deccc6abf2ec14b57c6bc6e4fab3b0f98843c1e3f4dae518110c6d1042e75d600ba4226b43d3771190f6bbbe19d114815fb11d145ff7367b3f7cf2963afa5d9e3849735e888f6ca21fdc0b4b30df517f5b0353adc61e", 0xa9}, {&(0x7f00000090c0)="81b0e0b475f017f3aec239be4bf45da7a475036baf77e3e2fae1f7e4cefb48455c41ea7c1e28ec04008878d157900c32c4699001449a31ee750d4db548fdfa0ee58b5e2b432a1ea214ed61f7944ee64193b475707798c82d463ad4f115e6fcf1540acf29c53b99efce95aac120c6b7d0f0aa6c2700a05b9673dbc7cf5e9b9be012ac468ea79d3014433f142c02034fdfa0f8b742c53511146f1f485b97ef4fd63859260b610e54e556365dbad75cc0b56e22dbd958e9886ff3bf6b", 0xbb}, {&(0x7f0000009180)="ae02380f36b90c0b3e5aa1cda1b8f6980cb9caca34e5a9d283", 0x19}, {&(0x7f00000091c0)="86c4649929a4cf96838f9e9bf33c565be0aaf45fcd0873906b4b59bb86f6bf16dc7023b37933ccbea615117dcc2f101712b6467a5256e3d81b3428e58a604f475c0382fe4e06caadef838df8e8345a7b22a9d64b0de57cc17086722e6d790b7eed22f9e1ece59c4360a8ca57ac76e6ac6ee24d2a7f32b849799ba2012df889df045c41ab42b5ea137798eb75ae0ed3ef6bd4611790025ad327095a61aa7914331d970705a30f3ac7cfc4fde23a375a5bf11ab420e02857cf4474f27b0ba1bca57454cd76dbfc954af4a6323573b0306f73b905c72d8b071d022c265f97a14346781e5e60a90a5f39b954a152", 0xec}, {&(0x7f00000092c0)="30e9ea1a6c930b19edd4021e3b3e4d20ef04d2b629ea7d155c12bc05511acf7f091c228d527b8445d4f989bf3cca476d5b1a5be589d947b8e204decf709952bd6b09c984d82fe5fab0b959c60a050ff0f40bed9c5e8c5fc3f31a029289f02f82bb8b2f7a948f45c188c7c1980e5799516fdb19e0528b8ad812fc6ae41066b6ed6a067d8e9b", 0x85}, {&(0x7f0000009380)="e87440fa49b3b0ca94728c1e8fe600e299fdef8cbaf4dbbbc39d4f509e53e72aed7e2710cf58a9efcbd339d0a95cec44444f46314765aa028c05752814386879cbc9135e2ed1b045a7113917af2fc5b4b6fb889f111d208e1d9c09a2b4b86fb00bba6b3ffb62baea0561899f01b88295d646c768bf4e6637ee0799e416319ab4cc60baf4fde9dc304dff4885b64ca6b8607c7ba04e4f828c351b06d605088a76cd9fd8f2176689efc765b411dd29b4dd6ce05b981422217dca15f2b7a53e476a93bc5cc858df8d122886d8e233da67f53069c5650565a7dd92ac0185a8175629f7d9c3d51625af1c0980f0c9a4385edc", 0xf0}], 0x9, &(0x7f0000009940)=[@rights={{0x28, 0x1, 0x1, [r127, r128, r129, r130, r131, r133]}}, @cred={{0x1c, 0x1, 0x2, {r134, r135, r136}}}, @cred={{0x1c, 0x1, 0x2, {0x0, r137, r140}}}], 0x68, 0x841}], 0x9, 0xc004) r142 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r142) r143 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r143, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1967.005507][ T9960] device syz_tun entered promiscuous mode [ 1967.069962][ T9955] device bridge_slave_0 left promiscuous mode [ 1967.085580][ T9955] bridge1216: port 2(bridge_slave_0) entered disabled state 05:16:00 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x500, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:16:00 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$VFIO_SET_IOMMU(r0, 0x3b66, 0x0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) [ 1967.139856][ T9955] bridge1217: port 2(bridge_slave_0) entered blocking state [ 1967.172572][ T9955] bridge1217: port 2(bridge_slave_0) entered disabled state [ 1967.230773][ T9955] device bridge_slave_0 entered promiscuous mode 05:16:00 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0xd00}, 0x0) 05:16:00 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x5000000}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:16:01 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x600, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1967.488589][ T9963] FAT-fs (loop4): bogus number of reserved sectors [ 1967.517206][ T9963] FAT-fs (loop4): Can't find a valid FAT filesystem [ 1967.780023][T10000] device syz_tun left promiscuous mode [ 1967.805743][T10000] bridge1217: port 1(syz_tun) entered disabled state 05:16:01 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x700, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1967.842506][T10000] bridge1218: port 1(syz_tun) entered blocking state [ 1967.870788][T10000] bridge1218: port 1(syz_tun) entered disabled state 05:16:01 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1967.915581][T10000] device syz_tun entered promiscuous mode [ 1967.951416][T10001] device syz_tun left promiscuous mode [ 1967.957120][T10001] bridge1183: port 1(syz_tun) entered disabled state [ 1967.990717][T10001] bridge1184: port 1(syz_tun) entered blocking state [ 1968.004945][T10001] bridge1184: port 1(syz_tun) entered disabled state [ 1968.022053][T10001] device syz_tun entered promiscuous mode [ 1968.035228][T10003] device bridge_slave_0 left promiscuous mode [ 1968.041920][T10003] bridge1217: port 2(bridge_slave_0) entered disabled state [ 1968.058980][T10003] bridge1218: port 2(bridge_slave_0) entered blocking state [ 1968.071747][T10003] bridge1218: port 2(bridge_slave_0) entered disabled state [ 1968.082026][T10003] device bridge_slave_0 entered promiscuous mode 05:16:01 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x900, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1968.114779][ T26] kauditd_printk_skb: 7 callbacks suppressed [ 1968.114800][ T26] audit: type=1804 audit(1579065361.616:1212): pid=9988 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1653/file0/file0" dev="loop3" ino=1434 res=1 05:16:01 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0xe00}, 0x0) 05:16:01 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x29}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x330f, 0x0) io_uring_register$IORING_REGISTER_EVENTFD(r1, 0x4, &(0x7f0000000140)=r0, 0x1) fchdir(r0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$TIOCGETD(r1, 0x5424, &(0x7f0000000180)) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_S390_UCAS_MAP(r0, 0x4018ae50, &(0x7f00000000c0)={0x2, 0x8, 0x6}) arch_prctl$ARCH_SET_GS(0x1001, &(0x7f0000000000)) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:16:01 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x6000000}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1968.249883][ T26] audit: type=1804 audit(1579065361.756:1213): pid=9979 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1587/file0/file0" dev="loop1" ino=1433 res=1 [ 1968.336377][T10029] device syz_tun left promiscuous mode [ 1968.345854][T10029] bridge1184: port 1(syz_tun) entered disabled state [ 1968.387521][T10029] bridge1185: port 1(syz_tun) entered blocking state [ 1968.399037][T10029] bridge1185: port 1(syz_tun) entered disabled state [ 1968.414544][T10029] device syz_tun entered promiscuous mode [ 1968.520497][ T26] audit: type=1804 audit(1579065362.026:1214): pid=9977 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1587/file0/file0" dev="loop1" ino=1433 res=1 [ 1968.588785][T10041] device syz_tun left promiscuous mode [ 1968.614944][T10041] bridge1218: port 1(syz_tun) entered disabled state [ 1968.651690][T10041] bridge1219: port 1(syz_tun) entered blocking state [ 1968.672476][T10041] bridge1219: port 1(syz_tun) entered disabled state [ 1968.688829][T10041] device syz_tun entered promiscuous mode [ 1968.763576][T10042] device bridge_slave_0 left promiscuous mode [ 1968.781777][T10042] bridge1218: port 2(bridge_slave_0) entered disabled state [ 1968.818919][T10042] bridge1219: port 2(bridge_slave_0) entered blocking state [ 1968.828469][ T26] audit: type=1800 audit(1579065362.336:1215): pid=10018 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="file0" dev="sda1" ino=16931 res=0 [ 1968.835637][T10042] bridge1219: port 2(bridge_slave_0) entered disabled state [ 1968.879578][T10042] device bridge_slave_0 entered promiscuous mode [ 1968.901848][T10041] device bridge_slave_0 left promiscuous mode [ 1968.911527][T10041] bridge1219: port 2(bridge_slave_0) entered disabled state [ 1968.956272][ T26] audit: type=1804 audit(1579065362.466:1216): pid=10043 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1654/file0/file0" dev="sda1" ino=16932 res=1 05:16:02 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) utimes(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040)) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) mmap$snddsp(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x110, r2, 0x7000) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r3, 0x330f, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r3, 0x10e, 0xa, &(0x7f00000000c0)=0x7fff, 0x4) 05:16:02 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0xa00, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:16:02 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0x4e00}, 0x0) 05:16:02 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) r1 = socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x76656f) ioctl$VIDIOC_PREPARE_BUF(r3, 0xc058565d, &(0x7f0000000140)={0x7, 0x9, 0x4, 0x1000, 0x9e, {}, {0x5, 0xc, 0x3, 0x3f, 0x2, 0xda, "d63653b1"}, 0x9, 0x47e4267f9fe810eb, @offset=0x5, 0xffffffff, 0x0, r1}) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r5, 0x330f, 0x0) clock_gettime(0x0, &(0x7f0000000400)={0x0, 0x0}) ioctl$VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000480)={0x10b, 0xb, 0x4, 0x0, 0xffffff10, {r6, r7/1000+10000}, {0x1, 0x2, 0xe4, 0x9, 0x7, 0x2, "ca674258"}, 0x1b95, 0x2, @planes=&(0x7f0000000440)={0xd65a, 0x1, @mem_offset=0x7fffffff}, 0x1000, 0x0, 0xffffffffffffffff}) r9 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r12 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$setperm(0x5, r12, 0x202002) keyctl$chown(0x4, r12, r10, r11) sendmsg$nl_netfilter(r8, &(0x7f0000000940)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000580)={&(0x7f00000007c0)={0x174, 0x12, 0x3, 0x1, 0x70bd2a, 0x25dfdbfc, {0x2, 0x0, 0x8}, [@generic="29ff", @generic="bb70cb4810379849141f67aa51edbc8f272d7eac7a94fc689ee2a87ae17bd3395f17ca8b3b2080baef9d6fb3e39b19c9522af1ecc6ecd544a6ef1aca84fdf62bfa330e0cfddb9575ecee701b9e9560341efd3c5cd377e8d8764eeec641", @typed={0x5, 0x52, 0x0, 0x0, @str='\x00'}, @nested={0xe5, 0x72, 0x0, 0x1, [@typed={0x8, 0x88, 0x0, 0x0, @uid=r10}, @generic="a40c6bc6ff4612e3ba1081850ed1225ab508d26381354ab0b830f117dd9c75cffb41f527ec535019562cb589d9c549e3af5906fd3288e19c3ba12d1276a1c8c82bddca1e15247e132616e27b43c67baf321e99e061c390caa18bc83a6494d9caf42396ce3492afa2de63042b4435a0ff5d1ec0bebf2156b807b93d6c33613e7de6c371906a8461675feaba4fe2bc8ae73bb42a2d149b832398a2cf6b9c67ab48e5360c2857ec2d790b0507eb29c668d0eb0d2824eda8940bac07b01932bce58c9fc5486b7ae146ab9e1fbe1d61936308a5473d25669acb878a"]}, @typed={0xd, 0x61, 0x0, 0x0, @str='threaded\x00'}]}, 0x174}, 0x1, 0x0, 0x0, 0x10000}, 0x2d004) r13 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r13, 0x84, 0x6d, &(0x7f00000005c0)=ANY=[@ANYRES32=r14, @ANYBLOB="76000000e64c772ff3d61ac642b6a108c69349d4b005dab21dda9f6e7688b89d179a2f8b59e30d89278d1f419f1d2065eeb4634d16618eda264d4502f4cc9c9c5dea5b347af89000000000000000000a4aae8e8ccf4c942cd6e1abd23f05f0ef0b15ba8c62135b428b34347007b09ab532f508356ea5738fd331207bb65971a2fa661b4bffe46013d5bbeed70dfd3a1ba99903a62b4d4ab056bf63796386d8383b02063da9e944f588ee10d146fb2f530c11cf1fe9e413c717d02eaf2f93516076e1c171a4a7e46b3c312606a75cfdbe6ac8b5cc48c3f8d283a4c6130f502f06e739c19c856753d7c62f19273fca4503eafa7c244739a8654c1d8d120f25e4e053fe745a6e30e401e6dd66af0000000000000f46cba2d81620421a7024840b42135b796da9086b5082f64530265da83a611aee1c65765f73ba8d1037b44445c6636585e9da16ade056015c6813f3b5c8306e3ffea10c18f7bfa98eb1260c8775cace2c70589a3a6bdefab7c060b9ea4863352a765aa8441f47c1443e323ca350c461db452b6fe78e7b3a124d4eb39cfa306beacc20874cbc60c652d4bad520463147f0c628752ce23813881fa6d117f77bdb3b56cae686dd4f0c49fc64ceed99b89355ddb77d676ecf47c69a493afcc546a150acf8031988742a48ffc2b4421986d62316f25480511a0782245500"/503], &(0x7f0000000140)=0x2) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x70, &(0x7f0000000300)={r14, @in6={{0xa, 0x4e20, 0x7ff, @local, 0x7fff}}, [0x7fff, 0x4, 0x401, 0x0, 0xb25, 0x7, 0xff, 0x80, 0x80000000, 0x1, 0x80000000000000, 0x4, 0x8, 0x9fc, 0x6]}, &(0x7f0000000200)=0x100) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) 05:16:02 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x7000000}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) 05:16:02 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) ioctl$SNDRV_PCM_IOCTL_REWIND(r1, 0x40084146, &(0x7f00000000c0)=0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r2, 0x330f, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f0000000680)=ANY=[], &(0x7f0000000180)) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000300)={r4, 0xae, "e7057bb855236029d020e822b925a28dd27bb910228f72797482b7074bb7fd1044f1f982d79bcd2a5de6627e873b5610d2f48eb3bc94908b8cffa99a0fd8110c582d8dc0e005a4a94c14794cd3b73e60fb94070e005787eda69ddff0a1ea7f5419b4abeafe2edb2f9e96b81b352ce70735131b8c7551ea61f181a02c6093a614b2b5b1de34a201809f05fa7e08feba95a749bc5173139d38772debaf09a6f6f90641342b6814e17f6822d2ed0cc5"}, &(0x7f0000000000)=0xb6) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r6, 0x330f, 0x0) r7 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/autofs\x00', 0x40080, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(r6, 0x400442c8, &(0x7f0000000480)={r7, 0x1f, 0x2, "985e0c08e3eeca69976c48a61fd4a04a0dc140655eeb355f0e8f26a7a6b6baa96b03c1764daefc865504de976a86da3d1b97db76e7cfe4bd1fad25d1eedf6f8f91ea2fff447f2dfc11660f99f44487"}) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f00000003c0)={r5, @in6={{0xa, 0x4e21, 0x2406ce5b, @loopback, 0x7ff}}}, 0x84) 05:16:02 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0xf94, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1969.293470][T10053] device syz_tun left promiscuous mode [ 1969.303359][T10053] bridge1185: port 1(syz_tun) entered disabled state [ 1969.313373][T10053] bridge1186: port 1(syz_tun) entered blocking state [ 1969.324379][T10053] bridge1186: port 1(syz_tun) entered disabled state [ 1969.374045][T10053] device syz_tun entered promiscuous mode 05:16:02 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x1020, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1969.432662][T10052] device syz_tun left promiscuous mode [ 1969.445670][T10052] bridge1219: port 1(syz_tun) entered disabled state [ 1969.475635][T10052] bridge1220: port 1(syz_tun) entered blocking state [ 1969.521685][T10052] bridge1220: port 1(syz_tun) entered disabled state [ 1969.548640][T10052] device syz_tun entered promiscuous mode [ 1969.592540][T10057] bridge1220: port 2(bridge_slave_0) entered blocking state [ 1969.618205][T10057] bridge1220: port 2(bridge_slave_0) entered disabled state [ 1969.645049][T10057] device bridge_slave_0 entered promiscuous mode 05:16:03 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x1f00, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) 05:16:03 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0xc00e}, 0x0) 05:16:03 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0xa000000}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1969.908727][T10089] device syz_tun left promiscuous mode [ 1969.914684][ T26] audit: type=1804 audit(1579065363.416:1217): pid=10066 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir224435824/syzkaller.6qzfdT/1655/file0/file0" dev="loop3" ino=1436 res=1 [ 1969.949050][T10089] bridge1186: port 1(syz_tun) entered disabled state 05:16:03 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2000, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1969.983134][T10089] bridge1187: port 1(syz_tun) entered blocking state [ 1970.028719][T10089] bridge1187: port 1(syz_tun) entered disabled state [ 1970.042209][ T26] audit: type=1804 audit(1579065363.536:1218): pid=10073 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir605832217/syzkaller.L0Y5sW/1588/file0/file0" dev="loop1" ino=1435 res=1 [ 1970.046496][T10089] device syz_tun entered promiscuous mode [ 1970.114888][ T26] audit: type=1804 audit(1579065363.596:1219): pid=10055 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir182390562/syzkaller.E7x5yX/1563/file0/file0" dev="sda1" ino=16919 res=1 [ 1970.144837][T10093] device syz_tun left promiscuous mode [ 1970.161597][T10093] bridge1220: port 1(syz_tun) entered disabled state 05:16:03 executing program 1: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:16:03 executing program 3: socket$unix(0x1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f00000009c0)='threaded\x00', 0x76656f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) 05:16:03 executing program 4: r0 = socket$unix(0x1, 0x0, 0x0) socket$unix(0x1, 0x0, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0xff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000240)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) fchdir(r1) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0x76656f) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r2, 0xc0105303, &(0x7f0000000140)={0x3, 0x3}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, 0x0, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) [ 1970.212786][T10093] bridge1221: port 1(syz_tun) entered blocking state [ 1970.224380][T10093] bridge1221: port 1(syz_tun) entered disabled state [ 1970.237215][T10093] device syz_tun entered promiscuous mode [ 1970.248236][T10094] device bridge_slave_0 left promiscuous mode [ 1970.257506][T10094] bridge1220: port 2(bridge_slave_0) entered disabled state [ 1970.269716][T10094] bridge1221: port 2(bridge_slave_0) entered blocking state [ 1970.278264][T10094] bridge1221: port 2(bridge_slave_0) entered disabled state [ 1970.288578][T10094] device bridge_slave_0 entered promiscuous mode 05:16:03 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}, 0xe600}, 0x0) 05:16:03 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r8}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0xc000000}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) [ 1970.395625][ C0] ================================================================== [ 1970.403782][ C0] BUG: KCSAN: data-race in blk_stat_add / blk_stat_timer_fn [ 1970.411052][ C0] [ 1970.413381][ C0] write to 0xffffe8ffffc24400 of 8 bytes by interrupt on cpu 1: [ 1970.421026][ C0] blk_stat_timer_fn+0x30d/0x3d0 [ 1970.425963][ C0] call_timer_fn+0x5f/0x2f0 [ 1970.430465][ C0] run_timer_softirq+0xc0c/0xcd0 [ 1970.435404][ C0] __do_softirq+0x115/0x33f [ 1970.439915][ C0] irq_exit+0xbb/0xe0 05:16:03 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) syz_mount_image$iso9660(&(0x7f0000000080)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2010, &(0x7f0000000440)={[{@gid={'gid', 0x3d, r1}}]}) [ 1970.443897][ C0] smp_apic_timer_interrupt+0xe6/0x280 [ 1970.449355][ C0] apic_timer_interrupt+0xf/0x20 [ 1970.454288][ C0] preempt_schedule_irq+0x4d/0x90 [ 1970.459319][ C0] restore_regs_and_return_to_kernel+0x0/0x25 [ 1970.465387][ C0] kcsan_setup_watchpoint+0x1d4/0x460 [ 1970.470849][ C0] __tsan_read1+0xc2/0x100 [ 1970.475262][ C0] fat_get_block+0xfb/0x4e0 [ 1970.479774][ C0] __block_write_begin_int+0x2ea/0xf10 [ 1970.485240][ C0] block_write_begin+0x77/0x160 [ 1970.490099][ C0] cont_write_begin+0x3d6/0x670 [ 1970.494946][ C0] fat_write_begin+0x72/0xc0 [ 1970.499533][ C0] generic_perform_write+0x136/0x320 [ 1970.504819][ C0] __generic_file_write_iter+0x251/0x380 [ 1970.510457][ C0] generic_file_write_iter+0x28c/0x38c [ 1970.515919][ C0] new_sync_write+0x388/0x4a0 [ 1970.520595][ C0] __vfs_write+0xb1/0xc0 [ 1970.524839][ C0] vfs_write+0x18a/0x390 [ 1970.529077][ C0] ksys_write+0xd5/0x1b0 [ 1970.533322][ C0] __x64_sys_write+0x4c/0x60 [ 1970.537912][ C0] do_syscall_64+0xcc/0x3a0 [ 1970.542414][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1970.548293][ C0] [ 1970.550627][ C0] read to 0xffffe8ffffc24400 of 8 bytes by interrupt on cpu 0: [ 1970.558178][ C0] blk_stat_add+0x1dc/0x2c0 [ 1970.562676][ C0] blk_mq_end_request+0x256/0x2b0 [ 1970.567695][ C0] lo_complete_rq+0x136/0x1a0 [ 1970.568419][T10115] device syz_tun left promiscuous mode [ 1970.572401][ C0] blk_done_softirq+0x1eb/0x250 [ 1970.572415][ C0] __do_softirq+0x115/0x33f [ 1970.572428][ C0] run_ksoftirqd+0x46/0x60 [ 1970.572452][ C0] smpboot_thread_fn+0x37d/0x4a0 [ 1970.587264][T10115] bridge1187: port 1(syz_tun) entered disabled state [ 1970.587293][ C0] kthread+0x1d4/0x200 [ 1970.607352][ C0] ret_from_fork+0x1f/0x30 [ 1970.611786][ C0] [ 1970.614108][ C0] Reported by Kernel Concurrency Sanitizer on: [ 1970.620251][ C0] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.5.0-rc1-syzkaller #0 [ 1970.628307][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1970.638359][ C0] ================================================================== [ 1970.646416][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 1970.653119][ C0] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.5.0-rc1-syzkaller #0 [ 1970.661174][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1970.671228][ C0] Call Trace: [ 1970.674526][ C0] dump_stack+0x11d/0x181 [ 1970.678874][ C0] panic+0x210/0x640 [ 1970.682777][ C0] ? vprintk_func+0x8d/0x140 [ 1970.687401][ C0] kcsan_report.cold+0xc/0xd [ 1970.692009][ C0] kcsan_setup_watchpoint+0x3fe/0x460 [ 1970.697393][ C0] __tsan_read8+0xc6/0x100 [ 1970.701819][ C0] blk_stat_add+0x1dc/0x2c0 [ 1970.706448][ C0] blk_mq_end_request+0x256/0x2b0 [ 1970.711478][ C0] lo_complete_rq+0x136/0x1a0 [ 1970.716159][ C0] blk_done_softirq+0x1eb/0x250 [ 1970.721010][ C0] __do_softirq+0x115/0x33f [ 1970.725524][ C0] ? takeover_tasklets+0x250/0x250 [ 1970.730650][ C0] run_ksoftirqd+0x46/0x60 [ 1970.735076][ C0] smpboot_thread_fn+0x37d/0x4a0 [ 1970.740026][ C0] kthread+0x1d4/0x200 [ 1970.744104][ C0] ? constant_test_bit.constprop.0+0x30/0x30 [ 1970.750086][ C0] ? kthread_unpark+0xe0/0xe0 [ 1970.754776][ C0] ret_from_fork+0x1f/0x30 [ 1970.760627][ C0] Kernel Offset: disabled [ 1970.764949][ C0] Rebooting in 86400 seconds..