INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.7' (ECDSA) to the list of known hosts. 2018/04/07 06:23:55 fuzzer started 2018/04/07 06:23:55 dialing manager at 10.128.0.26:38639 2018/04/07 06:24:01 kcov=true, comps=false 2018/04/07 06:24:04 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f00000000c0)=0x61) close(r0) 2018/04/07 06:24:04 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)=@ipv6_getroute={0x20, 0x1a, 0x403, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x6}, [@RTA_MULTIPATH={0x4, 0x9}]}, 0x20}, 0x1}, 0x0) 2018/04/07 06:24:04 executing program 7: r0 = socket$inet6(0xa, 0x2100000000000002, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000080)={{{@in6=@remote={0xfe, 0x80, [], 0xbb}, @in, 0x0, 0x0, 0x0, 0x0, 0x2}}, {{@in6=@mcast1={0xff, 0x1, [], 0x1}, 0x0, 0x2b}, 0x0, @in=@loopback=0x7f000001, 0x0, 0xfffffffffffffffe}}, 0xe8) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000001780)={&(0x7f0000001700)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0) 2018/04/07 06:24:04 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@ipv4={[], [0xff, 0xff]}, @in, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in=@loopback=0x7f000001, 0x0, 0x2b}, 0x0, @in6=@mcast1={0xff, 0x1, [], 0x1}}}, 0xe8) close(r0) 2018/04/07 06:24:04 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000340)=@ipv4_newaddr={0x28, 0x14, 0x101, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r1}, [@IFA_ADDRESS={0x8, 0x1, @multicast2=0xe0000002}, @IFA_LOCAL={0x8, 0x2, @rand_addr}]}, 0x28}, 0x1}, 0x0) 2018/04/07 06:24:04 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f00000000c0)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x3cc) bind$inet6(r0, &(0x7f0000f13000)={0xa, 0x4e22}, 0x1c) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f00000034c0)={0x5, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x88) syz_emit_ethernet(0x3e, &(0x7f0000694ffe)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "06f526", 0x8, 0x11, 0x0, @empty, @mcast2={0xff, 0x2, [], 0x1}, {[], @udp={0x0, 0x4e22, 0x8}}}}}}, &(0x7f0000775000)) 2018/04/07 06:24:04 executing program 5: r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f0000df8fd9)="2600000022004701050007008980e8ff06006d20002b1f00c0e9ff094a51f10101c7033500b0", 0x26) recvmsg(r0, &(0x7f0000bf9000)={&(0x7f0000fb9000)=@sco, 0x80, &(0x7f0000e9c000)=[{&(0x7f000024e000)=""/219, 0xdb}, {&(0x7f00000a5000)=""/43, 0x2b}, {&(0x7f0000165fca)=""/54, 0x36}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000b14f72)=""/142, 0x8e}, {&(0x7f0000ba9fd5)=""/43, 0x2b}, {&(0x7f0000820000)=""/185, 0xb9}, {&(0x7f0000a77000)=""/243, 0xf3}, {&(0x7f00001b1ffd)=""/53, 0x35}], 0x9, &(0x7f00006d6faf)=""/81, 0x51}, 0x0) sendto(r0, &(0x7f0000000100)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmsg(r0, &(0x7f0000fa3000)={&(0x7f0000d0b000)=@ax25, 0x10, &(0x7f00002e6f80), 0x0, &(0x7f0000878000)}, 0x0) 2018/04/07 06:24:04 executing program 6: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000289000)={&(0x7f0000cf1ff4)={0x10}, 0xc, &(0x7f0000703000)={&(0x7f000023f000)=ANY=[@ANYBLOB="840000000000000000000000000000000046659a62290ffc380c2dbfc75e89e106ba4206274d760dfe0597260617e101000006000000001cb4e2bf501db1bb9427ecd8337f6d63cc8769c29c4d91b00ffff0be48b748d3050bc1700612dbc3080c91125fa158cf0d70309f7f19007c8262d732940142ab1cf90b11e0141c63f5f94035"], 0x83}, 0x1}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f000023f000)=0xa, 0x20b) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f000053b000)={0xa}, 0x1c) syzkaller login: [ 43.051915] ip (3745) used greatest stack depth: 54672 bytes left [ 43.420861] ip (3775) used greatest stack depth: 54312 bytes left [ 44.420178] ip (3875) used greatest stack depth: 54200 bytes left [ 44.985260] ip (3923) used greatest stack depth: 53960 bytes left [ 46.661622] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 46.674114] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 46.918883] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 47.022478] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 47.081998] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 47.193983] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 47.216818] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 47.230631] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 55.575091] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 55.626253] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 55.682202] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 55.849111] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 56.084880] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 56.178977] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 56.222946] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 56.282803] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 56.289135] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.301626] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.326604] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 56.362690] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 56.368939] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.383656] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.445951] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 56.452242] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.466760] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.633118] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 56.639891] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.658656] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.881902] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 56.888328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.903577] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.997573] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 57.003837] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 57.014630] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 57.048363] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 57.054653] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 57.094593] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 57.118183] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 57.127428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 57.166503] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 2018/04/07 06:24:21 executing program 7: bpf$PROG_LOAD(0x5, &(0x7f00004f2fb8)={0x1, 0x5, &(0x7f0000519fa8)=ANY=[@ANYBLOB="180000000000000000000000000000006b1af0fe0000000044000000000000009500000000000000"], &(0x7f0000001000)='syzkaller\x00', 0xfffffffffffffffd, 0x1000, &(0x7f0000000000)=""/4096}, 0x48) 2018/04/07 06:24:21 executing program 1: perf_event_open(&(0x7f0000b5a000)={0x4000000002, 0x70, 0x1e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x88) recvfrom$inet6(r0, &(0x7f0000fbef6d)=""/185, 0xffffffffffffff24, 0x0, 0x0, 0x0) r1 = getpid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f000064e000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f00005ebff8)=0x3f) fcntl$setsig(r2, 0xa, 0x12) fcntl$setownex(r2, 0xf, &(0x7f0000704000)={0x0, r1}) recvmsg(r3, &(0x7f000095cfc8)={&(0x7f0000893ff8)=@sco, 0x8, &(0x7f00000a4fb0), 0x0, &(0x7f0000b30000)}, 0x0) dup2(r2, r3) tkill(r1, 0x15) bind$inet6(r0, &(0x7f00008a8000)={0xa, 0x4e23}, 0x1c) r4 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r4, &(0x7f0000a29000)={&(0x7f0000000000)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 2018/04/07 06:24:22 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00006ffff8)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000240)='V', 0x1}], 0x1) connect$unix(r0, &(0x7f0000f57000)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) dup2(r1, r0) 2018/04/07 06:24:22 executing program 7: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0x0, 0x0}) sendmmsg(r0, &(0x7f0000008600)=[{{0x0, 0x0, &(0x7f0000003140)}}, {{&(0x7f00000072c0)=@un=@file={0x1, './file0\x00'}, 0x4, &(0x7f0000000300), 0x0, &(0x7f0000000600)}}], 0x2, 0x0) 2018/04/07 06:24:22 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000d60000)) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000000)) 2018/04/07 06:24:22 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000080)={0x2, &(0x7f0000000100)=[{0x20, 0x0, 0x0, 0xfffffffffffff000}, {0x6}]}, 0x10) 2018/04/07 06:24:22 executing program 5: r0 = socket(0x10, 0x803, 0x0) write(r0, &(0x7f0000df8fd9)="2600000022004701050007008980e8ff06006d20002b1f00c0e9ff094a51f10101c7033500b0", 0x26) recvmsg(r0, &(0x7f0000bf9000)={&(0x7f0000fb9000)=@sco, 0x80, &(0x7f0000e9c000)=[{&(0x7f000024e000)=""/219, 0xdb}, {&(0x7f00000a5000)=""/43, 0x2b}, {&(0x7f0000165fca)=""/54, 0x36}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000b14f72)=""/142, 0x8e}, {&(0x7f0000ba9fd5)=""/43, 0x2b}, {&(0x7f0000820000)=""/185, 0xb9}, {&(0x7f0000a77000)=""/243, 0xf3}, {&(0x7f00001b1ffd)=""/53, 0x35}], 0x9, &(0x7f00006d6faf)=""/81, 0x51}, 0x0) sendto(r0, &(0x7f0000000100)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmsg(r0, &(0x7f0000fa3000)={&(0x7f0000d0b000)=@ax25, 0x10, &(0x7f00002e6f80), 0x0, &(0x7f0000878000)}, 0x0) 2018/04/07 06:24:22 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x80c) writev(r0, &(0x7f0000000040)=[{&(0x7f0000dbe000)="290000002e003109ebff0706000000070a000000010000001883000016fffff70000d81f99645aff00", 0x29}], 0x1) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000000)={&(0x7f0000000340)=@newsa={0x140, 0x10, 0x1, 0x0, 0x0, {{@in6=@remote={0xfe, 0x80, [], 0xbb}, @in6=@local={0xfe, 0x80, [], 0xaa}}, {@in=@broadcast=0xffffffff, 0x0, 0x6c}, @in6=@mcast2={0xff, 0x2, [], 0x1}, {}, {}, {}, 0x0, 0x0, 0x2}, [@output_mark={0x8, 0x1d}, @algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x140}, 0x1}, 0x0) r2 = dup3(r0, r0, 0x80000) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$EVIOCGEFFECTS(r2, 0x80044584, &(0x7f0000000100)=""/190) 2018/04/07 06:24:22 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00'}) setsockopt$inet_buf(r0, 0x0, 0x11, &(0x7f00000000c0)="b1612faa33fa953fcb8cc6bd59763595c03282a173e4d8d2a65a295d0e4123d111e924e186cc76e03e41534cca9512fdd2451111c00081ae0ad1566b89b69c906fc4b6e72eef90ecc2cbaf7c889db4e92e4a7e1984d8530679b30fbc16a3cb226eebc47437dee96a9f84827d5711fdacc69da848ec820a9173fde609337394cbba6b1ab9ae8af8e5792f96a1332e455f17976d5bf6f8e4ad2bdb5c0c0585935aff2a3c7b53083011ecc30522b5c461306b553ab50d0183d82202ab2896158e", 0xbf) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'lo\x00', 0x101}) 2018/04/07 06:24:22 executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) r2 = epoll_create(0x6) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000fdb000)) ioctl$TCSETS(r1, 0x5402, &(0x7f00000000c0)) [ 58.797760] device lo entered promiscuous mode [ 58.828546] device lo left promiscuous mode 2018/04/07 06:24:22 executing program 7: setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f0000000000)={{0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}, {0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, 0x5c) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_ifreq(r0, 0x89f0, &(0x7f0000000040)={'tunl0\x00', @ifru_data=&(0x7f0000000000)="ac8be4abd0f79d6325ae476aab5970a3131f2fb4bbfb3c75500e33d0612f430d"}) 2018/04/07 06:24:22 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(r0, &(0x7f0000001d80)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @loopback={0x0, 0x1}}, 0x80, &(0x7f0000001380), 0x0, &(0x7f0000000040)}}, {{&(0x7f0000000a80)=@un=@file={0x0, './file0\x00'}, 0x80, &(0x7f0000001bc0), 0x0, &(0x7f0000001c00)}}], 0x2, 0x0) 2018/04/07 06:24:23 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000014000)={&(0x7f0000000140)={0x14, 0x1e, 0x100000002ff, 0x0, 0x0, {0x7}}, 0x14}, 0x1}, 0x0) 2018/04/07 06:24:23 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f000009ef58)={{0x80}, "706f7274310000004000000000000000000000d600fffffff0000000000000000000eda4000000000000000700", 0xbffffffdffffffff, 0x2}) readv(r0, &(0x7f0000459000)=[{&(0x7f0000fd5fc3)=""/61, 0x3d}], 0x1) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f00000000c0)={0x383, @time}) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r0, 0xc058534b, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000380)={0x0, @tick=0xeebc, 0x81, {0x8, 0x9}}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5335, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue1\x00'}) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000180), &(0x7f0000000340)=0x8) 2018/04/07 06:24:23 executing program 4: r0 = socket(0x11, 0x100000802, 0x0) r1 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0xe86824d2c1c833cb}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201}) preadv(r1, &(0x7f0000000340)=[{&(0x7f00000002c0)=""/73, 0x49}], 0x1, 0x0) 2018/04/07 06:24:23 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000fd1ff6)='net/tcp\x00') preadv(r2, &(0x7f0000000000)=[{&(0x7f0000040000)=""/136, 0x88}, {&(0x7f0000ddd000)=""/143, 0x8f}, {&(0x7f000032df3a)=""/198, 0x4ca}], 0x3, 0x0) 2018/04/07 06:24:23 executing program 7: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_int(r0, 0x0, 0x15, &(0x7f0000000140), &(0x7f0000000180)=0x4) 2018/04/07 06:24:23 executing program 2: r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000000)={{0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, {0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}, 0x0, {0x2, 0x0, @dev={0xac, 0x14, 0x14}}, 'syz_tun\x00'}) 2018/04/07 06:24:23 executing program 5: r0 = socket(0x10, 0x802, 0x0) write(r0, &(0x7f00001ed000)="24000000200025f0006b000420edff00023714e788cfdf32a910ffea08000100000000b7", 0x24) 2018/04/07 06:24:23 executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0xfd0000)=nil, 0xfd0000, 0x0, 0x100032, 0xffffffffffffffff, 0x0) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000280)={{{@in6=@mcast1={0xff, 0x1, [], 0x1}, @in=@broadcast=0xffffffff}}, {{@in6=@mcast1={0xff, 0x1, [], 0x1}}, 0x0, @in=@loopback=0x7f000001}}, 0xe8) 2018/04/07 06:24:23 executing program 0: r0 = syz_open_dev$tun(&(0x7f00000013c0)='/dev/net/tun\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fsetxattr(r0, &(0x7f0000262fe8)=@known='system.posix_acl_access\x00', &(0x7f000050bff4)="020000000800002000000000", 0xc, 0x0) 2018/04/07 06:24:23 executing program 6: mknod(&(0x7f000086c000)='./file0\x00', 0x103d, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x400000901, 0x0) 2018/04/07 06:24:23 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x18, &(0x7f0000000040), 0x4) 2018/04/07 06:24:23 executing program 7: mmap(&(0x7f000000e000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) process_vm_readv(0x0, &(0x7f0000000500), 0x0, &(0x7f0000007000)=[{&(0x7f000000b000)=""/240, 0xf0}, {&(0x7f0000008f9d)=""/99, 0x63}, {&(0x7f000000b000)=""/4096, 0x1000}, {&(0x7f000000bf62)=""/158, 0x9e}], 0x4, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000007000)={0x0, 0x0, 0x2320, 0x0, 0x0, 0x8020000000}) ioctl(r0, 0x2285, &(0x7f0000007000)='S') 2018/04/07 06:24:23 executing program 2: r0 = socket$nl_xfrm(0x11, 0x3, 0x6) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'syz_tun\x00', &(0x7f00000000c0)=@ethtool_cmd={0x1}}) 2018/04/07 06:24:23 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000fd1ff6)='net/tcp\x00') preadv(r2, &(0x7f0000000000)=[{&(0x7f0000040000)=""/136, 0x88}, {&(0x7f0000ddd000)=""/143, 0x8f}, {&(0x7f000032df3a)=""/198, 0x4ca}], 0x3, 0x0) 2018/04/07 06:24:23 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f000000cfe4)={0xa}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x3e, &(0x7f0000000000)=0x2, 0x4) setsockopt$inet6_int(r0, 0x29, 0x3c, &(0x7f0000000080)=0x2, 0x4) sendmmsg(r0, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f0000000380), 0x24d, &(0x7f00000003c0)}}, {{&(0x7f0000000140)=@in6={0xa, 0x4e22, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000500), 0xfffffeb6}], 0x1, &(0x7f0000000000)}}], 0x40000000000001c, 0x0) 2018/04/07 06:24:23 executing program 7: r0 = syz_open_dev$tun(&(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x102}) r1 = dup(r0) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000040)={'\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}) 2018/04/07 06:24:24 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000f65000)=0x3fb, 0x4) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00004aaffc)=0x6, 0x4) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0xfffffefffffffffe, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) 2018/04/07 06:24:24 executing program 4: mkdir(&(0x7f0000000040)='./control\x00', 0x0) r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000029ff6)='./control\x00', 0x86000006) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000b3aff6)='./control\x00', 0x1000800) rmdir(&(0x7f00000000c0)='./control\x00') 2018/04/07 06:24:24 executing program 0: r0 = socket(0xa, 0x2, 0x0) perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x36, &(0x7f0000d7bfc8)=@routing, 0x8) setsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c2d000), 0x0) 2018/04/07 06:24:24 executing program 1: capset(&(0x7f0000fcdff8)={0x4000019980330}, &(0x7f0000000000)={0x800000, 0xfffffffffff7fffb}) ioprio_set$pid(0x3, 0x0, 0x0) 2018/04/07 06:24:24 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x1, 0x5, 0xb, 0x10}, 0x2c) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x1, 0x5, 0x9, 0x10}, 0x2c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00004f9fe4)={0xc, 0x4, 0x4, 0x100000001, 0x0, r0}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00005f1000)={r1, &(0x7f0000eed000), &(0x7f0000b88000)="13"}, 0x20) 2018/04/07 06:24:24 executing program 7: capset(&(0x7f0000581ff8)={0x19980330}, &(0x7f00005ccfe8)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f000001bfc8)={&(0x7f0000016000)={0x10}, 0x0, &(0x7f0000014ff0)={&(0x7f0000022000)=@delneigh={0x24, 0x1d, 0x513}, 0x24}, 0x1}, 0x0) 2018/04/07 06:24:24 executing program 6: r0 = socket$inet6(0xa, 0x802, 0x100000000000088) setsockopt$inet6_udp_int(r0, 0x11, 0x100000000000a, &(0x7f0000246ffc)=0xffa, 0x4) sendto$inet6(r0, &(0x7f0000a05ae2), 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c) 2018/04/07 06:24:24 executing program 3: r0 = memfd_create(&(0x7f0000002000)="2f7b06003170707031253a656d30f9", 0x0) write$evdev(r0, &(0x7f0000000100)=[{{}, 0x0, 0x0, 0xfffffffffffffffd}], 0x18) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) sigaltstack(&(0x7f0000001000/0xd000)=nil, &(0x7f0000000000)) [ 60.820019] capability: warning: `syz-executor1' uses 32-bit capabilities (legacy support in use) 2018/04/07 06:24:24 executing program 3: r0 = socket$inet6(0xa, 0x80002, 0x0) recvmsg(r0, &(0x7f0000000100)={0x0, 0xfffffffffffffcca, &(0x7f0000000200), 0x213, &(0x7f0000000140)=""/180, 0xb4}, 0x0) bind$inet6(r0, &(0x7f0000726fe4)={0xa, 0x4e23}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x4a, &(0x7f0000000040)=0x7fffffff, 0x4) sendto$inet6(r0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, 0x1c) 2018/04/07 06:24:24 executing program 1: r0 = socket$inet(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="260000001a00030207fffd73ffffff188100000003000000031d8568647ba3a2d188637e57e4", 0x26}], 0x1}, 0x0) 2018/04/07 06:24:24 executing program 6: r0 = socket$inet6(0xa, 0x3, 0x8) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@loopback={0x0, 0x1}, 0x800, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x21, &(0x7f00001e0ffc)=0x3, 0xffffff02) perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x800, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000340)={@mcast1={0xff, 0x1, [], 0x1}}, &(0x7f00000000c0)=0x20) 2018/04/07 06:24:24 executing program 4: r0 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, 0x19) 2018/04/07 06:24:25 executing program 7: r0 = socket$key(0xf, 0x3, 0x2) r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x2, &(0x7f0000000080)=0x0) dup3(r0, r1, 0x0) io_submit(r2, 0x1, &(0x7f0000000500)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x8, 0x0, r1, &(0x7f0000000200)="02000000a00a000000215d2924af7b", 0xf}]) 2018/04/07 06:24:25 executing program 5: r0 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x4012}) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000100)={0x0, 0x15b, [@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, @empty, @link_local={0x1, 0x80, 0xc2}, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}]}) 2018/04/07 06:24:25 executing program 0: creat(&(0x7f00008d6ff8)='./file0\x00', 0x0) r0 = open(&(0x7f000011a000)='./file0\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x40049409, 0xffffffffffffffff) 2018/04/07 06:24:25 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000f65000)=0x3fb, 0x4) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00004aaffc)=0x6, 0x4) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0xfffffefffffffffe, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) 2018/04/07 06:24:25 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$netlink(r0, 0x10e, 0xa, &(0x7f0000000080)=""/112, &(0x7f0000000000)=0x70) 2018/04/07 06:24:25 executing program 4: r0 = syz_open_dev$tun(&(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'ifb0\x00', 0x4012}) ioctl$TTUNGETFILTER(r0, 0x801054db, &(0x7f0000000180)=""/197) 2018/04/07 06:24:25 executing program 3: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) chroot(&(0x7f000009a000)='./file0\x00') chdir(&(0x7f0000cd2ff8)='./file0\x00') symlink(&(0x7f0000000140)='..', &(0x7f0000272ff7)='../file0\x00') umount2(&(0x7f0000000080)='../file0\x00', 0x4) 2018/04/07 06:24:25 executing program 5: r0 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) setreuid(0x0, r1) 2018/04/07 06:24:25 executing program 7: r0 = socket$key(0xf, 0x3, 0x2) r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x2, &(0x7f0000000080)=0x0) dup3(r0, r1, 0x0) io_submit(r2, 0x1, &(0x7f0000000500)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x8, 0x0, r1, &(0x7f0000000200)="02000000a00a000000215d2924af7b", 0xf}]) 2018/04/07 06:24:25 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000f65000)=0x3fb, 0x4) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00004aaffc)=0x6, 0x4) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0xfffffefffffffffe, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) 2018/04/07 06:24:25 executing program 6: r0 = syz_open_procfs(0x0, &(0x7f0000001b80)='/exe\x00\x00\x00\x00\x00\x00') fcntl$setstatus(r0, 0x4, 0x46000) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}}) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000ffc000/0x2000)=nil, 0x2000}) preadv(r0, &(0x7f0000000040), 0x10000000000000a6, 0x0) 2018/04/07 06:24:25 executing program 1: open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r0 = syz_open_dev$tun(&(0x7f00000004c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syz+aller0\x00', 0x2001}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x20) close(r0) sysinfo(&(0x7f0000000500)=""/4096) syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, &(0x7f0000000000)) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000140)=0x4) 2018/04/07 06:24:25 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000080)={&(0x7f00000000c0)=@getsa={0x28, 0x12, 0x501, 0x0, 0x0, {@in=@multicast1=0xe0000001}}, 0x28}, 0x1}, 0x0) recvmsg(r0, &(0x7f0000000340)={&(0x7f0000000100)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @dev}}}, 0x9305025714c1f531, &(0x7f0000000300), 0x0, 0x0, 0xfffffec5}, 0x0) 2018/04/07 06:24:25 executing program 4: r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) r1 = syz_open_dev$tun(&(0x7f00000004c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syz+aller0\x00', 0x2001}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x20) close(r1) sysinfo(&(0x7f0000000500)=""/4096) fcntl$setlease(r0, 0x400, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000140)=0x4) [ 61.932605] netlink: 24 bytes leftover after parsing attributes in process `syz-executor0'. 2018/04/07 06:24:26 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x2, &(0x7f0000000080)=0x0) dup3(r0, r1, 0x0) io_submit(r2, 0x1, &(0x7f0000000500)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x8, 0x0, r1, &(0x7f0000000200)="02000000a00a000000215d2924af7b", 0xf}]) [ 61.979955] netlink: 24 bytes leftover after parsing attributes in process `syz-executor0'. 2018/04/07 06:24:26 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000f65000)=0x3fb, 0x4) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00004aaffc)=0x6, 0x4) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0xfffffefffffffffe, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) 2018/04/07 06:24:26 executing program 0: pipe(&(0x7f0000eb0ff8)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r0, r1, 0x1, 0x3) 2018/04/07 06:24:26 executing program 4: mprotect(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0) r0 = memfd_create(&(0x7f0000000ffe)='\'\x00', 0x0) fcntl$lock(r0, 0x24, &(0x7f000000eff0)) 2018/04/07 06:24:26 executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000c80)=@nat={'nat\x00', 0x19, 0x2, 0xb78, [0x20000100, 0x0, 0x0, 0x20000c18, 0x20000c48], 0x0, &(0x7f0000000000), &(0x7f0000000100)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff020000000300000000000000000065716c000000000000000000000000006970365f76746930000000000000000073697430000000000000000000000000697036746e6c30000000000000000000ffffffffffff0000000000000180c20000000000000000000000480900004809000080090000616d6f6e67000000000000000000000000000000000000000000000000000000b008000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000ac1414aa00000000ff010000ffffffff0000000000000000ac1414000000000000000000000000000000000000000000ac1414000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000eef7134ee0f365b097e643eb9f800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000007f0000010000000000000000ac1414aa0000000000000000ac1414000000000000000000ac1414bb0000000000000000e000000100000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000ffffffffffff0000000000000000000009000000000000000000697064647030000000000000000000006772657461703000000000000000000069726c616e300000000000000000000079616d300000000000000000000000007ce4b22e5be3000000000000ffffffffffff0000000000000000a80000003001000068010000636c7573746572000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000004c45440000000000000000000000000000000000000000000000000000000000280000000000000073797a31000000000000000000000000000000000000000000000000000000000000000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa00000000000000000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff00000000"]}, 0xbf0) 2018/04/07 06:24:26 executing program 7: mmap(&(0x7f0000000000/0xb3c000)=nil, 0xb3c000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/igmp6\x00') fchown(r0, 0x0, 0x0) 2018/04/07 06:24:26 executing program 1: open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) r0 = syz_open_dev$tun(&(0x7f00000004c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syz+aller0\x00', 0x2001}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x20) close(r0) sysinfo(&(0x7f0000000500)=""/4096) syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, &(0x7f0000000000)) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000140)=0x4) 2018/04/07 06:24:26 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='task\x00') fstat(r0, &(0x7f0000000000)) 2018/04/07 06:24:26 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)=@ipv6_newroute={0x30, 0x18, 0x121, 0x0, 0x0, {0xa}, [@RTA_PREF={0x8, 0x14}, @RTA_MULTIPATH={0xc, 0x9, [{}]}]}, 0x30}, 0x1}, 0x0) 2018/04/07 06:24:26 executing program 7: setsockopt$netlink_NETLINK_RX_RING(0xffffffffffffffff, 0x10e, 0x6, &(0x7f0000017000)={0x0, 0x0, 0x400}, 0x37f) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000ca3000)='/dev/autofs\x00', 0x0, 0x0) ioctl(r0, 0x800000000000937e, &(0x7f0000017000)="01") 2018/04/07 06:24:26 executing program 6: mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x0, 0x32, 0xffffffffffffffff, 0x0) sched_getaffinity(0x0, 0x8, &(0x7f0000000180)) [ 62.367589] netlink: 'syz-executor5': attribute type 20 has an invalid length. [ 62.436716] autofs4:pid:5318:validate_dev_ioctl: invalid path supplied for cmd(0x0000937e) 2018/04/07 06:24:26 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x3}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x8}, 0x1c) 2018/04/07 06:24:26 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000f65000)=0x3fb, 0x4) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00004aaffc)=0x6, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) 2018/04/07 06:24:26 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000aabff1)='net/xfrm_stat\x00') bind$alg(r0, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'md4-generic\x00'}, 0x58) r2 = accept4$alg(r0, 0x0, 0x0, 0x0) sendfile(r2, r1, &(0x7f0000a2effc), 0x7f) fsync(0xffffffffffffffff) 2018/04/07 06:24:26 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)=@ipv6_newroute={0x30, 0x18, 0x121, 0x0, 0x0, {0xa}, [@RTA_PREF={0x8, 0x14}, @RTA_MULTIPATH={0xc, 0x9, [{}]}]}, 0x30}, 0x1}, 0x0) 2018/04/07 06:24:26 executing program 7: r0 = gettid() socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000bbff8)={0xffffffffffffffff, 0xffffffffffffffff}) mknod(&(0x7f0000000ffa)='./bus\x00', 0x1000, 0x0) open(&(0x7f0000e9a000)='./bus\x00', 0x85, 0x0) unlink(&(0x7f0000000000)='./bus\x00') read(r2, &(0x7f000043bfff)=""/1, 0x1) ioctl$int_in(r1, 0x40000005452, &(0x7f0000000040)=0x2891) creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setown(r1, 0x8, r0) fcntl$setsig(r1, 0xa, 0x12) dup2(r1, r2) tkill(r0, 0x16) 2018/04/07 06:24:26 executing program 3: r0 = socket$inet(0x2, 0x2000000000003, 0x1) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x83, &(0x7f0000001200)={'nat\x00', 0x0, 0x0, 0x3e6, [], 0x100000e4, &(0x7f00000001c0), &(0x7f0000000200)=""/4096}, &(0x7f0000001280)=0x108) 2018/04/07 06:24:26 executing program 6: r0 = syz_open_procfs(0x0, &(0x7f0000000140)="6e65742f69636d703600e980e7a58cb23dc59482be5a6ab7d3da0f685b91b2243e763e46a00f4dd609d862617728c0d127d8fb00c1cf9dd5ba693e9729264b9eb85e304e9382e41db8a0132c283489685306eef156fbe5a8c2430a531e29bf4823d24d003de994592fbf3780a78776b48e0a76800bfd57e900db7fd0d47aaeefdcb35f08e52528be856129b498a7b1a55963b34842b0895a2d7f0315222b3a05f641b6d00e38426a16700b51f35cea2f0a84492ef2a1afb2c5a61fcd23ebf409c7357cecb49c96628f39887fad17a5a48abd90e788758e") readv(r0, &(0x7f00000022c0)=[{&(0x7f00000011c0)=""/4096, 0x1000}], 0x1) 2018/04/07 06:24:26 executing program 1: syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x4002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000001, 0x8031, 0xffffffffffffffff, 0x0) pkey_free(0xffffffffffffffff) getitimer(0x0, &(0x7f0000000340)) [ 62.511110] autofs4:pid:5322:validate_dev_ioctl: invalid path supplied for cmd(0x0000937e) [ 62.610409] netlink: 'syz-executor5': attribute type 20 has an invalid length. 2018/04/07 06:24:26 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) getsockopt$packet_int(r0, 0x107, 0x12, &(0x7f0000001ffc), &(0x7f0000000000)=0x4) 2018/04/07 06:24:26 executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000fe6ff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = epoll_create(0x30fd) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00003b8ffc)=0x51) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r0, 0x0) ioctl$TCFLSH(r2, 0x540b, 0x2) 2018/04/07 06:24:26 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$tun(&(0x7f0000000200)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bridge0\x00', 0xfffffffffffffffe}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0, 0x0}, &(0x7f0000000100)=0xc) ioctl$TUNSETGROUP(r1, 0x400454ce, r2) 2018/04/07 06:24:26 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r0, 0x29, 0xcc, &(0x7f00000000c0), 0x0) 2018/04/07 06:24:26 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000f65000)=0x3fb, 0x4) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00004aaffc)=0x6, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) 2018/04/07 06:24:26 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)=@ipv6_newroute={0x30, 0x18, 0x121, 0x0, 0x0, {0xa}, [@RTA_PREF={0x8, 0x14}, @RTA_MULTIPATH={0xc, 0x9, [{}]}]}, 0x30}, 0x1}, 0x0) [ 62.855989] netlink: 'syz-executor5': attribute type 20 has an invalid length. 2018/04/07 06:24:26 executing program 0: r0 = add_key$keyring(&(0x7f00000003c0)='keyring\x00', &(0x7f0000000400)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$link(0x8, 0x0, r0) 2018/04/07 06:24:26 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f00000000c0), 0x3) 2018/04/07 06:24:26 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000f65000)=0x3fb, 0x4) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00004aaffc)=0x6, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) 2018/04/07 06:24:26 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x15, &(0x7f0000ff7000), &(0x7f0000ff7000)=0x4) 2018/04/07 06:24:27 executing program 6: r0 = socket(0x11, 0x4000000000080003, 0x0) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0xfffffffffffffffe, 0x4) 2018/04/07 06:24:27 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)=@ipv6_newroute={0x30, 0x18, 0x121, 0x0, 0x0, {0xa}, [@RTA_PREF={0x8, 0x14}, @RTA_MULTIPATH={0xc, 0x9, [{}]}]}, 0x30}, 0x1}, 0x0) [ 63.161328] netlink: 'syz-executor5': attribute type 20 has an invalid length. 2018/04/07 06:24:27 executing program 7: setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f00008d8000)=ANY=[@ANYBLOB="687696efec0b091d00000000000000000a004e2000000000ff010010000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010"], 0x1) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00003cf000)={&(0x7f0000f4dff4)={0x10}, 0x37b, &(0x7f00005ad000)={&(0x7f00008d8000)=@migrate={0x15c, 0x21, 0x1, 0x0, 0x0, {{@in6=@ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, @in6=@dev={0xfe, 0x80}}}, [@migrate={0x10c, 0x11}]}, 0x15c}, 0x1}, 0x0) 2018/04/07 06:24:27 executing program 0: sendmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000564000)=@abs, 0x6e, &(0x7f0000000040)=[{&(0x7f0000007000)="002a932f01000000cf960802e02348f800000000001c0003f2a576", 0x1b}], 0x1, &(0x7f00001f9fe0)}, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000140)='/dev/sg#\x00', 0x0, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000007000)={0x0, 0x0, 0x2e5}) ppoll(&(0x7f0000000080)=[{r0}], 0x1, &(0x7f00000000c0)={0x0, 0x1c9c380}, &(0x7f0000000100), 0x8) ioctl(r0, 0x2285, &(0x7f0000007000)='S') 2018/04/07 06:24:27 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000f65000)=0x3fb, 0x4) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0xfffffefffffffffe, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) [ 63.608258] sd 0:0:1:0: [sg0] tag#5122 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 63.617132] sd 0:0:1:0: [sg0] tag#5122 CDB: Test Unit Ready [ 63.622980] sd 0:0:1:0: [sg0] tag#5122 CDB[00]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.631974] sd 0:0:1:0: [sg0] tag#5122 CDB[10]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.640954] sd 0:0:1:0: [sg0] tag#5122 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.649924] sd 0:0:1:0: [sg0] tag#5122 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.658868] sd 0:0:1:0: [sg0] tag#5122 CDB[40]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.667822] sd 0:0:1:0: [sg0] tag#5122 CDB[50]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.676810] sd 0:0:1:0: [sg0] tag#5122 CDB[60]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.685765] sd 0:0:1:0: [sg0] tag#5122 CDB[70]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.694742] sd 0:0:1:0: [sg0] tag#5122 CDB[80]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.703686] sd 0:0:1:0: [sg0] tag#5122 CDB[90]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.712660] sd 0:0:1:0: [sg0] tag#5122 CDB[a0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.721613] sd 0:0:1:0: [sg0] tag#5122 CDB[b0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.730589] sd 0:0:1:0: [sg0] tag#5122 CDB[c0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.739530] sd 0:0:1:0: [sg0] tag#5122 CDB[d0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.748495] sd 0:0:1:0: [sg0] tag#5122 CDB[e0]: 00 00 00 00 00 [ 63.774726] sd 0:0:1:0: [sg0] tag#5122 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 63.783634] sd 0:0:1:0: [sg0] tag#5122 CDB: Test Unit Ready [ 63.789511] sd 0:0:1:0: [sg0] tag#5122 CDB[00]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.798498] sd 0:0:1:0: [sg0] tag#5122 CDB[10]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.807507] sd 0:0:1:0: [sg0] tag#5122 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.816416] sd 0:0:1:0: [sg0] tag#5122 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.825371] sd 0:0:1:0: [sg0] tag#5122 CDB[40]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.834342] sd 0:0:1:0: [sg0] tag#5122 CDB[50]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.843340] sd 0:0:1:0: [sg0] tag#5122 CDB[60]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.852246] sd 0:0:1:0: [sg0] tag#5122 CDB[70]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.861169] sd 0:0:1:0: [sg0] tag#5122 CDB[80]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2018/04/07 06:24:27 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f00004f2fb8)={0x1, 0x5, &(0x7f0000519fa8)=ANY=[@ANYBLOB="180000000000000000000000000000007b1af0fe0000000044000000000000009500000000000000"], &(0x7f0000001000)='syzkaller\x00', 0xfffffffffffffffd, 0x1000, &(0x7f0000000000)=""/4096}, 0x48) 2018/04/07 06:24:27 executing program 0: sendmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000564000)=@abs, 0x6e, &(0x7f0000000040)=[{&(0x7f0000007000)="002a932f01000000cf960802e02348f800000000001c0003f2a576", 0x1b}], 0x1, &(0x7f00001f9fe0)}, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000140)='/dev/sg#\x00', 0x0, 0x0) ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000007000)={0x0, 0x0, 0x2e5}) ppoll(&(0x7f0000000080)=[{r0}], 0x1, &(0x7f00000000c0)={0x0, 0x1c9c380}, &(0x7f0000000100), 0x8) ioctl(r0, 0x2285, &(0x7f0000007000)='S') 2018/04/07 06:24:27 executing program 7: r0 = socket(0xa, 0x1, 0x0) getsockopt(r0, 0x0, 0xcf, &(0x7f0000001ff8)=""/8, &(0x7f0000000ffc)=0x8) 2018/04/07 06:24:27 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000aabff1)='net/xfrm_stat\x00') bind$alg(r0, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'wp256-generic\x00'}, 0x58) r2 = accept4$alg(r0, 0x0, 0x0, 0x0) sendfile(r2, r1, &(0x7f0000a2effc), 0x7f) 2018/04/07 06:24:27 executing program 4: creat(&(0x7f00008d6ff8)='./file0\x00', 0x0) r0 = open(&(0x7f000011a000)='./file0\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x40049409, r0) 2018/04/07 06:24:27 executing program 6: r0 = socket$inet(0x2, 0x3, 0x20) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f00000000c0)="860c8800007491033e", 0x9) 2018/04/07 06:24:27 executing program 5: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)=@ipv6_newroute={0x30, 0x18, 0x121, 0x0, 0x0, {0xa}, [@RTA_PREF={0x8, 0x14}, @RTA_MULTIPATH={0xc, 0x9, [{}]}]}, 0x30}, 0x1}, 0x0) 2018/04/07 06:24:27 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000f65000)=0x3fb, 0x4) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0xfffffefffffffffe, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) [ 63.870114] sd 0:0:1:0: [sg0] tag#5122 CDB[90]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.879084] sd 0:0:1:0: [sg0] tag#5122 CDB[a0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.888075] sd 0:0:1:0: [sg0] tag#5122 CDB[b0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.896978] sd 0:0:1:0: [sg0] tag#5122 CDB[c0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.905911] sd 0:0:1:0: [sg0] tag#5122 CDB[d0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 63.914820] sd 0:0:1:0: [sg0] tag#5122 CDB[e0]: 00 00 00 00 00 [ 64.042835] sd 0:0:1:0: [sg0] tag#5122 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK [ 64.051735] sd 0:0:1:0: [sg0] tag#5122 CDB: Test Unit Ready [ 64.057587] sd 0:0:1:0: [sg0] tag#5122 CDB[00]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.066589] sd 0:0:1:0: [sg0] tag#5122 CDB[10]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.075583] sd 0:0:1:0: [sg0] tag#5122 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.084527] sd 0:0:1:0: [sg0] tag#5122 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.093477] sd 0:0:1:0: [sg0] tag#5122 CDB[40]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.102409] sd 0:0:1:0: [sg0] tag#5122 CDB[50]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.111382] sd 0:0:1:0: [sg0] tag#5122 CDB[60]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.120323] sd 0:0:1:0: [sg0] tag#5122 CDB[70]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.129303] sd 0:0:1:0: [sg0] tag#5122 CDB[80]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.138251] sd 0:0:1:0: [sg0] tag#5122 CDB[90]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.147225] sd 0:0:1:0: [sg0] tag#5122 CDB[a0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.156178] sd 0:0:1:0: [sg0] tag#5122 CDB[b0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.165148] sd 0:0:1:0: [sg0] tag#5122 CDB[c0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.174118] sd 0:0:1:0: [sg0] tag#5122 CDB[d0]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.183110] sd 0:0:1:0: [sg0] tag#5122 CDB[e0]: 00 00 00 00 00 2018/04/07 06:24:28 executing program 1: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}, {{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}}}, {{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}]}, 0x20c) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000a83000)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, {{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x108) 2018/04/07 06:24:28 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000f65000)=0x3fb, 0x4) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0xfffffefffffffffe, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) 2018/04/07 06:24:28 executing program 7: perf_event_open(&(0x7f0000012000)={0x2, 0x78, 0xfffffffffffffff5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) fgetxattr(r0, &(0x7f0000785000)=@known='security.selinux\x00', &(0x7f0000043000), 0xfffffffffffffce0) 2018/04/07 06:24:28 executing program 6: r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x9}, 0x1c) sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)="031d7d91290d61befff302763f000000000000000000000000000000000000000000000000000000", 0x28}], 0x1}, 0x0) 2018/04/07 06:24:28 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)=@ipv6_newroute={0x30, 0x18, 0x121, 0x0, 0x0, {0xa}, [@RTA_PREF={0x8, 0x14}, @RTA_MULTIPATH={0xc, 0x9, [{}]}]}, 0x30}, 0x1}, 0x0) 2018/04/07 06:24:28 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f000001aff8)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r0, &(0x7f0000000180)=[{&(0x7f0000000040)="83", 0x1}], 0x1) write(r1, &(0x7f0000000080)="11", 0x1) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000240)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @broadcast}}}, 0x80, &(0x7f0000000480)=[{&(0x7f00000003c0)=""/89, 0x59}], 0x1, &(0x7f00000004c0)=""/3, 0x3}, 0x100) close(r1) 2018/04/07 06:24:28 executing program 0: clone(0x0, &(0x7f0000659ffe), &(0x7f00003c6ffc), &(0x7f0000a2effc), &(0x7f00007c4000)) wait4(0x0, &(0x7f0000ec8ffc), 0x80000000, &(0x7f0000edc000)) 2018/04/07 06:24:28 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'ip_vti0\x00', &(0x7f0000000080)=@ethtool_eee={0x45}}) 2018/04/07 06:24:28 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)=@ipv6_newroute={0x30, 0x18, 0x0, 0x0, 0x0, {0xa}, [@RTA_PREF={0x8, 0x14}, @RTA_MULTIPATH={0xc, 0x9, [{}]}]}, 0x30}, 0x1}, 0x0) 2018/04/07 06:24:28 executing program 3: r0 = socket$inet6(0xa, 0x1000000000000006, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) listen(r0, 0x5eb855) r1 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r1, &(0x7f0000772000)={0x2, 0x4e23}, 0x10) sendmmsg(r1, &(0x7f0000003b80)=[{{&(0x7f0000000240)=@un=@file={0x0, './file0\x00'}, 0x80, &(0x7f00000016c0), 0x0, &(0x7f0000002900)}}, {{&(0x7f0000001740)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes)\x00'}, 0x80, &(0x7f0000001880), 0x37c, &(0x7f00000018c0)=[{0x10, 0x10d}], 0x10}}], 0x2, 0x0) 2018/04/07 06:24:28 executing program 6: r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f00004ee000)=@req={0x200, 0x0, 0x3, 0x3}, 0x32f) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000040), 0x4) sendmsg$key(r0, &(0x7f00005af000)={0x0, 0x0, &(0x7f00003f1000)={&(0x7f00007b1000)={0x2, 0x0, 0x0, 0x0, 0xffffffffffffff26}, 0x2114}, 0x1}, 0x0) 2018/04/07 06:24:28 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000f65000)=0x3fb, 0x4) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00004aaffc)=0x6, 0x4) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0xfffffefffffffffe, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) 2018/04/07 06:24:28 executing program 7: r0 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000000)={0x73, 0x79, 0x7a}, 0x0, 0x0, r0) r2 = add_key$user(&(0x7f00003bd000)='user\x00', &(0x7f0000a00000)={0x73, 0x79, 0x7a}, &(0x7f0000facfff)="01", 0x1, r1) r3 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000752ffb)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000001c0), 0x330, r1) keyctl$dh_compute(0x17, &(0x7f0000000180)={r2, r3, r3}, &(0x7f0000a53ffb)=""/5, 0x5, &(0x7f0000000100)={&(0x7f0000000140)={'crc32c-intel\x00'}}) 2018/04/07 06:24:28 executing program 1: r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, 0x0, 0x3, [{{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}, {{0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}}}, {{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}]}, 0x20c) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000a83000)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}, {{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}}, 0x108) 2018/04/07 06:24:28 executing program 3: r0 = socket$inet6(0xa, 0x1000000000000006, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23}, 0x1c) listen(r0, 0x5eb855) r1 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r1, &(0x7f0000772000)={0x2, 0x4e23}, 0x10) sendmmsg(r1, &(0x7f0000003b80)=[{{&(0x7f0000000240)=@un=@file={0x0, './file0\x00'}, 0x80, &(0x7f00000016c0), 0x0, &(0x7f0000002900)}}, {{&(0x7f0000001740)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes)\x00'}, 0x80, &(0x7f0000001880), 0x37c, &(0x7f00000018c0)=[{0x10, 0x10d}], 0x10}}], 0x2, 0x0) 2018/04/07 06:24:29 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)=@ipv6_newroute={0x30, 0x18, 0x0, 0x0, 0x0, {0xa}, [@RTA_PREF={0x8, 0x14}, @RTA_MULTIPATH={0xc, 0x9, [{}]}]}, 0x30}, 0x1}, 0x0) 2018/04/07 06:24:29 executing program 6: r0 = socket$kcm(0x29, 0x2, 0x0) sendmmsg(r0, &(0x7f000000ab00)=[{{&(0x7f0000000080)=@in={0x2, 0x0, @broadcast=0xffffffff}, 0xff33, &(0x7f000000a280), 0x0, &(0x7f0000000040)}}, {{&(0x7f000000a440)=@can={0x1d}, 0x10, &(0x7f000000a5c0), 0x3a5, &(0x7f000000a600)}, 0x3}], 0x2, 0x0) 2018/04/07 06:24:29 executing program 7: r0 = socket(0x100000001e, 0x1, 0x0) setsockopt(r0, 0x10f, 0x7f, &(0x7f0000f76ffa)="f1ffffff", 0x4) 2018/04/07 06:24:29 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000f65000)=0x3fb, 0x4) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00004aaffc)=0x6, 0x4) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0xfffffefffffffffe, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) 2018/04/07 06:24:29 executing program 1: r0 = syz_open_dev$tun(&(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x101}) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000040)) 2018/04/07 06:24:29 executing program 0: r0 = socket$inet6(0xa, 0x2000000000001, 0x0) getsockopt$inet6_tcp_int(r0, 0x6, 0x10, &(0x7f0000000000), &(0x7f0000000180)=0x4) 2018/04/07 06:24:29 executing program 4: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$packet(0x11, 0x800000000002, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10) sendto$inet(r0, &(0x7f0000762fff), 0xfdc7, 0x0, &(0x7f000057bff0)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) recvmmsg(r1, &(0x7f0000001b40)=[{{&(0x7f00000019c0)=@nfc, 0x80, &(0x7f0000001a40), 0x0, &(0x7f0000001a80)=""/148, 0x94}}], 0x1, 0x0, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xe0000001}, 0x10) 2018/04/07 06:24:29 executing program 3: r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000fc7ff0)={0x0, 0x2710}, 0x10) recvmmsg(r0, &(0x7f0000fc5fc7)=[{{0x0, 0x0, &(0x7f000062cfe0), 0x0, &(0x7f0000fc1f6e)=""/146, 0x92}}], 0x1, 0x0, 0x0) [ 65.159410] Trying to set illegal importance in message 2018/04/07 06:24:29 executing program 0: r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000540)='oom_adj\x00') exit(0x0) writev(r1, &(0x7f0000b97000)=[{&(0x7f0000962000)='5', 0x1}], 0x1) 2018/04/07 06:24:29 executing program 6: r0 = socket$kcm(0x29, 0x2, 0x0) sendmmsg(r0, &(0x7f000000ab00)=[{{&(0x7f0000000080)=@in={0x2, 0x0, @broadcast=0xffffffff}, 0xff33, &(0x7f000000a280), 0x0, &(0x7f0000000040)}}, {{&(0x7f000000a440)=@can={0x1d}, 0x10, &(0x7f000000a5c0), 0x3a5, &(0x7f000000a600)}, 0x3}], 0x2, 0x0) 2018/04/07 06:24:29 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)=@ipv6_newroute={0x30, 0x18, 0x0, 0x0, 0x0, {0xa}, [@RTA_PREF={0x8, 0x14}, @RTA_MULTIPATH={0xc, 0x9, [{}]}]}, 0x30}, 0x1}, 0x0) 2018/04/07 06:24:29 executing program 7: mkdir(&(0x7f0000b17ff8)='./file0\x00', 0x0) r0 = open(&(0x7f0000aa0000)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$dupfd(r0, 0x800000000402, 0xffffffffffffffff) r1 = openat(0xffffffffffffff9c, &(0x7f00004e2ff8)='./file0\x00', 0x0, 0x0) r2 = fcntl$dupfd(r1, 0x402, 0xffffffffffffffff) fcntl$dupfd(r0, 0x280000000000402, r2) 2018/04/07 06:24:29 executing program 3: r0 = socket$inet(0x2, 0x3, 0x800000000000b) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000000c0)=@nat={'nat\x00', 0x19, 0x3, 0x58c, [0x20000240, 0x0, 0x0, 0x2000063c, 0x2000079c], 0x0, &(0x7f0000000080), &(0x7f0000000240)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, [{{{0x5, 0x0, 0x0, 'ip6tnl0\x00', 'ip6_vti0\x00', 'lo\x00', 'ipddp0\x00', @empty, [], @link_local={0x1, 0x80, 0xc2}, [], 0x148, 0x178, 0x2a4, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x0, 0x0, 0x0, 0x0, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}}}}, @stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], 0x0, 0x0, 0x0, 0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}}}}]}, [@snat={'snat\x00', 0xc, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}}}]}, @common=@SECMARK={'SECMARK\x00', 0x108, {{0x0, 0x0, 'system_u:object_r:v4l_device_t:s0\x00'}}}}, {{{0x9, 0x0, 0x0, 'ip6gre0\x00', 'dummy0\x00', 'vlan0\x00', 'sit0\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0xf8, 0xf8, 0x128, [@connbytes={'connbytes\x00', 0x18}, @ipvs={'ipvs\x00', 0x28, {{@ipv4=@remote={0xac, 0x14, 0x14, 0xbb}}}}]}}, @arpreply={'arpreply\x00', 0xc, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe, 0x1, [{{{0x9, 0x0, 0x0, "697036746e6c300000008000", 'dummy0\x00', 'teql0\x00', 'rose0\x00', @link_local={0x1, 0x80, 0xc2}, [], @empty, [], 0xac, 0x100, 0x130, [@limit={'limit\x00', 0x18}]}, [@common=@AUDIT={'AUDIT\x00', 0x4}, @common=@mark={'mark\x00', 0x8}]}, @snat={'snat\x00', 0xc, {{@random="29e7beb3a774"}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe}]}, 0x650) 2018/04/07 06:24:29 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000f65000)=0x3fb, 0x4) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00004aaffc)=0x6, 0x4) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0xfffffefffffffffe, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) 2018/04/07 06:24:29 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) sendto$inet6(r0, &(0x7f0000001a40)="81", 0x1, 0x0, &(0x7f0000001a00)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x6}, 0x1c) sendmmsg(r0, &(0x7f0000e8e000)=[{{&(0x7f00008b6000)=@in6={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xffffffffffffffff}, 0x1}, 0x80, &(0x7f0000231ff0)=[{&(0x7f0000f89000)='t', 0x1}], 0x1, &(0x7f0000dffeb8)}}], 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00006a7ffc), 0x4) 2018/04/07 06:24:29 executing program 7: r0 = socket$inet6(0xa, 0x3, 0x4000000000084) connect$inet6(r0, &(0x7f000000cfe4)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x9}, 0x1c) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480), 0x0, &(0x7f0000000000)}, 0xc100) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001000)="8e", 0x1}], 0x1, &(0x7f0000002000)}, 0x8000) recvmsg(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000840), 0x0, &(0x7f0000001000)=""/4096, 0x1000}, 0x0) sendmsg(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000002ff0)=[{&(0x7f0000000100)="bc", 0x1}], 0x1, &(0x7f000000ae80)}, 0x0) 2018/04/07 06:24:29 executing program 3: getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00005c3ff0)={0x0, 0xffffffffffffff5b, &(0x7f0000519fa8)=[@in6={0xa, 0x0, 0x0, @empty, 0x5}]}, &(0x7f0000f91ffc)=0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x5, &(0x7f0000519fa8)=@framed={{0x18}, [@alu={0x1, 0x0, 0x6, 0x0, 0x0, 0x27}], {0x95}}, &(0x7f0000000080)="73597a6b618f6c65000d", 0x8000, 0x1000, &(0x7f0000b6d000)=""/4096, 0x0, 0x1}, 0x48) 2018/04/07 06:24:29 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)=@ipv6_newroute={0x28, 0x18, 0x121, 0x0, 0x0, {0xa}, [@RTA_MULTIPATH={0xc, 0x9, [{}]}]}, 0x28}, 0x1}, 0x0) 2018/04/07 06:24:30 executing program 6: r0 = socket$kcm(0x29, 0x2, 0x0) sendmmsg(r0, &(0x7f000000ab00)=[{{&(0x7f0000000080)=@in={0x2, 0x0, @broadcast=0xffffffff}, 0xff33, &(0x7f000000a280), 0x0, &(0x7f0000000040)}}, {{&(0x7f000000a440)=@can={0x1d}, 0x10, &(0x7f000000a5c0), 0x3a5, &(0x7f000000a600)}, 0x3}], 0x2, 0x0) 2018/04/07 06:24:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x200000002, 0x78, 0xc568, 0x100000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key(&(0x7f0000000080)='asymmetric\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a}, &(0x7f0000000100), 0x0, 0xfffffffffffffffd) 2018/04/07 06:24:30 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00004aaffc)=0x6, 0x4) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0xfffffefffffffffe, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) 2018/04/07 06:24:30 executing program 3: clone(0x200, &(0x7f0000151000), &(0x7f0000000080), &(0x7f0000f8b000), &(0x7f0000000100)) mknod(&(0x7f0000b75ff8)='./file0\x00', 0x2001001, 0x0) execve(&(0x7f0000f8aff8)='./file0\x00', &(0x7f0000000240), &(0x7f0000000140)) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') preadv(r0, &(0x7f0000000040)=[{&(0x7f00006f0000)=""/154, 0x9a}], 0x1, 0x0) lseek(r0, 0x0, 0x0) creat(&(0x7f0000b7a000)='./file0\x00', 0x0) 2018/04/07 06:24:30 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)=@ipv6_newroute={0x28, 0x18, 0x121, 0x0, 0x0, {0xa}, [@RTA_MULTIPATH={0xc, 0x9, [{}]}]}, 0x28}, 0x1}, 0x0) 2018/04/07 06:24:30 executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv4_newaddr={0x50, 0x14, 0x11, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r1}, [@IFA_LOCAL={0x8, 0x2, @local={0xac, 0x14, 0x14, 0xaa}}, @IFA_BROADCAST={0x8, 0x4, @rand_addr}, @IFA_CACHEINFO={0x14, 0x6, {0x0, 0xfffffffffffffff9}}, @IFA_LABEL={0x14, 0x3, 'ipddp0\x00'}]}, 0x50}, 0x1}, 0x0) 2018/04/07 06:24:30 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000efdffc)=0x1, 0xd2) sendto$inet(r0, &(0x7f0000a63fff), 0x0, 0x20020004, &(0x7f0000385ff0)={0x2, 0x0, @loopback=0x7f000001}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000040)=[{}, {}, {}, {0x3, 0x80000001}, {}], 0x33) 2018/04/07 06:24:30 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv4_newaddr={0x50, 0x14, 0x11, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r1}, [@IFA_LOCAL={0x8, 0x2, @local={0xac, 0x14, 0x14, 0xaa}}, @IFA_BROADCAST={0x8, 0x4, @rand_addr}, @IFA_CACHEINFO={0x14, 0x6}, @IFA_LABEL={0x14, 0x3, 'ipddp0\x00'}]}, 0x50}, 0x1}, 0x0) 2018/04/07 06:24:30 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000616ff8)={0xffffffffffffffff, 0xffffffffffffffff}) setrlimit(0x7, &(0x7f0000a9cff8)) sendmsg$unix(r2, &(0x7f0000bba000)={&(0x7f0000c57ff8)=@abs, 0x8, &(0x7f00006c6ff0), 0x0, &(0x7f00009dffb8)=[@rights={0x18, 0x1, 0x1, [r0]}], 0x18}, 0x0) recvmsg(r1, &(0x7f00003d6fc8)={&(0x7f0000698000)=@generic, 0x80, &(0x7f000081afd0), 0x0, &(0x7f0000f9fff8)=""/90, 0x5a}, 0x0) 2018/04/07 06:24:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x78, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='oom_score_adj\x00') writev(r0, &(0x7f000000a000)=[{&(0x7f0000000080)='+0', 0x2}], 0x1) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 2018/04/07 06:24:31 executing program 7: r0 = socket(0x10, 0x802, 0x0) write(r0, &(0x7f0000000000)="24000000210025f0071c0165ff0ffc0e020000000010000002e1080c08000b002ca72c44", 0x24) 2018/04/07 06:24:31 executing program 6: r0 = socket$kcm(0x29, 0x2, 0x0) sendmmsg(r0, &(0x7f000000ab00)=[{{&(0x7f0000000080)=@in={0x2, 0x0, @broadcast=0xffffffff}, 0xff33, &(0x7f000000a280), 0x0, &(0x7f0000000040)}}, {{&(0x7f000000a440)=@can={0x1d}, 0x10, &(0x7f000000a5c0), 0x3a5, &(0x7f000000a600)}, 0x3}], 0x2, 0x0) 2018/04/07 06:24:31 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)=@ipv6_newroute={0x28, 0x18, 0x121, 0x0, 0x0, {0xa}, [@RTA_MULTIPATH={0xc, 0x9, [{}]}]}, 0x28}, 0x1}, 0x0) 2018/04/07 06:24:31 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00002f5ff8)={0xffffffffffffffff}) bind$unix(r1, &(0x7f0000968ff6)=@file={0x1, './file0\x00'}, 0xa) connect$unix(r1, &(0x7f00000bc000)=@abs, 0x8) connect$unix(r0, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) 2018/04/07 06:24:31 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0x9, 0x4000000000080, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f000051e000)={r0, &(0x7f0000fc5000), &(0x7f0000950000)}, 0x20) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') pread64(r1, &(0x7f0000015000), 0x0, 0x2000000000) 2018/04/07 06:24:31 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x48, &(0x7f0000000100)=0xc84e, 0x4) 2018/04/07 06:24:31 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00004aaffc)=0x6, 0x4) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0xfffffefffffffffe, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) 2018/04/07 06:24:31 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)=@ipv6_newroute={0x24, 0x18, 0x121, 0x0, 0x0, {0xa}, [@RTA_PREF={0x8, 0x14}]}, 0x24}, 0x1}, 0x0) 2018/04/07 06:24:31 executing program 4: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x20000000000002}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000d65000)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f00004ca000)={&(0x7f0000000040)={0x14, 0xd, 0x6, 0x1}, 0x14}, 0x1}, 0x0) 2018/04/07 06:24:31 executing program 2: perf_event_open(&(0x7f0000271000)={0x2, 0x70, 0x49, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00004aaffc)=0x6, 0x4) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0xfffffefffffffffe, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000d1b252)) 2018/04/07 06:24:31 executing program 7: r0 = add_key(&(0x7f0000001240)='big_key\x00', &(0x7f0000001280)={0x73, 0x79, 0x7a}, &(0x7f00000012c0)="3192b61395cd5768cb664ff2cb7f9581b11cba2820373315a8d103c544aa520315305574dc5c4ca85ac68265c3092ca69ac61b8cdafa29cd8f03c5c0d8d38d55873b864fb0eaf1d8bd3834880e8ed251b257709b66fc8146bb377da4f9240450f125e695087c8faa6ceed4716ca078662bb2679bc6eaf90207a09079342d5b4e30acde2692e1cb8901dd6d2d449f79c1f0061026c0788bfad16d8bbfc1e83f829e52910f89fdda0ea0f57495c54cfeefaae96b089befd0b57d8e9400bf7c0f35ceeeb67b1f8a08b03fa865e2e667cc0b09f6a15553909150fede4d02162d261114a8fa6e941e08c060d5eff515089ccfc765a452e3cb7ae866aeeef526e8052f84e864a3be5f6938b96d601ca9e4d29da72bde87432ce10692b631e865c28623e5de0b6ee7bfd007431be9908bc7e27019eb8156df49928b6bd5c34a5f477b537b3e3ccdf2860470625d0f53b8c19faf73a73b94f9793ae43aa4b72da7988be64da2d51057c9c2695ae018981a657aa4cb69e96b017d5082b8b9afc660099b05994619d680207dfb69b1f08916b130a9147c833032a01f1666e2518caed7ccaff15257043e74cef0ffb4ab9aad2bd8a8573a2c2c90bb36842a312052158d4a943a48fc1fabda436d913239921cbeda4af92eb153795a00f19644f406df2ec72c0b2dc254f50eba1ff5d8d0dbddeb161ed39ff6f11688203e594e3fd6568bb20ee053fd186c7d39fff8c35596816c1b15dfb1227ca145207d09dc10abe3a9cfcac56bd42d9d0ede14171fb54727d9ab386de99d22d2b34a87727e3cd751653cb23281bb5273782cd427f133c471c34014aa918d0d9458b76326767be67f5ed1d0412abbd06151e1064a899683ac3d193c0308caf5478ade6a3a5da55d426d6990d520dec6c74e26aa493b1f73d08cb036cbb5d2f4d1aaed0cff2f71c85ca307b8e49acc341b2478dc4f9a6a5f1b81287e0662eebe01bfba8a277d58a5bfb27ccacd3ecf34a82066a372fea28cf28df37547a1e4c209a5dd4a0e21ab6dbf780c0af7d855433444e302ce037238a558f0b7321c5383cd80098c8d809791c31c6eb47165ae7feff197c134cee40522547a5df74c5c98083c32b68e8cc4151291a2e903952c4206aaf560256fbef712afb5d9c166c028be2e5fdcf36522cc754deac0e167583241db73ab5c617351dfed340418d6d39e1eed61938216e75aad77f3c5fd0f344b6cfe9171d1869325ca52fb79fb20b1fffd425774bc7c72fb453360fe1a0e77b2b51891228624ee302525dd827b5677bd1059d991800c857fba4be02b740883c57ad51b4f6a0e832989fc527a601f2ec5ad5508b38007c712f8a6687621db724587c329146a4015730b3a564734b7a9d1b2f8a21e5d22c502968e938dbb617865e387a146fbfeabc11ff02121867a0887e3545b49e41f9020107107e10a892191f79b700940381b45bd9cc4c5ef9d913f3b2675c1f25520f9936de9b5a6f36c07734baac3e9c81fe0d3ecdc9b18b5e8a59c079b8ba41a759d26dadbc10683bbb637794e54b4c341ffb78c6cbe5fd7596eba621accfa9c38cadc92fb155815ef3f1b58ec5a56d7ac69c6c88cd2761f8cd6908d7b9a4de23176cf9a1cc1e5d04d4e0edb576f9472c39ad5f16bcee8b7314a65ff9f04a0c2fb3f9661d7100336a9ea363d2d0183b3d1f742fb5f8bbc0115171e323941c6e5f502875bcc94a41bf090178f5c533d178a744f11e36b7f", 0x4d1, 0xfffffffffffffffc) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) keyctl$read(0xb, r0, &(0x7f00000022c0)=""/4096, 0x1000) 2018/04/07 06:24:31 executing program 6: sendmmsg(0xffffffffffffffff, &(0x7f000000ab00)=[{{&(0x7f0000000080)=@in={0x2, 0x0, @broadcast=0xffffffff}, 0xff33, &(0x7f000000a280), 0x0, &(0x7f0000000040)}}, {{&(0x7f000000a440)=@can={0x1d}, 0x10, &(0x7f000000a5c0), 0x3a5, &(0x7f000000a600)}, 0x3}], 0x2, 0x0) 2018/04/07 06:24:31 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000b5dfa8)={0x26, 'hash\x00', 0x0, 0x0, 'wp512\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) r2 = open(&(0x7f00004b8ff8)='./file0\x00', 0x28042, 0x0) fallocate(r2, 0x0, 0x0, 0x73e0) sendfile(r1, r2, &(0x7f0000145000), 0x7dd) 2018/04/07 06:24:31 executing program 1: syz_emit_ethernet(0x42, &(0x7f00000000c0)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], {@ipv4={0x800, {{0x9, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=0x2ad9ed40, @local={0xac, 0x14, 0x14, 0xaa}, {[@rr={0x7, 0xf, 0x9, [@broadcast=0xffffffff, @empty, @multicast2=0xe0000002]}]}}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "f77a48", 0x0, "9a5cc6"}}}}}}, &(0x7f0000000180)) 2018/04/07 06:24:31 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0x9, 0x4000000000080, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f000051e000)={r0, &(0x7f0000fc5000), &(0x7f0000950000)}, 0x20) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') pread64(r1, &(0x7f0000015000), 0x0, 0x2000000000) [ 67.829289] netlink: 'syz-executor5': attribute type 20 has an invalid length. [ 67.994511] ================================================================== [ 68.001952] BUG: KMSAN: uninit-value in wp512_process_buffer+0x4ad5/0x4d90 [ 68.008993] CPU: 1 PID: 5617 Comm: syz-executor0 Not tainted 4.16.0+ #81 [ 68.015824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 68.025174] Call Trace: [ 68.027766] dump_stack+0x185/0x1d0 [ 68.031404] ? wp512_process_buffer+0x4ad5/0x4d90 [ 68.036252] kmsan_report+0x142/0x240 [ 68.040059] __msan_warning_32+0x6c/0xb0 [ 68.044130] wp512_process_buffer+0x4ad5/0x4d90 [ 68.048806] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 68.054264] ? get_page_from_freelist+0xab28/0xb600 [ 68.059288] ? save_stack_trace+0xa5/0xf0 [ 68.063437] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 68.068893] ? update_stack_state+0x885/0xa40 [ 68.073399] ? entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 68.078764] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 68.084219] ? update_stack_state+0x885/0xa40 [ 68.088728] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 68.089334] netlink: 'syz-executor5': attribute type 20 has an invalid length. [ 68.094092] ? is_bpf_text_address+0xb4/0x4b0 [ 68.094110] ? __is_insn_slot_addr+0x198/0x1c0 [ 68.094130] ? kernel_text_address+0x34d/0x3a0 [ 68.094150] ? __kernel_text_address+0x34/0xe0 [ 68.094167] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 68.094184] ? __save_stack_trace+0x893/0xa80 [ 68.094205] ? entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 68.094221] ? save_stack_trace+0xa5/0xf0 [ 68.094235] ? __irqentry_text_end+0x1fb47e/0x1fb47e [ 68.094247] ? kmsan_internal_chain_origin+0x1d3/0x210 [ 68.094275] ? kmsan_internal_chain_origin+0x12b/0x210 [ 68.154829] ? __msan_chain_origin+0x69/0xc0 [ 68.159247] ? wp512_update+0x76c/0xc40 [ 68.163228] ? shash_finup_unaligned+0x202/0x3f0 [ 68.167985] ? shash_ahash_finup+0x468/0xa30 [ 68.172392] ? shash_ahash_digest+0x5c6/0x600 [ 68.176885] ? shash_async_digest+0x11c/0x1b0 [ 68.181383] ? crypto_ahash_op+0x89a/0xc10 [ 68.185624] ? crypto_ahash_digest+0xe4/0x160 [ 68.190118] ? hash_sendpage+0xb40/0xe10 [ 68.194183] ? sock_sendpage+0x1de/0x2c0 [ 68.198250] ? pipe_to_sendpage+0x31b/0x430 [ 68.202576] ? __splice_from_pipe+0x49a/0xf30 [ 68.207077] ? generic_splice_sendpage+0x1c6/0x2a0 [ 68.212018] ? direct_splice_actor+0x19b/0x200 [ 68.216612] ? splice_direct_to_actor+0x764/0x1040 [ 68.221546] ? do_splice_direct+0x335/0x540 [ 68.225871] ? do_sendfile+0x1067/0x1e40 [ 68.229936] ? SYSC_sendfile64+0x1b3/0x300 [ 68.234173] ? SyS_sendfile64+0x64/0x90 [ 68.238151] ? do_syscall_64+0x309/0x430 2018/04/07 06:24:32 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000840)={&(0x7f0000000780)=@ipv6_newroute={0x24, 0x18, 0x121, 0x0, 0x0, {0xa}, [@RTA_PREF={0x8, 0x14}]}, 0x24}, 0x1}, 0x0) [ 68.242215] ? entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 68.247580] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 68.252944] ? is_bpf_text_address+0xb4/0x4b0 [ 68.257443] ? __is_insn_slot_addr+0x198/0x1c0 [ 68.262031] ? kernel_text_address+0x34d/0x3a0 [ 68.266619] ? apic_timer_interrupt+0xa/0x20 [ 68.271042] wp512_update+0x5f4/0xc40 [ 68.274850] ? wp512_init+0xf0/0xf0 [ 68.278478] shash_finup_unaligned+0x202/0x3f0 [ 68.283060] ? crypto_shash_finup+0x520/0x520 [ 68.287550] shash_ahash_finup+0x468/0xa30 [ 68.291793] shash_ahash_digest+0x5c6/0x600 [ 68.296118] shash_async_digest+0x11c/0x1b0 [ 68.300452] crypto_ahash_op+0x89a/0xc10 [ 68.304524] ? __kmalloc+0x23c/0x350 [ 68.308243] ? shash_async_finup+0x1b0/0x1b0 [ 68.312653] ? shash_async_finup+0x1b0/0x1b0 [ 68.317063] crypto_ahash_digest+0xe4/0x160 [ 68.321385] hash_sendpage+0xb40/0xe10 [ 68.325281] ? hash_recvmsg+0xd50/0xd50 [ 68.329263] sock_sendpage+0x1de/0x2c0 [ 68.333159] pipe_to_sendpage+0x31b/0x430 [ 68.337313] ? sock_fasync+0x2b0/0x2b0 [ 68.341212] ? propagate_umount+0x3a30/0x3a30 [ 68.345711] __splice_from_pipe+0x49a/0xf30 [ 68.350032] ? generic_splice_sendpage+0x2a0/0x2a0 [ 68.354965] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 68.360330] generic_splice_sendpage+0x1c6/0x2a0 [ 68.365092] ? iter_file_splice_write+0x1710/0x1710 [ 68.370119] ? iter_file_splice_write+0x1710/0x1710 [ 68.375143] direct_splice_actor+0x19b/0x200 [ 68.379557] splice_direct_to_actor+0x764/0x1040 [ 68.384318] ? do_splice_direct+0x540/0x540 [ 68.388647] ? security_file_permission+0x28f/0x4b0 [ 68.393666] ? rw_verify_area+0x35e/0x580 [ 68.397820] do_splice_direct+0x335/0x540 [ 68.401971] do_sendfile+0x1067/0x1e40 [ 68.405890] SYSC_sendfile64+0x1b3/0x300 [ 68.409955] SyS_sendfile64+0x64/0x90 [ 68.413753] do_syscall_64+0x309/0x430 [ 68.417646] ? SYSC_sendfile+0x320/0x320 [ 68.421716] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 68.426898] RIP: 0033:0x455259 [ 68.430077] RSP: 002b:00007f83a0172c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 68.437762] RAX: ffffffffffffffda RBX: 00007f83a01736d4 RCX: 0000000000455259 [ 68.445020] RDX: 0000000020145000 RSI: 0000000000000015 RDI: 0000000000000014 [ 68.452280] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 68.459541] R10: 00000000000007dd R11: 0000000000000246 R12: 00000000ffffffff [ 68.466791] R13: 00000000000004c6 R14: 00000000006fa330 R15: 0000000000000000 [ 68.474046] [ 68.475653] Uninit was stored to memory at: [ 68.479969] kmsan_internal_chain_origin+0x12b/0x210 [ 68.485057] __msan_chain_origin+0x69/0xc0 [ 68.489282] wp512_update+0x76c/0xc40 [ 68.493072] shash_finup_unaligned+0x202/0x3f0 [ 68.497640] shash_ahash_finup+0x468/0xa30 [ 68.501850] shash_ahash_digest+0x5c6/0x600 [ 68.506148] shash_async_digest+0x11c/0x1b0 [ 68.510448] crypto_ahash_op+0x89a/0xc10 [ 68.514486] crypto_ahash_digest+0xe4/0x160 [ 68.518786] hash_sendpage+0xb40/0xe10 [ 68.522664] sock_sendpage+0x1de/0x2c0 [ 68.526541] pipe_to_sendpage+0x31b/0x430 [ 68.530681] __splice_from_pipe+0x49a/0xf30 [ 68.535010] generic_splice_sendpage+0x1c6/0x2a0 [ 68.539756] direct_splice_actor+0x19b/0x200 [ 68.544144] splice_direct_to_actor+0x764/0x1040 [ 68.548879] do_splice_direct+0x335/0x540 [ 68.553010] do_sendfile+0x1067/0x1e40 [ 68.556885] SYSC_sendfile64+0x1b3/0x300 [ 68.560925] SyS_sendfile64+0x64/0x90 [ 68.564706] do_syscall_64+0x309/0x430 [ 68.568576] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 68.573747] Uninit was created at: [ 68.577264] kmsan_alloc_meta_for_pages+0x161/0x3a0 [ 68.582265] kmsan_alloc_page+0x82/0xe0 [ 68.586224] __alloc_pages_nodemask+0xf5b/0x5dc0 [ 68.590955] alloc_pages_vma+0xcc8/0x1800 [ 68.595080] shmem_alloc_and_acct_page+0x6d5/0x1000 [ 68.600073] shmem_getpage_gfp+0x35db/0x5770 [ 68.604457] shmem_fallocate+0xde2/0x1610 [ 68.608583] vfs_fallocate+0x9dc/0xde0 [ 68.612446] SYSC_fallocate+0x119/0x1d0 [ 68.616397] SyS_fallocate+0x64/0x90 [ 68.620089] do_syscall_64+0x309/0x430 [ 68.623967] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 68.629140] ================================================================== [ 68.636477] Disabling lock debugging due to kernel taint [ 68.641916] Kernel panic - not syncing: panic_on_warn set ... [ 68.641916] [ 68.650307] CPU: 1 PID: 5617 Comm: syz-executor0 Tainted: G B 4.16.0+ #81 [ 68.658429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 68.667765] Call Trace: [ 68.670350] dump_stack+0x185/0x1d0 [ 68.673961] panic+0x39d/0x940 [ 68.677166] ? wp512_process_buffer+0x4ad5/0x4d90 [ 68.682000] kmsan_report+0x238/0x240 [ 68.685791] __msan_warning_32+0x6c/0xb0 [ 68.689832] wp512_process_buffer+0x4ad5/0x4d90 [ 68.694483] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 68.699923] ? get_page_from_freelist+0xab28/0xb600 [ 68.704939] ? save_stack_trace+0xa5/0xf0 [ 68.709077] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 68.714518] ? update_stack_state+0x885/0xa40 [ 68.719002] ? entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 68.724357] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 68.729797] ? update_stack_state+0x885/0xa40 [ 68.734280] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 68.739624] ? is_bpf_text_address+0xb4/0x4b0 [ 68.744106] ? __is_insn_slot_addr+0x198/0x1c0 [ 68.748674] ? kernel_text_address+0x34d/0x3a0 [ 68.753244] ? __kernel_text_address+0x34/0xe0 [ 68.757809] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 68.763244] ? __save_stack_trace+0x893/0xa80 [ 68.767828] ? entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 68.773176] ? save_stack_trace+0xa5/0xf0 [ 68.777308] ? __irqentry_text_end+0x1fb47e/0x1fb47e [ 68.782394] ? kmsan_internal_chain_origin+0x1d3/0x210 [ 68.787657] ? kmsan_internal_chain_origin+0x12b/0x210 [ 68.792915] ? __msan_chain_origin+0x69/0xc0 [ 68.797308] ? wp512_update+0x76c/0xc40 [ 68.801265] ? shash_finup_unaligned+0x202/0x3f0 [ 68.806005] ? shash_ahash_finup+0x468/0xa30 [ 68.810398] ? shash_ahash_digest+0x5c6/0x600 [ 68.814876] ? shash_async_digest+0x11c/0x1b0 [ 68.819356] ? crypto_ahash_op+0x89a/0xc10 [ 68.823585] ? crypto_ahash_digest+0xe4/0x160 [ 68.828066] ? hash_sendpage+0xb40/0xe10 [ 68.832114] ? sock_sendpage+0x1de/0x2c0 [ 68.836164] ? pipe_to_sendpage+0x31b/0x430 [ 68.840473] ? __splice_from_pipe+0x49a/0xf30 [ 68.844957] ? generic_splice_sendpage+0x1c6/0x2a0 [ 68.849871] ? direct_splice_actor+0x19b/0x200 [ 68.854450] ? splice_direct_to_actor+0x764/0x1040 [ 68.859364] ? do_splice_direct+0x335/0x540 [ 68.863665] ? do_sendfile+0x1067/0x1e40 [ 68.867727] ? SYSC_sendfile64+0x1b3/0x300 [ 68.871944] ? SyS_sendfile64+0x64/0x90 [ 68.875899] ? do_syscall_64+0x309/0x430 [ 68.879943] ? entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 68.885291] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 68.890639] ? is_bpf_text_address+0xb4/0x4b0 [ 68.895119] ? __is_insn_slot_addr+0x198/0x1c0 [ 68.899689] ? kernel_text_address+0x34d/0x3a0 [ 68.904257] ? apic_timer_interrupt+0xa/0x20 [ 68.908655] wp512_update+0x5f4/0xc40 [ 68.912451] ? wp512_init+0xf0/0xf0 [ 68.916061] shash_finup_unaligned+0x202/0x3f0 [ 68.920627] ? crypto_shash_finup+0x520/0x520 [ 68.925106] shash_ahash_finup+0x468/0xa30 [ 68.929332] shash_ahash_digest+0x5c6/0x600 [ 68.933639] shash_async_digest+0x11c/0x1b0 [ 68.937947] crypto_ahash_op+0x89a/0xc10 [ 68.941991] ? __kmalloc+0x23c/0x350 [ 68.945691] ? shash_async_finup+0x1b0/0x1b0 [ 68.950083] ? shash_async_finup+0x1b0/0x1b0 [ 68.954479] crypto_ahash_digest+0xe4/0x160 [ 68.958788] hash_sendpage+0xb40/0xe10 [ 68.962662] ? hash_recvmsg+0xd50/0xd50 [ 68.966619] sock_sendpage+0x1de/0x2c0 [ 68.970493] pipe_to_sendpage+0x31b/0x430 [ 68.974621] ? sock_fasync+0x2b0/0x2b0 [ 68.978492] ? propagate_umount+0x3a30/0x3a30 [ 68.982973] __splice_from_pipe+0x49a/0xf30 [ 68.987283] ? generic_splice_sendpage+0x2a0/0x2a0 [ 68.992200] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 68.997549] generic_splice_sendpage+0x1c6/0x2a0 [ 69.002293] ? iter_file_splice_write+0x1710/0x1710 [ 69.007296] ? iter_file_splice_write+0x1710/0x1710 [ 69.012300] direct_splice_actor+0x19b/0x200 [ 69.016703] splice_direct_to_actor+0x764/0x1040 [ 69.021444] ? do_splice_direct+0x540/0x540 [ 69.025751] ? security_file_permission+0x28f/0x4b0 [ 69.030757] ? rw_verify_area+0x35e/0x580 [ 69.034904] do_splice_direct+0x335/0x540 [ 69.039046] do_sendfile+0x1067/0x1e40 [ 69.042930] SYSC_sendfile64+0x1b3/0x300 [ 69.046978] SyS_sendfile64+0x64/0x90 [ 69.050763] do_syscall_64+0x309/0x430 [ 69.054637] ? SYSC_sendfile+0x320/0x320 [ 69.058683] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [ 69.063858] RIP: 0033:0x455259 [ 69.067030] RSP: 002b:00007f83a0172c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 69.074724] RAX: ffffffffffffffda RBX: 00007f83a01736d4 RCX: 0000000000455259 [ 69.081987] RDX: 0000000020145000 RSI: 0000000000000015 RDI: 0000000000000014 [ 69.089254] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 69.096521] R10: 00000000000007dd R11: 0000000000000246 R12: 00000000ffffffff [ 69.103775] R13: 00000000000004c6 R14: 00000000006fa330 R15: 0000000000000000 [ 69.111527] Dumping ftrace buffer: [ 69.115059] (ftrace buffer empty) [ 69.118758] Kernel Offset: disabled [ 69.122374] Rebooting in 86400 seconds..