[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. Starting mcstransd: [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 29.436428] kauditd_printk_skb: 10 callbacks suppressed [ 29.436442] audit: type=1400 audit(1540057751.769:35): avc: denied { map } for pid=5426 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.0.31' (ECDSA) to the list of known hosts. 2018/10/20 17:49:18 fuzzer started [ 36.092470] audit: type=1400 audit(1540057758.419:36): avc: denied { map } for pid=5437 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2018/10/20 17:49:20 dialing manager at 10.128.0.26:34171 2018/10/20 17:49:20 syscalls: 1 2018/10/20 17:49:20 code coverage: enabled 2018/10/20 17:49:20 comparison tracing: enabled 2018/10/20 17:49:20 setuid sandbox: enabled 2018/10/20 17:49:20 namespace sandbox: enabled 2018/10/20 17:49:20 Android sandbox: /sys/fs/selinux/policy does not exist 2018/10/20 17:49:20 fault injection: enabled 2018/10/20 17:49:20 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/10/20 17:49:20 net packed injection: enabled 2018/10/20 17:49:20 net device setup: enabled 17:51:57 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000000)=0x3, 0x4) [ 195.183822] audit: type=1400 audit(1540057917.519:37): avc: denied { map } for pid=5452 comm="syz-executor0" path="/sys/kernel/debug/kcov" dev="debugfs" ino=93 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 195.283399] IPVS: ftp: loaded support on port[0] = 21 17:51:57 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, &(0x7f0000000040), 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000200)='ip6_vti0\x00', 0x10) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)={0x4, {0x2, 0x4e20, @loopback}, {0x2, 0x4e20, @remote}, {0x2, 0x4e24, @broadcast}, 0xc8, 0x9, 0x2, 0xfd11, 0x0, 0x0, 0x0, 0x0, 0x8}) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, &(0x7f00000000c0)="001f3d3f54d91a646562731998283a6d", 0x10) sendto$inet(r0, &(0x7f0000000140)='n', 0x1, 0x0, &(0x7f0000893ff0), 0x10) [ 195.543659] IPVS: ftp: loaded support on port[0] = 21 17:51:57 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000182000)={&(0x7f0000000000)={0x2, 0x4000000000000d, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, [@sadb_x_policy={0x8, 0x12, 0x0, 0x3, 0x0, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @in=@multicast1}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}}]}, 0x80}}, 0x0) [ 195.803597] IPVS: ftp: loaded support on port[0] = 21 17:51:58 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) write$FUSE_OPEN(r0, &(0x7f0000000040)={0x20, 0x0, 0x3}, 0x20) [ 196.210346] IPVS: ftp: loaded support on port[0] = 21 17:51:58 executing program 4: r0 = epoll_create1(0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000000c0)) write$UHID_CREATE(r1, &(0x7f0000001080)={0x0, 'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000200)=""/11, 0xb}, 0x120) ppoll(&(0x7f0000000100)=[{r0}], 0x1, &(0x7f0000000180)={0x77359400}, &(0x7f00000001c0)={0x6}, 0x8) [ 196.751745] IPVS: ftp: loaded support on port[0] = 21 17:51:59 executing program 5: listen(0xffffffffffffffff, 0x6) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80}}], 0x1, 0x0, &(0x7f0000000140)) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1a1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x80000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000380)) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00'}, 0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x856, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x3, 0x19) connect$inet(r1, &(0x7f00000002c0)={0x2, 0x4e22, @local}, 0x5) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0xfb) setsockopt$inet_tcp_int(r2, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0xfdf6) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000280)='tls\x00', 0x4) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000340)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@dev, @in=@multicast2}}, {{@in6=@dev}, 0x0, @in6=@loopback}}, &(0x7f0000000500)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000540)={{{@in6=@mcast1, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6}}, &(0x7f0000000640)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000800)={{{@in6=@dev, @in6=@mcast2}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000680)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000940)={{{@in=@multicast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000000a40)=0xe8) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000000cc0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000c80)={&(0x7f0000000a80)={0x9c, r3, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [{{0x8, 0x1, r4}, {0x80, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}]}}]}, 0x9c}, 0x1, 0x0, 0x0, 0x4}, 0x20000010) bind$inet(r2, &(0x7f0000738ff0)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000700)={0x0, 0x40000007fff, 0x80000001}, 0x14) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGPGRP(r6, 0x8904, &(0x7f0000000200)) sendto$inet(r2, &(0x7f00000006c0)="b3", 0x1, 0x0, &(0x7f00000007c0)={0x2, 0x4e20, @remote}, 0x10) shutdown(r2, 0x1) [ 197.052040] bridge0: port 1(bridge_slave_0) entered blocking state [ 197.065879] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.083048] device bridge_slave_0 entered promiscuous mode [ 197.275550] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.309714] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.323558] device bridge_slave_1 entered promiscuous mode [ 197.400217] IPVS: ftp: loaded support on port[0] = 21 [ 197.484563] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 197.589441] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 197.693697] bridge0: port 1(bridge_slave_0) entered blocking state [ 197.700257] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.714834] device bridge_slave_0 entered promiscuous mode [ 197.780757] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.812558] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.819821] device bridge_slave_1 entered promiscuous mode [ 197.942766] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 197.953163] bridge0: port 1(bridge_slave_0) entered blocking state [ 197.970548] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.996491] device bridge_slave_0 entered promiscuous mode [ 198.016244] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 198.048271] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 198.129917] bridge0: port 2(bridge_slave_1) entered blocking state [ 198.144443] bridge0: port 2(bridge_slave_1) entered disabled state [ 198.151741] device bridge_slave_1 entered promiscuous mode [ 198.188449] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 198.287079] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 198.383881] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 198.480172] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 198.527578] bridge0: port 1(bridge_slave_0) entered blocking state [ 198.551593] bridge0: port 1(bridge_slave_0) entered disabled state [ 198.560052] device bridge_slave_0 entered promiscuous mode [ 198.608050] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 198.693897] bridge0: port 2(bridge_slave_1) entered blocking state [ 198.700444] bridge0: port 2(bridge_slave_1) entered disabled state [ 198.709209] device bridge_slave_1 entered promiscuous mode [ 198.769396] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 198.794283] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 198.801579] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 198.832136] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 198.888488] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 198.924538] team0: Port device team_slave_0 added [ 198.934438] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 198.945469] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 198.957225] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 198.969020] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 199.046995] bridge0: port 1(bridge_slave_0) entered blocking state [ 199.056570] bridge0: port 1(bridge_slave_0) entered disabled state [ 199.064676] device bridge_slave_0 entered promiscuous mode [ 199.073475] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 199.080712] team0: Port device team_slave_1 added [ 199.211055] bridge0: port 2(bridge_slave_1) entered blocking state [ 199.232012] bridge0: port 2(bridge_slave_1) entered disabled state [ 199.240230] device bridge_slave_1 entered promiscuous mode [ 199.251932] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 199.389615] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 199.420203] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 199.428009] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 199.453070] team0: Port device team_slave_0 added [ 199.470219] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 199.518190] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 199.538960] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 199.555736] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 199.571628] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 199.608219] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 199.623307] team0: Port device team_slave_0 added [ 199.631199] bridge0: port 1(bridge_slave_0) entered blocking state [ 199.641193] bridge0: port 1(bridge_slave_0) entered disabled state [ 199.649265] device bridge_slave_0 entered promiscuous mode [ 199.657125] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 199.667439] team0: Port device team_slave_1 added [ 199.675228] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 199.685935] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 199.734094] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 199.753064] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 199.762160] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 199.782998] team0: Port device team_slave_1 added [ 199.789466] bridge0: port 2(bridge_slave_1) entered blocking state [ 199.796766] bridge0: port 2(bridge_slave_1) entered disabled state [ 199.806850] device bridge_slave_1 entered promiscuous mode [ 199.823281] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 199.860287] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 199.884470] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 199.892430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 199.900390] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 199.933370] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 199.941484] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 199.968541] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 199.984091] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 199.997002] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 200.014871] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 200.023404] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 200.041290] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 200.062423] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 200.069585] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 200.103416] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 200.114129] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 200.133338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 200.146886] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 200.169359] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 200.185343] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 200.200495] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 200.233145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 200.251429] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 200.277827] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 200.305687] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 200.326517] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 200.363751] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 200.378210] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 200.404466] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 200.413072] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 200.434942] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 200.483434] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 200.503532] team0: Port device team_slave_0 added [ 200.614850] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 200.634171] team0: Port device team_slave_1 added [ 200.672436] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 200.717489] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 200.743372] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 200.768908] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 200.812046] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 200.832164] team0: Port device team_slave_0 added [ 200.842105] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 200.865392] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 200.887085] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 200.903465] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 200.998912] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 201.006594] team0: Port device team_slave_1 added [ 201.013659] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 201.032856] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 201.040379] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 201.057306] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 201.083399] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 201.136403] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 201.150067] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 201.173128] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 201.215793] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 201.348279] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 201.453442] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 201.460725] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 201.474088] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 201.499345] bridge0: port 2(bridge_slave_1) entered blocking state [ 201.506133] bridge0: port 2(bridge_slave_1) entered forwarding state [ 201.513739] bridge0: port 1(bridge_slave_0) entered blocking state [ 201.520155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 201.550821] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 201.557783] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 201.581763] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 201.606491] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 201.614109] team0: Port device team_slave_0 added [ 201.620028] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 201.628983] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 201.712158] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 201.741663] team0: Port device team_slave_1 added [ 201.755700] bridge0: port 2(bridge_slave_1) entered blocking state [ 201.762120] bridge0: port 2(bridge_slave_1) entered forwarding state [ 201.768878] bridge0: port 1(bridge_slave_0) entered blocking state [ 201.775326] bridge0: port 1(bridge_slave_0) entered forwarding state [ 201.784753] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 201.882629] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 201.889621] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 201.906484] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 201.994027] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 202.000987] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 202.012999] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 202.159876] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 202.192603] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 202.200707] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 202.225136] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.231525] bridge0: port 2(bridge_slave_1) entered forwarding state [ 202.238298] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.244807] bridge0: port 1(bridge_slave_0) entered forwarding state [ 202.253721] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 202.289341] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 202.332929] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 202.353639] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 202.567328] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 202.582023] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 202.780596] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.787053] bridge0: port 2(bridge_slave_1) entered forwarding state [ 202.793814] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.800458] bridge0: port 1(bridge_slave_0) entered forwarding state [ 202.825339] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 202.936983] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.943483] bridge0: port 2(bridge_slave_1) entered forwarding state [ 202.950154] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.956599] bridge0: port 1(bridge_slave_0) entered forwarding state [ 202.979310] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 203.583673] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 203.599745] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 203.694283] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.700801] bridge0: port 2(bridge_slave_1) entered forwarding state [ 203.707509] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.713932] bridge0: port 1(bridge_slave_0) entered forwarding state [ 203.745615] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 204.622755] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 206.658385] 8021q: adding VLAN 0 to HW filter on device bond0 [ 206.946520] 8021q: adding VLAN 0 to HW filter on device bond0 [ 207.139400] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 207.428661] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 207.548068] 8021q: adding VLAN 0 to HW filter on device bond0 [ 207.648945] 8021q: adding VLAN 0 to HW filter on device bond0 [ 207.663321] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 207.687335] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 207.712611] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 207.975256] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 207.981497] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 207.995222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 208.047335] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 208.103586] 8021q: adding VLAN 0 to HW filter on device bond0 [ 208.121494] 8021q: adding VLAN 0 to HW filter on device team0 [ 208.129716] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 208.510940] 8021q: adding VLAN 0 to HW filter on device team0 [ 208.543398] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 208.564176] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 208.570458] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 208.578981] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 208.593528] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 208.612879] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 208.639915] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 208.742680] 8021q: adding VLAN 0 to HW filter on device bond0 [ 208.993518] 8021q: adding VLAN 0 to HW filter on device team0 [ 209.003701] 8021q: adding VLAN 0 to HW filter on device team0 [ 209.073700] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 209.079977] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 209.093044] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 209.250292] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 209.523885] 8021q: adding VLAN 0 to HW filter on device team0 [ 209.733178] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 209.739529] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 209.753034] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 210.238255] 8021q: adding VLAN 0 to HW filter on device team0 17:52:13 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000001000)=ANY=[@ANYBLOB="7b1af8fffff5000069a2f8ff00000000bf2000000c00000095"], &(0x7f0000000100)='GPL\x00'}, 0x48) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x6) r0 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000788000)=0x2, 0x4) bind$packet(r0, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r0, 0x107, 0x5, &(0x7f0000001000), 0xc5) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x4000100000008912, &(0x7f0000000280)="88f96234488dd25d766070") syz_emit_ethernet(0x56, &(0x7f0000000140)={@broadcast, @local, [], {@canfd={0xd, {{0x1, 0x8, 0x8, 0x5}, 0x3d, 0x3, 0x0, 0x0, "7db7b50cecb21497c1eb8c939a38af3a8f8bd1e96396a15350888dc46b7746c16ac8c59c75d373f6859a955812bb4c00211b87ed8b17f23094f3fb655ff9ade2"}}}}, &(0x7f0000000000)={0x0, 0x0, [0x20]}) [ 211.196298] audit: type=1400 audit(1540057933.529:38): avc: denied { prog_load } for pid=6918 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 17:52:13 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x5, 0x7f, 0x1, 0x3, 0x0, 0xffffffffffffff9c}, 0x21d) r1 = getegid() r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x80000, 0x0) r3 = socket$inet6(0xa, 0x2, 0xdc97) setsockopt$inet_dccp_buf(r2, 0x21, 0x80, &(0x7f00000000c0)="eae8d3b1e52a341b690e3da6f6080cf4c8f8c6eec17f2748c87b651f7b6e9f2162916305edb7726051ae35933b51cc4988d31fb739919b79b18f6e7aa2cdf487ad2458f1cb2fcc47ca58b4b8fab1061471c08350e11ae5b13c0caded3e846eb87af79e9f5fa2ae3ac75b7b746d278caecb17e5b5203256759542", 0x7a) r4 = shmat(0xffffffffffffffff, &(0x7f0000ffb000/0x3000)=nil, 0x2000) shmdt(r4) r5 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x9, 0x40) setsockopt$inet6_MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000000)={0x1, 0x1, 0x3, 0x401, 0xffffffff}, 0xc) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000140)={@mcast2, 0x48fb, 0x2, 0xff, 0x7, 0x1, 0x8000}, &(0x7f0000000200)=0x20) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000000300)=ANY=[@ANYBLOB="02ec00ed0000040063807894304c58d5af99e474a4bdd9523ed7f908c7264cb98facc29784b8bf6eccea6bde418025b3445a903ec439e4eaea9b13fddfd5897a8e18a39b72dfb9ed36ebbc9b8a78ea5c42f24a"], &(0x7f00000002c0)=0x1) socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r3, 0x29, 0xc8, &(0x7f0000000280), 0x4) setsockopt$inet6_MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000540)={0x13, 0x0, 0x0, 0x1, 0x8001}, 0xc) recvmmsg(r5, &(0x7f0000004980)=[{{&(0x7f00000005c0)=@alg, 0x80, &(0x7f0000001bc0)=[{&(0x7f0000000640)=""/250, 0xfa}, {&(0x7f0000000740)=""/66, 0x42}, {&(0x7f00000007c0)=""/52, 0x34}, {&(0x7f0000000800)=""/151, 0x97}, {&(0x7f00000008c0)=""/221, 0xdd}, {&(0x7f00000009c0)=""/85, 0x55}, {&(0x7f0000000a40)=""/60, 0x3c}, {&(0x7f0000000a80)=""/229, 0xe5}, {&(0x7f0000000b80)=""/32, 0x20}, {&(0x7f0000000bc0)=""/4096, 0x1000}], 0xa, 0x0, 0x0, 0x1f}, 0x3}, {{&(0x7f0000001c80)=@nfc_llcp, 0x80, &(0x7f0000002000)=[{&(0x7f0000001d00)=""/162, 0xa2}, {&(0x7f0000001dc0)=""/86, 0x56}, {&(0x7f0000001e40)=""/176, 0xb0}, {&(0x7f0000001f00)=""/239, 0xef}], 0x4, &(0x7f0000002040)=""/74, 0x4a, 0x8c5}, 0x100000000}, {{&(0x7f00000020c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000002200)=[{&(0x7f0000002140)=""/149, 0x95}], 0x1, &(0x7f0000002240)=""/252, 0xfc, 0x3}, 0x1000}, {{0x0, 0x0, &(0x7f0000002600)=[{&(0x7f0000002340)=""/97, 0x61}, {&(0x7f00000023c0)=""/126, 0x7e}, {&(0x7f0000002440)=""/190, 0xbe}, {&(0x7f0000002500)=""/185, 0xb9}, {&(0x7f00000025c0)=""/24, 0x18}], 0x5, &(0x7f0000002680)=""/94, 0x5e, 0x7}, 0x800}, {{0x0, 0x0, &(0x7f0000002c40)=[{&(0x7f0000002700)=""/128, 0x80}, {&(0x7f0000002780)=""/39, 0x27}, {&(0x7f00000027c0)=""/112, 0x70}, {&(0x7f0000002840)=""/15, 0xf}, {&(0x7f0000002880)=""/235, 0xeb}, {&(0x7f0000002980)=""/184, 0xb8}, {&(0x7f0000002a40)=""/124, 0x7c}, {&(0x7f0000002ac0)=""/241, 0xf1}, {&(0x7f0000002bc0)=""/119, 0x77}], 0x9, &(0x7f0000002d00)=""/171, 0xab, 0x5}, 0x1}, {{&(0x7f0000002dc0)=@sco, 0x80, &(0x7f0000002ec0)=[{&(0x7f0000002e40)=""/119, 0x77}], 0x1, &(0x7f0000002f00)=""/48, 0x30, 0x3f}, 0x7}, {{&(0x7f0000002f40)=@generic, 0x80, &(0x7f0000004140)=[{&(0x7f0000002fc0)=""/113, 0x71}, {&(0x7f0000003040)=""/196, 0xc4}, {&(0x7f0000003140)=""/4096, 0x1000}], 0x3, &(0x7f0000004180)=""/174, 0xae, 0x5}, 0x401}, {{&(0x7f0000004240)=@xdp, 0x80, &(0x7f0000004880)=[{&(0x7f00000042c0)=""/26, 0x1a}, {&(0x7f0000004300)=""/164, 0xa4}, {&(0x7f00000043c0)=""/65, 0x41}, {&(0x7f0000004440)=""/153, 0x99}, {&(0x7f0000004500)=""/255, 0xff}, {&(0x7f0000004600)=""/72, 0x48}, {&(0x7f0000004680)=""/134, 0x86}, {&(0x7f0000004740)=""/204, 0xcc}, {&(0x7f0000004840)}], 0x9, &(0x7f0000004940)=""/45, 0x2d, 0x3}, 0x3f}], 0x8, 0x20, 0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000440)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@multicast1}}, &(0x7f0000000580)=0xe8) chown(&(0x7f0000000240)='./file0\x00', r6, r1) ioctl(r2, 0x2, &(0x7f0000000380)="dec8e649936a68510c49df1ff77aee1390065d7a5f569bf7ca03957e9988e44b0a8c1e97ce72b3e88d2d04a71b0e32d3c3e327c2eb3f8935403392229be7fa76351bc376e412a1d6103c67e8978f4f1163ce69def08c371b0cfe113e930c5daf2fd2aafeaf1b8c30c3b0a6f92c5939ff7e6a67b2c8a7d9b72ef55d7e781f15b420aac5118c68a32737514ac4681ff1c9030f5950a16380714b011a8253af7ffa970986eea1933a761174c0b582d444a764899ddeb0902bc8da0d0d") setsockopt$inet6_MRT6_ADD_MFC(r3, 0x29, 0xc9, &(0x7f0000000180)={{0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, {0xa, 0x0, 0x0, @remote}}, 0x5c) [ 211.405552] audit: type=1400 audit(1540057933.739:39): avc: denied { map_create } for pid=6937 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 17:52:13 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x800}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f00000000c0)="74086e750000000000000000008c00", 0x0) fsetxattr$security_smack_entry(r0, &(0x7f0000000140)='security.SMACK64IPIN\x00', &(0x7f0000000280)='\x00', 0x1, 0x1) ioctl$KDSKBMETA(r0, 0x4b63, &(0x7f0000000040)=0x3) 17:52:13 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000000)=0x3, 0x4) [ 211.475766] audit: type=1400 audit(1540057933.739:40): avc: denied { map_read map_write } for pid=6937 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 17:52:13 executing program 0: r0 = socket$inet6(0xa, 0x1000000000006, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/qat_adf_ctl\x00', 0x80080, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$nl_generic(0x10, 0x3, 0x10) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rfkill\x00', 0x10000, 0x0) bind$netlink(r1, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f00000000c0)=0x20, 0x4) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x7, 0x180) ioctl$DRM_IOCTL_ADD_CTX(r2, 0xc0086420, &(0x7f0000000100)) ioctl$VT_RESIZEX(r2, 0x560a, &(0x7f0000000140)={0x9, 0x5, 0x84e1, 0x4, 0x4, 0x1f}) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) sendmsg$nl_generic(r1, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@typed={0x8, 0xc, @pid}]}, 0x1c}}, 0x0) [ 211.630952] audit: type=1400 audit(1540057933.829:41): avc: denied { create } for pid=6949 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 17:52:14 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x87) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000001}, 0xc) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@rand_addr, @in6=@ipv4={[], [], @dev}, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0x0, 0x2b}, 0x0, @in6=@remote, 0x0, 0x0, 0x0, 0xfffffffffffffffd}}, 0xe8) stat(&(0x7f0000001500)='./file0\x00', &(0x7f0000001540)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$iso9660(&(0x7f0000000040)='iso9660\x00', &(0x7f0000000100)='./file0\x00', 0xaa, 0x6, &(0x7f0000001440)=[{&(0x7f0000000140)="351c756858ce00f0e705331d27cff472bc8cfd8ae4c010e046279955c071257648492e2b7ceca4f44fee6d7276273b45840a", 0x32, 0x7}, {&(0x7f0000000180)="acbe57c7ac16b4f5691c3f6a3cfc6a7f3f56b985e77927f0b4492bccff60d8186ba7fb8781949955e4c3167bb9dc97", 0x2f, 0x4b2}, {&(0x7f00000001c0)="84f547112398205f6cf250e686a147a392f65970888c50de41d66cc7b0e87bd5e7d1ae3c7273a6a747cf767db29432284e06948a94d0fb8343b0ece2008ecf1f23c1509327aebb80c2e52a45984f2308fd72155e808d553cd5776fa524d2b6246946576568da74a3483561", 0x6b, 0x1}, {&(0x7f0000000240)="f09b9bd8d40b29ec8baa20ca2becfae9038a9543fe3f81620c155fea74deb5d4d40dceab45daf1cc72f8e620a61aafd5881609713da0fe2db07ab55ce4d6c665a72fed2361d66e727d6316fdcc128ddf658bdb48cf6939ce83e740341fdf76", 0x5f, 0x6}, {&(0x7f00000003c0)="4b3a8e51c624f88afe07189838c1146727f11bd6081e2b0462ee79366075d0971bdcba15324e7970fde15191173ece280d3f8e446d2f7d5daaf208db91b4c9476268620baf9683888f648a12262009533633f2153e451df2803b6b75c875767af676194c6b77667f9ff889dcbad367ed75bec6d4e8bc94cad02a5efa12f2df38bf33ab160a689d72fee45cc3ffcea362ce8f1ac3eb3ebdd23ad4414cbd8369be47b366a2bae4e852f272159ae373235b1841b9fc9d945e08322729bf9885abbe2f29698e03e545eb3b7fdffe0aa644d0ab5dc20ca88ce1dc094fbe0cf043ddce9284dcfcff102116aade95aac4ada04ab6c2958625b24f11f06396fb162a43457b4e332bd7f3b5dd86ec8fada7474ecbe577e3ca84fb416ef256d6198920c648844fc01049c5aa298e46ae8a17a79d69ecdc4ee08b7a98a89c79cef585672c3b9a8467ca8af139ee101931c66dc160879f2a1579c0a4ffa0c8f9a0867da5605f0dbc1a6b3d2ef9661d4d3acc4de1e11d757df8aee6c05b2a961ab166748c777e52b33bf73e422719bf183b819232524c2a101932b7520b2f685754e55050ade5393a56cbac6713a4a3e910b3bf632ab18dbe311936ec0d375987fda96bdff6670b0523ba8b6db381c983bb506d54056ea45a6f02dd27ed425e50dd5f8b60e319471b02e7df5eb04a2360b426e665e62604f3af744b198d94759b79318399b8ca36426cb650519e4afaf4ed2c3f146ac4a7886392154cd16ab25bfa5d58ec223f985770caeb2a16f0437a6cdf8ac6c1c57534c9766c2d9b718e35769cad787d0bdc6a3f64dd588d26870105aa3e55d0650a1e6ba8ffa9d1b028b1588e12c257acc12e7cdb9eb92ffda7e091d948920d87512892228968335b5597839b411d79fcf930932bfd5f31580ce8abc9a442b485bde0f8a826bc9fd20bc8f3cc355c7ab4b48d1bc8c93bda9a93f36a7b065aa3e3182b509510c95994e00e5ed92936de2128a70a9c909d6cac2fe363b77dd3cd6c25d1d90c761f3884ac277dcd434d8cc5a15070796a7b99eb27ba14dd2d2fc2b1a862deee259d30ea1f64ac71aa50232eda6a966959346c7f078b365da4a6f4d10bf03f0a4aae5ad17223b385b1ebd299ee111667785a380de9915905049cbdcd9c5b631856cc07203f01865d236894534a5231c8868d43464f24e03b494dc234ce72f065162d697e891efd1bd5819a4cb43d49439bb486579db75e00d6618d3c23a5f900d7df2721547efa1bf90eda91d61239dbe83491c1a204219a43de8666d848101ea59507cdd2dade3130d17d4f0925ab829a60aaafeb3d8e608d96e319dfc906dc6dc9dba3933479e72166bab09f32968ec4093076e11bdaabba0a53549f2056f05decc703c6e049d743f5511f2061c9184e9d39f89ce7a810009599b6d5ba8328cc76ab02437ba0652dda15fbecff2d8b553941d3d32f186cd5d501b1ec0b83cc56666bc5060435a23d9b0d00d62faaca77fe3023542d7421d9b75977f45d13f48e669d965ec7f0e565e7b604e89f42437607162a80f3286dc2098f9947f9c67ce21422b9e1c85563d50117f9773b2840b6b5786472764a3c2f3f4642d418d05f8f6d1e38b29715b6edf8a02693936fe42aeecf6a9cc15e85e2bad450c6a088a50984a520f719a0ce13c0ea62d118acee7733bb8fced8841c860037886d75cdaa2b6b10d36144cba122e542a5485ba5a4959cc68384250dc2792eee0cd931551ff6f765850d65b71cc834074d84324b53508e45d4ec72a9ee19f87a0f001909efd4ed7044c08fb4de6c7a4a4e43f1834c64a7113ff5aef7a6c0d0bd2d273c953e55aecd22e2310841a2b4f62a59f7a71469c3129aa96abcb3750a0833d1b03b20e9af83dd4bd2fab86f667dfac764d77d6f2852c45173a41d1528985f66c78d67e0a7f1368e2d65d3bee6376903dd6320b04e9429441826fa0ac9d223e9b64573ef1086ea8826fcfc2702d93453eb7f49bac77a08c90b9c1953aac53c81f7acc6b0310e0f6c231f81ed770e1ea2f8690f334dcaf444d755e91cd5f5b9d4c17ec21ce0b244adccf35a9e214debc6b7b8695eb2c3ad8bbf45a202b022664b415b7c83bcbe1b017e4107d054c0c51e120d3e5488b908892f00fafb4e9adf959551f1e9585b17aecaa4d9c097478434ab9ca44f7f9d5c824eef427450942a184acef015404aa5736f96180d7b815d60bdca5a488525af3ebddcc34bf608954aafe8050131c7d97bf34100a8c62a29949bc88abe22a71fc4f4e2fa4e091d53b54b8da3f41a2b9540f1d9d1f82a24845f9453e3a0227bc565a6993ba8c098247487a9ba871b149b2e79ba639518c9a9529480bd722034da17fc47d6b3807acd9167df0eaf575dd9d0baf102000aafaedbc33a23cdc75b8e039590e18a7c10561869744c245506acbd9a3b2aeb34ce6cf4fd023477944424bbf8082399e4632203971648d67deb7545a076329aa2d6b6faba25856a53275add5f0323c2a5a48766a7b817c2f9a9b1212afd13bbe6b06bf84283c825a5e72aef33e72adaf720b5f90256c8106052fea04ef01228b7f5dd85bdee648ddcc3cecb81311047fb875a8eb6ddc152ad0b3315f5d9a5f752448dc7960339934605b34c25e15bf823d52a429e8a9c782f6768af79d24f75995760453898f24a0559214438979aa2b5584bc1f4d2a8926e445df76ee73cef9eeaf11c1c9c137e9ab6be05ea2c2f6e9e4c9b598eb56a6df5fd80ac12b5b73c307b423268e54e37011caf4c75d8062a99691576692b1acabffdeabc69684ec8c2e613337c89249bb87f4bc4e39446f3be57b7223a70f245fe7fcc4bb8f430267218b70d83e0d0105186b581e1bacadc5fdf57ada681d5b77962947dfce0f09bd0c3467fd0b7eb648ceeed8976141ae8b19f852d76059fa9d7ea95f6e38d854c28e3e66db26bb57ad30ddebee5f0f2c24a1e401ee03a71214bf8c54c0c88026408c1a66c9cf4314a0bb5956215f0d5f39232da221887ec91ef5eb47df0ffa2f340a70ad6de43da1c158beab79ebc479f0ac370ab1329ae3295aacc90da50a4152312b8098c4e1a2eb81d831ad4313333f73435a004219d44457332b147ead5f698c7e1362218748c1415c2748f0d04c05983308dbf0cd96862975da02547d0304f1ec8a9c94dcc3d4585629055a4110e60e75a9bdd371040b053adc57f472a5ebd67aa4ca3f7e3127ad896c9928ea7b0a03faa1fed918f286e2a576f72e4bad48b0eba1be8c94e9d1307662a0edd6b6dab26dcaff41cdb406b38ab88c4a0ff4eb71d948230ab7c34edfca58dff07276ab04ae77d84fa41326549527e35188a95990118fb4366a5c549a6d5244f304aa7088f274e24b4b62bf3bcd7bf6029acbba4fe2b1ca5e0ad9179194de7651bd99a13f6a10c2ca7533a6e142c38a7b1e4ff95e7492e9978b78af663754dc2ea98a09d7da16ee64da0c83aec3379f47929867885fbcba33eb5e349f8c05793a3e3f8cbc20a80c1be90a3f47dc43c47df839d18bac86925b157dfc183db9538bfe986889adfbd7c72df3a82a37cd1789293b0f951037737f0b5aaf76e5998f2afb5c8ab59c138010d64d90ffa85a97f4acbd82ce37112043bc991451d77cc48780f543da184244603940e9afdc3cf935ca62d53bf5a583918b794c0b6fd8f1d0b94bea66e40cef322f17bb3ba475d812f2d998268586a5e550b92b91bca3438fff4ea74f1afbf7c191e1e28dd24d10540cb1b6b4f0ff8051018431ae1454ed37b125d5a292ba2224589847b0e103175ea67017dfa635477e12127484cd3122899732f1dd6062a680b990283bbb082d6c44ea16244ea3e621898ac7ecf4f4869c96dbbb953a7145390cfa441fd76b056359624a0d699e9c39bdba62ede3463f88f7e8d618865dc93d3e4ec898e14b6e6ddd50d9941a36c0c96a1985805bd5102acc68be42ef20898d435fa1e291fa082c7a54d908c90e350759a79efd26f15b6830a245b5d70311fdea42b29a2bd9c1319a95e72064b4e711340da93fd8e1973a46b0614ae5a37904a5968e86d7b7dd74769522650bbe3c6d6346b534a84daec29dfced82c8745fced7d79bd108b3d19f3d380f92e0c9789cbb732268e0832af70ae764248ff0314e150837cc6690aeed3cac97aeeab5b4d9e7a7780219b0f389d54184c6477e74fb81487709bcb082ab32e0d3036d149910ed0e2a958e000b2216c573089930ff219448c69558faf72158411bae4704df5002248be8fe5dbcc30cfaa1a42e2c59016d64aba5a17db14dc8e1475aab6ff544a5eda50ffdcd6a07e7d738a3baf8abaac5fdb848b7eb2ca2b333e10e0f995464db87ef3de81b24466c071109a0c52a2e0188ef7b30eb6f43a2122df24c696e376bd66af0437f65cfd9f32f952c3c7c1514dc27d0fce07ac075564581825922845f551d641056d2c8c1015ace788bcf02bb04466d9f40424b7010cb24a3f8b81c57fc29634ddd3b6284711227d53539b1ed9512fea5d9b8e559e02359ca0391ccc75113a7956871583917038bbbd9e7e3f1a2e32c77f1d3e6636d780a4cfd53c5a4bcda23bd004071f9ea2fedff64e63af2df8c0cd2ae5417d3dd8a64082981f0b5c5e6dafa3632b8473df3be58692937f859e56cfc15bc634324da47d9759a7b23e1e978e6d4075880cacea7bd41f0aed4de1960081b39bef1fdfb7757a12a25259ddabd3d4e77c37e7ec91b7f44d2616f2fa7c6a8fd8e7db8a6147a984cfed7d86476d2b17064573c783ab45015a6ac86346f5c4bb1dd3320a39739dbecf5e62e9a6c83b60d1b4729339924a21be675d40147bf5e28835d2daa0a13ccbd9328aa59f17d5eeaa882edc5d69227c5f6a25f1a86454d1f0ec5f87ba176dccc466dcf86d4ebe04d140fa5cb3b090d4318376345d7eb6f72dce7fd6b7c1f39e8475b2ab6d79b7a26b471e350f0407eacbc3bad309de2d79e9f8dba097d10b777f1a1ae15387c8ffda56eff47f20a644977a708fd824d7ba9237f54deecee641d4310df706bff2defaf81b4c7eb21c65e612bb39afba629697f3a3963ce2bcc5652edbd0f63a760033d4074750694a846c2be7dec3323b8346fd0049a1d00105ea4d485fb08a61455b08b785a4a4296f14e6c4c741a284062be3d4873d2d624455a4c8a2b346d19a5b9b51a595752227787cbd3e6e3246ed2bfce7b1a3198cdf670b1fdc34f2fca726eef543ea3bae8e6db94b199c53258ce3e4a951bb8230b95fd6278ca0ad9c4a2eee8c91810cda358d15b49f757d1dc6b1d9955fb4cbd623fd7678c70b9f842323badf94829f49b08fb026f711476dbbc623492ae75a44936c91437d693dbb012f123fecc215245f129df46c113ee5648e30f4f2291cc1df6063f081c9527a5ecf16c96585a98c85c0134b3b2acd3f101d602ff3cc2381f1a2415e89dcea8a679eb79246941cd80a29155bd490c3655c41b011e0ed91ebe3a47888454c72d69eaecb70e084875793986ad3e6b67f4bbd0c8f3b042a223b8317c625e25ecf0fc47bb4f08071b902824f43f1aa38b4c785364bbb305c0aef35cacbd69ae942062e6963e4d3425b0ed9067efe1a589e82d58f0178578b94bf7d7ceb409286c86a2cd156ac2dfd00838a2327396e816468b91d60f8c5051ecbaa93f0ff5a67b0deee7a236ccff2feed948a5ab78d4300820c58f5948036bf6a23e21956c50ee7361844f4ffa6940ad6a3fd9282ebe2be0eabed8f9afa032fe1e9c5ee9661bbd043b6a4898ca8a3baf0f263d7984dff7f49a82d4fec8026794711", 0x1000, 0x8001}, {&(0x7f00000013c0)="3b963ef7d40e4db55d1467670a64745f79572918a093582544f6af5b59c33fb231a4910094d5825d1407606a232c68d6a4185eae6bc92bc4a561d9a6a85e45b527dcbab746872296d300d49dc166a7b81f4a2c632e7e68", 0x57, 0x5}], 0x40000, &(0x7f00000015c0)=ANY=[@ANYBLOB='fsm!gicx0000000000000000,euid>\x00\x00', @ANYRESDEC=r2, @ANYBLOB="2c6673757569643d37653377347230612d7b7665612d779c39342d7261767b2d77347d00376765752c00"]) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x10000, 0x0) ioctl$KDENABIO(r3, 0x4b36) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000001640)=ANY=[@ANYBLOB="490000000300000000000000000000000400be0000000000280000000000000076626f786e657441656d3176626f786e6574317365635372697479297d9f0c0000656c696e75785ee0"], 0x49) [ 211.710330] audit: type=1400 audit(1540057933.829:42): avc: denied { setopt } for pid=6949 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 211.768984] audit: type=1400 audit(1540057934.009:43): avc: denied { bind } for pid=6966 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 211.802106] audit: type=1400 audit(1540057934.009:44): avc: denied { write } for pid=6966 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 17:52:14 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r1, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000040)}]) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x5, 0x200400) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000fee000/0x11000)=nil, &(0x7f0000fee000/0x8000)=nil, 0x11000, 0x1}) io_getevents(r1, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) tkill(0x0, 0x0) 17:52:14 executing program 0: r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x8, 0x4000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0xe}}, 0x20) syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x2, 0x4000) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f00000000c0)={0x7, 0x8, 0xfa00, {r1, 0x8}}, 0x10) migrate_pages(0xffffffffffffffff, 0x8, &(0x7f0000000600), &(0x7f0000000640)) 17:52:14 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000013000/0x2000)=nil, 0x2000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000000c0)={'veth1_to_bond\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='\t']}) close(r2) close(r1) [ 212.394620] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 212.401530] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 212.422928] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 212.429702] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 212.438206] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 212.452679] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 212.459449] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 212.472371] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 212.482438] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 212.489266] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 212.498259] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 212.510088] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz1 [ 212.631956] hrtimer: interrupt took 43703 ns [ 212.689105] audit: type=1400 audit(1540057935.009:45): avc: denied { read } for pid=7052 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 17:52:15 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) write$FUSE_OPEN(r0, &(0x7f0000000040)={0x20, 0x0, 0x3}, 0x20) [ 213.186190] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 213.200262] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 213.216470] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 213.229455] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 213.243323] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 213.250332] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 213.257325] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 213.267107] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 213.274441] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 213.281129] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 17:52:15 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") clock_adjtime(0x0, &(0x7f0000000180)={0xe18d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b9ac9ff}) 17:52:15 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r1, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000040)}]) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x5, 0x200400) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000fee000/0x11000)=nil, &(0x7f0000fee000/0x8000)=nil, 0x11000, 0x1}) io_getevents(r1, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) tkill(0x0, 0x0) 17:52:15 executing program 0: r0 = socket$inet6(0xa, 0x1000000000005, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f00000000c0)={0x0, 0x0, 0x4}) 17:52:17 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0xffefffffffffff7f) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg(r2, &(0x7f0000007ac0)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000001c0)='A', 0x1}], 0x1, &(0x7f0000000500)=[{0x10}], 0x10}}], 0x1, 0x0) [ 213.288002] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 213.295755] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz1 17:52:17 executing program 5: listen(0xffffffffffffffff, 0x6) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80}}], 0x1, 0x0, &(0x7f0000000140)) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') preadv(r0, &(0x7f00000017c0), 0x1a1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x80000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000380)) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00'}, 0x10) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x856, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x3, 0x19) connect$inet(r1, &(0x7f00000002c0)={0x2, 0x4e22, @local}, 0x5) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0xfb) setsockopt$inet_tcp_int(r2, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0xfdf6) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000280)='tls\x00', 0x4) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000340)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@dev, @in=@multicast2}}, {{@in6=@dev}, 0x0, @in6=@loopback}}, &(0x7f0000000500)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000540)={{{@in6=@mcast1, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6}}, &(0x7f0000000640)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000800)={{{@in6=@dev, @in6=@mcast2}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000680)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000940)={{{@in=@multicast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000000a40)=0xe8) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000000cc0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000c80)={&(0x7f0000000a80)={0x9c, r3, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [{{0x8, 0x1, r4}, {0x80, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}]}}]}, 0x9c}, 0x1, 0x0, 0x0, 0x4}, 0x20000010) bind$inet(r2, &(0x7f0000738ff0)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000700)={0x0, 0x40000007fff, 0x80000001}, 0x14) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGPGRP(r6, 0x8904, &(0x7f0000000200)) sendto$inet(r2, &(0x7f00000006c0)="b3", 0x1, 0x0, &(0x7f00000007c0)={0x2, 0x4e20, @remote}, 0x10) shutdown(r2, 0x1) 17:52:17 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = getpid() fcntl$setownex(r0, 0xf, &(0x7f0000000000)={0x0, r1}) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f0000000100), 0xfffffffffffffffa, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 17:52:17 executing program 0: capset(&(0x7f00000000c0)={0x20071026}, &(0x7f00000003c0)) setpriority(0x2, 0x0, 0x0) 17:52:17 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r1, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000040)}]) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x5, 0x200400) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000fee000/0x11000)=nil, &(0x7f0000fee000/0x8000)=nil, 0x11000, 0x1}) io_getevents(r1, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) tkill(0x0, 0x0) 17:52:17 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000540)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) chroot(&(0x7f00000000c0)='./file0\x00') read$FUSE(r0, &(0x7f00000030c0), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, 0x1}, 0x50) write$FUSE_INTERRUPT(r0, &(0x7f0000000100)={0x10, 0x0, 0x2}, 0x10) [ 213.532159] capability: warning: `syz-executor0' uses deprecated v2 capabilities in a way that may be insecure 17:52:17 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="2400000052001f0014f9f407000904000a00071008000100040000000800000000000000", 0x24) 17:52:17 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r1, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000040)}]) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x5, 0x200400) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000fee000/0x11000)=nil, &(0x7f0000fee000/0x8000)=nil, 0x11000, 0x1}) io_getevents(r1, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) tkill(0x0, 0x0) 17:52:18 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) write$FUSE_OPEN(r0, &(0x7f0000000040)={0x20, 0x0, 0x3}, 0x20) 17:52:18 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff) r1 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_ifreq(r1, 0x8008000000008b35, &(0x7f0000000000)={'ip\x00', @ifru_map}) 17:52:18 executing program 5: r0 = socket(0x2000000011, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto$inet6(r0, &(0x7f0000000040), 0xfe69, 0x0, &(0x7f0000000140)={0xa, 0x0, 0x1, @ipv4={[], [], @multicast2}}, 0x1c) 17:52:18 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={"0000000000000000000000000200", 0x5002}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000040)) 17:52:18 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r1, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000040)}]) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x5, 0x200400) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000fee000/0x11000)=nil, &(0x7f0000fee000/0x8000)=nil, 0x11000, 0x1}) io_getevents(r1, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:18 executing program 5: syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000340)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="1020f5f20100070009000000030000000c0000000900000001000000020000000000000000300000000000000e00000016000000020000000200000002000000020000000e000000000400000004000000080000000c00000010000000140000030000000100000002", 0x69, 0x1400}], 0x0, &(0x7f0000000240)={[], [{@euid_gt={'euid>'}}]}) [ 213.997657] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 214.011287] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 214.019075] F2FS-fs (loop5): Unrecognized mount option "euid>00000000000000000000" or missing value [ 214.029234] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 214.036447] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 214.044604] F2FS-fs (loop5): Unrecognized mount option "euid>00000000000000000000" or missing value [ 214.103083] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 214.110287] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 214.119265] F2FS-fs (loop5): Unrecognized mount option "euid>00000000000000000000" or missing value [ 214.132855] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) 17:52:18 executing program 4: r0 = socket$inet(0x2, 0x6000000000000003, 0x6) sendto$inet(r0, &(0x7f00000003c0)="40782c4f0fcdd6f4753b4c6aefe0712481c4c3ad4098216a407cf8c22cb259381790bfdb42fd7885f13d795bf173c5c35a765dc0e2fdc7452dd8cc5731ef09158795802754e98ceb73850662e6f78e7c35ef041b6b1a3804fa3e7362ce946e542250c3598dd42851a967f20d796bb2d38d2f3da68576a28e627dc33195d7a4a1bc12e8027e3fd37ec1c56e58f252b9e6afde750826ffe189970aa6d4997e3885a52d170b10dd0954993b817a5183e02e3abf8754b8cf344fef444dd9b84e2667d74cb6eb920e2e6509386281477265dc3262bb9ba6bee9f6b62cf3c6f69e7b020588ce6878fa8a49c2dbebed8589d65846ee3117f22de717182a5aeccf6bb0ab0244c00d77960578e2f4d593479efcc30182bf7977ae38b6fe567b366deb6ef3aaf90d2e8feadfea5785b11d8dc95c4930969e075becac569227e09460cc0f9cf255dadc4b12e9f3a52ecef82a285416a9e2ba854c755de8c44c8c67bc5ea495d078fc85a74d6abdb6486c1a39031a5dbf8f0c5479674a4968da5047cd961edf5b8121fc1d4739fe9a9c51c8d7a3dc58498bea6b4efffc116737ba7bdfb0f224bcb852f53eb63544736ab2299cf2ba8ff44f3cd591a01375f892b90083da4ff6b98d122397c1ad7836609a650a777be469908e6ee55294523a22d9e63ac61e58a0fb0ce0568336237fc0c9c46ba3d672dfdab00ec189ba43e8e9ab7930ae021b8957d0f8fb1cc026e5889108ffbdaff02fd18c6e254468ec370ba0367ec127a35fcc4b14b5f9a896beb43e59f9c8e8ff661b9eaea296ae54d54023cdfa31be80149fcd7daad2f29d63beedbbab342df0decdc9216d5c70f8", 0x258, 0x0, &(0x7f00000000c0)={0x2, 0x0, @remote}, 0x10) 17:52:18 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r1, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000040)}]) syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x5, 0x200400) io_getevents(r1, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:18 executing program 1: syz_mount_image$f2fs(&(0x7f0000000240)='f2fs\x00', &(0x7f0000000340)='./file0\x00', 0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f00000000c0)={[{@user_xattr='user_xattr'}]}) 17:52:18 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000de2ff4), 0xc, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000000301ff007b0700000000000000ae1e"], 0x13}}, 0x0) 17:52:18 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000002980), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f00000005c0)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000640)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400aa009b84136ef75afb83de448daa7227c43ab8220000060cec4fab651330b6f64906631aa07322ee0a63fa08ffd76cddbe0ae558a1b56f5094259ae212b4a357a54afbd8552e2113dac60a8c9c8b96564a28be3101cf17f5b7e0eaaafc01ee20370b96fdf7788642eeae2641fa9f03da07cf3f3d7b161f413ed6197b9d796d112d929079a8731c2f73019a68ec03a240f2d96609d4b7", 0xcf}], 0x1, &(0x7f0000000400)}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40046607, &(0x7f0000000400)) listen(r0, 0x7c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) r3 = memfd_create(&(0x7f0000000180)='syz1\x00', 0x0) write$P9_RFSYNC(r3, &(0x7f0000000240)={0x7, 0x33, 0x1}, 0xfffffffffffffe2d) sendto$inet6(r2, &(0x7f0000000380), 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4}, 0x1c) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup/syz0\x00', 0x200002, 0x0) fchdir(0xffffffffffffffff) r4 = creat(&(0x7f00000004c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x4) r5 = open(&(0x7f0000000540)='./bus\x00', 0x141042, 0x0) sigaltstack(&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000480)) write$selinux_context(r5, &(0x7f0000000000)='system_u:object_r:crontab_exec_t:s0\x00', 0xfffffffffffffe84) r6 = creat(&(0x7f00000003c0)='./bus\x00', 0x2) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x200000, 0x0) write(0xffffffffffffffff, &(0x7f0000000380), 0x0) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) select(0xffffffffffffffe7, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000}, &(0x7f0000000280)={0x77359400}) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f00000008c0)=ANY=[@ANYBLOB="73656375726974796d0000000000000000000000000000000000000000000000c40000004e8b4b1c7fa37c911d43b7dfc1540065e2cf063a33e71b903574450eb6fcc611bb94c232461f22877f4a2e09f7f448f8a2ef823ff78d796ab6ab52f030b8fea1243b4a37836d690100843a8998fea04a2bc4f9661e5ad62438873674078acbeac561a51093ca99b61c426c9382417876b70a4bcff2d634050eca0d4f941bfec0542fd99b2bd8823b4175d0b0e455f150e292c18a967fdc58383f9af93bc9c8b8578b5ed8ba7d2084ab94919aea43e1a3adfd6d899dd2159976a615f1279aaf23ce57319edb9be03d5b849777d956c09bcb8bc5eb1d793fe7b7d0c34d4d6cc6d28cb99320750390dc04b3af4959443184210eb68c4fe6dced7e44cd2b39f7d25dc53dab0fd596052191868741cecd379b6e87b1c1a8c0dc6b8004595fb6"], &(0x7f00000002c0)=0x1) recvfrom$inet6(r2, &(0x7f0000001840)=""/31, 0xfffffe0e, 0x100, &(0x7f0000001880)={0xa, 0x0, 0xffff}, 0x1c) getsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f0000000500)={@multicast1, @multicast1, 0x0}, &(0x7f0000000440)=0xc) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000580)={@remote, r7}, 0x14) r8 = accept4(r0, 0x0, &(0x7f0000000000)=0xfffffffffffffefa, 0x0) sendto$inet6(r8, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) 17:52:18 executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x3, 0x6) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x400448c8, &(0x7f0000000000)) [ 214.474431] audit: type=1400 audit(1540057938.812:46): avc: denied { create } for pid=7165 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 214.522526] audit: type=1400 audit(1540057938.832:47): avc: denied { write } for pid=7165 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 17:52:18 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) write$FUSE_OPEN(r0, &(0x7f0000000040)={0x20, 0x0, 0x3}, 0x20) 17:52:18 executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x400000000000003}]}, 0x10) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) 17:52:18 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r1, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000040)}]) io_getevents(r1, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:18 executing program 4: clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000180)={0x0, 0x7530}, 0x10) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) write$P9_RMKNOD(r0, &(0x7f0000000000)={0x14}, 0x14) 17:52:18 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000140)="000000008c00000000000000000000", 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000000)='/dev/loop#\x00') pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) sendfile(r0, r1, &(0x7f0000000100), 0x80003) 17:52:19 executing program 2: socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_getevents(r0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:19 executing program 4: r0 = gettid() r1 = getpgid(r0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x7) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000340)={0x26, 'hash\x00', 0x0, 0x0, 'digest_null-generic\x00'}, 0x58) syz_open_procfs(r1, &(0x7f0000000100)='attr/current\x00') r3 = accept4(r2, 0x0, &(0x7f0000000000)=0xfffffffffffffcbe, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000003c0)="4fabc9d241fbf9f667462743771ca3fbf786a3aa636c65049bd8008ddcfcc00345018b32a60c985e93cb606da09fcd1698998d147083126fdf7d38fe399e202053b57e7e11f73d1c63a296227786a78c8fe2539af8327abe35205699b95e6c1bf7ef2b5364a57fc8452d09eb9510155fbb6cae099d08e1a098db5bb773ea96fa4e943c67024f97e8113ebfa08c27d19580ba90feb7accd973a58fff413a139da91c030a6053fe477823de4772e81d21bf4f4a62c86213337fcf5305c5f8231d73a76d7c6f4972a6fdf1c786d76f48356e29c65d4263cd7a11c9657566ca824c68844ac93108c133c0e25f9afc14d28e2", 0xf0) sendto$unix(r3, &(0x7f00000000c0), 0xfffffffffffffdee, 0x0, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) 17:52:19 executing program 4: ioctl$int_out(0xffffffffffffffff, 0xade7465b20ecc01e, &(0x7f0000000080)) socket$inet6(0xa, 0x8000e, 0x8) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) creat(&(0x7f0000000100)='./file0\x00', 0x0) getsockname$netlink(0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000180)=0xc) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x406, r1) ioctl$UI_SET_PROPBIT(r2, 0x4004556e, 0x1c) getsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f0000b67000), &(0x7f00007d0000)=0x2fd71482) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f00000000c0)="2400000052001f0014f9f407000904000a00071008000100040000000800000000000000", 0x24) 17:52:19 executing program 2: socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_getevents(r0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:19 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={"0000000000000000000000000200", 0x5002}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000340)={&(0x7f00000000c0), 0xc, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x3cd}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x2007fff) write$P9_RSETATTR(r4, &(0x7f0000000100)={0x1e8}, 0x11a) sendfile(r0, r4, &(0x7f0000d83ff8), 0x8000fffffffe) [ 215.006861] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 215.022731] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 17:52:19 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000023000)={&(0x7f0000000000), 0xc, &(0x7f0000023ff0)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000002700010b000000000000000003000000548ee386f1a38172b1fab3d91da459d38d5c48ed663676a5f9abe02a0c8ef35c919c10caf1364d7f0945144bc774e90ec062df0ea7606413d1b9cadd4c4f2cb1d7bdfee7f620052ca8cad5439ecd45540d9afd90ec9200cd2e439044f1b29fd4f355203ede05efe517188c06da558c7c0aba560ab6fb82cf7738e3cf9671959d5d19c79fb1"], 0x1}}, 0x0) 17:52:19 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setpriority(0x2, 0x0, 0x0) 17:52:19 executing program 2: socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_getevents(r0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:19 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) 17:52:19 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000140)="000000008c00000000000000000000", 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000000)='/dev/loop#\x00') pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) sendfile(r0, r1, &(0x7f0000000100), 0x80003) 17:52:20 executing program 1: 17:52:20 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) io_submit(0x0, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000040)}]) io_getevents(0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:20 executing program 1: [ 215.828529] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 17:52:20 executing program 5: 17:52:20 executing program 1: 17:52:20 executing program 2: io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r0, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000040)}]) io_getevents(r0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:20 executing program 4: 17:52:20 executing program 5: 17:52:20 executing program 1: 17:52:20 executing program 2: io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r0, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000040)}]) io_getevents(r0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:20 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) 17:52:20 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000140)="000000008c00000000000000000000", 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000000)='/dev/loop#\x00') pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) sendfile(r0, r1, &(0x7f0000000100), 0x80003) 17:52:20 executing program 5: 17:52:20 executing program 1: 17:52:20 executing program 1: 17:52:20 executing program 5: 17:52:21 executing program 2: io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r0, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000040)}]) io_getevents(r0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:21 executing program 1: 17:52:21 executing program 4: 17:52:21 executing program 5: 17:52:21 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) 17:52:21 executing program 1: 17:52:21 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x0, &(0x7f0000000000)=0x0) io_submit(r1, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000040)}]) io_getevents(r1, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:21 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000140)="000000008c00000000000000000000", 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000000)='/dev/loop#\x00') pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) sendfile(r0, r1, &(0x7f0000000100), 0x80003) 17:52:21 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) 17:52:21 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(0x0, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000040)}]) io_getevents(r1, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:21 executing program 1: 17:52:21 executing program 5: 17:52:21 executing program 4: 17:52:21 executing program 1: 17:52:21 executing program 5: 17:52:21 executing program 4: 17:52:21 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) 17:52:22 executing program 5: 17:52:22 executing program 1: 17:52:22 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000140)="000000008c00000000000000000000", 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000000)='/dev/loop#\x00') pipe(&(0x7f0000000040)) sendfile(r0, r1, &(0x7f0000000100), 0x80003) 17:52:22 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(0x0, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000040)}]) io_getevents(r1, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:22 executing program 4: 17:52:22 executing program 1: 17:52:22 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) 17:52:22 executing program 5: 17:52:22 executing program 4: 17:52:22 executing program 1: 17:52:22 executing program 5: 17:52:22 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) 17:52:23 executing program 4: 17:52:23 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(0x0, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000040)}]) io_getevents(r1, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:23 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000140)="000000008c00000000000000000000", 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000000)='/dev/loop#\x00') sendfile(r0, r1, &(0x7f0000000100), 0x80003) 17:52:23 executing program 5: 17:52:23 executing program 1: 17:52:23 executing program 3: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) 17:52:23 executing program 4: 17:52:23 executing program 2: socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r0, 0x0, &(0x7f0000000240)) io_getevents(r0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:23 executing program 1: 17:52:23 executing program 5: 17:52:23 executing program 3: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) 17:52:23 executing program 4: 17:52:23 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000140)="000000008c00000000000000000000", 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r1, &(0x7f0000000100), 0x80003) 17:52:23 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={"0000000000000000000000000200", 0x5002}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000040)={0x0, 0x1, [@link_local]}) 17:52:23 executing program 2: socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r0, 0x0, &(0x7f0000000240)) io_getevents(r0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:23 executing program 1: r0 = socket(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'syz_tun\x00'}) sendmsg$nl_route(r1, &(0x7f00000001c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="08000200ac1414aa1400030073797a6b616c6c6572300000000000006a91e1b2d820337b697c6164ecce4a99b91a773bfe0b591cf05881405727ef7faa502ada9226fde6bea922baaefbe9e8ad0e03e37374e5f2c59e5d3baffe2f47f70917dd4baf026498c689fd26cf9573654a8edbbc0f3668d2b457aaf48a10e40928b5c1f9b2f1dd4a9df9"], 0x1}, 0x1, 0x0, 0x0, 0x50}, 0x84) 17:52:23 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setpriority(0x2, 0x0, 0x0) 17:52:23 executing program 3: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) 17:52:23 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000380)="153f6234488dd25d766070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = dup(r1) ioctl$EVIOCGKEYCODE_V2(r2, 0x80284504, &(0x7f0000000340)=""/180) clone(0x70024100, &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000000), &(0x7f0000000140)) 17:52:23 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000140)="000000008c00000000000000000000", 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) sendfile(r0, r1, &(0x7f0000000100), 0x80003) 17:52:23 executing program 2: socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r0, 0x0, &(0x7f0000000240)) io_getevents(r0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) [ 219.289234] audit: type=1400 audit(1540057943.622:48): avc: denied { ioctl } for pid=7404 comm="syz-executor1" path="socket:[26000]" dev="sockfs" ino=26000 ioctlcmd=0x4504 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 219.305166] IPVS: ftp: loaded support on port[0] = 21 17:52:23 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) 17:52:23 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") bind$alg(r0, &(0x7f0000001540)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100)="b7f25df5cf00cd419d142c3b9617068715", 0x11) 17:52:23 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x2000, 0x0) fstat(r0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0}, &(0x7f00000004c0)=0xc) syz_mount_image$f2fs(&(0x7f00000000c0)='f2fs\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x4, &(0x7f0000000340)=[{&(0x7f0000000180)="7401a64eed4eebb1fcf5d6be6324ff28854205fcfe1922187c26533e4fd975dc3b552ae56173f441cb074eba52015d199882456c7e6c5ce22dc54241d813e754aa6cba25d49c9357193e92a9f94d5b89376a51055dac75f219463c4a4eae0549d40f10a2d2486c18923d19", 0x6b, 0x4}, {&(0x7f0000000200)="317787285ba9d89af2c8782b1d320a773bf72231", 0x14, 0x3f}, {&(0x7f0000000240)="13ff2d9bae7763ecd9115476df6b2d2552ba946e9ef54e6b61", 0x19, 0x1}, {&(0x7f0000000280)="f284703c15c7880a05d8ae8549faa0f27519ee9e0a8b2d541dfcda4696a144e172fce909a4c2e06a877afa60ed8489d134f9d8d7464b2f0f9c4e4192ff0eef207fa8", 0x42, 0x2}], 0x20024, &(0x7f0000000500)={[{@nolazytime='nolazytime'}], [{@smackfsfloor={'smackfsfloor', 0x3d, 'fuse\x00'}}, {@fowner_lt={'fowner<', r1}}, {@pcr={'pcr', 0x3d, 0x3b}}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/autofs\x00'}}, {@rootcontext={'rootcontext', 0x3d, 'root'}}, {@uid_eq={'uid', 0x3d, r2}}]}) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0xfffffffffffffffe, 0x9, 0xe91, 0x7ff, 0x5, 0x90600000000000, 0x5, 0xffffffff, 0x4, 0xfff}) getsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f00000005c0), &(0x7f0000000600)=0xb) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB=',rootmode=00000000000000000040000,user_id=2', @ANYRESDEC=0x0]) 17:52:23 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000140)="000000008c00000000000000000000", 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r1, &(0x7f0000000100), 0x80003) [ 219.459339] audit: type=1400 audit(1540057943.622:49): avc: denied { sys_admin } for pid=7404 comm="syz-executor1" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 17:52:23 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) 17:52:23 executing program 2: socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r0, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000040)}]) io_getevents(r0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:23 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000140)="000000008c00000000000000000000", 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r1, &(0x7f0000000100), 0x80003) 17:52:23 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) 17:52:24 executing program 4: r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000180)=@broute={'broute\x00', 0x20, 0x1, 0x2d0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000c00], 0x0, &(0x7f0000000040), &(0x7f0000000c00)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff00000000190000000000000008006c6f00000000000000000000000000007465716c3000000000000000000000006970365f76746930000000000000000062637366300000000000000000000000ffffffffffff000000000000aaaaaaaaaa000000000000000000e0010000100200004002000069700000000000000000000000000000000000000000000000000000000000002000000000000000ac1414bbffffffff000000000000000000062d00000000000000000000000000636f6d6d656e740000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041554449540000000000000000000000000000000000000000000000000000000800000000000000000000000000000041554449540000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000001000000ffffffff00000000"]}, 0x348) timer_create(0x7, &(0x7f0000000000)={0x0, 0x23, 0x3}, &(0x7f0000000080)=0x0) timer_getoverrun(r1) 17:52:24 executing program 1: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000200)) r1 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x0, 0x0) socketpair(0x0, 0x0, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x12, 0x3, 0x4, 0x3}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r5, &(0x7f0000000000), &(0x7f0000000140)}, 0x20) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000280)=0xc) ioctl$DRM_IOCTL_GET_CLIENT(r3, 0xc0286405, &(0x7f00000002c0)={0x2, 0x2, r0, 0xc37e, r6, 0x400000000000, 0x2, 0x80000001}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={r5, &(0x7f0000000040), &(0x7f0000000140)}, 0x20) write$P9_RLINK(r2, &(0x7f0000000300)={0x7, 0x47, 0x2}, 0x7) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000240)={r5, &(0x7f0000000100), &(0x7f00000001c0)=""/113}, 0x18) 17:52:24 executing program 2: socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r0, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000040)}]) io_getevents(r0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:24 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) [ 219.775699] kernel msg: ebtables bug: please report to author: nentries does not equal the nr of entries in the chain [ 219.791417] kernel msg: ebtables bug: please report to author: nentries does not equal the nr of entries in the chain 17:52:24 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000140)="000000008c00000000000000000000", 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r1, &(0x7f0000000100), 0x80003) 17:52:24 executing program 5: r0 = socket$inet_dccp(0x2, 0x6, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000040)={'veth0_to_team\x00', {0x2, 0x0, @multicast1}}) 17:52:24 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sendmmsg(r0, &(0x7f0000000000)=[{{&(0x7f00000001c0)=@can, 0x80, &(0x7f0000000100), 0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="a0000000000000000000000008000000c1a38829a7a15f67822636cdf19ac0f257943a5548cb7ebc3675c8637228920acc9c160320b214a779efd396bb8319368bfe53efd47e954a599f10bcc172fda7949f130708028b0a8397e47b18bcd8cd8e8f916519ac3f0fe2f575cd56510a88f0a6c0b331cef64817591b3d32cb7a866e20e025ec8315b96a510a00680392d7d28d8aff037ee5a5fe18dc1a23430000a0000000000000001f01000002000000e98db08997f88a0657e5e64ac4fff3879216ed51ed7d2d222d5b2e983c7839536bedcacfe2d6837cca412d58b115feaec226052c2718195ceab599baf4cbdbae31150df35033f609709906516a51aff3d8563a2ecc34d822ef3f651a448f4dc1fa68b737a0bccd7601bd55bb8326a4fb7cc85dc63bf978a614d0301b4c24f75da8999801bebe970273c0160000000000dffe0000000000001f01000007000000a7e492760373d49c4f4abd75db1830286ee54b6789e8dea4081ecf973539ff3ce8a780dc052b31cfd7fb2a3e08c90585506359d4e1fa7ca4c41c5e44b6029c301f0757f10f4a75befef6aa36a8adf789ed67f09a05a05b78acc67198152c589be27f44ae7e5f04b65342f1776e92672e524556e348b9196697e1622fd8df993447cb9856f4d66a43a85f246fc50f7df7f76e66038048929172ad02311a6c457f1763b3d1472fb4985310004bc76e4d65299131f7e65924090bdf9af953dad449f0aed5b2e0158cb51d043ae5ea953c7fba09f1c8960fec44d6ad39e5a21f2f9e3c5f1d15ab46801dff4530437b135904c4e3a30d6fdcaac5d371b850116c83c6b37ba1dbf2b9ebb58b86161fd8f39817db57a66c2cf8ab5c792813514c8488b9b6b7e1e7e961f3035be26d65aca7f93ed79867be0ede4ecea0ec23266c357f87d447c2bcc62bbc470a8d877061336265691744a90edbedad9363ab4afc4a990a274341e28d78ad5c779e020c4bd979a118b8621e7964c0c63a37d244e2d356901ad1761147bb233a9ac3a1573da21660a7d6e14ca0e7d689bf50f1b1c840346a7b0c27d1548a48fb940585d5bfca2649fdfd09b2e92449d7dba969e81e72204a0d01dc26ecab896b3baae825e2e08a5de1e938db09c5fcd7791cf7c27800828d6d373614f6f23d85804ee78c5190eafe8112e29ae0ec74d8cf1444df06a119852cdcfd00f7257664ba9e4c6682267a7616e772ab4c8bc03d1fdd350af82e2dc6e40f2fc85b6c5dc5a10875d44cb43bc059738558e9a6b7af86828768e27405c079d0110dd3de0e691bc4e480ce05ce814592dec52f8742cfbf7bf4a14da01badf134be293c84de61812fb3f6077225b13b50b1272ef501953a1ba620dce30fb2a154a10a9f566aecf8090fcd6e21db2096a022d96a1c9c1eb63f87bdb5825918fdd7f6e9a391f720fe09000000fee9e26104fa8fc2ef90e9560db14b4658e052a198e089f798a2a8dc91fcabd995e1b2b13b53227dcff34385a141c98812b869f71630047460b9d241bdc557d1f5f879fbd33bb75c8983af32828027b3960f026234e429c99585c7e8cf5f0b4d530743175dd4e4591c2e824454989f4056706b25ec9a52c0d941dd415ac3209f34aee8cfd5d8c6d848b03473dbed18f47b53781f7789309e69c4b6f5b7c5037b3b79c9a41ddd80ea7da4e2dad315f5ed51cb81fde66ed17e1a3ccd55d69bcc95e5b8f70598a0eb21e8e158899581ff7a902bdc691d389b8822f85d77a88153c8d621e64a0813afe8ed240ad81b2f7b03eea9af67585ce8042764a6ab3dafe8f018e7c22f418104c5913e8a84a9c84b32f6091125a3e787076f4b0788591afd25bff9f80b04b65aeeb75edce0afd6df7e3025fb84274d9bdda0098e0626f87f6c9e725f40d963d0eb4be97923336f8d98065f738623a59042a58518b5b8583ff2d9e00d006be7cd4d136c617151b87d7e6e9d1544f384c08fe388692c2c7a7a80cbb452555ec8a318bcb0bbfa381c3b2022c11c2006eacfb815cd31825a673ea9df7ad48b0111691d124293ca3996cca494c0a6a6a21dd5a661e25e80263a971c68c8e2696f91ba5c3e575baa8ae093fbc3ac9c073561fc577fae8360ff6acdb4b650854fee75214140d27fdffe1063c8cd969bb75c16e68ef7563fcebc9cfd80d16fee42461e8b6f46f624229fdffd890cc6d9f6ed6abd89a3f2c0ba37a0d0bd58a74561d7ca167d090486222f7af6e035719a4cac0e56b058a356e5ef7c44015a50bb9ca601b7b77abec0cd8ee4ae02c5b66f3736c20662e26ce7f8721ccc8c82e9c17880b36780d28fdb2566049e97d22c81a5e0f4de65efbc49f26efd91135f214f519716019083270d0b6df6028c3835ab6885623c04d28ff278bf90ee30199cbdf05bbd46583cc500b402811bd5b8e1dc096f2bdbffa2da2b632a44e41facd7d8047a8676f1d4e326b318c67bee8dd3edce03c252939e1c99b66daa80c7aaab7c72dffb394408b3215e4e175e48082f6ffcd81f138b06f6c736a5018c9e41973bb895dd006432d93013e3b28a4f4c536cd5b0179da5ac144cfabe8975e34204cb7197d98ca66bfc7c563b361a60e93511629972533875667c2ea48242cd021cbca35f5cf743d5627c72156a8032aa0ab814f88f06de1c2169fe7d77d5c7e988e6b1b83b8798a16df091c0bd4fc296930e645f08bad7ccd917353f642a5e91ca37855c3ae395c4cc9cf8c84e7cc1385ba5779e32f3a19a122d3304ec62a0ff987585cb564d87ed4cb225e84d28f5908d22e095ecffecde547ab80c4273f4b5c6e147f13d79ee6c034b7d1ba8c352bdc11ccb883b165a7a3e0f522d934746a3df284c96a7da0f445916d2d3a9cba289c6cb825daeb44e1139357bc58dc03dc2ddba710e423c26cd9ac100cc72a6215fe83eddd56b836146915a574d7bcef2172ebddb676b74dbfd08bfd7da5168388fdf0b00d293300b54ee5c7bc008ead0b06e8400d7bbb3930bf5467b3f074a10649ed318b946eaee991531390f13ea52a2994cfe3283ff4dd5404409de7a00e28dc37ed41b75c42b8b62272731917ba86adbf4e52e7585c4db53fc46af36455fcf2b17e494b2eb3b391bb28b750d4fd612f4f74c7855ea6d605ae0bc18b3ef27576fcfac47d2b930f4d5442442b4d9aade5205a394fd6dd27bb979e1bdaad94521376bc23ccfa269aab5f6ba7aadbb22740c12b3e28acc9a8187497c482f20807b4f48aeaed3abad9e36d2d562c1dae53f46b62740a407f11412ed38fce163791f9ee62a9dea41de01f9feeb45b19153f937ecb9644c5d57456d44731ec86a5bc505fdc09eb9ff12f897be2d825a1912e30b52eafc0cd739be754cab921f51f2ff206b5d1feb46ba8ad22bec7dcba68ba89f5769f5baaa1dc8ca2915eb996236a50e6efd16cf29ab61223a0276535d42e6583516ada71c302807b8625d4cf165dd7b3d8e5782adfb2a5882a1c8f203487b8ccf77408bf6c19eb68ec7f5f540fae1ca08f0db7e34068fca585d33ed7ad9af3d2087e7cf6a5a9de46705e291766f3eedb664ab4fd439ac93efb946e7086a1058bdc8fd1f65673547adbf08f66ff37e1984b0e5d52c66acafbb4e69abd01f18f1d41405fc5b99fa515cba228bb76b7262274c134090e5458fcbf97a70d6193f00e6d86716d9ade24c76199408034f15150374f47ba7d79654c07207650e0d3aee51946878c9436c0e6991d64dfda2d8ae8eaf99b15be972f4f01238535c13cfba927aa05b1114544bd3f85e23ec0674e67d2cd4791cf1ae23227691b98b796562ead6688aab27b320f91553de8bed22f15908a9deb2701e8483786a481da1d3627b144a0b15b8f070d3c1a8120267e64ea589bd2b7a90d0d0ef9ddae047e2932dc93b74dacc0a46d3d336d834cf079c2e123bfdacfbf6bcc40b99965e39e04a33d2e5d93113b08da8da9eef8c46d896273d517ae95b9f82e8d223cc57cd81e87665fc06cf438cc08d6cd30158d3278ee89d1be6be2d4f6f3e769e6ffc3696bd7705bb4981120c9fbf7088a454b6f750abc223a70a7f8463d807f0c74f2b775c28c8e5ffc115295edfd109a127e58a5c839d0067132667793ee4cc53b0333ce98fd5ce53a1a26ffc602cedf39ccc7cb2b6e52f65e23a120d523719a9ef77e53e60a0e27931d0615ef397403ffb14513688a3bd6b7da4aedba9e75fe6dcb6227f63238890679da3be724e7b6f6df06ef874dc5614811771e56b301698bc3b1dc23fc09a0091c59f8b1c5c508d4f9eaa073eb79b446748435a00e5da373c17edf1022be00b9d862d2c80d549893577b660d144bfe31adc23fd742669e587c3165c88c12a68872c3d080f4aa290f3d4c265669e7ddc71aafa5511afc7180c51ae4cf066417b3bd5d25619ea9fc07b328365af7084eb5118ca33d744582fe56b748374dcb10a1ebbbea08e79b670adbfc64f0d73c0420d71b5cb11980fe63643aa91e0d9aebb2b27c2d9192d3bb47247fe7b3097a2fdc3ad20b9d5f907570b1ba69e10dbe90ee387e8fec75aa75ec9b50b7c998f4c463e8f1d5f846ccb22ad3f8cfa41d5955d210867b61e659ea64e084f40d1f78b0159ab09b2280324c96d10c91d862376076f6b8a65d67d6969f5cf0bd754ba60f611a61aeb5e15ba747a551291846b8c146058f7667d767794c3b67c50dbd8936bb7c5394e25952928142399a8b9daee9e968afba881ed91b202299779d89d0c367d401daddcd0f2b5935abb110aef5ba8570182ca45ae8aa860efe5db152cda1c47451ca62a50c2d49083ceb178eb6e31e748d48f3f70dab668c6b6a7565ab6e31ece48677a2d6842b78655ee8c5eeea99eacf49d9d346467b4b82b21f7dddf7effb7e84f45ed2f94879ad6e6184c7e602a121d5f2f7468038ea1d81da4cc246a20f027a86f50fefb14c006b63fbc3657c5c2f3f56674331b4d259bb5c327d456734a6646872707c68cd865d2ddd25f9f27c1244896f457d5fcaaf959f2557617aadf67ea92c47105357182c2bc831f423124b46d2278bfaaeb5f93733167e4bde5c2b7ebfebeb672a81436e0746468fb085b84ab9ca1059619831b0d8510ee6fb5077066d897854dee1febd639729d9dfc1dcc390a2c5d42543e62f9c9a633c3f19a5b82b020e5c7bf4ee0e707f53878a275719c7b74d9f84b46e3a0f638ce880d0a4549b5a855627a7f233f6980c23d0f5bd757b11cbe5c1779ebbb8c0a3b5f549802054d654d71b962041c8739581b53d10e023ae5aeaac60a0085579d38d079f546f4a387a34e6f02244dfa56d74225df90b52126c0acbadb10132a00ff43c87b8d048d765b6a5ef8b77b8e71e3ff7d36248074c2db790d8a5495697fd0224c487afa419d4c62f0a2480a34dc635a9f92de2e443a223aba41ee1b5109c95dd24e8438d9ee9a6ce9785ad548c6c506c54c78d5509c64047bf85407d7ff65c2a6120dadafc06a73a6e2a0a231fb175edb406d46e441007a1df9f740919a69af4316082b4ec4a0d79867d0e76455ba941ce901d9f927b4a87d3c9ebcc09a61ef3edcc39732a49cee1be5ef9d7ae5d6641209b3c637475b588c11f9fbdc75b6407e2d09b327a4d251b7d28bf6abe8b39260d66347b4d70dad619e3e1a486255a06070783952fcb93e2e94bc7870c5ce1f184e8485647e3e0c1526aa7aa7b039f5116e460ae38a68773210c99d7218a99df0bd182b38f2dd0f228919ae586eefe2b76686696ea3566314e4716de2e8e0fa346aa7a96ea9a1da03c9c0edd75947844bc63a4d7e433536fbc1f82ed788608f20c544ebac0d09e892842e1efd1c1c39512c9300fd5863f0dde0ca32d9369f8d83cb5aa4a10796671da03c93f8a813c13d422b000a554636eba0bcb3c3b0dc9ad4f7832ba30d6f8c372cda014e49129f56d3d4ff97af9a5dbdb41c12202996694ac3886038383bb57237f374ad69548b6c83708c5ebc95497778e7326e7a13b25d4a6613e085e6268f19cc549ddeaca42dbc5913679a9eccfb4185451080dbf816d20cf3ad2cf505851135b3b03f4edc2a5e973a2ebae1b88c386514fb69ed4951e8c5f727a1e680f11ecc56a8ae77fd35f3c366908564967127a6a1e8b18943b4c668c14f1c4e1c6e146ac80a1ab85af07b5e4b3112f810dd2816bb43ae9c6d63dc7c5c733feff0120bd4222ed7cc290badcad261077767e049ffbc8fe01c9a6f75ad07c3d9d2717b317634b2a959ecd6fec69b41ee69860a66aa716f5b03b2541b71703a2c900177d9bb0ebd8d0eafe8582f5d193d7a5805920223c8134fd8eb79ccd72956c96675b5d8815d7e8e5f0030a95772c88d2e95523b1c431c099afe46e071701ad5da693f984a1a10eb74afaf9886a361e5dd24ce8289126ec98533428ab1a96c765a9ced9cfaf29d537c15773e5b40d7d3983a773d9e33c5"], 0x1150}}], 0x1, 0x800) 17:52:24 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) 17:52:24 executing program 2: socket$inet_udp(0x2, 0x2, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r0, 0x39a, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000040)}]) io_getevents(r0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000001380)={0x77359400}) 17:52:24 executing program 4: r0 = syz_open_dev$mice(&(0x7f00000003c0)='/dev/input/mice\x00', 0x0, 0x8000) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000380)=0x2, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) connect(0xffffffffffffffff, &(0x7f0000000040)=@un=@abs, 0x80) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f00000000c0)=@routing={0x0, 0x2, 0x0, 0x0, 0x0, [@dev]}, 0x18) connect$inet6(r1, &(0x7f0000002740)={0xa, 0x0, 0x0, @dev, 0x4}, 0x79) sendmmsg(r1, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) syz_emit_ethernet(0xfed1, &(0x7f0000000240)=ANY=[@ANYBLOB="ffe0ffffffffff00ffffff1ce1ff4400fec30000000002009078ac14ffbbe00000010000000a0008907872f7dad4aa14952357ff227c29a971fd4e4d9218c3470d95aa03000000bcf7c99c612d2c02d57900d025ad1e6f76dbbadd5d3aa278d3008d48dee41fd0b255eaff6e942daca211db6a2f07bbf55270e03667bcc01fade6b30ee08ee6de3c19f8ffffffffffffffab29ab459c9c9e2759c6f596a0a10e00cd5ca740cd3151f5b2d4aab0aa89698829d589c2979be109b4c2779969b72d37fa36abfbbfb5a972d5ed9509b4c9d9"], 0x0) r2 = syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0x7, 0x2000) ioctl$sock_kcm_SIOCKCMUNATTACH(r2, 0x89e1, &(0x7f0000000200)={r1}) mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x2000, 0x0) ioctl$DRM_IOCTL_AGP_FREE(r3, 0x40206435, &(0x7f0000000180)={0x7, 0x0, 0x1, 0x8}) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)=""/56, &(0x7f0000000100)=0x38) 17:52:24 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, 0xffffffffffffffff) sendfile(r0, 0xffffffffffffffff, &(0x7f0000000100), 0x80003) 17:52:24 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000006e80)=[{&(0x7f0000000780)=@abs, 0x6e, &(0x7f0000002e00), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="180000000000000001000000010000004ebe05f7d71c2ecb"], 0x18}], 0x1, 0x0) sendmmsg(r0, &(0x7f0000006e00), 0x2, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x6, 0x10080) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000040)={'bond_slave_1\x00', 0x8}) 17:52:24 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/95) [ 220.232853] ================================================================== [ 220.240415] BUG: KASAN: use-after-free in __lock_acquire+0x37c2/0x4ec0 [ 220.247094] Read of size 8 at addr ffff8801babd8b48 by task syz-executor1/7459 [ 220.254451] [ 220.256092] CPU: 0 PID: 7459 Comm: syz-executor1 Not tainted 4.19.0-rc8+ #72 [ 220.263279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 220.272637] Call Trace: [ 220.275241] dump_stack+0x1c4/0x2b4 [ 220.278894] ? dump_stack_print_info.cold.2+0x52/0x52 [ 220.284093] ? printk+0xa7/0xcf [ 220.287379] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 220.292144] print_address_description.cold.8+0x9/0x1ff [ 220.297508] kasan_report.cold.9+0x242/0x309 [ 220.301924] ? __lock_acquire+0x37c2/0x4ec0 [ 220.306255] __asan_report_load8_noabort+0x14/0x20 [ 220.311192] __lock_acquire+0x37c2/0x4ec0 [ 220.315793] ? mark_held_locks+0x130/0x130 [ 220.320048] ? is_bpf_text_address+0xac/0x170 [ 220.324553] ? find_held_lock+0x36/0x1c0 [ 220.328618] ? depot_save_stack+0x292/0x470 [ 220.332945] ? lock_downgrade+0x900/0x900 [ 220.337098] ? trace_hardirqs_off+0xb8/0x310 [ 220.341514] ? kasan_check_read+0x11/0x20 [ 220.345675] ? do_raw_spin_unlock+0xa7/0x2f0 [ 220.350091] ? trace_hardirqs_on+0x310/0x310 [ 220.355040] ? kasan_check_write+0x14/0x20 [ 220.359283] ? do_raw_spin_lock+0xc1/0x200 [ 220.363525] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 220.368630] ? depot_save_stack+0x292/0x470 [ 220.373044] ? save_stack+0xa9/0xd0 [ 220.376765] ? save_stack+0x43/0xd0 [ 220.380400] ? __kasan_slab_free+0x102/0x150 [ 220.384829] lock_acquire+0x1ed/0x520 [ 220.388639] ? psock_map_pop.isra.23+0x93/0x3b0 [ 220.393316] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 220.398688] ? lock_release+0x970/0x970 [ 220.402673] ? trace_hardirqs_on+0x310/0x310 [ 220.407092] ? kasan_check_write+0x14/0x20 [ 220.411346] _raw_spin_lock_bh+0x31/0x40 [ 220.415412] ? psock_map_pop.isra.23+0x93/0x3b0 [ 220.420088] psock_map_pop.isra.23+0x93/0x3b0 [ 220.424588] ? trace_hardirqs_on+0xbd/0x310 [ 220.428912] ? smap_list_map_remove+0x360/0x360 [ 220.433588] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 220.439043] ? __kasan_slab_free+0x119/0x150 [ 220.443463] ? bpf_tcp_remove+0x546/0xca0 [ 220.447621] bpf_tcp_remove+0x54e/0xca0 [ 220.451602] ? graph_lock+0x170/0x170 [ 220.455408] ? free_sg+0x630/0x630 [ 220.458960] ? __lock_is_held+0xb5/0x140 [ 220.463035] ? tcp_check_oom+0x530/0x530 [ 220.467100] bpf_tcp_close+0x1c6/0x4a0 [ 220.471000] ? bpf_tcp_unhash+0x470/0x470 [ 220.475157] ? down_write+0x8a/0x130 [ 220.478875] ? ip_mc_drop_socket+0x20b/0x270 [ 220.483293] ? down_read+0x1d0/0x1d0 [ 220.487012] inet_release+0x104/0x1f0 [ 220.490832] __sock_release+0xd7/0x250 [ 220.494718] ? __sock_release+0x250/0x250 [ 220.498868] sock_close+0x19/0x20 [ 220.502322] __fput+0x385/0xa30 [ 220.505610] ? get_max_files+0x20/0x20 [ 220.509507] ? trace_hardirqs_on+0xbd/0x310 [ 220.513839] ? kasan_check_read+0x11/0x20 [ 220.518005] ? task_work_run+0x1af/0x2a0 [ 220.522712] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 220.528165] ? kasan_check_write+0x14/0x20 [ 220.532418] ? do_raw_spin_lock+0xc1/0x200 [ 220.536655] ____fput+0x15/0x20 [ 220.539940] task_work_run+0x1e8/0x2a0 [ 220.543837] ? task_work_cancel+0x240/0x240 [ 220.548165] ? copy_fd_bitmaps+0x210/0x210 [ 220.552409] ? do_syscall_64+0x9a/0x820 [ 220.556394] exit_to_usermode_loop+0x318/0x380 [ 220.560979] ? syscall_slow_exit_work+0x520/0x520 [ 220.565835] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 220.571382] do_syscall_64+0x6be/0x820 [ 220.575276] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 220.580648] ? syscall_return_slowpath+0x5e0/0x5e0 [ 220.585585] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 220.590441] ? trace_hardirqs_on_caller+0x310/0x310 [ 220.595457] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 220.600471] ? prepare_exit_to_usermode+0x291/0x3b0 [ 220.605499] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 220.610352] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 220.615543] RIP: 0033:0x411021 [ 220.618745] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 19 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 220.637657] RSP: 002b:00007ffe66ea78b0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 220.645377] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000411021 [ 220.652653] RDX: 0000000000000000 RSI: 00000000007310c0 RDI: 0000000000000003 [ 220.659926] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 220.667206] R10: 00007ffe66ea77d0 R11: 0000000000000293 R12: 0000000000000000 [ 220.674483] R13: 0000000000000001 R14: 000000000000001a R15: 0000000000000001 [ 220.681756] [ 220.683395] Allocated by task 7462: [ 220.687033] save_stack+0x43/0xd0 [ 220.690489] kasan_kmalloc+0xc7/0xe0 [ 220.694210] kmem_cache_alloc_node_trace+0x14c/0x740 [ 220.699322] __sock_map_ctx_update_elem.isra.26+0x7a9/0x12f0 [ 220.705147] sock_hash_ctx_update_elem.isra.30+0x7b8/0x1490 [ 220.710959] sock_hash_update_elem+0x282/0x5f0 [ 220.715541] map_update_elem+0x753/0xd50 [ 220.719601] __x64_sys_bpf+0x32d/0x510 [ 220.723502] do_syscall_64+0x1b9/0x820 [ 220.727397] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 220.732586] [ 220.734213] Freed by task 2497: [ 220.737500] save_stack+0x43/0xd0 [ 220.740957] __kasan_slab_free+0x102/0x150 [ 220.745195] kasan_slab_free+0xe/0x10 [ 220.748998] kfree+0xcf/0x230 [ 220.752112] smap_gc_work+0x910/0xc70 [ 220.755915] process_one_work+0xc90/0x1b90 [ 220.760151] worker_thread+0x17f/0x1390 [ 220.764133] kthread+0x35a/0x420 [ 220.767505] ret_from_fork+0x3a/0x50 [ 220.771220] [ 220.772850] The buggy address belongs to the object at ffff8801babd8900 [ 220.772850] which belongs to the cache kmalloc-1024 of size 1024 [ 220.785688] The buggy address is located 584 bytes inside of [ 220.785688] 1024-byte region [ffff8801babd8900, ffff8801babd8d00) [ 220.797652] The buggy address belongs to the page: [ 220.802593] page:ffffea0006eaf600 count:1 mapcount:0 mapping:ffff8801da800ac0 index:0x0 compound_mapcount: 0 [ 220.812569] flags: 0x2fffc0000008100(slab|head) [ 220.817251] raw: 02fffc0000008100 ffffea0007186c08 ffffea0006c78d08 ffff8801da800ac0 [ 220.825139] raw: 0000000000000000 ffff8801babd8000 0000000100000007 0000000000000000 [ 220.833016] page dumped because: kasan: bad access detected [ 220.838722] [ 220.840349] Memory state around the buggy address: [ 220.845280] ffff8801babd8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 220.852642] ffff8801babd8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 220.859999] >ffff8801babd8b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 220.867354] ^ [ 220.873065] ffff8801babd8b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 220.880428] ffff8801babd8c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 220.887791] ================================================================== [ 220.895143] Disabling lock debugging due to kernel taint [ 220.900588] Kernel panic - not syncing: panic_on_warn set ... [ 220.900588] [ 220.907972] CPU: 0 PID: 7459 Comm: syz-executor1 Tainted: G B 4.19.0-rc8+ #72 [ 220.916550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 220.925903] Call Trace: [ 220.928506] dump_stack+0x1c4/0x2b4 [ 220.932315] ? dump_stack_print_info.cold.2+0x52/0x52 [ 220.937510] ? lock_downgrade+0x900/0x900 [ 220.941671] panic+0x238/0x4e7 [ 220.944868] ? add_taint.cold.5+0x16/0x16 [ 220.949016] ? add_taint.cold.5+0x5/0x16 [ 220.953089] ? trace_hardirqs_off+0xaf/0x310 [ 220.957503] kasan_end_report+0x47/0x4f [ 220.961482] kasan_report.cold.9+0x76/0x309 [ 220.965808] ? __lock_acquire+0x37c2/0x4ec0 [ 220.970136] __asan_report_load8_noabort+0x14/0x20 [ 220.975069] __lock_acquire+0x37c2/0x4ec0 [ 220.979231] ? mark_held_locks+0x130/0x130 [ 220.983474] ? is_bpf_text_address+0xac/0x170 [ 220.987979] ? find_held_lock+0x36/0x1c0 [ 220.992056] ? depot_save_stack+0x292/0x470 [ 220.996387] ? lock_downgrade+0x900/0x900 [ 221.000545] ? trace_hardirqs_off+0xb8/0x310 [ 221.004958] ? kasan_check_read+0x11/0x20 [ 221.009112] ? do_raw_spin_unlock+0xa7/0x2f0 [ 221.013529] ? trace_hardirqs_on+0x310/0x310 [ 221.017940] ? kasan_check_write+0x14/0x20 [ 221.022177] ? do_raw_spin_lock+0xc1/0x200 [ 221.026451] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 221.031645] ? depot_save_stack+0x292/0x470 [ 221.035975] ? save_stack+0xa9/0xd0 [ 221.039602] ? save_stack+0x43/0xd0 [ 221.043233] ? __kasan_slab_free+0x102/0x150 [ 221.047652] lock_acquire+0x1ed/0x520 [ 221.051460] ? psock_map_pop.isra.23+0x93/0x3b0 [ 221.056137] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 221.061522] ? lock_release+0x970/0x970 [ 221.065509] ? trace_hardirqs_on+0x310/0x310 [ 221.069929] ? kasan_check_write+0x14/0x20 [ 221.074175] _raw_spin_lock_bh+0x31/0x40 [ 221.078250] ? psock_map_pop.isra.23+0x93/0x3b0 [ 221.082943] psock_map_pop.isra.23+0x93/0x3b0 [ 221.087444] ? trace_hardirqs_on+0xbd/0x310 [ 221.091784] ? smap_list_map_remove+0x360/0x360 [ 221.096464] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 221.101942] ? __kasan_slab_free+0x119/0x150 [ 221.106362] ? bpf_tcp_remove+0x546/0xca0 [ 221.110523] bpf_tcp_remove+0x54e/0xca0 [ 221.114506] ? graph_lock+0x170/0x170 [ 221.118319] ? free_sg+0x630/0x630 [ 221.121868] ? __lock_is_held+0xb5/0x140 [ 221.125942] ? tcp_check_oom+0x530/0x530 [ 221.130013] bpf_tcp_close+0x1c6/0x4a0 [ 221.133908] ? bpf_tcp_unhash+0x470/0x470 [ 221.138301] ? down_write+0x8a/0x130 [ 221.142018] ? ip_mc_drop_socket+0x20b/0x270 [ 221.146521] ? down_read+0x1d0/0x1d0 [ 221.150241] inet_release+0x104/0x1f0 [ 221.154048] __sock_release+0xd7/0x250 [ 221.157945] ? __sock_release+0x250/0x250 [ 221.162098] sock_close+0x19/0x20 [ 221.165556] __fput+0x385/0xa30 [ 221.168843] ? get_max_files+0x20/0x20 [ 221.172738] ? trace_hardirqs_on+0xbd/0x310 [ 221.177092] ? kasan_check_read+0x11/0x20 [ 221.181249] ? task_work_run+0x1af/0x2a0 [ 221.185324] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 221.190785] ? kasan_check_write+0x14/0x20 [ 221.195033] ? do_raw_spin_lock+0xc1/0x200 [ 221.199286] ____fput+0x15/0x20 [ 221.202578] task_work_run+0x1e8/0x2a0 [ 221.206473] ? task_work_cancel+0x240/0x240 [ 221.210799] ? copy_fd_bitmaps+0x210/0x210 [ 221.215038] ? do_syscall_64+0x9a/0x820 [ 221.219023] exit_to_usermode_loop+0x318/0x380 [ 221.223612] ? syscall_slow_exit_work+0x520/0x520 [ 221.228463] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 221.234008] do_syscall_64+0x6be/0x820 [ 221.237903] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 221.246411] ? syscall_return_slowpath+0x5e0/0x5e0 [ 221.251354] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 221.256209] ? trace_hardirqs_on_caller+0x310/0x310 [ 221.261239] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 221.266271] ? prepare_exit_to_usermode+0x291/0x3b0 [ 221.271298] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 221.276154] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 221.281351] RIP: 0033:0x411021 [ 221.284552] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 19 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 221.303458] RSP: 002b:00007ffe66ea78b0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 221.311176] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000411021 [ 221.318457] RDX: 0000000000000000 RSI: 00000000007310c0 RDI: 0000000000000003 [ 221.325745] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 221.333027] R10: 00007ffe66ea77d0 R11: 0000000000000293 R12: 0000000000000000 [ 221.340306] R13: 0000000000000001 R14: 000000000000001a R15: 0000000000000001 [ 221.348924] Kernel Offset: disabled [ 221.352559] Rebooting in 86400 seconds..