[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 55.734478][ T26] audit: type=1800 audit(1573922984.784:25): pid=8723 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 55.768393][ T26] audit: type=1800 audit(1573922984.784:26): pid=8723 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 55.824620][ T26] audit: type=1800 audit(1573922984.784:27): pid=8723 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.49' (ECDSA) to the list of known hosts. 2019/11/16 16:49:56 fuzzer started 2019/11/16 16:49:58 dialing manager at 10.128.0.26:44591 2019/11/16 16:49:58 syscalls: 2566 2019/11/16 16:49:58 code coverage: enabled 2019/11/16 16:49:58 comparison tracing: enabled 2019/11/16 16:49:58 extra coverage: enabled 2019/11/16 16:49:58 setuid sandbox: enabled 2019/11/16 16:49:58 namespace sandbox: enabled 2019/11/16 16:49:58 Android sandbox: /sys/fs/selinux/policy does not exist 2019/11/16 16:49:58 fault injection: enabled 2019/11/16 16:49:58 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/11/16 16:49:58 net packet injection: enabled 2019/11/16 16:49:58 net device setup: enabled 2019/11/16 16:49:58 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2019/11/16 16:49:58 devlink PCI setup: PCI device 0000:00:10.0 is not available 16:52:06 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$packet(0x11, 0x2, 0x300) r3 = fcntl$dupfd(r1, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x58, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x3}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 16:52:06 executing program 1: rt_sigprocmask(0x0, &(0x7f0000000000)={0xfffffffffffffffe}, 0x0, 0x8) r0 = gettid() tkill(r0, 0x3f) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000ff8)={0xfffffffffffffdb0}, 0x8, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) read(r1, &(0x7f00000001c0)=""/128, 0x3ea) syzkaller login: [ 197.757919][ T8889] IPVS: ftp: loaded support on port[0] = 21 [ 197.947774][ T8889] chnl_net:caif_netlink_parms(): no params data found [ 197.952793][ T8892] IPVS: ftp: loaded support on port[0] = 21 16:52:07 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000003a40)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xffe0) [ 198.045641][ T8889] bridge0: port 1(bridge_slave_0) entered blocking state [ 198.054667][ T8889] bridge0: port 1(bridge_slave_0) entered disabled state [ 198.063254][ T8889] device bridge_slave_0 entered promiscuous mode [ 198.092776][ T8889] bridge0: port 2(bridge_slave_1) entered blocking state [ 198.102417][ T8889] bridge0: port 2(bridge_slave_1) entered disabled state [ 198.110848][ T8889] device bridge_slave_1 entered promiscuous mode [ 198.203487][ T8889] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 198.223565][ T8892] chnl_net:caif_netlink_parms(): no params data found [ 198.244071][ T8889] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 198.289070][ T8889] team0: Port device team_slave_0 added [ 198.306548][ T8896] IPVS: ftp: loaded support on port[0] = 21 [ 198.314112][ T8889] team0: Port device team_slave_1 added 16:52:07 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="6653f0d89abf4d209bc876003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805ae64f8f36460234432479aed75d492b41fd983f79e65199615607672c59957ab35f4ad614fd33cebbc158bb2b03b5b2461179f5f90bba001b5080da6218a8106df2858ec973328e5a2c078a3fe3b52020203517e25ee74e82ba80a0fa881e689f7615baf78f08ea33bcb860d6a0b61193d4a1cb622431d42fee5e91531bfdfe5cb19ff15d6d891a92efa823a3c231ea82fdf0e7fcf567362f600a24", 0xc5}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 198.366164][ T8892] bridge0: port 1(bridge_slave_0) entered blocking state [ 198.388448][ T8892] bridge0: port 1(bridge_slave_0) entered disabled state [ 198.396177][ T8892] device bridge_slave_0 entered promiscuous mode [ 198.430548][ T8892] bridge0: port 2(bridge_slave_1) entered blocking state [ 198.437634][ T8892] bridge0: port 2(bridge_slave_1) entered disabled state [ 198.447645][ T8892] device bridge_slave_1 entered promiscuous mode [ 198.492545][ T8889] device hsr_slave_0 entered promiscuous mode [ 198.540642][ T8889] device hsr_slave_1 entered promiscuous mode [ 198.628134][ T8892] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 198.650909][ T8892] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 16:52:07 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x400000000004e22}, 0x1c) sendto$inet6(r4, &(0x7f0000000780)="f80fbd5da1b3c0f09d3d94815745711bc76fe5db01b2fc2212e65d8952d0e6c6a78d9f733c0b2e6e682851541ccb5deb7457e151cc1b5b5f36b48923af79e3e31d74d21dc9276ec6f239daf8840b23b84d41ef4054d550e46cfccfc13cb3a98b0115acdeb9a444078b26402b41c98ab137b29323385056b60a526b3761a836df03793a0d70bc210cdffb72830619e25a176e9093cd2f7638c729ff1729c356aa239337240d338a81f3518edc86ef1b5c6cd42d1cb29af9759c30b7c23ffae4fecf251357f1393e3a0323f95bd74bbf0ef60ffaf5f145b6f799b8b78adeefd3fdd5e5c640aeef43a440e9ff23509a446d6fa8496d4d073d1b98352d9ad48c32cc08b80ddf39dd47ed07b16dc93e526db098de8a840c9c65cbdbae98c40da0ef48e76429d4a74a2b228bfba5ed2eaf754154621255f65595ffaa1ae75d0dbc34502d79c49efd77849986e5dc12189002f11145da3d56c1ce8cac370b43b3cee8e8065e18dbb19fcd57d51c44f54f94f17368586f53dbaf3be6e5aba47cccac708235c3d6f75e18d397fd167aee63522153e59d14fc28996fae0c2ee0a6c582146530547829808681f6f631ece598d63118a08a4550534ac8ad228c05182eb2fee2a304b6d27db943307578e78c68b2b3889abf3158ec7fd4603aa7a6b601769724e669c4a3dc74afaeba1ed37b00ec985b1553e3452de574312e12114412bbefa6b1ac9d613fe505421f835f8c3a17aa04f20be028c321f176", 0x218, 0x8000, 0x0, 0x0) close(r4) [ 198.683709][ T8898] IPVS: ftp: loaded support on port[0] = 21 [ 198.714529][ T8889] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 198.772744][ T8892] team0: Port device team_slave_0 added [ 198.791796][ T8892] team0: Port device team_slave_1 added [ 198.866066][ T8889] netdevsim netdevsim0 netdevsim1: renamed from eth1 16:52:08 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6(0x10, 0x400000000000002, 0x0) sendmsg(r3, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000002c0)="5500000018007f0500fe01b2a4a280930a06000000000000000200003900090035005056030000001900095ce7ded3b2cc4554dc1338d54400009b03006ef75afb83de4411000500fe80000000000000ec4fab91d4", 0x55}], 0x1}, 0x0) [ 198.910698][ T8889] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 198.982678][ T8889] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 199.054987][ T8896] chnl_net:caif_netlink_parms(): no params data found [ 199.086734][ T8904] IPVS: ftp: loaded support on port[0] = 21 [ 199.123715][ T8901] IPVS: ftp: loaded support on port[0] = 21 [ 199.162262][ T8892] device hsr_slave_0 entered promiscuous mode [ 199.218719][ T8892] device hsr_slave_1 entered promiscuous mode [ 199.268481][ T8892] debugfs: Directory 'hsr0' with parent '/' already present! [ 199.305631][ T8896] bridge0: port 1(bridge_slave_0) entered blocking state [ 199.312845][ T8896] bridge0: port 1(bridge_slave_0) entered disabled state [ 199.321148][ T8896] device bridge_slave_0 entered promiscuous mode [ 199.332657][ T8896] bridge0: port 2(bridge_slave_1) entered blocking state [ 199.339881][ T8896] bridge0: port 2(bridge_slave_1) entered disabled state [ 199.347582][ T8896] device bridge_slave_1 entered promiscuous mode [ 199.400184][ T8896] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 199.421395][ T8892] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 199.482914][ T8892] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 199.541540][ T8896] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 199.571623][ T8892] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 199.620972][ T8892] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 199.696843][ T8896] team0: Port device team_slave_0 added [ 199.708061][ T8896] team0: Port device team_slave_1 added [ 199.762375][ T8904] chnl_net:caif_netlink_parms(): no params data found [ 199.849625][ T8898] chnl_net:caif_netlink_parms(): no params data found [ 199.868086][ T8904] bridge0: port 1(bridge_slave_0) entered blocking state [ 199.875728][ T8904] bridge0: port 1(bridge_slave_0) entered disabled state [ 199.883912][ T8904] device bridge_slave_0 entered promiscuous mode [ 199.920686][ T8904] bridge0: port 2(bridge_slave_1) entered blocking state [ 199.927771][ T8904] bridge0: port 2(bridge_slave_1) entered disabled state [ 199.936855][ T8904] device bridge_slave_1 entered promiscuous mode [ 199.990417][ T8896] device hsr_slave_0 entered promiscuous mode [ 200.039215][ T8896] device hsr_slave_1 entered promiscuous mode [ 200.098402][ T8896] debugfs: Directory 'hsr0' with parent '/' already present! [ 200.115939][ T8889] 8021q: adding VLAN 0 to HW filter on device bond0 [ 200.135835][ T8904] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 200.198751][ T8904] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 200.256863][ T8898] bridge0: port 1(bridge_slave_0) entered blocking state [ 200.264710][ T8898] bridge0: port 1(bridge_slave_0) entered disabled state [ 200.273782][ T8898] device bridge_slave_0 entered promiscuous mode [ 200.281236][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 200.290600][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 200.299062][ T8896] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 200.345244][ T8896] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 200.404585][ T8904] team0: Port device team_slave_0 added [ 200.411164][ T8898] bridge0: port 2(bridge_slave_1) entered blocking state [ 200.418811][ T8898] bridge0: port 2(bridge_slave_1) entered disabled state [ 200.426553][ T8898] device bridge_slave_1 entered promiscuous mode [ 200.449591][ T8898] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 200.461561][ T8896] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 200.521975][ T8904] team0: Port device team_slave_1 added [ 200.531769][ T8889] 8021q: adding VLAN 0 to HW filter on device team0 [ 200.545230][ T8898] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 200.554855][ T8901] chnl_net:caif_netlink_parms(): no params data found [ 200.567534][ T8896] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 200.626083][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 200.636169][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 200.644754][ T2847] bridge0: port 1(bridge_slave_0) entered blocking state [ 200.651954][ T2847] bridge0: port 1(bridge_slave_0) entered forwarding state [ 200.661582][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 200.674640][ T8892] 8021q: adding VLAN 0 to HW filter on device bond0 [ 200.702842][ T8898] team0: Port device team_slave_0 added [ 200.709639][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 200.721673][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 200.730872][ T3617] bridge0: port 2(bridge_slave_1) entered blocking state [ 200.737917][ T3617] bridge0: port 2(bridge_slave_1) entered forwarding state [ 200.768172][ T8898] team0: Port device team_slave_1 added [ 200.784981][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 200.794241][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 200.818157][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 200.829140][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 200.837502][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 200.846235][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 200.856192][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 200.911854][ T8904] device hsr_slave_0 entered promiscuous mode [ 200.948851][ T8904] device hsr_slave_1 entered promiscuous mode [ 200.988432][ T8904] debugfs: Directory 'hsr0' with parent '/' already present! [ 201.007767][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 201.021373][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 201.080753][ T8898] device hsr_slave_0 entered promiscuous mode [ 201.118711][ T8898] device hsr_slave_1 entered promiscuous mode [ 201.178447][ T8898] debugfs: Directory 'hsr0' with parent '/' already present! [ 201.194790][ T8889] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 201.213776][ T8889] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 201.221723][ T8901] bridge0: port 1(bridge_slave_0) entered blocking state [ 201.229513][ T8901] bridge0: port 1(bridge_slave_0) entered disabled state [ 201.237216][ T8901] device bridge_slave_0 entered promiscuous mode [ 201.245179][ T8901] bridge0: port 2(bridge_slave_1) entered blocking state [ 201.252526][ T8901] bridge0: port 2(bridge_slave_1) entered disabled state [ 201.261651][ T8901] device bridge_slave_1 entered promiscuous mode [ 201.270371][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 201.282156][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 201.327709][ T8901] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 201.350516][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 201.358510][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 201.368715][ T8901] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 201.407152][ T8892] 8021q: adding VLAN 0 to HW filter on device team0 [ 201.419689][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 201.427077][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 201.434615][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 201.443313][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 201.452507][ T2847] bridge0: port 1(bridge_slave_0) entered blocking state [ 201.459616][ T2847] bridge0: port 1(bridge_slave_0) entered forwarding state [ 201.470544][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 201.496181][ T8898] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 201.563121][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 201.572248][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 201.581479][ T8903] bridge0: port 2(bridge_slave_1) entered blocking state [ 201.588572][ T8903] bridge0: port 2(bridge_slave_1) entered forwarding state [ 201.596582][ T8904] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 201.652371][ T8901] team0: Port device team_slave_0 added [ 201.663201][ T8901] team0: Port device team_slave_1 added [ 201.681099][ T8898] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 201.721664][ T8889] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 201.736779][ T8904] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 201.790838][ T8904] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 201.881659][ T8901] device hsr_slave_0 entered promiscuous mode [ 201.929161][ T8901] device hsr_slave_1 entered promiscuous mode [ 201.969516][ T8901] debugfs: Directory 'hsr0' with parent '/' already present! [ 201.987885][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 202.008096][ T8898] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 202.057043][ T8904] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 202.135654][ T8892] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 202.146372][ T8892] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 202.158053][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 202.167073][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 202.176225][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 202.184788][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 202.193671][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 202.202367][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 202.210920][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 202.220011][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 202.228393][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 202.236663][ T8898] netdevsim netdevsim3 netdevsim3: renamed from eth3 16:52:11 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x400004e21, 0x0, @empty}, 0x1c) setsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f00000000c0)=0x7, 0x4) setsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x8) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e21, 0x0, @loopback}, 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup3(r2, r3, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) [ 202.295585][ T8896] 8021q: adding VLAN 0 to HW filter on device bond0 [ 202.320744][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 202.332836][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 202.387089][ T8896] 8021q: adding VLAN 0 to HW filter on device team0 [ 202.404405][ T8901] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 202.462556][ T8901] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 202.521094][ T8901] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 202.562050][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 202.571700][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 202.579500][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 202.587157][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 202.607672][ T8892] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 202.616910][ T8901] netdevsim netdevsim4 netdevsim3: renamed from eth3 16:52:11 executing program 0: [ 202.658684][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 202.667367][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 202.676085][ T8903] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.683199][ T8903] bridge0: port 1(bridge_slave_0) entered forwarding state [ 202.695016][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 202.778366][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 202.787329][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready 16:52:11 executing program 0: [ 202.823267][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.830439][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 202.864052][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 202.875422][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 202.884457][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready 16:52:11 executing program 1: 16:52:11 executing program 0: [ 202.916353][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready 16:52:12 executing program 1: [ 202.998735][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 203.006726][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 203.025856][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready 16:52:12 executing program 0: syz_open_dev$mice(0x0, 0x0, 0x0) syz_extract_tcp_res(&(0x7f00000000c0), 0x1, 0x0) ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000400)=""/151) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) socketpair$unix(0x1, 0x200000000000001, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = add_key$user(&(0x7f0000000080)='user\x00', &(0x7f0000000340)={'syz', 0x2}, &(0x7f0000000540)="effd60065bd0c7cbb9b693ea6192237f930d5fad7bd58bfeb8d6997d2c56150451b6d627a57f4f3e584ca9135c321b0a836937ff9b4925cc749b9435a3cbdeedef8d2eb11d64f553a7ea2a3c032e19462a75b20712c2c153d0902221f59fe6eb49e692e0d450ce2a7c38d0af316ec32500b4f7ed588a5400f4fbeb9771e85c636756d12d50f3b2444cb4919fcef1fa445cd28de684", 0x95, 0xfffffffffffffffb) r3 = add_key(&(0x7f0000000600)='logon\x00', &(0x7f0000000640)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$search(0xa, r2, &(0x7f0000000380)='rxrpc\x00', &(0x7f00000004c0)={'syz', 0x1}, r3) write$binfmt_elf64(r0, &(0x7f0000000200)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [{}]}, 0xffffffffffffff41) recvfrom$unix(r1, &(0x7f0000000040)=""/4, 0xfffffffffffffda1, 0x3f00, &(0x7f0000000100)=@abs, 0xa) r4 = memfd_create(&(0x7f0000000140)='#em1#+\x00', 0x0) write(r4, &(0x7f0000000000)="641c508c0eed24018a921b24aba9e5afa50bc61d177ee50316ee964196cf924eac2b5586865f3bbc1008ed", 0x2b) sendfile(r4, r4, &(0x7f0000001000), 0xffff) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x0, 0x11, r4, 0x0) open(&(0x7f0000000180)='./bus\x00', 0xfffffffffffffffd, 0x0) geteuid() ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r1, 0xc0096616, &(0x7f0000000280)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r5 = gettid() ptrace$setopts(0x4206, r5, 0x0, 0x0) tkill(r5, 0x17) r6 = syz_open_procfs(r5, &(0x7f00000002c0)='smaps_rollup\x00') sendmsg$IPVS_CMD_DEL_DEST(r6, &(0x7f0000000840)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40800400}, 0xc, &(0x7f00000006c0)={&(0x7f0000000780)={0xb0, 0x0, 0x300, 0x70bd26, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3ff}, @IPVS_CMD_ATTR_DAEMON={0x58, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x9}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}]}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x3f}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x3}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x40880}, 0x0) syz_open_procfs(0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000500), 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x2, &(0x7f0000000240)=ANY=[@ANYRES32, @ANYBLOB="00000000000000009500000000000000"], 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) [ 203.042552][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 203.074243][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 203.082991][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 203.097743][ T8903] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 16:52:12 executing program 1: [ 203.124436][ T8896] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 203.200736][ T8898] 8021q: adding VLAN 0 to HW filter on device bond0 [ 203.219027][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 203.226464][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 203.279762][ T8898] 8021q: adding VLAN 0 to HW filter on device team0 [ 203.314413][ T8896] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 203.329314][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 203.340323][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 203.369669][ T8904] 8021q: adding VLAN 0 to HW filter on device bond0 [ 203.388757][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 203.399688][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 203.409365][ T2847] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.416517][ T2847] bridge0: port 1(bridge_slave_0) entered forwarding state [ 203.427159][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 203.435784][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 203.444243][ T2847] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.451348][ T2847] bridge0: port 2(bridge_slave_1) entered forwarding state [ 203.459624][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 203.468167][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 203.480022][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 203.487889][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 203.496498][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 203.513246][ T8904] 8021q: adding VLAN 0 to HW filter on device team0 [ 203.542435][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 203.551116][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 203.571030][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 16:52:12 executing program 2: [ 203.591365][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 203.603469][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 203.615819][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 203.625137][ T8893] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 203.656206][ T8898] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 203.691942][ T8898] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 203.700952][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 203.710183][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 203.725891][ T2847] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.733005][ T2847] bridge0: port 1(bridge_slave_0) entered forwarding state [ 203.740841][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 203.749664][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 203.757987][ T2847] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.765093][ T2847] bridge0: port 2(bridge_slave_1) entered forwarding state [ 203.774577][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 203.783151][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 203.800821][ T8901] 8021q: adding VLAN 0 to HW filter on device bond0 [ 203.809831][ T8909] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 203.817855][ T8909] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 203.845941][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 203.856520][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 203.865942][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 203.874666][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 203.883541][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 203.892126][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 203.900665][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 203.909077][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 203.917583][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 203.926384][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 203.956646][ T8898] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 203.969258][ T8909] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 203.976762][ T8909] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 203.993672][ T8904] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 204.006310][ T8901] 8021q: adding VLAN 0 to HW filter on device team0 [ 204.040800][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 204.049470][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 204.082514][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 204.092205][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 204.100930][ T3617] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.108006][ T3617] bridge0: port 1(bridge_slave_0) entered forwarding state [ 204.119572][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 16:52:13 executing program 1: [ 204.129015][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 204.137475][ T3617] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.144608][ T3617] bridge0: port 2(bridge_slave_1) entered forwarding state [ 204.151015][ T8950] ptrace attach of "/root/syz-executor.3"[8949] was attempted by "/root/syz-executor.3"[8950] [ 204.153625][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 204.195026][ T8904] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 204.218723][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 204.228113][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 204.251124][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 204.295927][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 204.305316][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 204.322123][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 204.334438][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 204.344946][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 204.355499][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 204.368706][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 204.377180][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 204.391431][ T8901] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 204.403802][ T8901] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 204.416124][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 204.424911][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 204.454709][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 204.463123][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 204.476747][ T8901] 8021q: adding VLAN 0 to HW filter on device batadv0 16:52:13 executing program 4: [ 204.602230][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 204.620269][ C1] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 204.638407][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 204.644467][ C0] protocol 88fb is buggy, dev hsr_slave_1 16:52:13 executing program 5: 16:52:13 executing program 3: 16:52:13 executing program 2: 16:52:13 executing program 0: 16:52:13 executing program 1: 16:52:13 executing program 4: 16:52:13 executing program 3: 16:52:13 executing program 1: 16:52:13 executing program 2: creat(&(0x7f0000000000)='./bus\x00', 0x0) mount(&(0x7f00000002c0)=ANY=[@ANYBLOB="85"], &(0x7f0000000100)='./bus\x00', &(0x7f0000000140)='ubifs\x00', 0x0, 0x0) 16:52:13 executing program 0: 16:52:13 executing program 4: 16:52:13 executing program 5: 16:52:14 executing program 3: 16:52:14 executing program 1: 16:52:14 executing program 0: 16:52:14 executing program 4: 16:52:14 executing program 5: [ 205.057394][ T8997] UBIFS error (pid: 8997): cannot open "…", error -22 16:52:14 executing program 2: 16:52:14 executing program 3: 16:52:14 executing program 4: 16:52:14 executing program 5: 16:52:14 executing program 0: 16:52:14 executing program 1: 16:52:14 executing program 2: 16:52:14 executing program 3: 16:52:14 executing program 4: 16:52:14 executing program 1: 16:52:14 executing program 0: 16:52:14 executing program 5: 16:52:14 executing program 2: 16:52:14 executing program 3: 16:52:14 executing program 0: 16:52:14 executing program 1: 16:52:14 executing program 5: 16:52:14 executing program 4: 16:52:14 executing program 2: 16:52:14 executing program 3: 16:52:15 executing program 1: 16:52:15 executing program 4: 16:52:15 executing program 0: 16:52:15 executing program 5: 16:52:15 executing program 3: 16:52:15 executing program 1: 16:52:15 executing program 5: 16:52:15 executing program 4: 16:52:15 executing program 0: 16:52:15 executing program 2: 16:52:15 executing program 3: 16:52:15 executing program 1: 16:52:15 executing program 2: 16:52:15 executing program 4: 16:52:15 executing program 0: 16:52:15 executing program 5: 16:52:15 executing program 1: 16:52:15 executing program 0: 16:52:15 executing program 2: 16:52:15 executing program 3: 16:52:15 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7, 0x0, 0xfffffffe}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00\xc7\xec\xac\xd9&{\x0f\x96\xad\xd1\x8fl![\x8f\xb9\f\xca\x1d\xc2{\xee\xb7\x03K\x0f\xa6\xaa;\xf6\x89\xf7b^\xa5\xafI\r\xc4\x9f\v\xf2\x1c\xdc\xddp2\xb7\xbb\x1b\xfev\xea\xed\xe0\xaa\xe8\xceR`\xbb\xf2\xed;pC\x19\xbfn\x16\xaa\x199\xfe.Q\xebvB\xd2\x19&l?\x87\x17H\x1f.\xdbA\x1b\xafz\xe3\xdc};*\xec\xfe\xfa\xfb/\x18g\x80y\xfe\x89', 0x26e1, 0x0) close(r0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)) write$cgroup_type(r1, &(0x7f0000000080)='threaded\x00', 0xfffffc61) recvmsg(r0, &(0x7f0000000140)={0x0, 0x100000039, &(0x7f0000000000)=[{&(0x7f0000000380)=""/110, 0xffffffd9}], 0x1, 0x0, 0x4a}, 0x2f04) 16:52:15 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket(0x11, 0x3, 0xaf) 16:52:15 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") sendto$ax25(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000780)={{0x3, @null}, [@bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') sendmsg$FOU_CMD_ADD(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x24, r2, 0x1, 0x0, 0x0, {}, [@FOU_ATTR_LOCAL_V4={0x8, 0x6, @initdev}, @FOU_ATTR_PEER_V4={0x8, 0xb}]}, 0x24}}, 0x0) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) 16:52:15 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000480)='/dev/video#\x00', 0x4, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup3(r2, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ppoll(&(0x7f0000001a80)=[{r0}, {r3}], 0x2, 0x0, 0x0, 0x0) 16:52:15 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x900c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x81, 0x2, 0xffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='/group.stat\x00', 0x2761, 0x0) openat$cgroup_int(r0, &(0x7f0000000140)='io.max\x00', 0x2, 0x0) r1 = gettid() ioctl$TUNSETIFF(0xffffffffffffffff, 0x5452, &(0x7f0000000280)={'nr0\x01\x00'}) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000240)) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x1420, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, r1, 0x0, 0xffffffffffffffff, 0x2) close(r2) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000005c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x92\xee2\xc2$Wx\x15^\xdaM\xeaB\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WZ;\xce\x05\xfc\x95\xd9\x88\x1f|\x8b\xf1\xbf\xf2u\xdd\xd8AV\xd87\x96M\xea\xd2\xa2iM\xe9\xa1\xbc\xba}\xbe\xa1\x05J\"\f\xf9\b\xcf\xb8J\x13#\xecT\xdf\xe0\x9dOA>\xe9\x99\xf8\xaf@{dw\b\xe7{\xaf\x9a\x1e3\xc1\x83&\x89\xc2\xa5\xb1\xe2NN\xdf\xd3\x0f{\x8c\xc1\xc8y\x01\x04\x00\xc7\x94\xe3\x89|\xd7\x9f\xd3\x06\x17\xe6]\xd7\x81q\x1d\x1dN\x9e\xf4c\x83\x86_\xfc\xbc\xdd\xd4{\xde\xc4\xe5\xb6\b;L\x1cN\xa2\xc9k\xd7 \xc3\xe4\x19\x96\x8c\x04\xea\x9c9\xfa\xe3\xc1\x8dDuTHL\n\xe8\xb7oSx\'\xfd=\xfc\xa4\xa51\b\x02j\xb7\x98{`\x89\x8c\xd3\xc6\xe8\xe2\x9b\xd7\xab\xd1s\xfb\xaa\xcd\x9d\xf1\x9e\xee\xe3e\xf1\x91\xf7\xee%\xf8\xc7G', 0x2761, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00'}) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f00000002c0)={0x0, 0x0}) [ 206.804893][ C1] hrtimer: interrupt took 25838 ns 16:52:15 executing program 3: 16:52:15 executing program 5: 16:52:16 executing program 2: 16:52:16 executing program 0: 16:52:16 executing program 3: 16:52:16 executing program 5: 16:52:16 executing program 2: 16:52:16 executing program 4: 16:52:16 executing program 3: 16:52:16 executing program 0: 16:52:16 executing program 5: 16:52:16 executing program 2: 16:52:16 executing program 1: 16:52:16 executing program 1: 16:52:16 executing program 2: 16:52:16 executing program 3: 16:52:16 executing program 5: 16:52:16 executing program 0: 16:52:16 executing program 4: 16:52:16 executing program 1: 16:52:16 executing program 5: 16:52:16 executing program 3: 16:52:16 executing program 2: 16:52:16 executing program 0: 16:52:17 executing program 4: 16:52:17 executing program 1: 16:52:17 executing program 5: 16:52:17 executing program 3: 16:52:17 executing program 2: 16:52:17 executing program 0: 16:52:17 executing program 4: 16:52:17 executing program 1: 16:52:17 executing program 5: 16:52:17 executing program 2: 16:52:17 executing program 3: 16:52:17 executing program 0: 16:52:17 executing program 1: 16:52:17 executing program 4: 16:52:17 executing program 5: 16:52:17 executing program 3: 16:52:17 executing program 2: 16:52:17 executing program 0: 16:52:17 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f00000003c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000280)='asymmetric\x00', 0x0, &(0x7f0000000340)="04", 0x2, r2) 16:52:17 executing program 4: syz_mount_image$iso9660(&(0x7f00000002c0)='iso9660\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)={[{@iocharset={'iocharset', 0x3d, 'utf8'}}]}) 16:52:17 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000140)='vS\xfdIG|\x8aL[\xf2\'\x9c\xea\xb1\xc0\xb1\x19\x91\x9d/Q\xd9\xe3T\xce\xdax;\x02%\xc5\x1c\xd5GA\xad[(\xbblZ\x01\x1dF\x92#]%sj\xd0i\xc6C\x1f&\xe2\xc5\xa5z\x7f\xe1 \xfb\xc27\x03\x84\x8e\xef\x82-\xfc$$\xaf\v\xbd\x95\x1e\x0f\xbeVI\xec\r!\f\x86\xf5\xfb[Y\x1e\xd4\xdfc\xb1\xc8\xa2\xc1/5\xffr\x1f\x80@\xb8F\xea\xde\x93\xa1\xcb6\xee\xf2\xce\x95\xf2\xfdxR\x17F\xad\xc1~\xa2\x97=O^o\"\xbb\xa8\x9746', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) r0 = socket(0xa, 0x1, 0x0) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000180)={0x0, {0x2, 0x0, @broadcast}, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x0, @multicast2}}) 16:52:17 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x45c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x1) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r0, &(0x7f00000000c0)={0xc, 0x8, 0xfa00, {&(0x7f0000000280)}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x80000000001, &(0x7f0000000000)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000140)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @remote}, r1}}, 0x48) 16:52:17 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x47, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000064c0)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) dup2(r0, r0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) r2 = dup2(r1, r1) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x30000, 0x1, 0x11, r2, 0x0) write(r2, &(0x7f0000000240)="9886e5c9649c4476a0ca2f3287ac12832d5fa6bd397012caa60966ccfd23149e494c681704914361dde2a09effe7d2b8ffdfed5155f9006036abfe7473f8213362dc0f7697ff", 0x46) 16:52:17 executing program 5: mknod$loop(&(0x7f0000000040)='./file0\x00', 0x0, 0x1) mount(&(0x7f0000000300)=ANY=[], &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='squashfs\x00', 0x0, 0x0) 16:52:17 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x2) 16:52:17 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb, 0x6, 0x209e1e, 0x3, 0x1}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000340), &(0x7f0000000100)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r0, &(0x7f0000000200), &(0x7f0000000100)=""/54}, 0x18) [ 208.832452][ T9201] ISOFS: Unable to identify CD-ROM format. [ 208.888438][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 208.894276][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 208.912252][ T9216] No source specified [ 208.968396][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 208.974292][ C0] protocol 88fb is buggy, dev hsr_slave_1 16:52:18 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x45c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x1) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r0, &(0x7f00000000c0)={0xc, 0x8, 0xfa00, {&(0x7f0000000280)}}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x80000000001, &(0x7f0000000000)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000140)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @remote}, r1}}, 0x48) 16:52:18 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61d7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 16:52:18 executing program 1: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x60000008, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r0 = gettid() tkill(r0, 0x39) [ 209.079537][ T9201] ISOFS: Unable to identify CD-ROM format. 16:52:18 executing program 4: openat$tun(0xffffffffffffff9c, &(0x7f0000000bc0)='/dev/net/tun\x00', 0x0, 0x0) r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f00000000c0)={0x19, 0x4, 0x4, 0x4, 0x0, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={r0, &(0x7f0000000200), &(0x7f00000000c0)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000032100)={r0, &(0x7f0000000080), 0x0}, 0x20) 16:52:18 executing program 5: io_setup(0x5, &(0x7f0000000040)) epoll_create1(0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x0, 0x2, 0x100, 0x0, 0x0, 0x77f, 0x7}, 0x1c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$setpipe(r1, 0x407, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r3 = eventfd2(0x0, 0x0) dup(r3) r4 = socket$packet(0x11, 0x2, 0x300) perf_event_open(&(0x7f00000007c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) eventfd2(0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x30005, 0x0) 16:52:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="28e8ffff5400012a96b90c0006000000000007000000002a0100000000000000000400"], 0x28}}, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="240000001e", 0x5) sendmmsg$alg(r2, &(0x7f0000000140)=[{0x6, 0x0, &(0x7f0000000100), 0x6, &(0x7f0000000100)}], 0x492492492492805, 0x0) 16:52:18 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x1001000004e23, 0x0, @loopback}, 0x1c) listen(r0, 0x4) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000200)="0800a1695e1dcfe87b1071") r3 = accept(r0, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='vcan0\x00', 0x10) sendto$packet(r3, &(0x7f0000000040)='u', 0x1, 0x0, 0x0, 0x0) 16:52:18 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x10008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x0, 0x6031, 0xffffffffffffffff, 0x0) 16:52:18 executing program 2: creat(&(0x7f0000000180)='./file0\x00', 0x0) inotify_init() r0 = socket$inet6(0xa, 0x2, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) pipe(&(0x7f00000003c0)) pselect6(0x40, &(0x7f0000000240), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200), 0x0) [ 209.405110][ T9258] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:52:18 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x9) recvmmsg(r0, &(0x7f0000002b40)=[{{0x0, 0x40000, 0x0}}], 0x4000000000003be, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f00000000c0)=0x8000, 0x4) [ 209.641053][ T9275] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 209.768367][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 209.774223][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 209.830823][ T9280] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:52:18 executing program 2: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='\b\x00', 0x1430c2, 0x0) [ 209.928554][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 209.934373][ C1] protocol 88fb is buggy, dev hsr_slave_1 16:52:19 executing program 2: syz_emit_ethernet(0x7a, &(0x7f0000000000)=ANY=[@ANYBLOB="31dd9638e37faaaaaaaaaabb86dd6073020000442f00fe800000000000000000006c000000aafe8000000000000000000000000000aa262065580000000000000021000086dd080088be00000000100000000100000000000000080022eb000000002000000002000000000000000000000008006558000000000f2bc188c0af18ab647d0793d791e38186481f08341271fd71b524a5d3ef030ff95079f6ca7ca2f2897f6a248cc578d041615b276f9443a89c495a5c1688019b1f764a54599a523a729bfed9b9deb7e34077966904f43453f5a1e8d9d87ee94a8da5202e740153c63cbf8e0e50f2387c0b508e3f4de81c34b5067c25a9b5ac9ae650db16"], 0x0) 16:52:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="28e8ffff5400012a96b90c0006000000000007000000002a0100000000000000000400"], 0x28}}, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="240000001e", 0x5) sendmmsg$alg(r2, &(0x7f0000000140)=[{0x6, 0x0, &(0x7f0000000100), 0x6, &(0x7f0000000100)}], 0x492492492492805, 0x0) 16:52:19 executing program 5: socket$inet6(0xa, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x4000001, 0x8031, 0xffffffffffffffff, 0x0) munmap(&(0x7f00000c9000/0x1000)=nil, 0x1000) 16:52:19 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x5100, 0x0) [ 210.384229][ T9290] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:52:19 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x9) recvmmsg(r0, &(0x7f0000002b40)=[{{0x0, 0x40000, 0x0}}], 0x4000000000003be, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f00000000c0)=0x8000, 0x4) 16:52:19 executing program 2: r0 = epoll_create(0x548) r1 = socket$inet6(0xa, 0x3, 0x9) recvmmsg(r1, &(0x7f0000002b40)=[{{0x0, 0x40000, 0x0}}], 0x4000000000003be, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000040)) 16:52:19 executing program 1: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0) getsockopt$netrom_NETROM_N2(r0, 0x103, 0x3, 0x0, 0x0) 16:52:19 executing program 1: r0 = socket$kcm(0x2b, 0x8000000000001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$packet(0x11, 0x3, 0x300) getgid() r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = gettid() sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x4c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_NET_NS_PID={0x8, 0x13, r4}, @IFLA_MAP={0x24}]}, 0x4c}}, 0x0) [ 211.035655][ T9316] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 211.058957][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 211.065392][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 211.200537][ T9318] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. 16:52:21 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x10008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x0, 0x6031, 0xffffffffffffffff, 0x0) 16:52:21 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="28e8ffff5400012a96b90c0006000000000007000000002a0100000000000000000400"], 0x28}}, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="240000001e", 0x5) sendmmsg$alg(r2, &(0x7f0000000140)=[{0x6, 0x0, &(0x7f0000000100), 0x6, &(0x7f0000000100)}], 0x492492492492805, 0x0) 16:52:21 executing program 5: 16:52:21 executing program 1: 16:52:21 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x9) recvmmsg(r0, &(0x7f0000002b40)=[{{0x0, 0x40000, 0x0}}], 0x4000000000003be, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f00000000c0)=0x8000, 0x4) 16:52:21 executing program 2: 16:52:21 executing program 5: 16:52:21 executing program 1: 16:52:21 executing program 2: [ 212.240718][ T9338] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 16:52:21 executing program 5: 16:52:21 executing program 1: 16:52:21 executing program 2: 16:52:22 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x10008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x0, 0x6031, 0xffffffffffffffff, 0x0) 16:52:22 executing program 5: 16:52:22 executing program 1: 16:52:22 executing program 2: 16:52:22 executing program 0: 16:52:22 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x9) recvmmsg(r0, &(0x7f0000002b40)=[{{0x0, 0x40000, 0x0}}], 0x4000000000003be, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x23, &(0x7f00000000c0)=0x8000, 0x4) 16:52:22 executing program 2: 16:52:22 executing program 0: 16:52:22 executing program 1: 16:52:22 executing program 5: 16:52:23 executing program 2: 16:52:23 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)=@l2={0x1f, 0xffffdd86}, 0x80, 0x0}, 0x0) r0 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r0, &(0x7f0000000100)={&(0x7f0000000040)=@nfc={0x27, 0x7}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000300)="050000002300400000068900ac14140de00000013c31b47d0510c147885b6e765e30637ec921f605", 0x28}], 0x8, 0x0, 0x0, 0x50}, 0x0) 16:52:24 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x10008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x0, 0x6031, 0xffffffffffffffff, 0x0) 16:52:24 executing program 0: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x0, 0x0) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x82911, r0, 0x0) 16:52:24 executing program 5: r0 = syz_open_dev$video4linux(&(0x7f0000000000)='/dev/v4l-subdev#\x00', 0x0, 0x0) ioctl$VIDIOC_G_CTRL(r0, 0xc040563e, &(0x7f0000000140)) 16:52:24 executing program 2: clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000540)=""/11, 0x61) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) r1 = creat(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x109) dup2(r0, r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x128402, 0x0) clone(0x3102001ff1, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) ioctl$EVIOCGBITSND(r1, 0x80404532, 0x0) 16:52:24 executing program 1: r0 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000300)={0x100000011, @rand_addr, 0x0, 0x0, 'nq\x00'}, 0x2c) 16:52:24 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x9) recvmmsg(r0, &(0x7f0000002b40)=[{{0x0, 0x40000, 0x0}}], 0x4000000000003be, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 16:52:24 executing program 5: syz_open_dev$mice(&(0x7f0000001580)='/dev/input/mice\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x80, 0x4) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) shutdown(r0, 0x1) recvmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000400)=""/4096, 0xf7e9}], 0x1, 0x0, 0xff96ce4aaaa4756f}, 0x100) ioctl$RTC_UIE_ON(0xffffffffffffffff, 0x7003) syz_genetlink_get_family_id$tipc2(0x0) 16:52:24 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x404e21, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmsg$inet6(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000140)="f8", 0x1}], 0x1}, 0x0) 16:52:24 executing program 0: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb, 0x6, 0x209e1e, 0x3, 0x1}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000340), &(0x7f0000000100)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r0, &(0x7f0000000200), &(0x7f0000000100)=""/54}, 0x18) 16:52:24 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000100)={'bridge_slave_0\x00\x04'}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f00000002c0)={@local, 0xf, r4}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000080)={'bridge_slave_0\x00?', 0x22000000c0ffffff}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) getpid() sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 16:52:24 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x1, 0x7f, 0x1, 0x2, 0x0, 0xffffffffffffff9c}, 0x3c) bpf$MAP_CREATE(0xf00000000000000, &(0x7f0000000400)={0xd, 0x4, 0x4000000004, 0x7fa5, 0x5, r0, 0x0, [0x305f, 0x2e]}, 0x2c) 16:52:25 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) read$char_usb(r0, &(0x7f00000002c0)=""/117, 0xfe4e) bind(0xffffffffffffffff, 0x0, 0x0) [ 216.008353][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 216.014276][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 216.168363][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 216.174260][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 216.461608][ T9432] bridge0: port 1(bridge_slave_0) entered disabled state [ 216.578996][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 216.585385][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 216.601647][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 216.619421][ T2847] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.626633][ T2847] bridge0: port 1(bridge_slave_0) entered forwarding state 16:52:26 executing program 3: 16:52:26 executing program 0: bind$netlink(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$sndctrl(0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000280)={0x2, &(0x7f0000000200)=[{0x6, 0x80, 0x2, 0x6}, {0x20, 0x20, 0x96, 0x1f}]}, 0x10) fstatfs(r1, &(0x7f0000000440)=""/127) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x223e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') mlock2(&(0x7f0000010000/0x3000)=nil, 0x3000, 0x1) writev(r3, &(0x7f0000000080), 0x5b) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x10032, 0xffffffffffffffff, 0x0) ioctl$VHOST_GET_FEATURES(0xffffffffffffffff, 0x8008af00, &(0x7f0000000040)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61d7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) r5 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x103000, 0x0) ioctl$BLKALIGNOFF(r5, 0x127a, &(0x7f0000000100)) r6 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r6, &(0x7f0000000240)={0xa, 0x0, 0x0, @rand_addr="d7bc703c3595e1d4b86143dcfddb8985", 0x2}, 0xffffffffffffffae) getsockname$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000180)={'team0\x00'}) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@ipv4={[], [], @loopback}, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2}, {{@in=@empty, 0x0, 0x3c}, 0x0, @in6=@ipv4={[], [], @empty}, 0x0, 0x0, 0x0, 0x6, 0x0, 0x2}}, 0xe8) r7 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x141000, 0x0) ioctl$CAPI_GET_FLAGS(r7, 0x80044323, &(0x7f0000000040)) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0x0) 16:52:26 executing program 1: 16:52:26 executing program 5: 16:52:26 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x9) recvmmsg(r0, &(0x7f0000002b40)=[{{0x0, 0x40000, 0x0}}], 0x4000000000003be, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 16:52:26 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000100)={'bridge_slave_0\x00\x04'}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f00000002c0)={@local, 0xf, r4}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000080)={'bridge_slave_0\x00?', 0x22000000c0ffffff}) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) getpid() sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 16:52:26 executing program 5: 16:52:26 executing program 1: 16:52:26 executing program 3: 16:52:26 executing program 5: [ 217.208350][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 217.214217][ C0] protocol 88fb is buggy, dev hsr_slave_1 16:52:26 executing program 1: [ 217.288370][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 217.294248][ C0] protocol 88fb is buggy, dev hsr_slave_1 16:52:26 executing program 3: 16:52:26 executing program 5: [ 217.738105][ T9456] bridge0: port 1(bridge_slave_0) entered disabled state [ 217.985761][ T2847] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 218.012195][ T2847] bridge0: port 1(bridge_slave_0) entered blocking state [ 218.019363][ T2847] bridge0: port 1(bridge_slave_0) entered forwarding state [ 378.968639][ T1082] INFO: task :9466 can't die for more than 143 seconds. [ 378.975686][ T1082] R running task 28568 9466 8889 0x00004006 [ 378.995529][ T1082] Call Trace: [ 379.000042][ T1082] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 379.005534][ T1082] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 379.016920][ T1082] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 379.022728][ T1082] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 379.028187][ T1082] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 379.040051][ T1082] ? lockdep_hardirqs_on+0x421/0x5e0 [ 379.045789][ T1082] ? lockdep_hardirqs_on+0x421/0x5e0 [ 379.058005][ T1082] ? retint_kernel+0x2b/0x2b [ 379.065344][ T1082] ? trace_hardirqs_on_caller+0x6a/0x240 [ 379.075142][ T1082] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 379.082885][ T1082] ? __this_cpu_preempt_check+0x35/0x190 [ 379.092654][ T1082] ? __this_cpu_preempt_check+0x35/0x190 [ 379.100591][ T1082] ? apic_timer_interrupt+0xa/0x20 [ 379.105734][ T1082] ? irq_work_sync+0xd1/0x1d0 [ 379.114439][ T1082] ? irq_work_sync+0xd1/0x1d0 [ 379.121269][ T1082] ? __sanitizer_cov_trace_pc+0x20/0x50 [ 379.126820][ T1082] ? irq_work_sync+0xf6/0x1d0 [ 379.136689][ T1082] ? irq_work_sync+0xd1/0x1d0 [ 379.143601][ T1082] ? _free_event+0x89/0x13b0 [ 379.148202][ T1082] ? __kasan_check_write+0x14/0x20 [ 379.157874][ T1082] ? __mutex_unlock_slowpath+0xf0/0x6a0 [ 379.166575][ T1082] ? mark_held_locks+0xa4/0xf0 [ 379.175540][ T1082] ? ring_buffer_attach+0x650/0x650 [ 379.183012][ T1082] ? wait_for_completion+0x440/0x440 [ 379.192363][ T1082] ? put_event+0x47/0x60 [ 379.196621][ T1082] ? perf_event_release_kernel+0x6d5/0xd70 [ 379.204632][ T1082] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 379.216087][ T1082] ? __perf_event_exit_context+0x170/0x170 [ 379.224102][ T1082] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 379.234557][ T1082] ? perf_release+0x37/0x50 [ 379.241906][ T1082] ? __fput+0x2ff/0x890 [ 379.246110][ T1082] ? perf_event_release_kernel+0xd70/0xd70 [ 379.256109][ T1082] ? ____fput+0x16/0x20 [ 379.263880][ T1082] ? task_work_run+0x145/0x1c0 [ 379.273407][ T1082] ? exit_to_usermode_loop+0x316/0x380 [ 379.281168][ T1082] ? do_syscall_64+0x676/0x790 [ 379.285971][ T1082] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 379.296172][ T1082] [ 379.296172][ T1082] Showing all locks held in the system: [ 379.306097][ T1082] 1 lock held by khungtaskd/1082: [ 379.315277][ T1082] #0: ffffffff88faccc0 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x279 [ 379.326772][ T1082] 1 lock held by rsyslogd/8761: [ 379.335765][ T1082] #0: ffff8880a959b860 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 [ 379.346794][ T1082] 2 locks held by getty/8851: [ 379.355595][ T1082] #0: ffff8880a910b090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 379.366836][ T1082] #1: ffffc90005f0d2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 379.383659][ T1082] 2 locks held by getty/8852: [ 379.390400][ T1082] #0: ffff88808f82c090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 379.404391][ T1082] #1: ffffc90005f252e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 379.415306][ T1082] 2 locks held by getty/8853: [ 379.424923][ T1082] #0: ffff8880a8e1b090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 379.435133][ T1082] #1: ffffc90005f112e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 379.452720][ T1082] 2 locks held by getty/8854: [ 379.457413][ T1082] #0: ffff88809d01c090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 379.472463][ T1082] #1: ffffc90005f292e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 379.483306][ T1082] 2 locks held by getty/8855: [ 379.487977][ T1082] #0: ffff88808e00e090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 379.503016][ T1082] #1: ffffc90005f2d2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 379.514820][ T1082] 2 locks held by getty/8856: [ 379.524549][ T1082] #0: ffff8880962c6090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 379.536131][ T1082] #1: ffffc90005f312e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 379.551945][ T1082] 2 locks held by getty/8857: [ 379.556672][ T1082] #0: ffff8880a1b93090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 379.568142][ T1082] #1: ffffc90005ef92e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 379.583758][ T1082] [ 379.586111][ T1082] ============================================= [ 379.586111][ T1082] [ 379.594861][ T1082] NMI backtrace for cpu 0 [ 379.599295][ T1082] CPU: 0 PID: 1082 Comm: khungtaskd Not tainted 5.4.0-rc7-next-20191115 #0 [ 379.607880][ T1082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 379.617934][ T1082] Call Trace: [ 379.621295][ T1082] dump_stack+0x197/0x210 [ 379.625625][ T1082] nmi_cpu_backtrace.cold+0x70/0xb2 [ 379.630817][ T1082] ? vprintk_func+0x86/0x189 [ 379.635405][ T1082] ? lapic_can_unplug_cpu.cold+0x3a/0x3a [ 379.641050][ T1082] nmi_trigger_cpumask_backtrace+0x23b/0x28b [ 379.647043][ T1082] arch_trigger_cpumask_backtrace+0x14/0x20 [ 379.652928][ T1082] watchdog+0xc8f/0x1350 [ 379.661514][ T1082] kthread+0x361/0x430 [ 379.665574][ T1082] ? reset_hung_task_detector+0x30/0x30 [ 379.671112][ T1082] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 379.676834][ T1082] ret_from_fork+0x24/0x30 [ 379.681486][ T1082] Sending NMI from CPU 0 to CPUs 1: [ 379.687190][ C1] NMI backtrace for cpu 1 [ 379.687196][ C1] CPU: 1 PID: 9466 Comm: Not tainted 5.4.0-rc7-next-20191115 #0 [ 379.687201][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 379.687205][ C1] RIP: 0010:__hrtimer_run_queues+0x9d5/0xe40 [ 379.687215][ C1] Code: 89 de e8 fe 85 0f 00 84 db 0f 84 99 f9 ff ff e8 b1 84 0f 00 e8 fd 12 9c ff e9 8a f9 ff ff e8 a2 84 0f 00 65 ff 05 e3 c9 9d 7e <48> c7 c0 68 d3 c4 89 48 c1 e8 03 42 80 3c 38 00 0f 85 32 04 00 00 [ 379.687219][ C1] RSP: 0018:ffff8880ae909e18 EFLAGS: 00000082 [ 379.687226][ C1] RAX: ffff888097d26600 RBX: 0000000000000001 RCX: ffffffff81644e96 [ 379.687231][ C1] RDX: 0000000000010000 RSI: ffffffff8164549e RDI: 0000000000000001 [ 379.687235][ C1] RBP: ffff8880ae909f08 R08: ffff888097d26600 R09: fffffbfff1390fd9 [ 379.687239][ C1] R10: fffffbfff1390fd8 R11: ffffffff89c87ec7 R12: 0000000000000001 [ 379.687244][ C1] R13: ffff8880a750a160 R14: ffff8880ae929440 R15: dffffc0000000000 [ 379.687249][ C1] FS: 00007f27677de700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 [ 379.687253][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 379.687257][ C1] CR2: ffffffffff600400 CR3: 00000000a834e000 CR4: 00000000001406e0 [ 379.687261][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 379.687266][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 379.687268][ C1] Call Trace: [ 379.687270][ C1] [ 379.687274][ C1] ? __perf_event_overflow+0x370/0x370 [ 379.687277][ C1] ? hrtimer_init+0x330/0x330 [ 379.687280][ C1] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 379.687284][ C1] ? ktime_get_update_offsets_now+0x2ce/0x430 [ 379.687287][ C1] hrtimer_interrupt+0x314/0x770 [ 379.687290][ C1] smp_apic_timer_interrupt+0x160/0x610 [ 379.687294][ C1] apic_timer_interrupt+0xf/0x20 [ 379.687296][ C1] [ 379.687299][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x50 [ 379.687309][ C1] Code: ff cc cc cc cc cc cc cc cc cc 65 48 8b 04 25 c0 1e 02 00 48 8b 80 18 13 00 00 c3 0f 1f 44 00 00 66 2e 0f 1f 84 00 00 00 00 00 <55> 48 89 e5 65 48 8b 04 25 c0 1e 02 00 65 8b 15 34 45 8e 7e 81 e2 [ 379.687312][ C1] RSP: 0018:ffff88805a1b7c00 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 379.687320][ C1] RAX: 0000000000040000 RBX: 0000000000000002 RCX: ffffc9000614e000 [ 379.687325][ C1] RDX: 0000000000040000 RSI: ffffffff817e51c1 RDI: 0000000000000005 [ 379.687329][ C1] RBP: ffff88805a1b7c28 R08: ffff888097d26600 R09: ffffed1014174e82 [ 379.687334][ C1] R10: ffffed1014174e81 R11: ffff8880a0ba740b R12: ffff8880a0ba7408 [ 379.687339][ C1] R13: 0000000000000003 R14: ffffed1014174e81 R15: ffff88805a1b7cc8 [ 379.687342][ C1] ? irq_work_sync+0xd1/0x1d0 [ 379.687345][ C1] ? irq_work_sync+0xd8/0x1d0 [ 379.687348][ C1] _free_event+0x89/0x13b0 [ 379.687351][ C1] ? __kasan_check_write+0x14/0x20 [ 379.687355][ C1] ? __mutex_unlock_slowpath+0xf0/0x6a0 [ 379.687358][ C1] ? mark_held_locks+0xa4/0xf0 [ 379.687361][ C1] ? ring_buffer_attach+0x650/0x650 [ 379.687365][ C1] ? wait_for_completion+0x440/0x440 [ 379.687367][ C1] put_event+0x47/0x60 [ 379.687371][ C1] perf_event_release_kernel+0x6d5/0xd70 [ 379.687375][ C1] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 379.687378][ C1] ? __perf_event_exit_context+0x170/0x170 [ 379.687382][ C1] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 379.687385][ C1] perf_release+0x37/0x50 [ 379.687387][ C1] __fput+0x2ff/0x890 [ 379.687391][ C1] ? perf_event_release_kernel+0xd70/0xd70 [ 379.687394][ C1] ____fput+0x16/0x20 [ 379.687397][ C1] task_work_run+0x145/0x1c0 [ 379.687400][ C1] exit_to_usermode_loop+0x316/0x380 [ 379.687403][ C1] do_syscall_64+0x676/0x790 [ 379.687407][ C1] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 379.687409][ C1] RIP: 0033:0x45a639 [ 379.687419][ C1] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 379.687422][ C1] RSP: 002b:00007f27677ddc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 379.687430][ C1] RAX: 0000000020000000 RBX: 0000000000000006 RCX: 000000000045a639 [ 379.687435][ C1] RDX: 0000000000010006 RSI: 0000000000003000 RDI: 0000000020000000 [ 379.687439][ C1] RBP: 000000000075bfc8 R08: 0000000000000005 R09: 0000000000000000 [ 379.687444][ C1] R10: 0000000000080011 R11: 0000000000000246 R12: 00007f27677de6d4 [ 379.687448][ C1] R13: 00000000004c705c R14: 00000000004dc7f8 R15: 00000000ffffffff [ 379.697498][ T1082] Kernel panic - not syncing: hung_task: blocked tasks [ 380.127459][ T1082] CPU: 0 PID: 1082 Comm: khungtaskd Not tainted 5.4.0-rc7-next-20191115 #0 [ 380.136035][ T1082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 380.146604][ T1082] Call Trace: [ 380.149896][ T1082] dump_stack+0x197/0x210 [ 380.154227][ T1082] panic+0x2e3/0x75c [ 380.158129][ T1082] ? add_taint.cold+0x16/0x16 [ 380.162897][ T1082] ? lapic_can_unplug_cpu.cold+0x3a/0x3a [ 380.168530][ T1082] ? ___preempt_schedule+0x16/0x18 [ 380.173639][ T1082] ? nmi_trigger_cpumask_backtrace+0x21b/0x28b [ 380.179792][ T1082] ? nmi_trigger_cpumask_backtrace+0x24c/0x28b [ 380.185940][ T1082] ? nmi_trigger_cpumask_backtrace+0x256/0x28b [ 380.192100][ T1082] ? nmi_trigger_cpumask_backtrace+0x21b/0x28b [ 380.198263][ T1082] watchdog+0xca0/0x1350 [ 380.202515][ T1082] kthread+0x361/0x430 [ 380.206582][ T1082] ? reset_hung_task_detector+0x30/0x30 [ 380.212118][ T1082] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 380.218701][ T1082] ret_from_fork+0x24/0x30 [ 380.224525][ T1082] Kernel Offset: disabled [ 380.228858][ T1082] Rebooting in 86400 seconds..