[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 11.686073] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 27.066588] random: sshd: uninitialized urandom read (32 bytes read) [ 27.249982] random: sshd: uninitialized urandom read (32 bytes read) [ 27.955173] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.15.204' (ECDSA) to the list of known hosts. [ 33.323907] random: sshd: uninitialized urandom read (32 bytes read) 2018/07/31 00:11:29 fuzzer started [ 34.215132] random: cc1: uninitialized urandom read (8 bytes read) 2018/07/31 00:11:30 dialing manager at 10.128.0.26:42063 2018/07/31 00:11:30 syscalls: 1184 2018/07/31 00:11:30 code coverage: enabled 2018/07/31 00:11:30 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/07/31 00:11:30 setuid sandbox: enabled 2018/07/31 00:11:30 namespace sandbox: enabled 2018/07/31 00:11:30 fault injection: CONFIG_FAULT_INJECTION is not enabled 2018/07/31 00:11:30 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/07/31 00:11:30 net packed injection: enabled 2018/07/31 00:11:30 net device setup: enabled 00:11:30 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:30 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) 00:11:30 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") clock_adjtime(0x0, &(0x7f0000000000)) 00:11:30 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:30 executing program 3: futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, &(0x7f00003b6ff0)={0x77359400}, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x3, 0x0, &(0x7f0000365ff8), &(0x7f0000c81ffc), 0x0) 00:11:30 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:30 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={&(0x7f0000000040), 0xc, &(0x7f0000000080)={&(0x7f0000000340)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in6=@remote, @in6=@local}, {@in=@broadcast, 0x0, 0x6c}, @in6=@mcast2, {}, {}, {}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x7472}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) 00:11:30 executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000000)={'nat\x00', 0x4, "b300641a"}, &(0x7f00000000c0)=0x28) [ 35.226373] IPVS: Creating netns size=2536 id=1 [ 35.263281] IPVS: Creating netns size=2536 id=2 [ 35.298833] IPVS: Creating netns size=2536 id=3 [ 35.333072] IPVS: Creating netns size=2536 id=4 [ 35.379730] IPVS: Creating netns size=2536 id=5 [ 35.413480] IPVS: Creating netns size=2536 id=6 [ 35.461662] IPVS: Creating netns size=2536 id=7 [ 35.510068] IPVS: Creating netns size=2536 id=8 [ 35.634313] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 35.643865] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 35.656522] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 35.680786] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 35.726488] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 35.754609] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 35.786498] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 35.821009] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 35.857002] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 35.867370] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 35.895920] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 35.907893] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 35.932275] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 35.943716] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 35.971811] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 35.984446] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 36.004027] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 36.032697] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 36.046134] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 36.065951] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 36.095808] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 36.104159] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 36.120719] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 36.131570] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 36.144153] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 36.162167] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 36.175085] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 36.182296] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 36.197798] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 36.211702] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 36.225577] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 36.238600] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 36.250523] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 36.265946] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 36.284648] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 36.299796] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 36.310740] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 36.331518] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 36.347029] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 36.356780] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 36.373907] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 36.383097] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 36.393347] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 36.405160] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 36.417979] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 36.430907] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 36.451786] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 36.476098] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 36.497355] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 36.507183] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 36.516689] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 36.527237] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 36.535610] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 36.565822] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 36.600161] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 36.674822] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 36.700847] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 36.725172] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 36.732326] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 36.747400] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 36.757583] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 36.783364] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 36.790448] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 36.807109] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 36.820152] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 36.839878] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 36.863295] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 36.870747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 36.884440] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 36.923102] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 36.930473] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 36.940422] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 36.963878] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 36.972163] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 36.980107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 37.001138] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 37.011769] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 37.027195] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 38.685529] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 38.855967] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 38.862130] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 38.871870] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 38.880905] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 38.970886] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 39.079253] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 39.095238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.102084] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.114782] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 39.214276] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 39.222194] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.234110] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.244706] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 39.333847] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 39.340087] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.351323] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.414322] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 39.420887] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.432964] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.511983] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 39.542794] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 39.701820] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 39.717544] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 39.730456] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.738753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.760157] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 39.767359] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.775185] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.849161] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 39.863053] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.869797] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 00:11:35 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:35 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:36 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) 00:11:36 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:36 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) 00:11:36 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000002740)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) 00:11:36 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:36 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:36 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:36 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:36 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") clock_adjtime(0x0, &(0x7f0000000000)) 00:11:36 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) [ 40.782415] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 00:11:37 executing program 3: futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, &(0x7f00003b6ff0)={0x77359400}, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x3, 0x0, &(0x7f0000365ff8), &(0x7f0000c81ffc), 0x0) 00:11:37 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:37 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:37 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") clock_adjtime(0x0, &(0x7f0000000000)) 00:11:37 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:37 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={&(0x7f0000000040), 0xc, &(0x7f0000000080)={&(0x7f0000000340)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in6=@remote, @in6=@local}, {@in=@broadcast, 0x0, 0x6c}, @in6=@mcast2, {}, {}, {}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x7472}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) 00:11:37 executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000000)={'nat\x00', 0x4, "b300641a"}, &(0x7f00000000c0)=0x28) 00:11:37 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:37 executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000000)={'nat\x00', 0x4, "b300641a"}, &(0x7f00000000c0)=0x28) 00:11:37 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") clock_adjtime(0x0, &(0x7f0000000000)) 00:11:37 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={&(0x7f0000000040), 0xc, &(0x7f0000000080)={&(0x7f0000000340)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in6=@remote, @in6=@local}, {@in=@broadcast, 0x0, 0x6c}, @in6=@mcast2, {}, {}, {}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x7472}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) 00:11:37 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:37 executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000000)={'nat\x00', 0x4, "b300641a"}, &(0x7f00000000c0)=0x28) 00:11:37 executing program 0: futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, &(0x7f00003b6ff0)={0x77359400}, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x3, 0x0, &(0x7f0000365ff8), &(0x7f0000c81ffc), 0x0) 00:11:37 executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:37 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) [ 41.811119] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 41.915476] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 41.935263] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 00:11:38 executing program 3: futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, &(0x7f00003b6ff0)={0x77359400}, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x3, 0x0, &(0x7f0000365ff8), &(0x7f0000c81ffc), 0x0) 00:11:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={&(0x7f0000000040), 0xc, &(0x7f0000000080)={&(0x7f0000000340)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in6=@remote, @in6=@local}, {@in=@broadcast, 0x0, 0x6c}, @in6=@mcast2, {}, {}, {}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x7472}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) 00:11:38 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:38 executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:38 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:38 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:38 executing program 0: futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, &(0x7f00003b6ff0)={0x77359400}, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x3, 0x0, &(0x7f0000365ff8), &(0x7f0000c81ffc), 0x0) 00:11:38 executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) [ 42.615060] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 42.627337] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 42.629768] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 42.648765] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 00:11:38 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) [ 42.734162] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 42.745524] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 00:11:39 executing program 3: futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, &(0x7f00003b6ff0)={0x77359400}, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x3, 0x0, &(0x7f0000365ff8), &(0x7f0000c81ffc), 0x0) 00:11:39 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:39 executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:39 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:39 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:39 executing program 0: futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, &(0x7f00003b6ff0)={0x77359400}, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x3, 0x0, &(0x7f0000365ff8), &(0x7f0000c81ffc), 0x0) [ 43.468678] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 43.479767] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 43.483627] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 00:11:39 executing program 7: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:39 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) [ 43.513772] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 43.573938] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 43.581157] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 00:11:39 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000000)={'nat\x00', 0x4, "b300641a"}, &(0x7f00000000c0)=0x28) 00:11:39 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000000)={'nat\x00', 0x4, "b300641a"}, &(0x7f00000000c0)=0x28) 00:11:39 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:39 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:39 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000000)={'nat\x00', 0x4, "b300641a"}, &(0x7f00000000c0)=0x28) 00:11:39 executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) accept4$inet6(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000080)=0x1c, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000100), 0xfffffffffffffe62, 0x20000004, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) r2 = socket$inet(0x10, 0x3, 0x4) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 00:11:39 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={&(0x7f0000000040), 0xc, &(0x7f0000000080)={&(0x7f0000000340)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in6=@remote, @in6=@local}, {@in=@broadcast, 0x0, 0x6c}, @in6=@mcast2, {}, {}, {}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x7472}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) 00:11:39 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={&(0x7f0000000040), 0xc, &(0x7f0000000080)={&(0x7f0000000340)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in6=@remote, @in6=@local}, {@in=@broadcast, 0x0, 0x6c}, @in6=@mcast2, {}, {}, {}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x7472}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) 00:11:39 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") clock_adjtime(0x0, &(0x7f0000000000)) 00:11:39 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:39 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={&(0x7f0000000040), 0xc, &(0x7f0000000080)={&(0x7f0000000340)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in6=@remote, @in6=@local}, {@in=@broadcast, 0x0, 0x6c}, @in6=@mcast2, {}, {}, {}, 0x0, 0x0, 0xa, 0x4, 0x0, 0x7472}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}}, 0x0) [ 44.294833] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 44.296629] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 00:11:39 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") clock_adjtime(0x0, &(0x7f0000000000)) 00:11:39 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") clock_adjtime(0x0, &(0x7f0000000000)) 00:11:40 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 7: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 1: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) gettid() llistxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=""/72, 0x48) timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(r1, r0, 0x0) 00:11:40 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 2: r0 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/relabel\x00', 0x2, 0x0) lseek(r0, 0x0, 0x3) 00:11:40 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:40 executing program 5: clone(0x0, &(0x7f0000b53000), &(0x7f000084effc), &(0x7f00000000c0), &(0x7f0000b3bfff)) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(0xffffffffffffffff, 0xc058534b, &(0x7f0000000980)={0x0, 0x0, 0x1ff, 0x0, 0x0, 0x7}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgid(0xffffffffffffffff) sched_setscheduler(r2, 0x0, &(0x7f0000000240)=0x14) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={"76657468300000000000000000000001", 0x0}) r6 = gettid() sendmsg$nl_route(r4, &(0x7f00000000c0)={&(0x7f0000000080), 0xc, &(0x7f0000000540)={&(0x7f0000000340)=@newlink={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_XDP={0x4}, @IFLA_NET_NS_PID={0x8, 0x13, r6}]}, 0x2c}}, 0x0) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) fgetxattr(r1, &(0x7f0000000000)=@known='com.apple.system.Security\x00', &(0x7f0000000040)=""/112, 0x70) recvfrom(r1, &(0x7f0000000180)=""/48, 0x30, 0x40, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x4, 0x0, 0x3, {0xa, 0x4e23, 0x8, @mcast1, 0x20}}}, 0x80) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r8, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) dup2(r1, r7) close(r8) 00:11:41 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:41 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:41 executing program 2: r0 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/relabel\x00', 0x2, 0x0) lseek(r0, 0x0, 0x3) 00:11:41 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r3, 0x0, 0x6, &(0x7f0000013ff4)={@multicast2, @multicast1, @multicast2}, 0x5) close(r3) dup3(r1, r2, 0x0) 00:11:41 executing program 2: r0 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/relabel\x00', 0x2, 0x0) lseek(r0, 0x0, 0x3) 00:11:41 executing program 2: r0 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/relabel\x00', 0x2, 0x0) lseek(r0, 0x0, 0x3) 00:11:41 executing program 5: clone(0x0, &(0x7f0000b53000), &(0x7f000084effc), &(0x7f00000000c0), &(0x7f0000b3bfff)) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(0xffffffffffffffff, 0xc058534b, &(0x7f0000000980)={0x0, 0x0, 0x1ff, 0x0, 0x0, 0x7}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgid(0xffffffffffffffff) sched_setscheduler(r2, 0x0, &(0x7f0000000240)=0x14) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={"76657468300000000000000000000001", 0x0}) r6 = gettid() sendmsg$nl_route(r4, &(0x7f00000000c0)={&(0x7f0000000080), 0xc, &(0x7f0000000540)={&(0x7f0000000340)=@newlink={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_XDP={0x4}, @IFLA_NET_NS_PID={0x8, 0x13, r6}]}, 0x2c}}, 0x0) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) fgetxattr(r1, &(0x7f0000000000)=@known='com.apple.system.Security\x00', &(0x7f0000000040)=""/112, 0x70) recvfrom(r1, &(0x7f0000000180)=""/48, 0x30, 0x40, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x4, 0x0, 0x3, {0xa, 0x4e23, 0x8, @mcast1, 0x20}}}, 0x80) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r8, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) dup2(r1, r7) close(r8) 00:11:41 executing program 1: clone(0x0, &(0x7f0000b53000), &(0x7f000084effc), &(0x7f00000000c0), &(0x7f0000b3bfff)) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(0xffffffffffffffff, 0xc058534b, &(0x7f0000000980)={0x0, 0x0, 0x1ff, 0x0, 0x0, 0x7}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgid(0xffffffffffffffff) sched_setscheduler(r2, 0x0, &(0x7f0000000240)=0x14) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={"76657468300000000000000000000001", 0x0}) r6 = gettid() sendmsg$nl_route(r4, &(0x7f00000000c0)={&(0x7f0000000080), 0xc, &(0x7f0000000540)={&(0x7f0000000340)=@newlink={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_XDP={0x4}, @IFLA_NET_NS_PID={0x8, 0x13, r6}]}, 0x2c}}, 0x0) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) fgetxattr(r1, &(0x7f0000000000)=@known='com.apple.system.Security\x00', &(0x7f0000000040)=""/112, 0x70) recvfrom(r1, &(0x7f0000000180)=""/48, 0x30, 0x40, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x4, 0x0, 0x3, {0xa, 0x4e23, 0x8, @mcast1, 0x20}}}, 0x80) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r8, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) dup2(r1, r7) close(r8) 00:11:41 executing program 0: clone(0x0, &(0x7f0000b53000), &(0x7f000084effc), &(0x7f00000000c0), &(0x7f0000b3bfff)) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(0xffffffffffffffff, 0xc058534b, &(0x7f0000000980)={0x0, 0x0, 0x1ff, 0x0, 0x0, 0x7}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgid(0xffffffffffffffff) sched_setscheduler(r2, 0x0, &(0x7f0000000240)=0x14) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={"76657468300000000000000000000001", 0x0}) r6 = gettid() sendmsg$nl_route(r4, &(0x7f00000000c0)={&(0x7f0000000080), 0xc, &(0x7f0000000540)={&(0x7f0000000340)=@newlink={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_XDP={0x4}, @IFLA_NET_NS_PID={0x8, 0x13, r6}]}, 0x2c}}, 0x0) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) fgetxattr(r1, &(0x7f0000000000)=@known='com.apple.system.Security\x00', &(0x7f0000000040)=""/112, 0x70) recvfrom(r1, &(0x7f0000000180)=""/48, 0x30, 0x40, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x4, 0x0, 0x3, {0xa, 0x4e23, 0x8, @mcast1, 0x20}}}, 0x80) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r8, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) dup2(r1, r7) close(r8) 00:11:41 executing program 4: clone(0x0, &(0x7f0000b53000), &(0x7f000084effc), &(0x7f00000000c0), &(0x7f0000b3bfff)) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(0xffffffffffffffff, 0xc058534b, &(0x7f0000000980)={0x0, 0x0, 0x1ff, 0x0, 0x0, 0x7}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgid(0xffffffffffffffff) sched_setscheduler(r2, 0x0, &(0x7f0000000240)=0x14) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={"76657468300000000000000000000001", 0x0}) r6 = gettid() sendmsg$nl_route(r4, &(0x7f00000000c0)={&(0x7f0000000080), 0xc, &(0x7f0000000540)={&(0x7f0000000340)=@newlink={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_XDP={0x4}, @IFLA_NET_NS_PID={0x8, 0x13, r6}]}, 0x2c}}, 0x0) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) fgetxattr(r1, &(0x7f0000000000)=@known='com.apple.system.Security\x00', &(0x7f0000000040)=""/112, 0x70) recvfrom(r1, &(0x7f0000000180)=""/48, 0x30, 0x40, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x4, 0x0, 0x3, {0xa, 0x4e23, 0x8, @mcast1, 0x20}}}, 0x80) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r8, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) dup2(r1, r7) close(r8) 00:11:41 executing program 7: clone(0x0, &(0x7f0000b53000), &(0x7f000084effc), &(0x7f00000000c0), &(0x7f0000b3bfff)) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(0xffffffffffffffff, 0xc058534b, &(0x7f0000000980)={0x0, 0x0, 0x1ff, 0x0, 0x0, 0x7}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgid(0xffffffffffffffff) sched_setscheduler(r2, 0x0, &(0x7f0000000240)=0x14) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={"76657468300000000000000000000001", 0x0}) r6 = gettid() sendmsg$nl_route(r4, &(0x7f00000000c0)={&(0x7f0000000080), 0xc, &(0x7f0000000540)={&(0x7f0000000340)=@newlink={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_XDP={0x4}, @IFLA_NET_NS_PID={0x8, 0x13, r6}]}, 0x2c}}, 0x0) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) fgetxattr(r1, &(0x7f0000000000)=@known='com.apple.system.Security\x00', &(0x7f0000000040)=""/112, 0x70) recvfrom(r1, &(0x7f0000000180)=""/48, 0x30, 0x40, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x4, 0x0, 0x3, {0xa, 0x4e23, 0x8, @mcast1, 0x20}}}, 0x80) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r8, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) dup2(r1, r7) close(r8) 00:11:41 executing program 2: clone(0x0, &(0x7f0000b53000), &(0x7f000084effc), &(0x7f00000000c0), &(0x7f0000b3bfff)) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(0xffffffffffffffff, 0xc058534b, &(0x7f0000000980)={0x0, 0x0, 0x1ff, 0x0, 0x0, 0x7}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgid(0xffffffffffffffff) sched_setscheduler(r2, 0x0, &(0x7f0000000240)=0x14) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={"76657468300000000000000000000001", 0x0}) r6 = gettid() sendmsg$nl_route(r4, &(0x7f00000000c0)={&(0x7f0000000080), 0xc, &(0x7f0000000540)={&(0x7f0000000340)=@newlink={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_XDP={0x4}, @IFLA_NET_NS_PID={0x8, 0x13, r6}]}, 0x2c}}, 0x0) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) fgetxattr(r1, &(0x7f0000000000)=@known='com.apple.system.Security\x00', &(0x7f0000000040)=""/112, 0x70) recvfrom(r1, &(0x7f0000000180)=""/48, 0x30, 0x40, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x4, 0x0, 0x3, {0xa, 0x4e23, 0x8, @mcast1, 0x20}}}, 0x80) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r8, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) dup2(r1, r7) close(r8) 00:11:41 executing program 6: clone(0x0, &(0x7f0000b53000), &(0x7f000084effc), &(0x7f00000000c0), &(0x7f0000b3bfff)) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(0xffffffffffffffff, 0xc058534b, &(0x7f0000000980)={0x0, 0x0, 0x1ff, 0x0, 0x0, 0x7}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgid(0xffffffffffffffff) sched_setscheduler(r2, 0x0, &(0x7f0000000240)=0x14) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={"76657468300000000000000000000001", 0x0}) r6 = gettid() sendmsg$nl_route(r4, &(0x7f00000000c0)={&(0x7f0000000080), 0xc, &(0x7f0000000540)={&(0x7f0000000340)=@newlink={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_XDP={0x4}, @IFLA_NET_NS_PID={0x8, 0x13, r6}]}, 0x2c}}, 0x0) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) fgetxattr(r1, &(0x7f0000000000)=@known='com.apple.system.Security\x00', &(0x7f0000000040)=""/112, 0x70) recvfrom(r1, &(0x7f0000000180)=""/48, 0x30, 0x40, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x4, 0x0, 0x3, {0xa, 0x4e23, 0x8, @mcast1, 0x20}}}, 0x80) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r8, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) dup2(r1, r7) close(r8) 00:11:41 executing program 3: clone(0x0, &(0x7f0000b53000), &(0x7f000084effc), &(0x7f00000000c0), &(0x7f0000b3bfff)) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(0xffffffffffffffff, 0xc058534b, &(0x7f0000000980)={0x0, 0x0, 0x1ff, 0x0, 0x0, 0x7}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgid(0xffffffffffffffff) sched_setscheduler(r2, 0x0, &(0x7f0000000240)=0x14) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={"76657468300000000000000000000001", 0x0}) r6 = gettid() sendmsg$nl_route(r4, &(0x7f00000000c0)={&(0x7f0000000080), 0xc, &(0x7f0000000540)={&(0x7f0000000340)=@newlink={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_XDP={0x4}, @IFLA_NET_NS_PID={0x8, 0x13, r6}]}, 0x2c}}, 0x0) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) fgetxattr(r1, &(0x7f0000000000)=@known='com.apple.system.Security\x00', &(0x7f0000000040)=""/112, 0x70) recvfrom(r1, &(0x7f0000000180)=""/48, 0x30, 0x40, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x4, 0x0, 0x3, {0xa, 0x4e23, 0x8, @mcast1, 0x20}}}, 0x80) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r8, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) dup2(r1, r7) close(r8) 00:11:41 executing program 5: clone(0x0, &(0x7f0000b53000), &(0x7f000084effc), &(0x7f00000000c0), &(0x7f0000b3bfff)) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(0xffffffffffffffff, 0xc058534b, &(0x7f0000000980)={0x0, 0x0, 0x1ff, 0x0, 0x0, 0x7}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = getpgid(0xffffffffffffffff) sched_setscheduler(r2, 0x0, &(0x7f0000000240)=0x14) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={"76657468300000000000000000000001", 0x0}) r6 = gettid() sendmsg$nl_route(r4, &(0x7f00000000c0)={&(0x7f0000000080), 0xc, &(0x7f0000000540)={&(0x7f0000000340)=@newlink={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_XDP={0x4}, @IFLA_NET_NS_PID={0x8, 0x13, r6}]}, 0x2c}}, 0x0) munlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) fgetxattr(r1, &(0x7f0000000000)=@known='com.apple.system.Security\x00', &(0x7f0000000040)=""/112, 0x70) recvfrom(r1, &(0x7f0000000180)=""/48, 0x30, 0x40, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x4, 0x0, 0x3, {0xa, 0x4e23, 0x8, @mcast1, 0x20}}}, 0x80) r7 = socket$inet6_udp(0xa, 0x2, 0x0) r8 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r8, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r7, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) dup2(r1, r7) close(r8) [ 45.712862] ================================================================== [ 45.712922] ------------[ cut here ]------------ [ 45.712925] kernel BUG at net/l2tp/l2tp_core.c:917! [ 45.712931] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 45.712936] Dumping ftrace buffer: [ 45.712939] (ftrace buffer empty) [ 45.712944] Modules linked in: [ 45.712953] CPU: 0 PID: 6282 Comm: syz-executor4 Not tainted 4.9.113-g8956c50 #67 [ 45.712958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 45.712963] task: ffff8801cefbe000 task.stack: ffff8801d3a50000 [ 45.712980] RIP: 0010:[] [] l2tp_session_queue_purge+0xe0/0x100 [ 45.712984] RSP: 0018:ffff8801d3a57d50 EFLAGS: 00010212 [ 45.712989] RAX: 0000000000040000 RBX: ffff8801cd5de000 RCX: ffffc90007744000 [ 45.712993] RDX: 0000000000000105 RSI: ffffffff836bbe20 RDI: ffff8801cd5de000 [ 45.713001] RBP: ffff8801d3a57d78 R08: ffff8801cefbe8e8 R09: 0000000000000000 [ 45.713006] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801cd5de000 [ 45.713011] R13: ffff8801cbf66660 R14: ffff8801cdf3ad58 R15: ffffffff83013be0 [ 45.713017] FS: 00007f5e11bb0700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 [ 45.713022] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.713027] CR2: 0000001b33729000 CR3: 00000001cf582000 CR4: 00000000001606f0 [ 45.713035] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 45.713039] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 45.713040] Stack: [ 45.713052] ffff8801cdf3aa80 ffff8801cd5de000 ffff8801cbf66660 ffff8801cdf3ad58 [ 45.713061] ffffffff83013be0 ffff8801d3a57da8 ffffffff836c7abb ffff8801cbf66640 [ 45.713070] ffffffff8417b160 ffff8801cbf66668 0000000000000000 ffff8801d3a57dd8 [ 45.713072] Call Trace: [ 45.713083] [] ? sock_release+0x1c0/0x1c0 [ 45.713092] [] pppol2tp_release+0x1fb/0x2e0 [ 45.713121] [] sock_release+0x96/0x1c0 [ 45.713134] [] sock_close+0x16/0x20 [ 45.713145] [] __fput+0x263/0x700 [ 45.713154] [] ____fput+0x15/0x20 [ 45.713166] [] task_work_run+0x10c/0x180 [ 45.713175] [] exit_to_usermode_loop+0xfc/0x120 [ 45.713182] [] do_syscall_64+0x364/0x490 [ 45.713191] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 45.713301] Code: 2c ca fd 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 66 2c ca fd 48 89 df e8 0e 7c 34 00 eb ca e8 57 2c ca fd 0f 0b e8 50 2c ca fd <0f> 0b 4c 89 ff e8 f6 fd e7 fd eb a6 48 89 df e8 cc fd e7 fd e9 [ 45.713309] RIP [] l2tp_session_queue_purge+0xe0/0x100 [ 45.713311] RSP [ 45.713338] ---[ end trace 8ccaed7ab82844a5 ]--- [ 45.713343] Kernel panic - not syncing: Fatal exception [ 45.979477] BUG: KASAN: use-after-free in l2tp_session_queue_purge+0xf4/0x100 [ 45.986738] Read of size 4 at addr ffff8801cd5de780 by task syz-executor2/6281 [ 45.994072] [ 45.995692] CPU: 1 PID: 6281 Comm: syz-executor2 Tainted: G D 4.9.113-g8956c50 #67 [ 46.004505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 46.013838] ffff8801cd4efcb0 ffffffff81eb32a9 ffffea0007357780 ffff8801cd5de780 [ 46.021861] 0000000000000000 ffff8801cd5de780 ffffffff83013be0 ffff8801cd4efce8 [ 46.029886] ffffffff81567bd9 ffff8801cd5de780 0000000000000004 0000000000000000 [ 46.037926] Call Trace: [ 46.040491] [] dump_stack+0xc1/0x128 [ 46.045837] [] ? sock_release+0x1c0/0x1c0 [ 46.051615] [] print_address_description+0x6c/0x234 [ 46.058261] [] ? sock_release+0x1c0/0x1c0 [ 46.064036] [] kasan_report.cold.6+0x242/0x2fe [ 46.070244] [] ? l2tp_session_queue_purge+0xf4/0x100 [ 46.076978] [] __asan_report_load4_noabort+0x14/0x20 [ 46.083707] [] l2tp_session_queue_purge+0xf4/0x100 [ 46.090263] [] ? sock_release+0x1c0/0x1c0 [ 46.096043] [] pppol2tp_release+0x1fb/0x2e0 [ 46.101992] [] sock_release+0x96/0x1c0 [ 46.107506] [] sock_close+0x16/0x20 [ 46.112762] [] __fput+0x263/0x700 [ 46.117845] [] ____fput+0x15/0x20 [ 46.122929] [] task_work_run+0x10c/0x180 [ 46.128621] [] exit_to_usermode_loop+0xfc/0x120 [ 46.134925] [] do_syscall_64+0x364/0x490 [ 46.140616] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 46.147514] [ 46.149118] Allocated by task 6262: [ 46.152722] save_stack_trace+0x16/0x20 [ 46.156683] save_stack+0x43/0xd0 [ 46.160112] kasan_kmalloc+0xc7/0xe0 [ 46.163802] __kmalloc+0x11d/0x300 [ 46.167318] l2tp_session_create+0x38/0x16f0 [ 46.171702] pppol2tp_connect+0x10d7/0x18f0 [ 46.176012] SYSC_connect+0x1b8/0x300 [ 46.179793] SyS_connect+0x24/0x30 [ 46.183311] do_syscall_64+0x1a6/0x490 [ 46.187176] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 46.192266] [ 46.193872] Freed by task 6262: [ 46.197140] save_stack_trace+0x16/0x20 [ 46.201094] save_stack+0x43/0xd0 [ 46.204523] kasan_slab_free+0x72/0xc0 [ 46.208399] kfree+0xfb/0x310 [ 46.211494] l2tp_session_free+0x166/0x200 [ 46.215706] l2tp_tunnel_closeall+0x284/0x350 [ 46.220194] l2tp_udp_encap_destroy+0x87/0xe0 [ 46.224666] udpv6_destroy_sock+0xb1/0xd0 [ 46.228789] sk_common_release+0x6d/0x300 [ 46.232932] udp_lib_close+0x15/0x20 [ 46.236622] inet_release+0xff/0x1d0 [ 46.240317] inet6_release+0x50/0x70 [ 46.244007] sock_release+0x96/0x1c0 [ 46.247695] sock_close+0x16/0x20 [ 46.251126] __fput+0x263/0x700 [ 46.254381] ____fput+0x15/0x20 [ 46.257640] task_work_run+0x10c/0x180 [ 46.261504] exit_to_usermode_loop+0xfc/0x120 [ 46.265997] do_syscall_64+0x364/0x490 [ 46.269861] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 46.274935] [ 46.276540] The buggy address belongs to the object at ffff8801cd5de780 [ 46.276540] which belongs to the cache kmalloc-512 of size 512 [ 46.289185] The buggy address is located 0 bytes inside of [ 46.289185] 512-byte region [ffff8801cd5de780, ffff8801cd5de980) [ 46.300859] The buggy address belongs to the page: [ 46.305769] page:ffffea0007357780 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 46.315961] flags: 0x8000000000004080(slab|head) [ 46.321125] page dumped because: kasan: bad access detected [ 46.326810] [ 46.328415] Memory state around the buggy address: [ 46.333323] ffff8801cd5de680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.340668] ffff8801cd5de700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 46.348007] >ffff8801cd5de780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.355340] ^ [ 46.358683] ffff8801cd5de800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.366018] ffff8801cd5de880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 46.373364] ================================================================== [ 46.381221] Dumping ftrace buffer: [ 46.384760] (ftrace buffer empty) [ 46.388443] Kernel Offset: disabled [ 46.392067] Rebooting in 86400 seconds..