[ 59.730531] audit: type=1800 audit(1539092741.764:27): pid=6148 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 61.148144] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 63.544382] random: sshd: uninitialized urandom read (32 bytes read) [ 63.910002] random: sshd: uninitialized urandom read (32 bytes read) [ 66.315024] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.117' (ECDSA) to the list of known hosts. [ 72.236476] random: sshd: uninitialized urandom read (32 bytes read) 2018/10/09 13:45:56 fuzzer started [ 77.024940] random: cc1: uninitialized urandom read (8 bytes read) 2018/10/09 13:46:01 dialing manager at 10.128.0.26:44001 2018/10/09 13:46:01 syscalls: 1 2018/10/09 13:46:01 code coverage: enabled 2018/10/09 13:46:01 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/10/09 13:46:01 setuid sandbox: enabled 2018/10/09 13:46:01 namespace sandbox: enabled 2018/10/09 13:46:01 Android sandbox: /sys/fs/selinux/policy does not exist 2018/10/09 13:46:01 fault injection: enabled 2018/10/09 13:46:01 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/10/09 13:46:01 net packed injection: enabled 2018/10/09 13:46:01 net device setup: enabled [ 81.753775] random: crng init done 13:47:55 executing program 0: mknod$loop(&(0x7f0000000080)='./file0\x00', 0x0, 0xffffffffffffffff) r0 = open(&(0x7f0000000080)='./file0\x00', 0x40002, 0x0) write$cgroup_type(r0, &(0x7f0000000040)='threaded\x00', 0x26cf) [ 194.356103] IPVS: ftp: loaded support on port[0] = 21 [ 196.823482] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.829970] bridge0: port 1(bridge_slave_0) entered disabled state [ 196.839342] device bridge_slave_0 entered promiscuous mode [ 197.013542] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.020001] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.028899] device bridge_slave_1 entered promiscuous mode [ 197.178303] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 197.326993] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 13:47:59 executing program 1: r0 = syz_open_dev$sndpcmc(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x800000000000004) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d5c6070") ioctl(r0, 0xc1004111, &(0x7f0000000000)) [ 198.072258] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 198.219668] IPVS: ftp: loaded support on port[0] = 21 [ 198.318888] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 198.495763] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 198.502915] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 198.719557] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 198.727197] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 199.312957] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 199.321004] team0: Port device team_slave_0 added [ 199.484746] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 199.493476] team0: Port device team_slave_1 added [ 199.719664] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 199.726791] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 199.735810] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 199.950844] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 199.958575] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 199.967333] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 200.176059] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 200.183876] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 200.193016] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 200.403602] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 200.411169] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 200.420290] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 201.828992] bridge0: port 1(bridge_slave_0) entered blocking state [ 201.835613] bridge0: port 1(bridge_slave_0) entered disabled state [ 201.844238] device bridge_slave_0 entered promiscuous mode [ 202.064900] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.071398] bridge0: port 2(bridge_slave_1) entered disabled state [ 202.080153] device bridge_slave_1 entered promiscuous mode [ 202.330655] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 202.585376] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 203.000873] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.007598] bridge0: port 2(bridge_slave_1) entered forwarding state [ 203.014746] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.021275] bridge0: port 1(bridge_slave_0) entered forwarding state [ 203.030586] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 203.261333] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 203.292580] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 203.425718] bond0: Enslaving bond_slave_1 as an active interface with an up link 13:48:05 executing program 2: socketpair$unix(0x1, 0x1000000000005, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={&(0x7f0000000040), 0xc, &(0x7f0000000000)={&(0x7f0000002f00)={0x14, 0x1c, 0xfffffffffffffffd, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) [ 203.688558] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 203.696172] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 204.011291] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 204.018643] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 204.490779] IPVS: ftp: loaded support on port[0] = 21 [ 204.921395] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 204.931726] team0: Port device team_slave_0 added [ 205.207497] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 205.216109] team0: Port device team_slave_1 added [ 205.468818] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 205.476114] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 205.485169] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 205.829057] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 205.836457] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 205.845707] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 206.102699] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 206.110363] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 206.120010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 206.513048] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 206.520886] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 206.530423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 209.729616] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.736292] bridge0: port 1(bridge_slave_0) entered disabled state [ 209.744929] device bridge_slave_0 entered promiscuous mode [ 209.816232] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.822841] bridge0: port 2(bridge_slave_1) entered forwarding state [ 209.829831] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.836516] bridge0: port 1(bridge_slave_0) entered forwarding state [ 209.845578] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 210.008712] bridge0: port 2(bridge_slave_1) entered blocking state [ 210.015581] bridge0: port 2(bridge_slave_1) entered disabled state [ 210.024966] device bridge_slave_1 entered promiscuous mode [ 210.252608] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 210.287744] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 210.608053] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 211.465934] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 211.798194] bond0: Enslaving bond_slave_1 as an active interface with an up link 13:48:13 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000180)="153f6234488dd25d766070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) r2 = syz_open_procfs(0x0, &(0x7f00000004c0)='oom_score_adj\x00') sendfile(r2, r2, &(0x7f0000000040), 0x100000001) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000000)) r3 = syz_open_pts(r1, 0x0) read(r3, &(0x7f0000000080)=""/1, 0x229) [ 212.156340] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 212.163788] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 212.559974] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 212.567852] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 213.158321] IPVS: ftp: loaded support on port[0] = 21 [ 213.706630] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 213.714951] team0: Port device team_slave_0 added [ 214.078531] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 214.087121] team0: Port device team_slave_1 added [ 214.421029] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 214.428266] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 214.437943] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 214.774299] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 214.781861] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 214.791295] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 215.110718] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 215.118470] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 215.128135] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 215.464101] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 215.471814] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 215.481132] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 216.256844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 217.504426] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 218.894166] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 218.900522] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 218.908637] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 219.704865] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.711367] bridge0: port 1(bridge_slave_0) entered disabled state [ 219.720082] device bridge_slave_0 entered promiscuous mode [ 219.873549] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.880128] bridge0: port 2(bridge_slave_1) entered forwarding state [ 219.887740] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.894785] bridge0: port 1(bridge_slave_0) entered forwarding state [ 219.905945] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 220.051224] 8021q: adding VLAN 0 to HW filter on device team0 [ 220.138851] bridge0: port 2(bridge_slave_1) entered blocking state [ 220.145634] bridge0: port 2(bridge_slave_1) entered disabled state [ 220.154379] device bridge_slave_1 entered promiscuous mode [ 220.577870] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 220.732550] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 220.985127] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 222.136652] bond0: Enslaving bond_slave_0 as an active interface with an up link 13:48:24 executing program 4: r0 = syz_open_dev$sndpcmc(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl(r0, 0xc0984124, &(0x7f0000000100)="64974b8bd5cf4ea0117584da0021f20b7a0c5b92d8ad156c89ce9e2acf0a22825aa9195c548254c9042891d0adb5ae18772957647fd563a792c0db13300d93553cd846dd3b296b9f98407c2b1f51873eef21e93756c7408fc385ef89aa") [ 222.594776] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 223.068741] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 223.076246] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 223.468457] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 223.476349] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 224.019757] IPVS: ftp: loaded support on port[0] = 21 [ 224.745760] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 224.758414] team0: Port device team_slave_0 added [ 225.122165] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 225.131457] team0: Port device team_slave_1 added [ 225.263896] 8021q: adding VLAN 0 to HW filter on device bond0 [ 225.529006] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 225.536248] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 225.545147] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 225.958980] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 225.966237] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 225.975365] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 226.454779] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 226.475142] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 226.489756] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 226.928206] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 226.939097] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 226.951486] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 227.162795] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 228.773016] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 228.780279] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 228.790342] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 230.246421] 8021q: adding VLAN 0 to HW filter on device team0 13:48:32 executing program 0: r0 = open(&(0x7f00007e2ff8)='./file0\x00', 0x80040, 0x0) fcntl$setlease(r0, 0x400, 0x0) fcntl$getflags(r0, 0x400) 13:48:32 executing program 0: r0 = socket(0x10, 0x80000, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f00000000c0)=@req={0x28, &(0x7f0000000040)={'gre0\x00', @ifru_addrs=@vsock={0x28, 0x0, 0x2711, @my=0x1}}}) sendmsg$nl_route(r0, &(0x7f0000000340)={&(0x7f0000000380), 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000c07890f0e487ec7a6ec68f4afb06af2221bb90fd25685083e2d50100000000000000"], 0xfde7}}, 0x0) 13:48:33 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x8000, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f00000009c0)={0x53, 0xfffffffffffffffb, 0x4d, 0x8, @scatter={0x6, 0x0, &(0x7f0000000880)=[{&(0x7f0000000400)=""/133, 0x85}, {&(0x7f00000004c0)=""/179, 0xb3}, {&(0x7f0000000580)=""/207, 0xcf}, {&(0x7f0000000680)=""/231, 0xe7}, {&(0x7f0000000780)=""/67, 0x43}, {&(0x7f0000000800)=""/127, 0x7f}]}, &(0x7f0000000900)="3e35356404e87e4aed0713f4a23e183e5b4f70564607c0e35d05046f8ec49f0a7245d60dc026ebbaffbb0834faad9ab8f417fa41d21bedc7af884893e14a081a87b961d1d7f47628c6d9d72a6f", &(0x7f0000000080)=""/26, 0x34b2afb5, 0x10024, 0x3, &(0x7f0000000980)}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000300)="87e37958224da81749aa1d79903ca294ea104b6ea9b63a1f9f65365d579fd36e41bb4bbf6c013ba7ba13023499c9e91d56ba51125589696f08e636b01b1ee704fed3ba8285ca6fccf66bd2816bf426770cea4964adb41b061444194b45bfacc3a17afc0f75cd004fdc6f3e3577814c91c408537c78824c83e8f1c98612806acbabbd4bd1fe3ff62c42a6bb6038d607c199efe58a3f2c7aa1d0d8cfd8c979fe5d961e17a77851e61cbb0c8a34c7e88e2aa3a313bca89e14068139ec490448c278f9d2f90ed077a2ce923da40ff89ec2e25ec866c56be0885b1ac83cb976f8e27fffca1c89dd558a123b4a0dd98949c90e90517acc93bc94fd3769ab5c3df0670b") r2 = socket$inet6_sctp(0xa, 0x200000000000005, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x70, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e23, 0x9, @mcast2, 0x10001}}, [0x1, 0xfffffffffffffff8, 0x7, 0xdd, 0x100, 0xff, 0x6d, 0x4, 0x4, 0xe1df0000000, 0x8, 0x3ff, 0x9, 0xfff]}, &(0x7f00000000c0)=0x100) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000100)={r3, 0x9}, &(0x7f00000002c0)=0x8) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000000), 0x4) [ 231.498672] bridge0: port 1(bridge_slave_0) entered blocking state [ 231.505372] bridge0: port 1(bridge_slave_0) entered disabled state [ 231.513945] device bridge_slave_0 entered promiscuous mode 13:48:33 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)) [ 231.984913] bridge0: port 2(bridge_slave_1) entered blocking state [ 231.995636] bridge0: port 2(bridge_slave_1) entered disabled state [ 232.004151] device bridge_slave_1 entered promiscuous mode 13:48:34 executing program 0: r0 = accept4$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, &(0x7f00000000c0)=0x10, 0x800) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000300)={0x0, 0x34, "0a6c2d8c3c25948c6c5527b76128b2cf9bcdab223a30895e8e555c5c2da72a3fe936803ff16a60f1bd438b4718986dbf208fdd94b9c53bde0828660baee055ccf5e817337fc0bdff"}, &(0x7f00000002c0)=0x50) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f00000001c0)={r1, 0x4}, 0x8) unshare(0x2000400) r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x80000000007, 0x1000000000000001) ioctl$FS_IOC_FSGETXATTR(r2, 0x802c550a, &(0x7f0000000040)={0x2, 0x0, 0x0, 0x730000, 0xffffffff7ff0bdbe}) ioctl$ASHMEM_GET_SIZE(r2, 0x7704, 0x0) [ 232.429509] vhci_hcd: invalid port number 255 [ 232.434348] vhci_hcd: default hub control req: feff vffff i00ff l65535 [ 232.439244] bridge0: port 2(bridge_slave_1) entered blocking state [ 232.447540] bridge0: port 2(bridge_slave_1) entered forwarding state [ 232.454862] bridge0: port 1(bridge_slave_0) entered blocking state [ 232.461308] bridge0: port 1(bridge_slave_0) entered forwarding state [ 232.469717] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 232.573675] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready 13:48:34 executing program 0: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhci\x00', 0x2000, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x26, &(0x7f00000000c0)={@local, @multicast2, @multicast1}, 0xc) unshare(0x2000400) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="726177000000c7959cb4eec4a8749b2d89efb7000000000000000000000000000000000000000800000000000009000000e9000000080200000000000000000000e80000000000000000180000a00100a0010000a0032d63"], 0x1) [ 232.953039] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 232.962227] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 13:48:35 executing program 0: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) fstat(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) r1 = getegid() lchown(&(0x7f0000000000)='./file0\x00', r0, r1) mount(&(0x7f0000000740), &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000240)='minix\x00', 0x0, &(0x7f00000002c0)='ns/mnt\x00') 13:48:36 executing program 0: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x10) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000080)=""/29) r1 = socket(0x10, 0x802, 0x0) write(r1, &(0x7f0000000040)="220000004a0007e6e9091008090007000a000000e46916c36f0279c66c74f3a17a17", 0x22) recvfrom(r1, &(0x7f0000000280)=""/24, 0x18, 0x0, 0x0, 0x0) [ 234.429500] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 234.823782] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 235.149917] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 235.157220] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 235.527180] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 235.537076] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 236.449227] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 236.457609] team0: Port device team_slave_0 added [ 236.746405] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 236.754603] team0: Port device team_slave_1 added [ 236.976823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 237.079815] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 237.087094] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 237.095704] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 237.374805] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 237.382085] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 237.390754] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 237.719052] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 237.726723] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 237.736146] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 237.937912] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 238.001890] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 238.010670] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 238.019755] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 239.113443] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 239.119869] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 239.128006] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 13:48:41 executing program 1: r0 = socket(0x50000000010, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="f38fa2b30000dc77677cf93a0b2fc3eafa66ff085ee46cdc5502e607f2274e08"], &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080)='tracefs\x00', 0x0, &(0x7f0000000300)) r1 = socket$inet(0x2, 0x3, 0x2) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000e15000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000133ffc)="71e67a15", 0x4) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000001040)='/dev/dsp\x00', 0x2, 0x0) ioctl$SG_GET_LOW_DMA(r3, 0x227a, &(0x7f0000001080)) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = accept4$alg(r2, 0x0, 0x0, 0x0) fcntl$setstatus(r4, 0x4, 0x2400) readv(r4, &(0x7f0000000000)=[{&(0x7f0000000040)=""/4096, 0xfea7}], 0x1) setsockopt$inet_int(r1, 0x0, 0xcb, &(0x7f0000000000)=0x10001, 0x10) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4, @remote}, 0x10) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') sendfile(r0, r5, &(0x7f0000000140), 0x80000002) [ 240.114164] 8021q: adding VLAN 0 to HW filter on device team0 [ 241.123968] bridge0: port 2(bridge_slave_1) entered blocking state [ 241.132054] bridge0: port 2(bridge_slave_1) entered forwarding state [ 241.139030] bridge0: port 1(bridge_slave_0) entered blocking state [ 241.146045] bridge0: port 1(bridge_slave_0) entered forwarding state [ 241.155033] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 241.162144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 244.373861] 8021q: adding VLAN 0 to HW filter on device bond0 [ 245.022754] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready 13:48:47 executing program 2: r0 = socket(0x50000000010, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="f38fa2b30000dc77677cf93a0b2fc3eafa66ff085ee46cdc5502e607f2274e08"], &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080)='tracefs\x00', 0x0, &(0x7f0000000300)) r1 = socket$inet(0x2, 0x3, 0x2) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000e15000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000133ffc)="71e67a15", 0x4) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000001040)='/dev/dsp\x00', 0x2, 0x0) ioctl$SG_GET_LOW_DMA(r3, 0x227a, &(0x7f0000001080)) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = accept4$alg(r2, 0x0, 0x0, 0x0) fcntl$setstatus(r4, 0x4, 0x2400) readv(r4, &(0x7f0000000000)=[{&(0x7f0000000040)=""/4096, 0xfea7}], 0x1) setsockopt$inet_int(r1, 0x0, 0xcb, &(0x7f0000000000)=0x10001, 0x10) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4, @remote}, 0x10) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') sendfile(r0, r5, &(0x7f0000000140), 0x80000002) [ 245.734446] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 245.740936] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 245.749174] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 246.302369] 8021q: adding VLAN 0 to HW filter on device team0 [ 248.865517] 8021q: adding VLAN 0 to HW filter on device bond0 [ 249.405686] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 249.908976] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 249.915380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 249.923341] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 250.270790] 8021q: adding VLAN 0 to HW filter on device team0 13:48:52 executing program 3: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000080)={0x10000009, 0xffffffffffffffff, 0x1, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000240)=0x1) [ 250.665501] updating oom_score_adj for 7607 (syz-executor3) from 0 to 0 because it shares mm with 7584 (syz-executor3). Report if this is unexpected. [ 251.574058] ion_buffer_destroy: buffer still mapped in the kernel 13:48:55 executing program 4: r0 = syz_open_dev$sndpcmc(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000700)=@filter={'filter\x00', 0xe, 0x1, 0x1, [0x0, 0x20000040, 0x20000070, 0x20000210], 0x0, &(0x7f0000000400), &(0x7f0000000000)=ANY=[@ANYBLOB="82"]}, 0x79) r1 = socket$inet6(0xa, 0x3, 0x800000000000004) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d5c6070") ioctl(r0, 0x5452, &(0x7f0000000000)) 13:48:55 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xfffffffffffffffc}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="06234c5f96db8dcbb0ff7f000000000000b36e0ebf4310c8e4f4af13e9b29834a5a57dbfcbf35df6124fa6fe58171373886067a8fbdd7466827207911f284442e76dd3a4e1ba0f4f17bbe35e4e00000000", @ANYRES32=0x0, @ANYBLOB="000008001400030003000000ff01000001000000ff0700000c0002000180c2000001000008000800", @ANYRES32=0x0, @ANYBLOB="0c000100aaaaaaaaaaaa0000"], 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) r1 = syz_genetlink_get_family_id$team(&(0x7f00000001c0)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f0000000200)={@local, 0x0}, &(0x7f0000000240)=0x14) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1b, &(0x7f0000000280)={@remote, 0x0}, &(0x7f00000002c0)=0x14) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000003c0)={0x0}, &(0x7f0000000400)=0xc) accept$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000480)=0x14) sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000000680)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000640)={&(0x7f00000004c0)=ANY=[@ANYBLOB="4c010000", @ANYRES16=r1, @ANYBLOB="0c0328bd7000fbdbdf250200000008000100", @ANYRES32=r2, @ANYBLOB="300102003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r3, @ANYBLOB="400001002400010071756575655f696400000000000000000000000000000000000000000000000008000300030000e7080004000000000008000600", @ANYRES32=r4, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r5, @ANYBLOB="40000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b00000008000400c8b60000080007000000000038000100240001006e6f746966795f70656572735f636f756e74000000000000000000000000000008000300030000000800040006000000"], 0x14c}, 0x1, 0x0, 0x0, 0x10}, 0x4040014) 13:48:55 executing program 5: r0 = memfd_create(&(0x7f0000000000)='[\x00', 0x1) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000040)=0x7ff) r1 = accept(r0, &(0x7f0000000080)=@generic, &(0x7f0000000100)=0x80) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) setsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000140)=0x4, 0x4) fremovexattr(r0, &(0x7f0000000180)=@random={'osx.', '+\x00'}) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f00000001c0)=0xbe) write$selinux_attr(r0, &(0x7f0000000200)='system_u:object_r:syslogd_exec_t:s0\x00', 0x24) delete_module(&(0x7f0000000240)='system_u:object_r:syslogd_exec_t:s0\x00', 0x200) write$P9_RVERSION(r0, &(0x7f0000000280)={0x15, 0x65, 0xffff, 0x3, 0x8, '9P2000.L'}, 0x15) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f00000002c0)) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000300)={'tunl0\x00'}) ioctl$SG_SCSI_RESET(r0, 0x2284, 0x0) ioctl$DRM_IOCTL_IRQ_BUSID(r0, 0xc0106403, &(0x7f0000000340)={0xffffffffffffff80, 0x4, 0x4, 0x4}) r2 = syz_open_dev$audion(&(0x7f0000000380)='/dev/audio#\x00', 0x100000000, 0x121000) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f0000000400)={0x1, &(0x7f00000003c0)=[{0x0}]}) ioctl$DRM_IOCTL_NEW_CTX(r2, 0x40086425, &(0x7f0000000440)={r3, 0x3}) ioctl$int_in(r0, 0x0, &(0x7f0000000480)=0x2) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000004c0)={'veth0\x00', 0x100}) getpeername$inet(r1, &(0x7f0000000500), &(0x7f0000000540)=0x10) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x4000, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f00000005c0)=0x8) ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000600)={0x6, r2}) clock_gettime(0x0, &(0x7f00000006c0)={0x0, 0x0}) ppoll(&(0x7f0000000640)=[{r2, 0x4000}, {r1, 0x8082}, {r4, 0x580}, {r0, 0x8000}, {r5}, {r4, 0x4000}, {r0, 0x200}, {r4, 0x100}, {r2, 0x2000}], 0x9, &(0x7f0000000700)={r6, r7+30000000}, &(0x7f0000000740)={0x6}, 0x8) accept(r0, &(0x7f0000000780)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000800)=0x80) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f0000000940)={'broute\x00', 0x0, 0x3, 0x7a, [], 0x6, &(0x7f0000000840)=[{}, {}, {}, {}, {}, {}], &(0x7f00000008c0)=""/122}, &(0x7f00000009c0)=0x78) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000a40)={0x4, {0x2, 0x4e24, @remote}, {0x2, 0x4e21, @remote}, {0x2, 0x4e20, @rand_addr=0x79a}, 0x100, 0x5, 0x4, 0x7, 0x100, &(0x7f0000000a00)='rose0\x00', 0x3, 0x80000000000, 0x4}) memfd_create(&(0x7f0000000ac0)='\x00', 0x4) 13:48:55 executing program 2: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0xffffffffffffffe0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 13:48:55 executing program 1: r0 = socket(0x50000000010, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="f38fa2b30000dc77677cf93a0b2fc3eafa66ff085ee46cdc5502e607f2274e08"], &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080)='tracefs\x00', 0x0, &(0x7f0000000300)) r1 = socket$inet(0x2, 0x3, 0x2) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000e15000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000133ffc)="71e67a15", 0x4) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000001040)='/dev/dsp\x00', 0x2, 0x0) ioctl$SG_GET_LOW_DMA(r3, 0x227a, &(0x7f0000001080)) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = accept4$alg(r2, 0x0, 0x0, 0x0) fcntl$setstatus(r4, 0x4, 0x2400) readv(r4, &(0x7f0000000000)=[{&(0x7f0000000040)=""/4096, 0xfea7}], 0x1) setsockopt$inet_int(r1, 0x0, 0xcb, &(0x7f0000000000)=0x10001, 0x10) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4, @remote}, 0x10) r5 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') sendfile(r0, r5, &(0x7f0000000140), 0x80000002) 13:48:55 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x201, 0xc000000100079) ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:48:55 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x84000000000000b) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r1, 0xffffffffffffff7f) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000900)={0x0, 0x0, 0x20}, 0xc) write$binfmt_misc(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="73797a9c8100000000e9a93b46bb485f520042f6a309000000000000a373915939eb2a7b3a9cd724eeb366bfc7cad8c6af92040c89c5c1badda79ddf637683603eb9a72e9b4a85147b2f11dea1c96f410c4fc9a13f18040e21b60808fb65d7ff28b024f4dcd363600da199c183130eed4a07837ee052a120539b94855bd624928a1fbbfe63748a4fbeac"], 0x8a) write$binfmt_misc(r2, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfdd5) 13:48:55 executing program 1: r0 = syz_open_dev$sndpcmc(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x800000000000004) ioctl(r1, 0x8912, &(0x7f0000000280)) ioctl(r0, 0xc2604110, &(0x7f0000000080)="754454dd311bd3e281da4b46784ad1d92395963bd8a077fec91273c82fb471554e66235a89e501fe8ff38d57b508e3b91138f962c054fa49044ef0135a7a5e4089014e1845") 13:48:55 executing program 0: 13:48:56 executing program 4: 13:48:56 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x201, 0xc000000100079) ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) [ 254.024741] sctp: failed to load transform for md5: -2 13:48:56 executing program 1: 13:48:56 executing program 4: 13:48:56 executing program 2: [ 254.939205] IPVS: ftp: loaded support on port[0] = 21 [ 256.180391] bridge0: port 1(bridge_slave_0) entered blocking state [ 256.186873] bridge0: port 1(bridge_slave_0) entered disabled state [ 256.195320] device bridge_slave_0 entered promiscuous mode [ 256.278796] bridge0: port 2(bridge_slave_1) entered blocking state [ 256.285260] bridge0: port 2(bridge_slave_1) entered disabled state [ 256.293777] device bridge_slave_1 entered promiscuous mode [ 256.367526] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 256.445188] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 256.684286] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 256.773565] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 256.858965] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 256.866167] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 256.950757] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 256.957985] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 257.223239] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 257.230895] team0: Port device team_slave_0 added [ 257.315065] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 257.323236] team0: Port device team_slave_1 added [ 257.405150] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 257.491735] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 257.577518] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 257.585038] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 257.594510] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 257.674718] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 257.682342] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 257.691265] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 258.550326] bridge0: port 2(bridge_slave_1) entered blocking state [ 258.556848] bridge0: port 2(bridge_slave_1) entered forwarding state [ 258.564054] bridge0: port 1(bridge_slave_0) entered blocking state [ 258.570449] bridge0: port 1(bridge_slave_0) entered forwarding state [ 258.578953] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 258.832268] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 261.860188] 8021q: adding VLAN 0 to HW filter on device bond0 [ 262.174386] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 262.485710] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 262.492278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 262.500833] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 262.810756] 8021q: adding VLAN 0 to HW filter on device team0 13:49:07 executing program 5: 13:49:07 executing program 0: 13:49:07 executing program 1: 13:49:07 executing program 2: 13:49:07 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x201, 0xc000000100079) ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:49:07 executing program 4: 13:49:07 executing program 0: 13:49:07 executing program 4: 13:49:08 executing program 1: 13:49:08 executing program 2: 13:49:08 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x201, 0xc000000100079) ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:49:08 executing program 5: 13:49:08 executing program 0: 13:49:08 executing program 4: 13:49:08 executing program 2: 13:49:08 executing program 1: 13:49:08 executing program 5: 13:49:08 executing program 3: ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:49:08 executing program 0: 13:49:08 executing program 4: 13:49:09 executing program 2: 13:49:09 executing program 1: 13:49:09 executing program 5: 13:49:09 executing program 0: 13:49:09 executing program 4: 13:49:09 executing program 3: ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:49:09 executing program 2: 13:49:09 executing program 5: 13:49:09 executing program 1: 13:49:09 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000080)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f00000040c0), 0x1000) read$FUSE(r0, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) write$FUSE_DIRENT(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="90000000000000000200000000000000010000000045000000000000000000000b08956d069e000000002066ce654d316e6f646576656d3100f9ff00000000000000000000000000000000000001000000000000002c00000000000008000000000000000000000000000000001c00000000000051a717000418b9b3cc002b737973740400000065746367726f757024"], 0x90) lsetxattr$security_smack_transmute(&(0x7f00000008c0)='./file0/file0\x00', &(0x7f0000000900)='security.SMACK64TRANSMUTE\x00', 0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000400)) 13:49:09 executing program 4: r0 = gettid() clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) clock_nanosleep(0x9, 0x0, &(0x7f0000000080)={0x0, r1+10000000}, &(0x7f00000000c0)) timer_create(0x0, &(0x7f0000044000)={0x0, 0x1000000000012, 0x0, @thr={&(0x7f0000000040), &(0x7f00000003c0)}}, &(0x7f0000044000)) fcntl$setownex(0xffffffffffffffff, 0xf, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x1c9c380}}, &(0x7f0000000000)) tkill(r0, 0x1004000000016) 13:49:09 executing program 3: ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:49:10 executing program 2: r0 = syz_open_dev$sndpcmc(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x800000000000004) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d5c6070") ioctl(r0, 0xc1004110, &(0x7f0000000000)) 13:49:10 executing program 5: perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x4b, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 13:49:10 executing program 1: 13:49:10 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x0, 0xc000000100079) ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:49:10 executing program 2: 13:49:10 executing program 4: r0 = syz_open_dev$sndpcmc(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000700)=@filter={'filter\x00', 0xe, 0x1, 0x33, [0x0, 0x20000040, 0x20000070, 0x20000210], 0x0, &(0x7f0000000400), &(0x7f0000000000)=ANY=[@ANYBLOB="822c52dad642e0ce40267d1fc1855d052bfc5b12963c4d44ad11f57b7a67f3173ea763a4342be21ba3", @ANYRES32=r0, @ANYRES16=r0, @ANYRES32=0x0]}, 0xab) r1 = socket$inet6(0xa, 0x3, 0x800000000000004) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d5c6070") ioctl(r0, 0xc2604110, &(0x7f0000000000)) 13:49:10 executing program 1: 13:49:10 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) rmdir(&(0x7f0000000100)='./file0\x00') 13:49:10 executing program 2: r0 = socket$inet6_sctp(0xa, 0x3, 0x84) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r2, &(0x7f0000000080), 0x2001007f) mmap(&(0x7f0000000000/0xc72000)=nil, 0xc72000, 0x2, 0x10401000000032, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f00000000c0)) 13:49:11 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000580)) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x5, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x1ff, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000500)={0x400000080000001, 0xfffffffe00000009, 0x0, r1}) 13:49:11 executing program 0: 13:49:11 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x0, 0xc000000100079) ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:49:11 executing program 1: syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @empty=[0x0, 0x4305, 0x30, 0xffffffff00000000], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0xffffff88, 0x0, @remote={0xac, 0x223}, @dev={0xac, 0x14, 0x14, 0x88}}, @icmp=@parameter_prob={0x11, 0x4888, 0x0, 0x0, 0x8, 0x6488, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @dev}}}}}}, &(0x7f0000000040)) 13:49:11 executing program 4: 13:49:11 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x0, 0xc000000100079) ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:49:11 executing program 0: 13:49:11 executing program 1: 13:49:11 executing program 5: 13:49:11 executing program 4: 13:49:12 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00008f0000)='/dev/ptmx\x00', 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000532000)=0x11) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000180)) 13:49:12 executing program 2: r0 = socket$inet6_sctp(0xa, 0x3, 0x84) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r2, &(0x7f0000000080), 0x2001007f) mmap(&(0x7f0000000000/0xc72000)=nil, 0xc72000, 0x2, 0x10401000000032, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f00000000c0)) 13:49:12 executing program 1: r0 = syz_open_dev$vcsa(0xffffffffffffffff, 0x0, 0x0) write$selinux_attr(r0, &(0x7f0000000380)='system_u:object_r:sendmail_exec_t:s0\x00', 0xfffffe48) r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x10000000001, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000080)={0x10000009, 0xffffffffffffffff, 0x1, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000240)=0x1) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)}}, 0x20) 13:49:12 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x201, 0x0) ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:49:12 executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(&(0x7f0000000100)=@nbd={'/dev/nbd'}, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='sockfs\x00', 0x0, 0x0) 13:49:12 executing program 4: r0 = syz_open_dev$sndpcmc(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) ioctl(r0, 0xc1004111, &(0x7f0000000040)="ed6d9b3b66") 13:49:12 executing program 4: r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x1, 0x0) ioctl(r0, 0xc1004111, &(0x7f0000000180)) 13:49:12 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'cryptd(hmac(sha256-generic))\x00'}, 0x58) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000364000/0x2000)=nil, 0x2000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040), 0x0) r1 = accept4(r0, 0x0, &(0x7f0000000200), 0x0) sendto$unix(r1, &(0x7f0000000040), 0xfffffef6, 0x0, &(0x7f0000000680)=@file={0x0, './file0\x00'}, 0x6e) getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000080), &(0x7f0000000140)=0x8) 13:49:12 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x201, 0x0) ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:49:12 executing program 5: r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x3, 0x402) write$binfmt_elf64(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="7f454c460605380001000000000000000300070009000000ee0000000000000040000000000000000901000000000000aba60000070038000200010000042125070000000000008001000000000000000100000000000000ae07000000000000860c00000000000001000000000000000100000000000000070000000000010006000000000000000200000000000000"], 0x90) [ 270.987669] hrtimer: interrupt took 51081 ns 13:49:13 executing program 4: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mount(&(0x7f00000000c0)=ANY=[@ANYBLOB='/dev/nullb0'], &(0x7f0000000340)='./file0\x00', &(0x7f0000000500)='squashfs\x00', 0x0, &(0x7f00000003c0)='/dev/dsp\x00') 13:49:13 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x201, 0x0) ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:49:13 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev}, 0x1c) r1 = gettid() clone(0x7ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clone(0x2102001fec, 0x0, 0xfffffffffffffffe, &(0x7f00000002c0), 0xffffffffffffffff) r2 = getpid() exit_group(0x0) perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x6d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r2, 0x0, 0xffffffffffffffff, 0x0) ptrace(0x10, r1) wait4(0x0, &(0x7f0000000100), 0x0, &(0x7f0000000140)) getgid() 13:49:13 executing program 2: r0 = socket$inet6_sctp(0xa, 0x3, 0x84) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r2, &(0x7f0000000080), 0x2001007f) mmap(&(0x7f0000000000/0xc72000)=nil, 0xc72000, 0x2, 0x10401000000032, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f00000000c0)) 13:49:13 executing program 5: clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000080)) mknod(&(0x7f0000000100)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000ee6ff8)='./file0\x00', &(0x7f0000578fe8), &(0x7f0000000500)) r0 = syz_open_procfs(0x0, &(0x7f0000000200)="696f005bfc57169babee54ed16e39e7a8fe4b90016f266e3f63c443b3fc5040006bb5cd4bd7c7373b3d4d470a0cb5617aadbfb64c5f9983c25d024a9f3c489cc438f9e6de1635f672bf70ad3bc27c924384f5586d4a51c6420a4e356e4e5ff7e28104d262f889f390101ccaff805816603f65ba3df555b6c352cd7d84a7267a03436ba") pread64(r0, &(0x7f00000002c0), 0x0, 0x0) getsockopt$bt_BT_VOICE(r0, 0x112, 0xb, &(0x7f0000000600), &(0x7f0000000640)=0x2) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@mcast2, @in=@dev}}, {{@in6=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000080)=0xe8) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) getuid() getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000003c0)={{{@in=@rand_addr, @in6=@loopback}}, {{@in6=@mcast1}, 0x0, @in6=@dev}}, &(0x7f00000001c0)=0xe8) fstat(r0, &(0x7f00000004c0)) getgroups(0x8, &(0x7f0000000540)=[0xee01, 0xffffffffffffffff, 0xee01, 0xee01, 0x0, 0xffffffffffffffff, 0xee00, 0x0]) lsetxattr$system_posix_acl(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f0000000580)={{}, {0x1, 0x1}, [{}, {0x2, 0x6, r1}, {0x2, 0x2}]}, 0x3c, 0x1) read(r0, &(0x7f0000000680)=""/28, 0x1c) lseek(0xffffffffffffffff, 0x0, 0x0) open$dir(&(0x7f0000296ff8)='./file0\x00', 0x27e, 0x0) 13:49:13 executing program 1: r0 = socket(0x50000000010, 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') sendfile(r0, r1, &(0x7f0000000140), 0x80000002) 13:49:13 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6(0xa, 0x3, 0x84) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000000140)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000080)=0x1, 0x4) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x10}}, 0x10) sendmmsg(r0, &(0x7f0000004c80)=[{{0x0, 0x18020000, &(0x7f0000004b40), 0x6c, &(0x7f0000004bc0)}}], 0x31e9cd3487dc94, 0x0) 13:49:13 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x8d4, 0x10}, 0x21) bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x4, 0x5, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x48, 0x1, 0x48}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x14) 13:49:13 executing program 3: syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x201, 0xc000000100079) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:49:13 executing program 1: 13:49:14 executing program 0: 13:49:14 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6(0xa, 0x3, 0x84) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000000140)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000080)=0x1, 0x4) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x10}}, 0x10) sendmmsg(r0, &(0x7f0000004c80)=[{{0x0, 0x18020000, &(0x7f0000004b40), 0x6c, &(0x7f0000004bc0)}}], 0x31e9cd3487dc94, 0x0) 13:49:14 executing program 0: 13:49:14 executing program 3: syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x201, 0xc000000100079) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:49:14 executing program 1: 13:49:14 executing program 2: r0 = socket$inet6_sctp(0xa, 0x3, 0x84) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r2, &(0x7f0000000080), 0x2001007f) mmap(&(0x7f0000000000/0xc72000)=nil, 0xc72000, 0x2, 0x10401000000032, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f00000000c0)) 13:49:14 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6(0xa, 0x3, 0x84) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000000140)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000080)=0x1, 0x4) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x10}}, 0x10) sendmmsg(r0, &(0x7f0000004c80)=[{{0x0, 0x18020000, &(0x7f0000004b40), 0x6c, &(0x7f0000004bc0)}}], 0x31e9cd3487dc94, 0x0) 13:49:14 executing program 5: 13:49:14 executing program 3: syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x201, 0xc000000100079) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0xc0185500, &(0x7f0000000080)=ANY=[@ANYBLOB="230308"]) 13:49:14 executing program 0: 13:49:14 executing program 1: 13:49:15 executing program 5: 13:49:15 executing program 0: 13:49:15 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6(0xa, 0x3, 0x84) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000000140)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000080)=0x1, 0x4) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x10}}, 0x10) sendmmsg(r0, &(0x7f0000004c80)=[{{0x0, 0x18020000, &(0x7f0000004b40), 0x6c, &(0x7f0000004bc0)}}], 0x31e9cd3487dc94, 0x0) 13:49:15 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x201, 0xc000000100079) ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000080)=ANY=[]) 13:49:15 executing program 1: 13:49:15 executing program 5: [ 273.610122] vhci_hcd: default hub control req: 0000 v0000 i0000 l0 13:49:16 executing program 2: r0 = socket$inet6_sctp(0xa, 0x3, 0x84) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r2, &(0x7f0000000080), 0x2001007f) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f00000000c0)) 13:49:16 executing program 0: 13:49:16 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6(0xa, 0x3, 0x84) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000000140)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000080)=0x1, 0x4) sendmmsg(r0, &(0x7f0000004c80)=[{{0x0, 0x18020000, &(0x7f0000004b40), 0x6c, &(0x7f0000004bc0)}}], 0x31e9cd3487dc94, 0x0) 13:49:16 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x201, 0xc000000100079) ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000080)=ANY=[]) 13:49:16 executing program 1: 13:49:16 executing program 5: [ 274.243852] vhci_hcd: default hub control req: 0000 v0000 i0000 l0 13:49:16 executing program 0: 13:49:16 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6(0xa, 0x3, 0x84) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000000140)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000080)=0x1, 0x4) sendmmsg(r0, &(0x7f0000004c80)=[{{0x0, 0x18020000, &(0x7f0000004b40), 0x6c, &(0x7f0000004bc0)}}], 0x31e9cd3487dc94, 0x0) 13:49:16 executing program 5: 13:49:16 executing program 1: 13:49:16 executing program 3: r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x201, 0xc000000100079) ioctl$KVM_SET_CPUID(r0, 0xc0185500, &(0x7f0000000080)=ANY=[]) 13:49:16 executing program 0: r0 = fanotify_init(0x0, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) read(r0, &(0x7f0000000000)=""/244, 0xf4) [ 274.923170] vhci_hcd: default hub control req: 0000 v0000 i0000 l0 [ 275.222281] Not allocated shadow for addr ffff88010ed28418 (page ffffea000658ef00) [ 275.230078] Attempted to access 8 bytes [ 275.234117] ------------[ cut here ]------------ [ 275.238927] kernel BUG at mm/kmsan/kmsan.c:1091! [ 275.243717] invalid opcode: 0000 [#1] SMP [ 275.247897] CPU: 0 PID: 2878 Comm: ion_system_heap Not tainted 4.19.0-rc4+ #65 [ 275.255310] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 275.264746] RIP: 0010:kmsan_get_shadow_address+0x2d6/0x3d0 [ 275.270391] Code: e9 89 00 00 00 c7 04 25 20 73 28 8c 01 00 00 00 65 48 8b 04 25 00 fd 02 00 c6 80 7b 09 00 00 01 80 3c 25 38 73 28 8c 00 74 0c <0f> 0b 0f 1f 84 00 00 00 00 00 eb fe 48 c7 c7 1c bc 57 8b 31 c0 4c [ 275.289314] RSP: 0018:ffff8801c30bfa48 EFLAGS: 00010046 [ 275.294707] RAX: 000000000000001b RBX: 0000000000000000 RCX: 0697e0489cdeb900 [ 275.301997] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000000 [ 275.309286] RBP: ffff8801c30bfa78 R08: 0000000000000000 R09: ffff88021fc38f50 [ 275.316566] R10: 0000000000000000 R11: ffffffff862594e0 R12: 0000000000000001 [ 275.323885] R13: ffff88010ed28418 R14: 0000000000000001 R15: 0000000000000008 [ 275.331175] FS: 0000000000000000(0000) GS:ffff88021fc00000(0000) knlGS:0000000000000000 [ 275.339414] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 275.345308] CR2: 00000000007096b4 CR3: 0000000095dd2000 CR4: 00000000001406f0 [ 275.352647] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 275.359933] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 275.367228] Call Trace: [ 275.369860] kmsan_internal_unpoison_shadow+0x5c/0xe0 [ 275.375089] kmsan_unpoison_shadow+0x72/0xd0 [ 275.379522] vunmap_page_range+0x828/0xc20 [ 275.383811] remove_vm_area+0x39b/0x450 [ 275.387816] __vunmap+0x34c/0x5d0 [ 275.391294] vunmap+0x69/0xb0 [ 275.394429] ion_heap_unmap_kernel+0x51/0x70 [ 275.398850] ? ion_heap_map_kernel+0xad0/0xad0 [ 275.403492] ion_buffer_destroy+0x116/0x2a0 [ 275.407854] ion_heap_deferred_free+0xc8/0x8b0 [ 275.412462] ? init_wait_entry+0x190/0x190 [ 275.416747] kthread+0x59c/0x5d0 [ 275.420127] ? ion_heap_init_deferred_free+0x460/0x460 [ 275.425433] ? INIT_BOOL+0x30/0x30 [ 275.429000] ret_from_fork+0x35/0x40 [ 275.432758] Modules linked in: [ 275.436033] ---[ end trace 6517b5e5c169dd85 ]--- [ 275.440909] RIP: 0010:kmsan_get_shadow_address+0x2d6/0x3d0 [ 275.446581] Code: e9 89 00 00 00 c7 04 25 20 73 28 8c 01 00 00 00 65 48 8b 04 25 00 fd 02 00 c6 80 7b 09 00 00 01 80 3c 25 38 73 28 8c 00 74 0c <0f> 0b 0f 1f 84 00 00 00 00 00 eb fe 48 c7 c7 1c bc 57 8b 31 c0 4c [ 275.465504] RSP: 0018:ffff8801c30bfa48 EFLAGS: 00010046 [ 275.470902] RAX: 000000000000001b RBX: 0000000000000000 RCX: 0697e0489cdeb900 [ 275.478233] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000000 [ 275.485530] RBP: ffff8801c30bfa78 R08: 0000000000000000 R09: ffff88021fc38f50 [ 275.492812] R10: 0000000000000000 R11: ffffffff862594e0 R12: 0000000000000001 [ 275.500128] R13: ffff88010ed28418 R14: 0000000000000001 R15: 0000000000000008 [ 275.507424] FS: 0000000000000000(0000) GS:ffff88021fc00000(0000) knlGS:0000000000000000 [ 275.515664] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 275.521556] CR2: 00000000007096b4 CR3: 0000000095dd2000 CR4: 00000000001406f0 [ 275.528836] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 275.536115] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 275.543395] Kernel panic - not syncing: Fatal exception [ 275.549738] Kernel Offset: disabled [ 275.553374] Rebooting in 86400 seconds..