[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 35.882346] random: sshd: uninitialized urandom read (32 bytes read) [ 36.195499] kauditd_printk_skb: 9 callbacks suppressed [ 36.195507] audit: type=1400 audit(1569040680.537:35): avc: denied { map } for pid=6818 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 36.252439] random: sshd: uninitialized urandom read (32 bytes read) [ 36.855556] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.39' (ECDSA) to the list of known hosts. [ 42.429549] random: sshd: uninitialized urandom read (32 bytes read) 2019/09/21 04:38:06 fuzzer started [ 42.630375] audit: type=1400 audit(1569040686.977:36): avc: denied { map } for pid=6827 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 43.013704] random: cc1: uninitialized urandom read (8 bytes read) 2019/09/21 04:38:08 dialing manager at 10.128.0.105:35365 2019/09/21 04:38:08 syscalls: 2472 2019/09/21 04:38:08 code coverage: enabled 2019/09/21 04:38:08 comparison tracing: ioctl(KCOV_TRACE_CMP) failed: invalid argument 2019/09/21 04:38:08 extra coverage: extra coverage is not supported by the kernel 2019/09/21 04:38:08 setuid sandbox: enabled 2019/09/21 04:38:08 namespace sandbox: enabled 2019/09/21 04:38:08 Android sandbox: /sys/fs/selinux/policy does not exist 2019/09/21 04:38:08 fault injection: enabled 2019/09/21 04:38:08 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/09/21 04:38:08 net packet injection: enabled 2019/09/21 04:38:08 net device setup: enabled [ 45.079807] random: crng init done 04:39:48 executing program 5: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000140)={0x14}, 0x14) 04:39:48 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) write$P9_RSYMLINK(r0, &(0x7f0000000140)={0x14, 0x11, 0x0, {0x0, 0x3}}, 0x14) 04:39:48 executing program 3: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, 0x0, &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000001c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) r0 = socket$inet(0x10, 0x3, 0xc) r1 = creat(&(0x7f00000002c0)='./file0\x00', 0x40) connect$inet(r1, 0x0, 0x0) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000d65000)={0x0, 0x0, 0x0}, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000200), &(0x7f0000000240)=0xc) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000180)='./file1\x00', &(0x7f0000000300)) lstat(0x0, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYRES16], 0x2, 0x4}, 0x10) stat(&(0x7f0000000180)='./file1\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read(0xffffffffffffffff, &(0x7f0000000340)=""/128, 0x80) setgroups(0x1, &(0x7f00000003c0)=[r2]) 04:39:48 executing program 1: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000100)) ioctl$EVIOCGBITSND(0xffffffffffffffff, 0x80404532, &(0x7f0000000300)=""/97) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x2, 0x0) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000002bc0)='./file0\x00', 0x40c2, 0x0) socket(0x0, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000001cc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) mount$9p_tcp(&(0x7f0000000040)='127.0.0.1\x00', &(0x7f0000000100)='./bus\x00', 0x0, 0x100c9, 0x0) r2 = socket$inet6(0xa, 0x0, 0x8010000000000084) bind$inet6(r2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000600)='4', 0x4100) 04:39:48 executing program 2: ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000100)) ioctl$EVIOCGBITSND(0xffffffffffffffff, 0x80404532, &(0x7f0000000300)=""/97) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x2, 0x0) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff577, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000002bc0)='./file0\x00', 0x40c2, 0x0) socket(0x0, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000001cc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x100000004e21, 0x0, @ipv4={[], [], @empty}}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000600)='4', 0x4100) 04:39:48 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x7}, 0x1c) [ 144.423539] audit: type=1400 audit(1569040788.767:37): avc: denied { map } for pid=6827 comm="syz-fuzzer" path="/root/syzkaller-shm369704087" dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 [ 144.490156] audit: type=1400 audit(1569040788.777:38): avc: denied { map } for pid=6845 comm="syz-executor.5" path="/sys/kernel/debug/kcov" dev="debugfs" ino=13820 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 144.811072] IPVS: ftp: loaded support on port[0] = 21 [ 145.652384] chnl_net:caif_netlink_parms(): no params data found [ 145.652681] IPVS: ftp: loaded support on port[0] = 21 [ 145.711185] bridge0: port 1(bridge_slave_0) entered blocking state [ 145.717974] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.725304] device bridge_slave_0 entered promiscuous mode [ 145.735438] bridge0: port 2(bridge_slave_1) entered blocking state [ 145.741933] bridge0: port 2(bridge_slave_1) entered disabled state [ 145.749044] device bridge_slave_1 entered promiscuous mode [ 145.761563] IPVS: ftp: loaded support on port[0] = 21 [ 145.777028] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 145.788460] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 145.807495] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 145.814960] team0: Port device team_slave_0 added [ 145.820751] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 145.827860] team0: Port device team_slave_1 added [ 145.839832] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 145.849299] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 145.922036] device hsr_slave_0 entered promiscuous mode [ 145.980366] device hsr_slave_1 entered promiscuous mode [ 146.054378] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 146.063473] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 146.087532] IPVS: ftp: loaded support on port[0] = 21 [ 146.101906] chnl_net:caif_netlink_parms(): no params data found [ 146.139952] bridge0: port 2(bridge_slave_1) entered blocking state [ 146.146459] bridge0: port 2(bridge_slave_1) entered forwarding state [ 146.153443] bridge0: port 1(bridge_slave_0) entered blocking state [ 146.160172] bridge0: port 1(bridge_slave_0) entered forwarding state [ 146.233166] bridge0: port 1(bridge_slave_0) entered blocking state [ 146.239624] bridge0: port 1(bridge_slave_0) entered disabled state [ 146.247259] device bridge_slave_0 entered promiscuous mode [ 146.255695] bridge0: port 2(bridge_slave_1) entered blocking state [ 146.262206] bridge0: port 2(bridge_slave_1) entered disabled state [ 146.269498] device bridge_slave_1 entered promiscuous mode [ 146.293795] chnl_net:caif_netlink_parms(): no params data found [ 146.303070] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 146.312530] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 146.346844] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 146.354870] team0: Port device team_slave_0 added [ 146.381628] IPVS: ftp: loaded support on port[0] = 21 [ 146.411022] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 146.418316] team0: Port device team_slave_1 added [ 146.424767] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 146.436941] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 146.469514] chnl_net:caif_netlink_parms(): no params data found [ 146.480281] bridge0: port 1(bridge_slave_0) entered blocking state [ 146.486659] bridge0: port 1(bridge_slave_0) entered disabled state [ 146.494078] device bridge_slave_0 entered promiscuous mode [ 146.542137] device hsr_slave_0 entered promiscuous mode [ 146.600409] device hsr_slave_1 entered promiscuous mode [ 146.644562] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 146.656384] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 146.662743] 8021q: adding VLAN 0 to HW filter on device bond0 [ 146.669114] bridge0: port 2(bridge_slave_1) entered blocking state [ 146.676104] bridge0: port 2(bridge_slave_1) entered disabled state [ 146.683907] device bridge_slave_1 entered promiscuous mode [ 146.697953] bridge0: port 1(bridge_slave_0) entered disabled state [ 146.705086] bridge0: port 2(bridge_slave_1) entered disabled state [ 146.723094] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 146.732519] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 146.747939] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 146.792527] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 146.808296] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 146.815763] bridge0: port 1(bridge_slave_0) entered blocking state [ 146.822460] bridge0: port 1(bridge_slave_0) entered disabled state [ 146.829382] device bridge_slave_0 entered promiscuous mode [ 146.836109] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 146.843983] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 146.852139] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 146.867033] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 146.881554] bridge0: port 2(bridge_slave_1) entered blocking state [ 146.888227] bridge0: port 2(bridge_slave_1) entered disabled state [ 146.896289] device bridge_slave_1 entered promiscuous mode [ 146.914607] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 146.928984] IPVS: ftp: loaded support on port[0] = 21 [ 146.936488] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 146.945336] 8021q: adding VLAN 0 to HW filter on device team0 [ 146.957322] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 146.971820] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 146.979016] team0: Port device team_slave_0 added [ 146.990828] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 147.006724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 147.016602] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 147.024511] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.030901] bridge0: port 1(bridge_slave_0) entered forwarding state [ 147.038816] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 147.047345] team0: Port device team_slave_1 added [ 147.054598] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 147.065023] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 147.072524] team0: Port device team_slave_0 added [ 147.078280] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 147.086237] team0: Port device team_slave_1 added [ 147.092917] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 147.116029] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 147.123925] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 147.135884] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 147.183436] device hsr_slave_0 entered promiscuous mode [ 147.220430] device hsr_slave_1 entered promiscuous mode [ 147.266707] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 147.275756] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 147.284030] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.290461] bridge0: port 2(bridge_slave_1) entered forwarding state [ 147.299373] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 147.315464] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 147.350836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 147.402417] device hsr_slave_0 entered promiscuous mode [ 147.460450] device hsr_slave_1 entered promiscuous mode [ 147.500604] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 147.513100] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 147.523822] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 147.532216] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 147.541088] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 147.552176] chnl_net:caif_netlink_parms(): no params data found [ 147.584588] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 147.595961] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 147.608516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 147.616608] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 147.624657] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 147.635504] 8021q: adding VLAN 0 to HW filter on device bond0 [ 147.643150] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 147.653052] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 147.668039] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 147.675989] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 147.683941] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 147.691938] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 147.713612] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 147.722752] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 147.729680] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 147.739806] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 147.749963] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 147.765215] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 147.771667] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 147.781096] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 147.789613] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 147.796302] 8021q: adding VLAN 0 to HW filter on device team0 [ 147.808098] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.814870] bridge0: port 1(bridge_slave_0) entered disabled state [ 147.822303] device bridge_slave_0 entered promiscuous mode [ 147.829430] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.836442] bridge0: port 2(bridge_slave_1) entered disabled state [ 147.843462] device bridge_slave_1 entered promiscuous mode [ 147.849586] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 147.856798] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 147.907248] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 147.917353] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 147.936214] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 147.944911] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 147.953031] bridge0: port 1(bridge_slave_0) entered blocking state [ 147.959651] bridge0: port 1(bridge_slave_0) entered forwarding state [ 147.966745] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 147.975000] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 147.982726] bridge0: port 2(bridge_slave_1) entered blocking state [ 147.989434] bridge0: port 2(bridge_slave_1) entered forwarding state [ 147.997199] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 148.012796] chnl_net:caif_netlink_parms(): no params data found [ 148.023791] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 148.033895] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 148.046667] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 148.055810] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 148.070762] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 148.085672] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 148.094429] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 148.135055] bridge0: port 1(bridge_slave_0) entered blocking state [ 148.141564] bridge0: port 1(bridge_slave_0) entered disabled state [ 148.148569] device bridge_slave_0 entered promiscuous mode [ 148.156713] 8021q: adding VLAN 0 to HW filter on device bond0 [ 148.164913] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 148.172494] team0: Port device team_slave_0 added [ 148.180986] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 148.188057] team0: Port device team_slave_1 added [ 148.194769] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 148.204933] bridge0: port 2(bridge_slave_1) entered blocking state [ 148.212026] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.219105] device bridge_slave_1 entered promiscuous mode [ 148.226806] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 148.238479] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 148.251769] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 148.260436] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 148.268872] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 148.279399] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 148.301900] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 148.308342] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 148.319683] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 148.327053] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 148.337424] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 148.345375] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 148.352621] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 148.361823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 148.371352] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 148.379727] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 148.389223] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 148.417228] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 148.425082] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 148.435341] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 148.443450] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 148.449530] 8021q: adding VLAN 0 to HW filter on device team0 [ 148.457643] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 148.465514] team0: Port device team_slave_0 added [ 148.475500] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 148.483893] team0: Port device team_slave_1 added [ 148.489705] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 148.499031] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 148.508851] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 148.515412] 8021q: adding VLAN 0 to HW filter on device team0 [ 148.524635] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready 04:39:52 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x20) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @rand_addr="6f24d04cf2ae4f653690d8b7f1a166e4"}, 0x1c) [ 148.572488] device hsr_slave_0 entered promiscuous mode [ 148.620432] device hsr_slave_1 entered promiscuous mode [ 148.651653] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 148.659705] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 148.666639] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 148.674405] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 148.683090] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 148.691443] bridge0: port 1(bridge_slave_0) entered blocking state [ 148.698009] bridge0: port 1(bridge_slave_0) entered forwarding state [ 148.705144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 148.712926] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 148.720695] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 148.737094] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 148.745781] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 148.754921] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 148.762745] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 04:39:53 executing program 5: r0 = openat$usbmon(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/usbmon0\x00', 0x0, 0x0) ioctl$MON_IOCG_STATS(r0, 0x80089203, &(0x7f0000000100)) 04:39:53 executing program 5: r0 = creat(&(0x7f0000000140)='./file0\x00', 0x0) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000180)={0x0, 0xfffffffffffffffa, 0x4}) [ 148.771067] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 148.778670] bridge0: port 2(bridge_slave_1) entered blocking state [ 148.785057] bridge0: port 2(bridge_slave_1) entered forwarding state [ 148.793769] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready 04:39:53 executing program 5: r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f00000003c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x6, 0x0, r0, 0x0}]) [ 148.843372] device hsr_slave_0 entered promiscuous mode [ 148.860877] device hsr_slave_1 entered promiscuous mode [ 148.901013] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 148.908590] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 148.915800] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 148.924616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 148.933016] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 148.941022] bridge0: port 1(bridge_slave_0) entered blocking state 04:39:53 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x32a) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)}, 0x0) 04:39:53 executing program 5: msgctl$IPC_SET(0x0, 0x1, &(0x7f0000258f88)) [ 148.947385] bridge0: port 1(bridge_slave_0) entered forwarding state [ 148.962863] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 148.971391] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 148.985208] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 149.002240] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 149.008767] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 149.017202] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 149.026389] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 149.043235] bridge0: port 2(bridge_slave_1) entered blocking state 04:39:53 executing program 5: syz_mount_image$iso9660(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x2418, 0x0) [ 149.049655] bridge0: port 2(bridge_slave_1) entered forwarding state [ 149.058316] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 149.068343] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 149.080011] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 149.092815] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 149.109866] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 149.119977] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 149.132792] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 149.144644] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 149.156831] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 149.166064] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 149.177128] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 149.197097] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 149.206621] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 149.219508] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 149.231513] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 149.238677] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 149.247742] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 149.255610] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 149.264304] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 149.274304] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 149.294781] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 149.302081] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 149.309379] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 149.317260] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 149.325258] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 149.332989] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 149.343041] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 149.353638] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 149.361520] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 149.371719] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 149.379878] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 149.390863] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 149.396912] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 149.407203] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 149.414967] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 149.434076] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 149.462101] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 149.469783] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 149.479199] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 149.491008] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 149.497063] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 149.506822] 8021q: adding VLAN 0 to HW filter on device bond0 [ 149.523708] 8021q: adding VLAN 0 to HW filter on device bond0 [ 149.534603] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 149.546230] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 149.555934] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 149.562965] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 149.569910] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 149.581186] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 149.587527] 8021q: adding VLAN 0 to HW filter on device team0 [ 149.599112] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 149.609646] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 149.618291] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 149.629660] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 149.636990] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 149.646484] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 149.653694] 8021q: adding VLAN 0 to HW filter on device team0 [ 149.661051] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 149.668544] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 149.677386] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 149.685301] bridge0: port 1(bridge_slave_0) entered blocking state [ 149.691870] bridge0: port 1(bridge_slave_0) entered forwarding state [ 149.699745] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 149.711029] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 149.721339] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 149.731616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 149.739353] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 149.747297] bridge0: port 1(bridge_slave_0) entered blocking state [ 149.753700] bridge0: port 1(bridge_slave_0) entered forwarding state [ 149.763426] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 149.771780] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 149.779453] bridge0: port 2(bridge_slave_1) entered blocking state [ 149.786038] bridge0: port 2(bridge_slave_1) entered forwarding state [ 149.793770] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 149.803245] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 149.812610] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 149.825852] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 149.833810] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 149.854518] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 149.873200] bridge0: port 2(bridge_slave_1) entered blocking state [ 149.879822] bridge0: port 2(bridge_slave_1) entered forwarding state [ 149.887222] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 149.897347] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 149.912776] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready 04:39:54 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty}, 0x16) [ 149.920815] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 149.931939] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 149.950149] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 149.959210] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 149.976335] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 149.985270] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 149.993540] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 150.007145] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 150.016739] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 150.028652] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 150.036961] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 150.045101] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 150.053024] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 150.060945] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 150.071594] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 150.079235] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 150.091476] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 150.099291] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 150.107626] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 150.115733] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 150.125919] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 150.139987] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 150.146978] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 150.154250] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 150.162157] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 150.169905] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 150.186018] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 150.190732] audit: type=1800 audit(1569040794.527:39): pid=6947 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="collect_data" cause="failed(directio)" comm="syz-executor.2" name="file0" dev="loop2" ino=3 res=0 [ 150.198326] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 150.228805] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 150.237057] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 150.247661] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 150.264988] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 150.272788] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 150.282643] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 150.299337] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 150.309475] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 150.353937] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 150.365498] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 151.447634] audit: type=1400 audit(1569040795.777:40): avc: denied { create } for pid=6970 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 151.457572] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 151.479542] audit: type=1400 audit(1569040795.787:41): avc: denied { write } for pid=6970 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 151.518814] audit: type=1800 audit(1569040795.857:42): pid=6974 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="collect_data" cause="failed(directio)" comm="syz-executor.1" name="file0" dev="loop1" ino=4 res=0 [ 151.531618] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. 04:39:55 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x2, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast1}, 0x18) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) write(r1, &(0x7f0000000340), 0x41395527) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 04:39:55 executing program 0: msgrcv(0x0, &(0x7f0000000000)={0x0, ""/77}, 0xfffffffffffffeec, 0x0, 0x0) 04:39:55 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) flistxattr(r0, &(0x7f00000001c0)=""/17, 0x11) 04:39:55 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='proc\x00', 0x0, &(0x7f0000000140)='\x00') 04:39:55 executing program 1: seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0xffffffffffffffff}]}) signalfd4(0xffffffffffffffff, &(0x7f0000000300), 0x8, 0x0) 04:39:55 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) fsetxattr$security_selinux(r0, &(0x7f0000000000)='security.selinux\x00', 0x0, 0x0, 0x0) 04:39:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000a80)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)={[{@uni_xlate='uni_xlate=1'}]}) 04:39:56 executing program 0: seccomp(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0xffffffffffffffff}]}) ustat(0x3, &(0x7f0000000000)) 04:39:56 executing program 2: io_cancel(0x0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x0) [ 151.648219] audit: type=1400 audit(1569040795.987:43): avc: denied { mac_admin } for pid=6989 comm="syz-executor.2" capability=33 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability2 permissive=1 [ 151.759336] hrtimer: interrupt took 37692 ns 04:39:56 executing program 2: seccomp(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0xffffffffffffffff}]}) stat(0x0, 0x0) [ 151.785290] FAT-fs (loop5): bogus number of reserved sectors 04:39:56 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='proc\x00', 0x0, &(0x7f0000000140)='\x00') [ 151.816031] audit: type=1326 audit(1569040796.087:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7000 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c84a code=0xffff0000 [ 151.846045] FAT-fs (loop5): Can't find a valid FAT filesystem [ 151.888653] audit: type=1326 audit(1569040796.127:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7008 comm="syz-executor.1" exe="/root/syz-executor.1" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c84a code=0xffff0000 [ 151.918390] audit: type=1326 audit(1569040796.227:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7017 comm="syz-executor.2" exe="/root/syz-executor.2" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c84a code=0xffff0000 04:39:56 executing program 4: socket$inet(0x2, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, &(0x7f0000000040), 0x0, 0x0) [ 151.964809] FAT-fs (loop5): bogus number of reserved sectors [ 151.971771] FAT-fs (loop5): Can't find a valid FAT filesystem 04:39:56 executing program 3: syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)={[{@session={'session'}}, {@map_normal='map=normal'}, {@gid={'gid'}}], [{@audit='audit'}]}) 04:39:56 executing program 5: syz_mount_image$nfs4(&(0x7f0000000340)='nfs4\x00', &(0x7f0000000380)='./bus\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 04:39:56 executing program 4: rt_sigqueueinfo(0x0, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffe1}) [ 152.512334] audit: type=1326 audit(1569040796.857:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7000 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c84a code=0xffff0000 04:39:56 executing program 4: seccomp(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0xffffffffffffffff}]}) setxattr$trusted_overlay_redirect(0x0, 0x0, 0x0, 0x0, 0x0) [ 152.552358] audit: type=1326 audit(1569040796.897:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7008 comm="syz-executor.1" exe="/root/syz-executor.1" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c84a code=0xffff0000 04:39:56 executing program 1: r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/uts\x00') sync_file_range(r0, 0x0, 0x5, 0x0) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, 0x0) socket$unix(0x1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(0xffffffffffffffff, 0x800448d3, &(0x7f00000001c0)={{0x0, 0x0, 0x5, 0xfffffffffffffff0}, 0x0, 0x0, 0x0, 0xe28, 0x0, "41b6a15ab3d84270b214a1e971fb0f3af0e313fd20714e272f734b96ea39323845a3a39695bb52b1497a504f7539ba5d374850db3bc4d7f963b91e2df0d01ac17f03210fe23f5c9f27a9b299c50f179f9e4f99b3597cc4b9d6bf16b21bf89e789e7cd523be1ef5ab01f99158ab3a0fe863c5f9754182b0a6c2cccee353d55520"}) sched_setaffinity(0x0, 0x8, &(0x7f0000000540)=0x80005) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ftruncate(r1, 0x8003f1) r2 = open(&(0x7f00000004c0)='./bus\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f00000000c0)) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000007c0)=ANY=[@ANYBLOB="0000000000000000ffffffff0000000000000000000000000200000000000000000000000000000a000000000000000000000000010000000000000000000000000000000000000000000000000000ef58964600"/103]) ioctl$DRM_IOCTL_ADD_MAP(0xffffffffffffffff, 0xc0286415, &(0x7f0000000000)={&(0x7f0000ffb000/0x5000)=nil, 0x0, 0x2, 0xbad3fc0971f6927f, &(0x7f0000ffc000/0x4000)=nil}) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, 0x0) 04:39:56 executing program 0: openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$bt_rfcomm(0xffffffffffffffff, 0x0, 0x0) r0 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000140)="e8", 0x1, 0xfffffffffffffffc) keyctl$set_timeout(0xf, r0, 0x0) r1 = creat(0x0, 0x0) write$eventfd(r1, 0x0, 0x0) 04:39:56 executing program 3: rt_sigtimedwait(&(0x7f0000000000), 0x0, &(0x7f00000000c0)={0x77359400}, 0x8) 04:39:57 executing program 2: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) 04:39:57 executing program 5: shmget(0x2, 0x4000, 0x0, &(0x7f0000ff9000/0x4000)=nil) 04:39:57 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r1, 0x4068aea3, &(0x7f00000000c0)={0x74}) 04:39:57 executing program 0: seccomp(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0xffffffffffffffff}]}) clock_nanosleep(0x0, 0x0, &(0x7f0000000080)={0x0, 0x989680}, 0x0) 04:39:57 executing program 2: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, 0x0, 0x0) [ 152.859142] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. 04:39:57 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000c000/0x1000)=nil, 0x1000, 0x0, 0xf0813, r0, 0x0) 04:39:57 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)={[{@uid={'uid'}}, {@type={'type', 0x3d, "acb4ef7f"}}, {@session={'session'}}]}) 04:39:57 executing program 2: r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) tee(r0, 0xffffffffffffffff, 0x8000, 0x0) [ 153.103080] hfsplus: invalid session number or type of track [ 153.134773] hfsplus: unable to find HFS+ superblock [ 153.191505] hfsplus: invalid session number or type of track [ 153.197368] hfsplus: unable to find HFS+ superblock 04:39:57 executing program 4: seccomp(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0xfffffffffffffff9}]}) setgid(0x0) 04:39:57 executing program 1: shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000000)=""/105) 04:39:57 executing program 2: seccomp(0x1, 0x0, &(0x7f00000005c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0xffffffffffffffff}]}) io_setup(0x6, &(0x7f0000000140)) 04:39:57 executing program 5: add_key$keyring(&(0x7f0000000200), 0x0, 0x0, 0x0, 0xfffffffffffffffc) 04:39:57 executing program 3: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff575, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401", 0xf}], 0x0, 0x0) 04:39:57 executing program 5: quotactl(0x0, 0x0, 0x0, 0x0) 04:39:57 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext2\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 153.586016] FAT-fs (loop3): bogus number of FAT structure [ 153.607689] FAT-fs (loop3): Can't find a valid FAT filesystem [ 153.657092] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 153.666683] FAT-fs (loop3): bogus number of FAT structure [ 153.675327] FAT-fs (loop3): Can't find a valid FAT filesystem 04:39:58 executing program 0: 04:39:58 executing program 5: r0 = creat(&(0x7f0000000300)='./bus\x00', 0x0) r1 = gettid() fcntl$lock(r0, 0x26, &(0x7f0000000580)={0x1, 0x0, 0x0, 0x0, r1}) 04:39:58 executing program 3: r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x0) 04:39:58 executing program 3: 04:39:58 executing program 5: [ 153.779052] EXT4-fs (loop1): VFS: Can't find ext4 filesystem 04:39:58 executing program 4: 04:39:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_udp_int(r0, 0x11, 0x0, &(0x7f0000000000), 0x4) 04:39:58 executing program 2: 04:39:58 executing program 5: r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) r2 = creat(&(0x7f0000000180)='./bus\x00', 0x0) io_submit(r1, 0x2, &(0x7f00000003c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, r2, 0x0}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0}]) 04:39:58 executing program 0: bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000), 0xa) clone(0x54041bc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() r1 = gettid() tkill(r1, 0x14) ptrace(0x4206, r0) ptrace$setregs(0xf, r0, 0x0, &(0x7f0000000140)) 04:39:58 executing program 1: 04:39:58 executing program 4: 04:39:58 executing program 3: 04:39:58 executing program 1: 04:39:58 executing program 4: 04:39:58 executing program 2: 04:39:58 executing program 3: 04:39:58 executing program 1: 04:39:58 executing program 4: 04:39:59 executing program 2: 04:39:59 executing program 5: 04:39:59 executing program 0: 04:39:59 executing program 3: 04:39:59 executing program 1: 04:39:59 executing program 2: 04:39:59 executing program 4: 04:39:59 executing program 5: [ 155.333461] ptrace attach of "/root/syz-executor.0"[7164] was attempted by "/root/syz-executor.0"[7194] 04:39:59 executing program 2: 04:39:59 executing program 5: 04:39:59 executing program 3: 04:39:59 executing program 1: 04:39:59 executing program 4: 04:39:59 executing program 0: 04:39:59 executing program 3: 04:39:59 executing program 5: 04:39:59 executing program 1: 04:39:59 executing program 4: 04:39:59 executing program 2: 04:39:59 executing program 3: 04:39:59 executing program 0: 04:39:59 executing program 1: 04:39:59 executing program 2: 04:39:59 executing program 3: 04:39:59 executing program 0: 04:40:00 executing program 4: 04:40:00 executing program 5: 04:40:00 executing program 1: 04:40:00 executing program 3: 04:40:00 executing program 0: 04:40:00 executing program 2: 04:40:00 executing program 1: 04:40:00 executing program 5: 04:40:00 executing program 4: 04:40:00 executing program 3: 04:40:00 executing program 0: 04:40:00 executing program 1: 04:40:00 executing program 2: 04:40:00 executing program 5: 04:40:00 executing program 3: 04:40:00 executing program 4: 04:40:00 executing program 0: 04:40:00 executing program 2: 04:40:00 executing program 4: 04:40:00 executing program 1: 04:40:00 executing program 5: 04:40:00 executing program 0: 04:40:00 executing program 2: 04:40:00 executing program 3: 04:40:00 executing program 5: 04:40:00 executing program 1: 04:40:00 executing program 0: 04:40:00 executing program 4: 04:40:00 executing program 3: 04:40:00 executing program 2: 04:40:00 executing program 5: 04:40:00 executing program 0: 04:40:00 executing program 1: 04:40:00 executing program 4: 04:40:00 executing program 2: 04:40:00 executing program 3: 04:40:00 executing program 2: 04:40:00 executing program 5: 04:40:00 executing program 0: 04:40:00 executing program 4: 04:40:00 executing program 1: 04:40:00 executing program 3: 04:40:00 executing program 2: 04:40:00 executing program 5: 04:40:00 executing program 0: 04:40:00 executing program 4: 04:40:00 executing program 1: 04:40:00 executing program 3: 04:40:00 executing program 2: 04:40:00 executing program 5: 04:40:00 executing program 4: 04:40:00 executing program 0: 04:40:00 executing program 1: 04:40:00 executing program 2: 04:40:00 executing program 3: r0 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x7723, 0x0) lseek(r0, 0x0, 0x3) 04:40:00 executing program 1: 04:40:00 executing program 4: 04:40:00 executing program 0: 04:40:00 executing program 5: 04:40:00 executing program 2: 04:40:01 executing program 0: 04:40:01 executing program 4: 04:40:01 executing program 5: 04:40:01 executing program 1: 04:40:01 executing program 3: 04:40:01 executing program 2: 04:40:01 executing program 5: 04:40:01 executing program 4: 04:40:01 executing program 2: 04:40:01 executing program 0: 04:40:01 executing program 1: 04:40:01 executing program 4: 04:40:01 executing program 5: 04:40:01 executing program 3: 04:40:01 executing program 0: 04:40:01 executing program 1: 04:40:01 executing program 5: 04:40:01 executing program 2: 04:40:01 executing program 3: 04:40:01 executing program 4: 04:40:01 executing program 5: 04:40:01 executing program 2: 04:40:01 executing program 0: 04:40:01 executing program 1: 04:40:01 executing program 3: 04:40:01 executing program 4: 04:40:01 executing program 5: 04:40:01 executing program 2: 04:40:01 executing program 1: 04:40:01 executing program 0: 04:40:01 executing program 3: 04:40:01 executing program 5: 04:40:01 executing program 4: 04:40:01 executing program 2: 04:40:01 executing program 0: 04:40:01 executing program 3: 04:40:01 executing program 1: 04:40:01 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) 04:40:01 executing program 2: syz_mount_image$hfsplus(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 04:40:01 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000002580)=[{&(0x7f0000000080)=""/104, 0x68}, {0x0}], 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') preadv(r0, &(0x7f0000000700), 0x31f, 0x10400003) 04:40:01 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_THP_DISABLE(0x29, 0x0) 04:40:01 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f00000001c0)={@link_local, @dev, [], {@ipv6={0x86dd, {0x0, 0x6, "50a09c", 0x8, 0xffffff11, 0x0, @remote, @mcast2, {[], @udp={0x0, 0x0, 0x8}}}}}}, 0x0) 04:40:01 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x2e1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) recvmmsg(r0, &(0x7f0000004b40)=[{{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000001e40)=""/239, 0xef}}, {{&(0x7f0000003300)=@tipc=@id, 0x80, &(0x7f00000049c0)=[{&(0x7f0000003380)=""/83, 0x53}, {0x0}, {0x0}, {&(0x7f0000004580)=""/203, 0xcb}, {0x0}, {&(0x7f00000048c0)=""/218, 0xda}], 0x6, &(0x7f0000004a40)=""/243, 0xf3}}], 0x20004582, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @local}, 0x14) sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="030400000300600000000000fff5", 0xe, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0x0, 0x0) ioctl$DRM_IOCTL_INFO_BUFS(r2, 0xc0106418, &(0x7f0000000200)={0x100000001, 0x7, 0x32a, 0x6, 0x9, 0x80000001}) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz\xff\xda', 0x1ff) getpid() sendto$packet(0xffffffffffffffff, &(0x7f0000000500)="4b085b2933a302781fbfc2b643da1df7eccc81350d5a7c588872130fce9650507f617d690da63ba4721826266a976f1556d4bdef04229705160946dc8f40e247a396e619168f625d90b74598218ab57e9e3160879a87fcdd39d0c80f2b922d356c7f3491d4e6c3913a114a5e08818a67f5a80f97a0cf82eab7304d4789f8e45adea072f3d05d1af3d50e7c7ee79d690a80ed42a6d56ad0622056c204ba892b73ce6b4dce6c049c622d63b31bb61b97bf648d718683049863dcc78e96bb1a3ae681e1aa8d2a1c6d3a7e01af7aae009c8be1237bb96090e5ff25523d85eff6fad3cd4d4cff864eb7d32960dd76f301076851a3e7a6752f48e2d4706dd3807674", 0xff, 0x55, 0x0, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x0) fadvise64(r3, 0x0, 0x8, 0x4) fadvise64(0xffffffffffffffff, 0x0, 0x8, 0x4) 04:40:01 executing program 3: perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000003000)=@abs={0x1}, 0x8) listen(r1, 0x0) connect(r0, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='net/unix\x00') sendfile(r0, r2, 0x0, 0x800000bf) 04:40:01 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getpriority(0x3, 0x0) 04:40:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={[{@type={'type', 0x3d, "c7cccd2c"}}]}) 04:40:01 executing program 4: open(&(0x7f00000001c0)='./file0\x00', 0x80040, 0x0) mount$fuseblk(&(0x7f0000000000)='/dev/loop0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='fuseblk\x00', 0x0, &(0x7f0000000300)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[], [{@smackfsroot={'smackfsroot', 0x3d, 'selinuxGPLwlan1vboxnet1\xac'}}]}}) 04:40:01 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x80040, 0x0) mount$fuseblk(&(0x7f0000000000)='/dev/loop0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='fuseblk\x00', 0x800, &(0x7f0000000300)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}], [{@smackfsroot={'smackfsroot', 0x3d, 'selinuxGPLwlan1vboxnet1\xac'}}]}}) [ 157.518840] hfsplus: type requires a 4 character value 04:40:01 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000300)='./file0\x00', 0x86842, 0x0) write$FUSE_BMAP(r0, &(0x7f00000001c0)={0x18, 0x0, 0x0, {0x9}}, 0x18) 04:40:01 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000080)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, &(0x7f00000001c0)={{}, 0x0, 0x8, 'id0\x00', 'timer1\x00', 0x0, 0x6}) [ 157.546819] hfsplus: unable to parse mount options 04:40:01 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={[{@nobarrier='nobarrier'}, {@decompose='decompose'}, {@creator={'creator', 0x3d, "bf2a0b14"}}, {@force='force'}]}) [ 157.607165] kauditd_printk_skb: 12 callbacks suppressed [ 157.607171] audit: type=1800 audit(1569040801.947:61): pid=7454 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="collect_data" cause="failed(directio)" comm="syz-executor.2" name="file0" dev="sda1" ino=16585 res=0 [ 157.672079] hfsplus: type requires a 4 character value [ 157.690779] hfsplus: unable to parse mount options [ 157.711581] audit: type=1800 audit(1569040801.957:62): pid=7454 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="collect_data" cause="failed(directio)" comm="syz-executor.2" name="file0" dev="sda1" ino=16585 res=0 [ 157.794902] hfsplus: unable to find HFS+ superblock [ 157.861287] hfsplus: unable to find HFS+ superblock [ 158.160379] protocol 88fb is buggy, dev hsr_slave_0 [ 158.165701] protocol 88fb is buggy, dev hsr_slave_1 04:40:02 executing program 1: r0 = socket(0x2, 0x3, 0x8) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000002c0)='bridge0\x00', 0x10) sendto$unix(r0, 0x0, 0x0, 0x4008000, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendto$unix(r0, 0x0, 0x193, 0x2221ae5c9db66eb4, &(0x7f00000000c0)=@abs, 0x35) 04:40:02 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) 04:40:02 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{}, {0x0, 0x0, 0x1}]}) [ 158.240113] protocol 88fb is buggy, dev hsr_slave_0 [ 158.245264] protocol 88fb is buggy, dev hsr_slave_1 [ 158.290581] raw_sendmsg: syz-executor.1 forgot to set AF_INET. Fix it! 04:40:02 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, 0x0) mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x3000, 0x0, &(0x7f0000ffc000/0x3000)=nil) 04:40:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = open(&(0x7f00000001c0)='./file0\x00', 0x80040, 0x0) chown(&(0x7f0000000040)='./file0\x00', 0xee00, 0x0) fcntl$setlease(r1, 0x400, 0x0) 04:40:02 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0x7, 0x9}, 0x2c) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0xd, 0x18, 0x4, 0x3, 0x0, r0}, 0x3c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x0, 0x0}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r1, &(0x7f00000001c0), &(0x7f0000000080)}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000540)={r1, &(0x7f0000000480)}, 0x10) 04:40:02 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r0, 0x29, 0x16, &(0x7f0000fcb000), 0x4) 04:40:02 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000) 04:40:02 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x2e1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) recvmmsg(r0, &(0x7f0000004b40)=[{{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000001e40)=""/239, 0xef}}, {{&(0x7f0000003300)=@tipc=@id, 0x80, &(0x7f00000049c0)=[{&(0x7f0000003380)=""/83, 0x53}, {0x0}, {0x0}, {&(0x7f0000004580)=""/203, 0xcb}, {0x0}, {&(0x7f00000048c0)=""/218, 0xda}], 0x6, &(0x7f0000004a40)=""/243, 0xf3}}], 0x20004582, 0x2, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="030400000300600000000000ff", 0xd, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0x0, 0x0) ioctl$DRM_IOCTL_INFO_BUFS(r1, 0xc0106418, &(0x7f0000000200)={0x100000001, 0x7, 0x32a, 0x6, 0x9, 0x80000001}) 04:40:02 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000180)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x0) 04:40:02 executing program 2: 04:40:02 executing program 1: clone(0x800000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02630440"], 0x0, 0x0, 0x0}) 04:40:02 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000180)='/dev/input/event#\x00', 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="d3d2b98922f1369c0400cd80"], 0xc}}, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYRESHEX, @ANYRESHEX, @ANYRESHEX], 0x0, 0x36}, 0x20) tkill(r2, 0x1f) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 04:40:02 executing program 2: syz_open_procfs(0x0, &(0x7f0000000180)='setgroups\x00') clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x1}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:40:02 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000180)='/dev/input/event#\x00', 0x0, 0x0) clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="d3d2b98922f1369c0400cd80"], 0xc}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYRESHEX, @ANYRESHEX, @ANYRESHEX], 0x0, 0x36}, 0x20) tkill(r0, 0x1f) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 158.521642] binder: BC_ACQUIRE_RESULT not supported [ 158.536319] ptrace attach of "/root/syz-executor.2"[7521] was attempted by "/root/syz-executor.2"[7524] [ 158.556602] binder: 7516:7520 ioctl c0306201 20000000 returned -22 04:40:02 executing program 5: 04:40:02 executing program 2: 04:40:02 executing program 1: [ 158.559626] ptrace attach of "/root/syz-executor.0"[7528] was attempted by "/root/syz-executor.0"[7531] [ 158.563290] protocol 88fb is buggy, dev hsr_slave_0 [ 158.577804] protocol 88fb is buggy, dev hsr_slave_1 [ 158.579241] ptrace attach of "/root/syz-executor.4"[7517] was attempted by "/root/syz-executor.4"[7530] 04:40:02 executing program 0: 04:40:03 executing program 2: [ 158.890160] protocol 88fb is buggy, dev hsr_slave_0 [ 158.895882] protocol 88fb is buggy, dev hsr_slave_1 [ 159.040137] protocol 88fb is buggy, dev hsr_slave_0 [ 159.045582] protocol 88fb is buggy, dev hsr_slave_1 04:40:03 executing program 3: 04:40:03 executing program 5: 04:40:03 executing program 4: 04:40:03 executing program 1: 04:40:03 executing program 2: 04:40:03 executing program 0: 04:40:03 executing program 0: 04:40:03 executing program 1: 04:40:03 executing program 5: 04:40:03 executing program 2: 04:40:03 executing program 3: 04:40:03 executing program 4: 04:40:03 executing program 0: 04:40:03 executing program 3: 04:40:03 executing program 4: 04:40:03 executing program 5: 04:40:03 executing program 2: 04:40:03 executing program 1: 04:40:03 executing program 3: 04:40:03 executing program 0: 04:40:03 executing program 4: 04:40:03 executing program 2: 04:40:03 executing program 1: 04:40:03 executing program 5: 04:40:03 executing program 3: 04:40:03 executing program 0: 04:40:03 executing program 4: 04:40:03 executing program 1: 04:40:03 executing program 3: 04:40:03 executing program 2: 04:40:04 executing program 0: 04:40:04 executing program 5: 04:40:04 executing program 3: 04:40:04 executing program 4: 04:40:04 executing program 1: 04:40:04 executing program 2: 04:40:04 executing program 5: 04:40:04 executing program 0: 04:40:04 executing program 3: 04:40:04 executing program 4: 04:40:04 executing program 2: 04:40:04 executing program 0: 04:40:04 executing program 5: 04:40:04 executing program 1: 04:40:04 executing program 3: 04:40:04 executing program 2: 04:40:04 executing program 3: 04:40:04 executing program 4: 04:40:04 executing program 0: 04:40:04 executing program 2: 04:40:04 executing program 5: 04:40:04 executing program 3: 04:40:04 executing program 1: 04:40:04 executing program 4: 04:40:04 executing program 0: 04:40:04 executing program 2: 04:40:04 executing program 1: 04:40:04 executing program 5: 04:40:04 executing program 4: 04:40:04 executing program 3: 04:40:04 executing program 0: 04:40:04 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x3, &(0x7f00000000c0), 0x4) 04:40:04 executing program 0: setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000002000)="24b38b20d0ef3254115223ef6cf758327575c041e002a8089496079b1b45009349041eca724fdec73fab9b04e4a4a5af1d03000000000000007faa62b9c0d263274f4a010c4f93ef85516b042511f32764171ba9bd278cbe360c22f184073fe215dee02fe37161246323ee9c82c790add905b90a64adab9fef855d72abb637d460fc6fb5a9eec5535b119c9dfbde3f76323a5af634e4235a33d57e226460104ca0dedf1f0e8365cd43d106c41d009976034d6557bf8917cad630598f6e58fd1770012d78aabb64ffffffed000046", 0xce) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @local}, {0xa, 0x0, 0x0, @mcast2}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x0, 0x7}, 0xffffffffffffff41) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x40, &(0x7f0000001fde), 0x4) 04:40:04 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000002c0)="6653070000003639405cb4aed12f0000000000ae47a825d86800278dcff47d010000805a", 0x24}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 04:40:04 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'ifb0\x00', 0x2}) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0xfdfdffff) 04:40:04 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x32600) write$cgroup_subtree(r1, &(0x7f0000000000)={[{0x0, 'memory'}]}, 0x3ff800) 04:40:04 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x9}) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffdc9) dup3(r1, r0, 0x0) 04:40:04 executing program 0: clone(0x0, 0x0, 0x0, 0x0, 0x0) sched_rr_get_interval(0x0, &(0x7f0000000000)) 04:40:04 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0xaed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xfbffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000080)='+', 0x1}], 0x1}, 0xc100) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000480)="a9772d9bea4824cc3854a62ffb84c4fb114d80fe462fd727b6f682cf0f9ccfe45f46ed18fc8af0505df86b4230370bfacd1f7266fae5859a3608357c69f51cfa473ef19a9dc2aeb43f9ed68acc034cf841229fbbe3f57130fe2ad707c56a92dbe64e59aa78e24db8e9b50597ab0024ca2564fbdb50e7b8cfa5c7028d556977ad6a90adf768a5ac0505ab07f8256368c6e71dd4b5a1c2e3c9946b610ab2b324099beb706b6a510c134ad18c928be3af6cf20e5016c9a050e35e30716e4913c882272bbfc8f0e1ee9c31484af6953e7d967640eff8accacee6daf3f98051a3ee281555a41340273dcb0bd8cc8cd549676f3ec23cbca42d4b76a178376eefb3da036d60cb88b5cb9c0ae0135be1d4f598c564fbe97ad4b691f59ba4063b898482d9cde4497009884d75b1965874e9c4d5a7cf8a640433c02acd340a98eff73e5948611184c7c60da3b233367d58aaf4e407e2e2c506b871fd822ec231389734d23a2aa5dc197831d8fee19361e5b99d0b51e5b1f0cadf296b91aa9477fa72879b4a3a3040777cf778cee1de32619701d71cb5316c7234a910b497b5f1b2cd2a0d39e92b6b92e091b470da2cec0e1b1fd3ce1a15d559b3733b97b2ddb1dd2aa73c9e03f189b8dd48c9093daddcd2c3fd0e1a9d16046d85c8934d2f9094aa5fa7b8ff061cb753dea2637ac2a8d523c9791ae454ea2e8cb10ce4a3ad8937ed583cd653bdb05b965e658f9c5f06a43bb1e61cfa4cb9be2cb4ef264d10f37e5292576bfdc97b2e1f8b692f0b64f76287e67805df914273677a9c39bd1e4f73d3c1afd99ad18a210caee42ab5c87969f6f99d7423dbb72d436ef3a3dead8eda03274d2e8e7f107eb04fdc3e36d6d4022dbc5c2fe388aaa3234950588ef56362708189826b98d3c9ed4dabcb33582a7e55327e82686aac973a5d0292afd7175a9c57b4fc1e5ba7cb0a34e35e50526d40bdb51a224e5b89e74e8752c1b39ab250b178adfab91c73c04d3c012b244cb7745dde4f716203ffcddaa096186ed0403b323c3aaa79aa4a0e6d1231ce99f83788ba0dc86da01cdad25816c26bf8e523b287d7ee83b5d0c55599ddbd202f743a1bc3d107a9c9610dc62537af48eecdd174ee4e796943250b81af0da28c57955aea149010ede13eb973dbe959500afe5e77b32ad5a11a353555b48eb7684596eadc481c291f185d0d47c639fa5bcb2dffe859a9d4a0e184a640e30f0afe83f2096faef9c0129289688a5267e0d2dadadd0f8cb13f35827f0337d2edf6220a244dd8c135563051f6fcd7fdad7879ff3ef01975938bc6e47aee745d4701cfc5e5546f05903bbcde0120ad847c32658c1384a6d8f188544df337a25f806051a346fb980a4e84fee06b0d367bc81161e96072b2e7e47999ac93437749d11864fa4c03a2d333135660aa17bd421623e6654eeae956e51a0157cb876db3e9cb324641d132cda7aabd9dcaa51f090c1955d20c2618466a0ea5acbaeac5a46e00b8869ca9a337eb5d9406592a790678a1f0bbe729054abb4810f4fdf50c517d4dd312b2d382412d45b9f60464c107c0735b16ceced73484f37cdcc8b9a4a62bc997bbd1d23b993fc5cfed9a43d2f4d335570e76715b020664bedb0db88816bc97ec37d13d64f604b71fc73f3c38954ae554e45997209afb0ff102dc170986e2d72e4178a7e6131308afa29ba732e251ebdf6254c0589752bfca3bef7fd0fc60ba683c6016b16234216bdcf8975bebafd8ee4606a96c1993d1f096b435fa84279344b914dec8e56566e103592a7ed44c63c8b5c18e01fa873032b1087622f225747339d38fa89e7008695ce0b3d6f505ab7ecdf99182ab7aa264d9108af35b0a373da18a8183f696dc70a8ac88c5663a866e89c7d7dbdf7296d63e5167978b38463ae9f36fe4121229e92cced04e", 0xfdef}], 0x1) 04:40:04 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendto$unix(r1, &(0x7f0000000140)="24c8385939070000", 0x8, 0x0, 0x0, 0x0) recvfrom(r1, &(0x7f0000001240)=""/4096, 0xffffff7e, 0x0, 0x0, 0x0) 04:40:04 executing program 0: seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x20006, 0x0, 0x0, 0xfffffffffffffffb}]}) symlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') 04:40:04 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000280)="a4ab12f728db4b2b4d2f2f3ff7ad273b1e89e46f905080af4890ccb170e60b3a8bf56db763e3062d037dca29aeb1747555ba16ea10e6ddb915ceb6397e514f3482ca3c4a1d3b9bdf674bf6fcf4d06402b236", 0x52}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) 04:40:04 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0xb, 0x0, &(0x7f0000000280)) 04:40:04 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x800448f0, &(0x7f00000000c0)) 04:40:04 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x1, 0x4) r1 = socket(0x18, 0x0, 0x3) connect(r1, &(0x7f0000000000)=@sco={0x1f, {0x0, 0x0, 0x0, 0xa30}}, 0x80) setsockopt$sock_int(r0, 0x1, 0x1e, 0x0, 0x0) clone(0x20003ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = socket(0x0, 0x80, 0x5) r3 = open(&(0x7f0000000500)='./bus\x00', 0x8141042, 0x80) close(r3) r4 = syz_open_dev$loop(&(0x7f0000000540)='/dev/loop#\x00', 0x0, 0x105082) r5 = memfd_create(&(0x7f0000000000)='}#*nodev\xee\xb8em2N,\x00', 0x0) pwritev(r5, &(0x7f00000000c0)=[{&(0x7f0000000480)="a8", 0x1}], 0x1, 0x81000) ioctl$LOOP_CHANGE_FD(r4, 0x4c00, r5) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r3, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffd0) fcntl$setstatus(r3, 0x4, 0x1) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) write(r7, &(0x7f00000001c0), 0x526987c9) getsockopt$ARPT_SO_GET_ENTRIES(r3, 0x0, 0x61, &(0x7f0000000740)=ANY=[], 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000680)='lp\xff\xbf\xfco\xd5\xaa\xfe\x1d\x15\xe2\x95Q\x87\xa4\'\xd0\xd8\xe3\xa1\x83\xf2A/\x80x\xe9\x11\x05\x8dOS\xdb\xc7`J\x94X\xbd\x9eXg\x7f\xfdQu\xcd<\xbfi1\xd4\xbbb\xe2\xf3,^\xbc\xbb\b\x8d#%\";+\xb8\xc3\x9ea\xde\xd2,S\xa1\x14\xbd\xe9\n3-\x88B\x1f\xa5\xba\xfc\x9fTZW\vG\xe4\x1a6\xdf\x14o.mU\x94t\x90P\x84\x7f\x16\x89\xf7S\x8e\x12U}[\xa6\xe7\"`\x14\xdf\x04z:', 0x80) read(r6, &(0x7f0000000200)=""/250, 0x50c7e889) sendfile(r4, r3, 0x0, 0x80005) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000003c0)={0x0}, &(0x7f0000000340)=0xb84699fd) r9 = syz_open_procfs(r8, &(0x7f0000000380)='envh&on\x00') ioctl$sock_SIOCGIFBR(r3, 0x8940, &(0x7f0000000800)=@generic={0x1, 0x10001, 0x80000000}) syz_open_procfs(r8, &(0x7f0000000640)='ne\x8e/dev_mcast\x00') openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000007c0)='/proc/th\xbb\x97\xc4\xe4\xeb\x10+\xe1f/attr/exec\x00', 0x2, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000400)='SEG6\x00') sendmsg$SEG6_CMD_GET_TUNSRC(r9, &(0x7f0000000600)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8201000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)=ANY=[]}, 0x1, 0x0, 0x0, 0x20011004}, 0x4) [ 160.557794] audit: type=1326 audit(1569040804.897:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7694 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c84a code=0xffff0000 [ 160.616455] audit: type=1400 audit(1569040804.927:64): avc: denied { map } for pid=7710 comm="syz-executor.2" path="/dev/loop0" dev="devtmpfs" ino=586 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=1 [ 160.728730] audit: type=1400 audit(1569040805.067:65): avc: denied { create } for pid=7714 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 160.753308] audit: type=1400 audit(1569040805.067:66): avc: denied { write } for pid=7714 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 160.778386] audit: type=1400 audit(1569040805.067:67): avc: denied { read } for pid=7714 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 161.231049] audit: type=1326 audit(1569040805.577:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=7694 comm="syz-executor.0" exe="/root/syz-executor.0" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45c84a code=0xffff0000 04:40:07 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r1) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x0, 0x0) 04:40:07 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000380)='net/ip_mr_cache\x00') preadv(r0, &(0x7f0000000140)=[{&(0x7f0000000000)=""/64, 0x40}], 0x1, 0x20000) 04:40:07 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) request_key(&(0x7f0000000100)='dns_resolver\x00', &(0x7f0000000140)={'syz', 0x1}, 0x0, 0xfffffffffffffffc) 04:40:07 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='cgroup\x00', 0x0, 0x0) chdir(&(0x7f0000000200)='./file0\x00') r0 = openat$cgroup_procs(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) r1 = memfd_create(&(0x7f00000001c0)='\xb3', 0x0) write$FUSE_DIRENT(r1, &(0x7f0000000080)=ANY=[], 0x29) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x81, 0x11, r1, 0x0) write$cgroup_pid(r0, &(0x7f0000000100), 0x12) 04:40:07 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='gid_map\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000100)) r2 = syz_open_pts(r1, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x200, 0x0) dup3(r2, r0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x41395527) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x8}, 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f00000003c0)={0x0, r5+30000000}, 0x0) socketpair(0x9a9355de6ee194da, 0x80000, 0x0, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 04:40:07 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmmsg(r0, &(0x7f0000000180), 0x400000000000078, 0x1) 04:40:07 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_buf(r0, 0x107, 0x2, &(0x7f0000000200)="f8962fa416ec271facced07ae56c6164", 0x10) 04:40:07 executing program 5: syz_emit_ethernet(0x86, &(0x7f0000000000)={@broadcast, @random="32729c78b7f2", [], {@ipv6={0x86dd, {0x0, 0x6, '\x00', 0xffffffffffffffda, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @local, {[], @gre={{}, {}, {}, {}, {}, {0x8, 0x6558, 0x0, "1f55d37adbf9347981b43eab"}}}}}}}, 0x0) 04:40:07 executing program 4: write$UHID_SET_REPORT_REPLY(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="0e003d69bb54000000000000cbf465db7e93905d67893fcf171b9c19cac264a5fdff1eefbf30cce46a78317bd284590fe0196d7329fefd45df86def3c125de241bc8703652a9889f5b0b21fc624e1cd86f4ad10896c7b489ef2b6ecc938ff33922bef43b97e72909b673beaeb82e502e986359865568129c0bce2158883538c83090d102bafa739cf1f36eaf80c1ba5c2a205038602c70e152f9145ca3d2ad29db43da2ad508cf00dbceccaae89fe9b637c86b9b1e2878c9d79cfc11184298507540faa2a1dd73463af856000495b04dace453a47dde31e55465eee44b2a3eb9efdf1fd2e97d51dd322d4623ca08e4ac"], 0x1) r0 = add_key(0x0, &(0x7f0000000180)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$read(0xb, r0, &(0x7f0000000240)=""/112, 0x349b7f55) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) r3 = getpid() sched_setattr(r3, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x1, 0x8, 0x0, 0x1}, 0x0) syz_open_procfs(r3, &(0x7f0000000440)='autogroup\x00') ioctl$TIOCPKT(r2, 0x5420, &(0x7f0000000540)=0x3) read(r2, &(0x7f0000000040)=""/11, 0xb) r4 = syz_open_pts(r2, 0x0) r5 = dup3(r4, r2, 0x0) ioctl$TCSETA(r5, 0x5406, &(0x7f0000000080)) fcntl$setpipe(r1, 0x407, 0x0) arch_prctl$ARCH_SET_GS(0x1001, 0x5) 04:40:07 executing program 0: mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mlockall(0x1) poll(0x0, 0x0, 0x0) [ 163.261947] audit: type=1400 audit(1569040807.607:69): avc: denied { map } for pid=7734 comm="syz-executor.3" path=2F6D656D66643AB3202864656C6574656429 dev="tmpfs" ino=28333 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:tmpfs_t:s0 tclass=file permissive=1 04:40:07 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="11dca50d5e0bcfe47bf070") time(&(0x7f0000000100)) 04:40:07 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'crct10dif-generic\x00'}, 0x58) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = accept$alg(r0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000006100)=[{{&(0x7f0000000100)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f0000000300), 0x0, &(0x7f0000000340)=""/120, 0x6f}}], 0x400000000000653, 0x0, 0x0) 04:40:07 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x17fe, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) 04:40:07 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1c) 04:40:07 executing program 3: r0 = socket(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'veth1_to_team\x00', 0xfffffffffffffffd}) 04:40:07 executing program 1: r0 = open(&(0x7f0000000000)='./bus\x00', 0x40000141042, 0x0) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0x323) r1 = open(&(0x7f0000000240)='./bus\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x9001) [ 163.677263] audit: type=1804 audit(1569040808.017:70): pid=7786 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.1" name="/root/syzkaller-testdir921422952/syzkaller.Vhd8zc/46/bus" dev="sda1" ino=16597 res=1 [ 163.826490] audit: type=1804 audit(1569040808.167:71): pid=7791 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.1" name="/root/syzkaller-testdir921422952/syzkaller.Vhd8zc/46/bus" dev="sda1" ino=16597 res=1 04:40:08 executing program 2: r0 = socket$inet6(0xa, 0x80003, 0xff) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") close(r0) 04:40:08 executing program 4: socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$SO_COOKIE(0xffffffffffffffff, 0x1, 0x39, 0x0, 0x0) r0 = dup(0xffffffffffffffff) r1 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r1, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @empty, @loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x42}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) vmsplice(r0, 0x0, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x5) read(0xffffffffffffffff, &(0x7f0000000180)=""/19, 0xfffffe47) bind$alg(0xffffffffffffffff, 0x0, 0x0) dup(0xffffffffffffffff) recvfrom$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='gid_map\x00') syz_open_pts(0xffffffffffffffff, 0x0) dup3(0xffffffffffffffff, r2, 0x0) getsockname$inet6(0xffffffffffffffff, 0x0, 0x0) 04:40:08 executing program 5: shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/224) 04:40:08 executing program 3: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f0000000380)=ANY=[@ANYBLOB="600300000000550000000000000000000000000000008a7054ecb466310d04000000f9d07353360700e34df912090815264ad72b30865e45f57174a5a910a3ee8ad4c0af9351c0d01e96ff2d829b3e40052892040cf48dfb15d4c68e63183e8320b4c1146cda888ee0adfc63d9", @ANYBLOB="c97825d0d92e1d8ddac6dbfaee14a318debd1a1933b82dbc947167246d1bdbb4f6c9342b2ba7df589b18e413f83ce631ff42a4b082bf7583a44fdf0dfd2642a0ef0a516d5e926ad730559c28f1cc0b4e7f74c22c3284d8aafbdb74c8"], 0xc9}}, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x898fd13755b449c, &(0x7f0000000100)=[{&(0x7f0000000040)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0xff66, 0x400}], 0x5, 0x0) syz_open_procfs(0x0, 0x0) getpid() sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, 0x0, 0x0) 04:40:08 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f00000002c0)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 04:40:08 executing program 0: mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mlockall(0x1) poll(0x0, 0x0, 0x0) 04:40:08 executing program 5: syz_emit_ethernet(0x46, &(0x7f0000000180)={@broadcast, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "007f00", 0x10, 0x400000000088, 0x0, @dev, @mcast2, {[], @icmpv6=@ndisc_ra}}}}}, 0x0) 04:40:08 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setreuid(0x0, 0xee00) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) setresuid(0x0, r1, 0x0) 04:40:08 executing program 5: openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="bcef637615f704c4f004000010006b2fe0cc7ba626ab55a14f42ff858272a3203611c611f3082ba58f7999a7487de970dc0ef7ceebfe9cff2d213855b50792461597723e24a4386f19cd199d1609bc6e9d419717fa0ad20a91a67f74525be599daad5d7827cab0accce71e2ff18fb62af355057747eb4961042386e187e68f1f957520b59bee03000000000000"], 0x8d) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) 04:40:08 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x88) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x4000000000005}, 0x1c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto(r0, &(0x7f0000000040), 0xfe4c, 0x0, 0x0, 0x8b) [ 164.195798] EXT4-fs (loop3): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 164.229052] EXT4-fs (loop3): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 164.278855] EXT4-fs error (device loop3): ext4_iget:4703: inode #2: comm syz-executor.3: root inode unallocated [ 164.355660] EXT4-fs (loop3): get root inode failed [ 164.377740] EXT4-fs (loop3): mount failed [ 164.395955] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 970769) 04:40:08 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000240)="a4ab12f728db4b2b4d2f2fba4fad273b1ea3e46f905080af4c90ccb170e60b3a8bf56db763e3a227deb6991fb054d54a333c28785d630f38ba0ff462a6eb00ea368db25633657b00008eaf3e5a53c644f6917333038571fe000000000000006af8dd1ce4f565d76454f9e2b3da964998113975a6d38f84c1dec32917503563a00c11ed7c0162b399f49dd26ea0d25a5cc147bb951df008a19d36c33a356294ffcfbb0c14024e250c21c0a1f51f0dc5e021079b45c81c1f06635ce516031ee8a289cd2377acfa6b9c2749967a780b02ee5b14f64283bdcf9c271bc09e624d227ce71dd1f5365bebe22552312fc0ecb44bc0f1568d1f6cad435813", 0xfa}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:40:08 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) vmsplice(r2, &(0x7f0000000380)=[{&(0x7f00000001c0)='+', 0x1}], 0x1, 0x0) [ 164.425318] FAT-fs (loop5): Filesystem has been set read-only [ 164.438509] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 970769) 04:40:08 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) lstat(&(0x7f0000000400)='./file0\x00', 0x0) setgid(0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$usbmon(0xffffffffffffff9c, 0x0, 0x800, 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x5, &(0x7f00000004c0)="4bac66a951d4286c5da0e4b6abf0321da6ebd8d588edd0284748fec8a07e84f57bf485fa331351a6d86cb7e94cea977a3fd22411182a57a87fd891f72c467da582614af3c3990560a60f344062d1339e59bd08d9c6a4af199d592df36be2d79690823359b007e8cb327777de15681f204d88b81e76a5e9430eb2b312b578dce9a41546572009736ac2537a4e6072f70a1fe2307800f20708dc82248476361ff429c40d3e1a06dc402d9652cdd6404db5e996f2aa961db4ddae55efd86d319ccd0ba07394219e33a9f15d72fc15a5304ef5fc44028c38231e9a6e6d43e4585f0c239c06924813a7867662ad1cdbd9039b265ee835063521c8f2e79430839e5c", 0xff) r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x481, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000000)='./bus\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setregid(0x0, r1) setfsgid(r1) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x89a1, &(0x7f0000000340)={@local}) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0xe0) ioctl$VT_GETSTATE(r2, 0x5603, &(0x7f0000000200)={0x16, 0x400, 0x1}) ioctl$sock_inet6_SIOCADDRT(r0, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000, 0x77a0100]}, @rand_addr="58c4c4a733d993a894f49491cb15d13e", @loopback}) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_DMA(0xffffffffffffffff, 0xc0406429, &(0x7f0000000480)={r3, 0x4, &(0x7f0000000240)=[0x5, 0x9, 0x7fff, 0xffffffffffffffff], &(0x7f00000002c0)=[0x401], 0x20, 0x1, 0x75, &(0x7f0000000300)=[0x8], &(0x7f0000000440)=[0x8, 0x20]}) getsockopt$netlink(0xffffffffffffffff, 0x10e, 0x0, 0x0, &(0x7f0000000100)) request_key(0x0, 0x0, &(0x7f0000000600)='/dev/null\x00', 0x0) syz_open_dev$sndseq(0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0) 04:40:08 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, &(0x7f0000000180)={0xf97cff8c, 0x8, 'SE Linux', "1200000000c46f00060000000700000008000300000000000000c27ed0e81f00030000000000000067681bfd760000000000000000fb6cfa040000"}, 0x4b) 04:40:09 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) chroot(&(0x7f0000000080)='./file0\x00') [ 164.642442] SELinux: failed to load policy 04:40:09 executing program 4: getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000000)) read(0xffffffffffffffff, 0x0, 0x0) dup(0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, 0x0) semctl$SETVAL(0x0, 0x0, 0x10, &(0x7f0000000200)=0x9d8) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, 0x0) open(0x0, 0x1, 0x11) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xd, &(0x7f0000000880), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fallocate(r0, 0x1, 0x0, 0x369e5d84) creat(0x0, 0x0) timer_create(0x0, 0x0, &(0x7f00000001c0)) 04:40:11 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="11dca50d5e0bcfe47bf070") setreuid(0xffffffffffffffff, 0x0) 04:40:11 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r1, &(0x7f0000000180)={0xf97cff8c, 0x8, 'SE Linux', "1200000000c46f00060000000700000008000300000000000000c27ed0e81f00030000000000000067681bfd760000000000000000fb6cfa040000"}, 0x4b) 04:40:11 executing program 0: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r0, &(0x7f00000002c0), 0x4cc, 0xfff6) 04:40:11 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) sync_file_range(r0, 0x2, 0x5, 0x4) setsockopt$inet_opts(r0, 0x0, 0x21, &(0x7f0000000000), 0x0) r1 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f00000002c0)) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) fcntl$dupfd(r0, 0x0, r1) pipe2(0x0, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r3, 0x0, 0xfffffffffffffdc6, 0x20000004, &(0x7f0000000280)={0xa, 0x4e22}, 0x1c) write(r3, &(0x7f0000000380), 0xfffffffe) recvfrom$inet6(r3, &(0x7f0000000240)=""/31, 0xfffffe0e, 0x100, &(0x7f00000000c0)={0xa, 0x0, 0x400}, 0xfffffffffffffe4a) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'lo\x00\x00\x00$\x00\x00\x00\x00\x00\x00\b\x00\x00\x11', 0xff}) r4 = accept4(r2, 0x0, 0x0, 0x0) sendto$inet6(r4, &(0x7f00000000c0), 0xfffffdda, 0x0, 0x0, 0x0) 04:40:11 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={[{@fat=@codepage={'codepage', 0x3d, '861'}}]}) 04:40:11 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setgroups(0x984, &(0x7f0000000000)=[0x0, 0xee00]) [ 167.102680] SELinux: failed to load policy [ 167.107462] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 167.119789] kasan: CONFIG_KASAN_INLINE enabled [ 167.131904] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 167.158780] FAT-fs (loop4): bogus number of reserved sectors [ 167.168642] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 167.174930] Modules linked in: [ 167.178160] CPU: 0 PID: 7885 Comm: syz-executor.5 Not tainted 4.14.145 #0 [ 167.184988] FAT-fs (loop4): Can't find a valid FAT filesystem [ 167.185089] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 167.200422] task: ffff888063492180 task.stack: ffff888063890000 [ 167.206708] RIP: 0010:tcp_sendmsg_locked+0x50e/0x3200 [ 167.211892] RSP: 0018:ffff8880638979b0 EFLAGS: 00010206 [ 167.217250] RAX: 0000000000000012 RBX: 0000000000000000 RCX: ffffc90005e65000 [ 167.224503] RDX: 000000000000011c RSI: ffffffff85240e44 RDI: 0000000000000090 [ 167.231769] RBP: ffff888063897b48 R08: ffff888063492180 R09: 0000000000000001 [ 167.239033] R10: 0000000000000000 R11: ffff888063492180 R12: dffffc0000000000 [ 167.246485] R13: ffff8880a616e500 R14: ffff888063897c28 R15: ffff88806240e0c0 [ 167.253741] FS: 00007f397c7f3700(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000 [ 167.261962] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 167.267848] CR2: 00007f6761146df8 CR3: 0000000087fca000 CR4: 00000000001406f0 [ 167.275151] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 167.282437] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 167.289704] Call Trace: [ 167.292336] ? trace_hardirqs_on+0x10/0x10 [ 167.296578] ? lock_sock_nested+0x9e/0x110 [ 167.301219] ? find_held_lock+0x35/0x130 [ 167.305309] ? tcp_sendpage+0x60/0x60 [ 167.309116] ? trace_hardirqs_on_caller+0x400/0x590 [ 167.314123] ? trace_hardirqs_on+0xd/0x10 [ 167.318260] tcp_sendmsg+0x30/0x50 [ 167.321786] inet_sendmsg+0x122/0x500 [ 167.325571] ? inet_recvmsg+0x500/0x500 [ 167.329543] sock_sendmsg+0xce/0x110 [ 167.333241] sock_write_iter+0x21d/0x390 [ 167.337287] ? sock_sendmsg+0x110/0x110 [ 167.341250] ? iov_iter_init+0xaf/0x1d0 [ 167.345297] __vfs_write+0x4a7/0x6b0 [ 167.349082] ? selinux_file_open+0x420/0x420 [ 167.353647] ? kernel_read+0x120/0x120 [ 167.357708] ? rw_verify_area+0xea/0x2b0 [ 167.361864] vfs_write+0x198/0x500 [ 167.365389] SyS_write+0xfd/0x230 [ 167.368824] ? SyS_read+0x230/0x230 [ 167.372459] ? do_syscall_64+0x53/0x640 [ 167.376418] ? SyS_read+0x230/0x230 [ 167.380032] do_syscall_64+0x1e8/0x640 [ 167.383915] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 167.388743] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 167.393916] RIP: 0033:0x459a09 [ 167.397087] RSP: 002b:00007f397c7f2c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 167.404778] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459a09 [ 167.412032] RDX: 00000000fffffffe RSI: 0000000020000380 RDI: 0000000000000009 [ 167.419468] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 167.426834] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f397c7f36d4 [ 167.434114] R13: 00000000004c5f88 R14: 00000000004e0610 R15: 00000000ffffffff 04:40:11 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) 04:40:11 executing program 3: r0 = epoll_create1(0x0) fcntl$lock(r0, 0x25, &(0x7f0000000200)={0x0, 0x2}) 04:40:11 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f5ffe0)={@dev, 0x400, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000a1fe0)={@dev, 0x400, 0x0, 0xff, 0x0, 0x0, 0x9}, 0x20) [ 167.441371] Code: d4 38 fc 4d 85 ed 0f 84 40 08 00 00 e8 ac d4 38 fc 8b 85 78 ff ff ff 48 8d bb 90 00 00 00 89 85 50 ff ff ff 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 06 0f 8e 4a 25 00 00 f6 83 90 00 00 00 [ 167.460764] RIP: tcp_sendmsg_locked+0x50e/0x3200 RSP: ffff8880638979b0 [ 167.477133] kobject: 'loop2' (ffff8880a4a4e9e0): kobject_uevent_env [ 167.488493] kobject: 'loop2' (ffff8880a4a4e9e0): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 167.498074] ---[ end trace 1de86189d3763768 ]--- [ 167.498081] Kernel panic - not syncing: Fatal exception [ 167.499992] Kernel Offset: disabled [ 167.514076] Rebooting in 86400 seconds..