[info] Using makefile-style concurrent boot in runlevel 2. [ 51.244504][ T26] audit: type=1800 audit(1568401920.845:21): pid=9017 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="bootlogs" dev="sda1" ino=2419 res=0 [ 51.290092][ T26] audit: type=1800 audit(1568401920.845:22): pid=9017 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="startpar" name="motd" dev="sda1" ino=2447 res=0 [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.74' (ECDSA) to the list of known hosts. 2019/09/13 19:12:14 fuzzer started 2019/09/13 19:12:15 dialing manager at 10.128.0.26:43261 2019/09/13 19:12:15 syscalls: 2487 2019/09/13 19:12:15 code coverage: enabled 2019/09/13 19:12:15 comparison tracing: enabled 2019/09/13 19:12:15 extra coverage: extra coverage is not supported by the kernel 2019/09/13 19:12:15 setuid sandbox: enabled 2019/09/13 19:12:15 namespace sandbox: enabled 2019/09/13 19:12:15 Android sandbox: /sys/fs/selinux/policy does not exist 2019/09/13 19:12:15 fault injection: enabled 2019/09/13 19:12:15 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/09/13 19:12:15 net packet injection: enabled 2019/09/13 19:12:15 net device setup: enabled 19:13:17 executing program 0: sched_setaffinity(0x0, 0x8, &(0x7f00000003c0)) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='\x00'/14) syzkaller login: [ 128.096927][ T9182] IPVS: ftp: loaded support on port[0] = 21 19:13:17 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000001900)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000000)=""/1, 0xfffffedc) [ 128.174186][ T9182] chnl_net:caif_netlink_parms(): no params data found [ 128.203866][ T9182] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.211009][ T9182] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.222062][ T9182] device bridge_slave_0 entered promiscuous mode [ 128.230423][ T9182] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.238663][ T9182] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.246642][ T9182] device bridge_slave_1 entered promiscuous mode [ 128.267012][ T9182] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 128.278782][ T9182] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 128.313681][ T9182] team0: Port device team_slave_0 added [ 128.320479][ T9182] team0: Port device team_slave_1 added [ 128.331476][ T9185] IPVS: ftp: loaded support on port[0] = 21 19:13:18 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000001900)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0xfffffece) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)) ioctl$TIOCSIG(r0, 0x40045436, 0x6) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='fd/4\x00') close(r1) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r4 = open$dir(&(0x7f0000000080)='./file0\x00', 0x4000, 0x0) write(r3, &(0x7f0000000600)="bb8f9f640903127a53527c6fbfe65d43b0e0586f2d40c7e7df58cac83420e83662d6e39bb6d5430622431454eedeeaee423d8f210bc3525fa7927c18d5fbc91ab13c2041136047d8da9375934d00f325499bfe7712208d387d41c31821c2a22d1325b556528e9b790b74053d1ed631c6ec8126d37c87216173138c00cef396868029af5b76bebac5e38b74d8bbc6ae66b6e202b6d505710377710ea7d43edf00e1a4c1c670bb4c263ce777da81abdd5ba5a5c82f67232f9b4d6f21b2e6afa8b38e4642b0daa2acbc0478d89b88e8b2094d4248855e5e81992e60be3afff0f3c3799350615489a901a659abdeca0c615a622ebf64175f990320e0356d4a11ed62eff72b709c23dd65942e8b534d7d775d370c1e435654a2634e6ee3649c4c3bcbe39e866f1eb9972af1a9cef42e701798a53dc92a242aadbac343e1765cf8ea5665e22deda69777e52b1e9e5d3edc022256939e1eee013448294911139d5b9c6241049fecdf9b31f4cdf6cff65d71b5071ef70e1798347c8846aa5b905e83050e3e606986ed3f603d18c5cdeb11cda1ce3abddea9376231af130e19fc7601ec1ab8cb5a7de9e2174547f18225b09a54fc8720dbb91eb69c1be88e601c3c9df4f2758f39a5151951b9c6dbb419ffd783a34c9fad10f201b8724d31865e2fc1fcf48db2be713053b43a0e3943c1e2b08e8a26e946c439d891db2a80b5ffa054bc8d0177d3214056250c61a537d2ec7630fb90395df2cd6aa9c5e573365db580520bdc3f1c6b2be992e1516a4b810a11935dc780699e461d9715f70c6d103ff49bf168f3cff4c0d0d6ba5671fcd2975450b0e1a3474139cb0f2d3476fcd87a8bccbeb2f5f8a821017b879aa5b9d1fafa9f4c429a74cd2da782114d97bf031746a817dd0293c4eddc3a9ecb5afe496f4971474ccd827449409f07cf94dda2e7dbe8520b5afff10a7e3b0b4289a167fc692635b5b7426d9e771b95860b09a3e752c867213c772e48ba30a78feecc7ff26e63e1749c62b52d377ac5cc52db830c965e04ccfcfb24ceacc69cfdc2094124dd27b2d68f699476a2562bab1de117ffc2b0702ee8b0b77f85fecec3a25b37ab7eb06232c9a73b4470f1727c82581d81942abf42d3ea37957927ad3dbd0ebe46678a9f4d25c47acaac83c14210a54b71fed40df017e2be27f01e3e6ea3ea381ca14efd202858e6535ad4f79a8cdf47e385b740a70c14e3651731a45cc0ca4a56f2e903cad0384efcc364caf67e09551d35c682ebc90a9286c4d274ba1b8ced742ede4e55a62db7ef9a96fde2add05b41599fd72a79ba280cc125cb266ef21b7eeafe3ee6aa78eef33fc66454549c3ec298cb683a55a32208cf6ce88b560166159d59e65f30540f62c5437652ea7f2a02f87ca242dd2250f58e75938a9a3ded51ae6598c2aba53287ff5cdaab17be7f4310f8e07e310d52778de79e1c2e4391b254be38910aa1cf6e1ca0e75d24be97d59f7025f16c6fbd549529b74e319c58f50438765ef0e3dc394eeb75dec41b3d80435b17520c97f5cd7ee692fb86d188fb0089fbf737dc1b96b9cc49be23a38a8cd92e5075f349993d7866369dd25eccbe1481477a05fee14e0edd1617921d7fcaa8fdc642e63b64388fa5b63442ff1466b1938d02546750b01ed9c980282ccbe10f204741249aed88c555ed6fdf7f68af9209807a71bbf4f31bef5a4223466da74ba8b034df529aef6ec6610a0d25973961e50e02af22d0ca8be1b9804a5918acbdb536e8f2f441ec9d640ed15133ee747440c86fc4526c9195954528673d25c8390170f3c19cb0b0c30b9e634c7ebae96946ae97c19eabca92226da925d22be37abbe0740938ea899ec42fd529a3b1063981e4c154219df5cf5af60a29b5a8ee530905725a14b28900eae937e705401ba8f632a7bca00d9724a992afdc9ed14aac71b8e3a7ee5ca095888feb195b4e083c3b611a1c2f8d092febe3b9f5f0df61e8d3c31a643c935b76bc1ad4265164e755484beb06610510bc51e8c6da8d71123bbe83a5e4128f41cf5c486d6a60496c300c406f990bee485cbdef794f2663ee66d2b18d8e55210c25c04b1a0c6d9c5f904e72806d2d4f5e5439bcdf146343cdffe4d0d70d42a9959cff9bd50c37cd478b0b0add16aae4dc839b46bca2ac7547144b6a422aed5e2db661bcb31a82bc0fc678e71a6cb090ef772860f3008b4152b5d281033be4a77b367baec3ab8ce7c83c601b11c8199bafcd15161a5454a6a982dbc3c2e3a5172b6a63e4904817075754eccbb0188c9cb2e5da9600f567485014887463b40f189b7ec3c5c0f36d502509e402c285765c78417ce6b3aab130ee79622dcd8ada842233e73a14554ee5e4995e32b3fe4075e247eb9bdeef64d1a7436c9b5782fb2f84f74e4c6e976289729c37b5bb8200a9480d181a6b11f5ec229b818134b8334967ae935ac1d81be4776fae4cb68b6fa330e93bd8de388b38455d569159bcd166df030a6dfedf28caf4608de7243f5df2c76f6680c301d819dc67d24d2f780432a931700a253b0a5b075195c6dbfd1fe17a1c11a3dffa872a07b877adc66d069fffb6d8326e1998c5a337c3d530250cae335ceffcf81dc438a47e73490d050a053813dbe6674e42c91ae94b4a88144f36adc1b08b4bcd6ddf4058c4e08d4dc83d5fbd843ee27eaf50b297c220350260d9abbeeb6deb921e50cae0ea590cfb6f00fb3c71520f565bb769705e2481ef27cf537d29f163c9fe3d39ed9fd18dc8b0c976cd302283e430807a9d751357f89092532d89fe280c69ad36e3541b5da9dea13fd19d0434c760fe295dfd9b9e63453c7853914c50b1b77ccd4b33c8b1f31fcb1aec040ffe2f9d728d8ea84297bac2e22230ebd1488c503b05b2e433cc37ce9fc123b7d3eb244b4549e9a841e73b664c8f6621ea5a4c9ff9c1da032255311f2c063a682baf4c97e7ba552bf71af4bd64f43872b846d15c65c487089be272cfa24a33f8c50930ea0bc4b089505fb8e9e688d35a978813c38add66548d7575727ded0e7e64a5ce897da6b940df4c3dddb8b4871d773f6ebf02058518c55c19aadb0f266caf18777ae68d2bfcfb2225961fcd10538ba664fd053a443320072707533ab761b9397bd0559126b84fe9196463ae50633017ea2d80940311d9c867102b1017f34af1965d8eb61be616a0d40656e2bbb750aee6f74f788c8acb2578e8686f5f8da6a19e979c152b7ee7c7f16902120588e2ff630144b5f929ffc593e946d9717c5968aa16c2d73d689fb5cce117acda3e23e5e0116de1cb6bddfa1a84cefb22c1e2c3753017696f27b9aec5d44f15411247643b84dd4410e784b4eb5b9c68fea671976f9b51c6526e2ddb40659611b0b3bcc7e249c77396fdb8c864ea9318f9de7fd3936fcbdc732c2f8b9556ec9afeb15d5e2df890351d66074d53dddc6e8dba8c91d733623ac95a49eb69c7de37ff2364ccddb01f6500750a012c2acf32a9f6bbd9e92d17ef858fbc34575db414ea42ad87a65b11ae5506469db256c421328f45aec73bdf18562447dc2840bbe9fc84dedd0fe6276fa174f21210d40193530ec7a70a9e60bfd6b00cba4d483be59950f16fa0dbd089b5fd0bb078badfcf42270cc62fe37be22b0d81f755263d74636fa466d2574ca62b58c649936d21e949de73ea45df3acade6609413f56fc218d6f11947bf1fd629d38d8acce90ee3c1a51117601ae126bec537e3e76ce7ecc53cfeefee8aaa104aa853a65aadf27bac9849ee0122793b11cd8e4f32f", 0xa72) sendfile(r3, r4, 0x0, 0x12000) ioctl$GIO_CMAP(r3, 0x4b70, &(0x7f00000000c0)) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6, @in=@remote}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f0000000040)=0xe8) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0xc0000, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x1b, 0x0}}], 0x1, 0x0, 0x0) r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) r7 = inotify_init1(0x80800) readv(r7, &(0x7f0000001080)=[{&(0x7f0000000400)=""/123, 0x7b}, {&(0x7f0000000480)=""/21, 0x15}, {&(0x7f0000001940)=""/4096, 0x1000}, {&(0x7f0000000540)=""/62, 0x3e}, {&(0x7f0000000580)=""/57, 0x39}], 0x5) ioctl$UI_GET_VERSION(r6, 0x8004552d, &(0x7f0000000080)) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') dup2(r5, r6) sendmsg$TIPC_NL_BEARER_SET(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000980)=ANY=[@ANYRES16=r8], 0x1}, 0x1, 0x0, 0x0, 0x44000}, 0x80) sendmsg$TIPC_NL_PEER_REMOVE(r3, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x4c, r8, 0x100, 0x70bd25, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x38, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x439}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x4}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4044000}, 0x8814) close(r0) [ 128.423286][ T9182] device hsr_slave_0 entered promiscuous mode [ 128.491422][ T9182] device hsr_slave_1 entered promiscuous mode 19:13:18 executing program 3: sched_setaffinity(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='\x00'/14) [ 128.583429][ T9187] IPVS: ftp: loaded support on port[0] = 21 [ 128.612863][ T9182] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.619958][ T9182] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.627332][ T9182] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.634418][ T9182] bridge0: port 1(bridge_slave_0) entered forwarding state [ 128.728165][ T9189] IPVS: ftp: loaded support on port[0] = 21 19:13:18 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) bind$packet(r1, &(0x7f0000000040)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @dev}, 0x14) sendmmsg(r1, &(0x7f0000000d00), 0x1bdd307, 0x0) [ 128.770231][ T9182] 8021q: adding VLAN 0 to HW filter on device bond0 [ 128.829147][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 128.839176][ T3024] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.857837][ T3024] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.866487][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 128.877348][ T9182] 8021q: adding VLAN 0 to HW filter on device team0 [ 128.888325][ T9185] chnl_net:caif_netlink_parms(): no params data found [ 128.915450][ T9194] IPVS: ftp: loaded support on port[0] = 21 [ 128.925815][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 128.935564][ T9191] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.942656][ T9191] bridge0: port 1(bridge_slave_0) entered forwarding state [ 128.950861][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 128.959611][ T9191] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.966688][ T9191] bridge0: port 2(bridge_slave_1) entered forwarding state 19:13:18 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f00000003c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xedX#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') openat$cgroup_ro(r0, &(0x7f0000000480)='mem\x00\x01y7SwaS.\x06ur\x89\xc9B\xab\xe3\xfarent\x00\xaa\x1a\xfd\xae\v\xbf\xd8d\xbb\xaf9Q\xde\xfb\x1fY\xfb\x8do\xd1\x16\xce(\x82\xf1\xbf{5Z\x13\x15\x14\xd7\xb8\xce\xf20\x1e\xc0\xc2\xed0xffffffffffffffff}) r2 = dup(r1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x5, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000000280)=0x800, 0x4) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000300), &(0x7f0000000340)=0x4) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) r5 = dup(r3) openat$cgroup(r0, &(0x7f00000002c0)='syz0\x00', 0x200002, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') sendmsg$FOU_CMD_DEL(r5, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x16ed588cc4117825}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, 0x0, 0x400, 0x70bd2c, 0x25dfdbfb, {}, [@FOU_ATTR_IPPROTO={0x8, 0x3, 0x67}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_PORT={0x8, 0xa, 0x4e22}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) syz_open_dev$vcsn(&(0x7f0000000380)='/dev/vcs#\x00', 0x7fff, 0x1800) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_SET_CLOCK(r2, 0x4030ae7b, &(0x7f0000000100)={0x5, 0x101}) r6 = openat$cgroup_int(r0, &(0x7f0000000080)='io.max\x00', 0x2, 0x0) r7 = openat$cgroup_ro(r0, &(0x7f00000003c0)='cgroup.controllers\x00', 0x0, 0x0) sendfile(r6, r7, 0x0, 0x5) [ 129.759610][ T9194] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.767205][ T9194] device bridge_slave_1 entered promiscuous mode [ 129.792695][ T9189] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.803362][ T9189] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.812183][ T9189] device bridge_slave_0 entered promiscuous mode [ 129.828110][ T9194] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 129.838512][ T9194] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 129.851380][ T9189] bridge0: port 2(bridge_slave_1) entered blocking state 19:13:19 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0x7, 0x8}, 0x3c) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xd, 0x100000001, 0x4, 0x100000001, 0x0, r0}, 0x2c) r2 = socket$isdn_base(0x22, 0x3, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000200)={{{@in=@initdev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6}}, &(0x7f00000000c0)=0x479) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'team_slave_1\x00', r4}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x0, 0x0}, 0x10) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r5, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") setsockopt$inet_mtu(r5, 0x0, 0xa, &(0x7f00000001c0)=0x1, 0x4) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r1, &(0x7f00000001c0), &(0x7f0000000080)}, 0x20) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r6, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") fsetxattr$trusted_overlay_redirect(r6, &(0x7f0000000140)='trusted.overlay.redirect\x00', &(0x7f0000000180)='./file0\x00', 0x8, 0x3) [ 129.858445][ T9189] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.872801][ T9189] device bridge_slave_1 entered promiscuous mode [ 129.924833][ T9194] team0: Port device team_slave_0 added [ 129.950174][ T9189] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 129.960221][ T9194] team0: Port device team_slave_1 added [ 129.971806][ T9187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 129.983126][ T9189] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 130.005707][ T9189] team0: Port device team_slave_0 added [ 130.016026][ T9187] 8021q: adding VLAN 0 to HW filter on device team0 19:13:19 executing program 0: timer_create(0xfffffffbfffffff9, 0x0, &(0x7f0000000040)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r1, 0xc0305302, &(0x7f0000000000)={0x3a5b, 0xffffffffffffffff, 0x5, 0x9, 0x3, 0x4}) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x77359400}, {0x77359400}}, 0x0) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{}, {0x77359400}}, 0x0) [ 130.028787][ T9197] chnl_net:caif_netlink_parms(): no params data found [ 130.055522][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 130.070007][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 130.078061][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 130.087219][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 130.095799][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 130.104077][ T3024] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.111137][ T3024] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.118623][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 130.127233][ T9189] team0: Port device team_slave_1 added [ 130.203548][ T9194] device hsr_slave_0 entered promiscuous mode [ 130.271451][ T9194] device hsr_slave_1 entered promiscuous mode [ 130.311211][ T9194] debugfs: Directory 'hsr0' with parent '/' already present! [ 130.362471][ T9189] device hsr_slave_0 entered promiscuous mode [ 130.402946][ T9189] device hsr_slave_1 entered promiscuous mode [ 130.441589][ T9189] debugfs: Directory 'hsr0' with parent '/' already present! [ 130.453839][ T9185] 8021q: adding VLAN 0 to HW filter on device bond0 [ 130.462631][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 130.470887][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 130.479767][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 130.488264][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.495328][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state 19:13:20 executing program 0: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000000)={0x2, r0, 0x1}) chdir(&(0x7f0000000140)='./file0\x00') fcntl$notify(r3, 0x402, 0x1c) read$rfkill(r0, 0x0, 0x7fff) r4 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x2, 0x2000) ioctl$KVM_ASSIGN_SET_MSIX_NR(r4, 0x4008ae73, &(0x7f0000000100)={0x7, 0x8}) [ 130.513043][ T9197] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.520140][ T9197] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.527807][ T9197] device bridge_slave_0 entered promiscuous mode [ 130.561735][ T9197] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.568791][ T9197] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.587864][ T9197] device bridge_slave_1 entered promiscuous mode [ 130.604699][ T9197] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 130.621617][ T9187] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 130.632032][ T9187] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 130.646843][ T9197] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 130.659827][ T9185] 8021q: adding VLAN 0 to HW filter on device team0 [ 130.669450][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 130.678160][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 130.686856][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 130.695899][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 130.704266][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 130.712557][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 130.720632][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 130.728984][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 130.737011][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 130.744600][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 130.752259][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 130.759853][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 130.783576][ T9197] team0: Port device team_slave_0 added [ 130.790167][ T9197] team0: Port device team_slave_1 added [ 130.814856][ T9189] 8021q: adding VLAN 0 to HW filter on device bond0 [ 130.838435][ T9185] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 130.850798][ T9185] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 130.864053][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 130.873123][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 130.881507][ T5] bridge0: port 1(bridge_slave_0) entered blocking state 19:13:20 executing program 0: r0 = syz_open_dev$audion(&(0x7f0000000240)='/dev/audio#\x00', 0x40, 0x402000) fchownat(r0, &(0x7f0000000280)='./file0\x00', 0xee00, 0x0, 0x400) r1 = getgid() setregid(0x0, r1) get_thread_area(&(0x7f0000000000)={0xfffffffffffffff7, 0x100000, 0x4000, 0x4, 0x7, 0x7fff, 0x3, 0x0, 0x600000000000000, 0x5}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet_udplite(0x2, 0x2, 0x88) io_setup(0x5, &(0x7f0000000040)=0x0) io_submit(r4, 0x1, &(0x7f0000001c00)=[&(0x7f0000001640)={0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0}]) io_getevents(r4, 0x0, 0x1, &(0x7f0000000180)=[{}], &(0x7f0000000080)) [ 130.888568][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 130.896435][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 130.905037][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 130.913364][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.920417][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 130.932875][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 130.941696][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 130.950781][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 130.959255][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 130.967543][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 130.975834][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 130.983936][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 130.992078][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 131.000115][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 131.008413][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 131.017672][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 131.025351][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 131.033975][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 131.082512][ T9197] device hsr_slave_0 entered promiscuous mode [ 131.121435][ T9197] device hsr_slave_1 entered promiscuous mode [ 131.171207][ T9197] debugfs: Directory 'hsr0' with parent '/' already present! [ 131.179782][ T9187] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 131.196049][ T9189] 8021q: adding VLAN 0 to HW filter on device team0 [ 131.203820][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 131.214596][ T3617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 131.224605][ T9185] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 131.251845][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 131.260233][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 131.269531][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.276613][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 131.285134][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 131.295082][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 131.310923][ T5] bridge0: port 2(bridge_slave_1) entered blocking state 19:13:20 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r5, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r6 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x0, 0x0) ioctl$sock_bt_cmtp_CMTPCONNADD(r6, 0x400443c8, &(0x7f0000000000)={r5, 0xfffffffffffffffe}) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x69) r7 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r7, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f0000033ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) shutdown(r7, 0x1) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r8, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r7, 0x84, 0xa, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r9}, &(0x7f0000000080)=0x20) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f0000000080)={r9, 0x8, 0x2, [0x401, 0x80]}, 0xc) sendto$inet(r5, &(0x7f0000000140)="60e2e16ec039c7db854d3e5e326e98d9e4280ceadba85a8200c76a37701d823206c14f478756a8ec870c3017899e4a873986967a1d00fdf212336ae79a705ade6351f73c2e76bf66702d4e4f26096d9d53a64da0a17eed80a0ce06207e67c9fcc73cee32317486c3a26dd6592d77fceb309b042741bb961b582fc151bef47c801343ee025e42ffc52dc976c872525a352962dce14196758b78bff2a8377dafa33deacf06aec6b43dd5a7f2a22ac1", 0xae, 0x4000000, &(0x7f0000000240)={0x2, 0x4e24, @rand_addr=0xe000000}, 0x10) [ 131.318025][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 131.326135][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 131.334924][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 131.346236][ T9244] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 131.350596][ T9194] 8021q: adding VLAN 0 to HW filter on device bond0 [ 131.380019][ T9189] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 131.391157][ T9189] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 131.424302][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 131.433638][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 131.465481][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 131.473942][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 131.482802][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 131.490919][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 131.500036][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 131.508308][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 131.516883][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 131.518616][ T26] kauditd_printk_skb: 8 callbacks suppressed [ 131.518622][ T26] audit: type=1800 audit(1568402001.115:31): pid=9250 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=16523 res=0 [ 131.525013][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 131.534127][ T26] audit: type=1804 audit(1568402001.135:32): pid=9250 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir876986940/syzkaller.eMG7yw/0/file0" dev="sda1" ino=16523 res=1 [ 131.550871][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 131.564150][ T26] audit: type=1800 audit(1568402001.165:33): pid=9250 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=16523 res=0 [ 131.587595][ T9189] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 131.627006][ T9194] 8021q: adding VLAN 0 to HW filter on device team0 [ 131.638235][ T26] audit: type=1800 audit(1568402001.235:34): pid=9250 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=16523 res=0 [ 131.664602][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready 19:13:21 executing program 2: r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0) write(r0, &(0x7f0000002000)='/', 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0xbfffffffffffff56, 0x40000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TIOCGPKT(r4, 0x80045438, &(0x7f0000000040)) fcntl$addseals(r2, 0x409, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x41, &(0x7f0000000180)=ANY=[@ANYBLOB="72617700000000000000800000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000002000"/72], 0x1) [ 131.673105][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 131.700181][ T9197] 8021q: adding VLAN 0 to HW filter on device bond0 [ 131.721448][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 131.729909][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 131.744373][ T9191] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.751445][ T9191] bridge0: port 1(bridge_slave_0) entered forwarding state [ 131.761734][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 131.776894][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 131.786418][ T9191] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.793492][ T9191] bridge0: port 2(bridge_slave_1) entered forwarding state [ 131.808243][ T9197] 8021q: adding VLAN 0 to HW filter on device team0 [ 131.824208][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 131.836843][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 131.847910][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 131.856705][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 131.864569][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 131.872212][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 131.880425][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 131.889515][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 131.898790][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 131.907532][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 131.927595][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 131.937791][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 131.952524][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.959569][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 131.967670][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 131.976510][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 131.984874][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.991917][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 131.999767][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 132.008131][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 132.017765][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 132.027499][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 132.035836][ T3024] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 132.050064][ T9197] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 132.061049][ T9197] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 132.072952][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 132.081356][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 132.089472][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 132.098723][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 132.107975][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 132.116499][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 132.126505][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 132.134770][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 132.143118][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 132.150734][ T9191] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 132.167881][ T9197] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 132.176488][ T9194] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 132.187868][ T9194] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 132.195503][ T9198] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 132.203889][ T9198] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 132.224730][ T9194] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 132.341165][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 132.346970][ C0] protocol 88fb is buggy, dev hsr_slave_1 19:13:22 executing program 3: perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000016c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r2, 0x0) r3 = syz_open_dev$audion(&(0x7f0000000080)='\f\x00', 0x40, 0x54b340) r4 = socket$isdn(0x22, 0x2, 0x21) bind$isdn(r4, &(0x7f0000000280), 0x6) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0, 0x0}, &(0x7f0000000300)=0xc) fchownat(r3, &(0x7f0000000280)='./file0\x00', 0xee00, r5, 0x400) chown(&(0x7f0000000040)='./file0\x00', r2, r5) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x8}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000100)={0x1}, 0x116) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f0000002780)=[{{0x0, 0x363, &(0x7f0000000200)=[{&(0x7f0000000140), 0x304}], 0x8}, 0x2}], 0x13, 0x24000004) 19:13:22 executing program 2: syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) shmget(0x0, 0x1000, 0x78000b30, &(0x7f0000ffc000/0x1000)=nil) 19:13:22 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$TIOCSSERIAL(0xffffffffffffffff, 0x541f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$msdos(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000001640)=ANY=[]) write(r1, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed1", 0x1fb) sendfile(r1, r2, 0x0, 0x7fffffff) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) read$FUSE(0xffffffffffffffff, 0x0, 0x0) sendfile(r3, r1, 0x0, 0xffffffff) [ 132.682635][ T26] audit: type=1800 audit(1568402002.285:35): pid=9299 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="loop0" ino=22 res=0 19:13:22 executing program 2: r0 = socket$kcm(0x2b, 0x2000000000000001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x7, 0x0, &(0x7f00000000c0)=0x6) [ 132.735655][ T26] audit: type=1804 audit(1568402002.305:36): pid=9299 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir310294118/syzkaller.Iabc9d/7/file0/file0" dev="loop0" ino=22 res=1 19:13:22 executing program 1: syz_open_procfs(0x0, 0x0) ftruncate(0xffffffffffffffff, 0x800) ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x3, 0x6f, 0xffff, 0x401}) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000140)='/dev/vbi#\x00', 0x0, 0x2) ioctl$UI_DEV_CREATE(r2, 0x5501) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000180)=0x2000000000000074, 0x4) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r2, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)={0x154, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_LINK={0x78, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5f5f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1b2d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe8}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NET={0x28, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffffffffffd}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x800}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x17}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xc1f}]}, @TIPC_NLA_MEDIA={0x4c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x400}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x395}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffffffffff8}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9000000000000}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000040)={0x80000000, {{0x2, 0x4e22, @empty}}}, 0x88) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000100)=0x6, 0x4) sendto$inet(r1, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) [ 132.796490][ C0] hrtimer: interrupt took 24905 ns [ 132.826728][ T9294] delete_channel: no stack [ 132.830125][ T26] audit: type=1804 audit(1568402002.365:37): pid=9302 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir310294118/syzkaller.Iabc9d/7/file0/file0" dev="loop0" ino=22 res=1 [ 132.847346][ T9294] delete_channel: no stack 19:13:22 executing program 4: r0 = socket$kcm(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KVM_ASSIGN_SET_MSIX_NR(r4, 0x4008ae73, &(0x7f0000000100)={0x7, 0x8}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$VIDIOC_DECODER_CMD(r2, 0xc0485660, &(0x7f0000000040)={0x3, 0x3, @stop_pts=0xffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r5 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000cc0)="2e0000001e000503ed0080647e6394f23200d2000600120111407f480f0001002700000002000000f88000f01700", 0x2e}], 0x1000000000000190}, 0x800) 19:13:22 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000180)="224353bf4d2a959655e98b5db71c184bfe70dd02c55579131e17d8d850abe90330cb913cd45235ec58b1b7408567b8db3e63cf7e642049f1e3003320796baa395a9fa12b3e24c0c0dadcf5fa94d3cfedf19d75e95757744a60966f064cb2e8b27caa12b4684d57bd772147186cffd55c4a631e55755b17afc5a883fde25936bf2bcb0c05a3bc73349b535436ec195616c228098c291249258113ce154161a59f6091fc909eeb32c9a231b6df60230026fa1d6e073603ee70efc1db04d97a6258ac5c99034cf85e3ab2484e4250c5a8897977faaa770910a9f3e24de6a0cfa6391151", 0x47b}, {&(0x7f0000000280)="ec340c4e4438e19e9c8e60c840cf13d1440ad143fe3d5ea809559242cdfa0ad957e94d9f2f11954afaf29d69048bc72a4b2687e85b6375267116d1f4ad6a336f1bcb2883e40aa8ed262f27e59f32c4831a15b107571fa447c33ac7ebb71e31ef47fb404f2cdea3ec60cff6557cb014f4fcfa57cd386d85a762a56c4303b9792b0ba5f4b83e5b3c", 0xfffffffffffffe9d}], 0x2}, 0x0) 19:13:22 executing program 4: r0 = socket(0x42000000015, 0x805, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x220080, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca5055e0bcfec7bf070") getsockopt(r0, 0x114, 0x8, &(0x7f0000af0fe7)=""/13, &(0x7f0000000000)=0x30d) 19:13:22 executing program 3: r0 = socket$inet_tcp(0x2, 0x3, 0x6) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000016c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x20ff0cdc) setresuid(0x0, r2, 0x0) sendmmsg$inet(r0, &(0x7f0000005b80)=[{{&(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10, 0x0}}, {{&(0x7f00000002c0)={0x2, 0x0, @loopback}, 0x10, 0x0, 0x289, &(0x7f00000001c0)=[@ip_retopts={{0x14, 0x0, 0x7, {[@generic={0x88, 0x2}]}}}], 0x18}}], 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 19:13:22 executing program 2: mlockall(0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) futex(0x0, 0x0, 0x0, 0x0, &(0x7f0000048000), 0x0) mmap(&(0x7f0000000000/0xddf000)=nil, 0xddf000, 0x0, 0x4032, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r1, 0xc0385720, &(0x7f0000000040)={0x0, {r2, r3+10000000}, 0x1000, 0xc95}) 19:13:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket$inet6(0xa, 0x5, 0x7) r1 = socket$inet6(0xa, 0x4000000080002, 0x88) connect$inet6(r1, &(0x7f0000005d00)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @initdev}}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f00000000c0), 0x4) sendmmsg(r0, &(0x7f0000006d00), 0xffffffffffffff92, 0x0) [ 133.243268][ T26] audit: type=1804 audit(1568402002.845:38): pid=9332 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir310294118/syzkaller.Iabc9d/7/file0/file0" dev="loop0" ino=22 res=1 19:13:22 executing program 3: r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000140)='/dev/video35\x00', 0x2, 0x0) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={0x2, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0='bpq0\x00', 0x3f, 'syz1\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x9, 0x0, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @bcast, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000100)={0x80000000003, 0x81000981900}) arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000000080)) close(r0) [ 133.365463][ T9299] syz-executor.0 (9299) used greatest stack depth: 24472 bytes left 19:13:23 executing program 0: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xa925, 0x2b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000000)=0x1) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000080)=0x2) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)={0x30, r3, 0x1, 0x0, 0x0, {{}, 0x0, 0xb, 0x0, {0x14, 0x14, 'broadcast-link\x00'}}}, 0x30}}, 0x0) 19:13:23 executing program 3: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x6f, 0x0, &(0x7f000095dffc)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KDGKBMETA(r2, 0x4b62, &(0x7f0000000000)) socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) linkat(r4, &(0x7f0000000040)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x800) 19:13:23 executing program 3: r0 = socket$unix(0x1, 0x1, 0x0) r1 = semget$private(0x0, 0x0, 0x428) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$VT_DISALLOCATE(r3, 0x5608) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) semtimedop(r1, &(0x7f0000000000)=[{0x0, 0x20, 0x1800}], 0x1, &(0x7f0000000080)={r4, r5+30000000}) recvmmsg(r0, &(0x7f00000062c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 19:13:23 executing program 2: r0 = memfd_create(&(0x7f0000000100)='#\'%nodev\x00', 0x0) write(r0, &(0x7f0000002000)='/', 0x1) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x31d400, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r1, 0xc008551b, &(0x7f0000000040)={0x2, 0x8, [0x6, 0xc2]}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r2, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f0000033ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) shutdown(r2, 0x1) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4}, &(0x7f0000000080)=0x20) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000080)=@sack_info={r4, 0x8, 0x7}, &(0x7f00000000c0)=0xc) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000140)={0x8, 0x10000, 0x201, 0x20, 0x7, 0x100, 0x1, 0x6, r5}, &(0x7f0000000180)=0x20) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, &(0x7f00000001c0)) [ 133.621338][ T9348] ion_buffer_destroy: buffer still mapped in the kernel 19:13:23 executing program 1: syz_open_procfs(0x0, 0x0) ftruncate(0xffffffffffffffff, 0x800) ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x3, 0x6f, 0xffff, 0x401}) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000140)='/dev/vbi#\x00', 0x0, 0x2) ioctl$UI_DEV_CREATE(r2, 0x5501) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000180)=0x2000000000000074, 0x4) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r2, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)={0x154, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_LINK={0x78, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5f5f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1b2d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe8}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NET={0x28, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffffffffffd}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x800}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x17}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xc1f}]}, @TIPC_NLA_MEDIA={0x4c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x400}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x395}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffffffffff8}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9000000000000}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000040)={0x80000000, {{0x2, 0x4e22, @empty}}}, 0x88) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000100)=0x6, 0x4) sendto$inet(r1, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 19:13:23 executing program 3: syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0xffffffffffffffff, 0x80000) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) setsockopt$packet_int(r0, 0x107, 0xe, &(0x7f00000000c0)=0x8ee, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x85fc2c857c1916af, 0x0) ioctl$TIOCMIWAIT(r2, 0x545c, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$inet_dccp_int(r4, 0x21, 0x4, &(0x7f0000000100)=0x8, 0x4) ioctl(r1, 0x1000008912, &(0x7f0000000140)="11dca50d5e0bcfe47bf070") setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000000), 0x4) 19:13:23 executing program 0: openat$ppp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ppp\x00', 0x80000101005, 0x0) r0 = socket$nl_crypto(0x10, 0x3, 0x15) r1 = dup2(r0, 0xffffffffffffffff) write$rfkill(r1, 0x0, 0x0) 19:13:23 executing program 2: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f00000015c0)}, 0x40) 19:13:23 executing program 3: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, 0x0, &(0x7f0000000040)) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x4000, 0x0) ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, &(0x7f0000000080)=r1) 19:13:23 executing program 4: r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000240)={0x0, 0x6000000, &(0x7f0000000000)=[{&(0x7f0000000140)="2e0000003100050ad25a80648c6394fb0124fc0010000b400c000300053582c137153e370900018025642500d1bd", 0xffffffffffffff16}], 0x1}, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x8, 0x20880) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000080)={0x1, 'gre0\x00', 0x2}, 0x18) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f00000000c0)={[{0x9, 0x8, 0x7d, 0xe0, 0x1, 0xbacf5a3, 0x7, 0x6, 0x81, 0x4, 0x6, 0x4280, 0x1}, {0x69, 0x3, 0x4, 0x3, 0x714, 0xffffffff, 0x2, 0xf85a, 0x1d, 0xffff, 0x2b0, 0x1, 0x1}, {0x3, 0x0, 0x1ef3, 0x9, 0x8, 0xa28, 0x7, 0xac, 0x6, 0x6, 0x1f, 0x5, 0x540}], 0x7}) 19:13:23 executing program 0: r0 = socket(0x400000000010, 0x2, 0x3) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) getsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000000), &(0x7f0000000080)=0xc) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x80000001, 0x800) 19:13:23 executing program 2: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x40002, 0x0) ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000100)={0x0, 0x9, 0x100000000, 0xfffffffffffffffe, 0x100000001, 0x1}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="11dca5055e0bcfe47bf070") r2 = socket$inet_smc(0x2b, 0x1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c000100766574680000598a180002001400010000000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x4}}, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000140)={@local, @initdev={0xac, 0x1e, 0x1, 0x0}, r5}, 0xc) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e0000001c00810ee00f80ecdb4cb9e307f029a00d0000002f003efb0a0002000000000000000f00060005000f02", 0x2e}], 0x1c2}, 0x0) 19:13:23 executing program 3: r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c000100766574680000598a180002001400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x50, 0x24, 0x507, 0x0, 0x0, {0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8, 0x1, 'hhf\x00'}, {0x24, 0x2, [@TCA_HHF_NON_HH_WEIGHT={0x8}, @TCA_HHF_BACKLOG_LIMIT={0x8}, @TCA_HHF_QUANTUM={0x8}, @TCA_HHF_HH_FLOWS_LIMIT={0x8}]}}]}, 0x50}}, 0x0) r7 = getuid() setsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000000)={{{@in6=@mcast1, @in=@broadcast, 0x4e20, 0xf5, 0x4e23, 0x0, 0x2, 0x20, 0x20, 0x32, r6, r7}, {0x2, 0x10000, 0x4, 0x6, 0x5cd4, 0x20, 0xffffffffffffffe1, 0x100000000}, {0x100000001, 0x1, 0x3ff, 0x11}, 0x40, 0x6e6bb0, 0x0, 0x2, 0x2, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0xd}, 0x4d5, 0x50}, 0x2, @in6=@remote, 0x3504, 0x7, 0x3, 0x3ead, 0x3, 0x9, 0x4}}, 0xe8) fallocate(r1, 0x43, 0x0, 0x800008004) 19:13:23 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x7, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x11}, [@call={0x85, 0x0, 0x0, 0x38}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x4040c0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000100)=[@in6={0xa, 0x4e20, 0x1fffffffe00000, @empty, 0x2}, @in6={0xa, 0x4e22, 0x0, @mcast2, 0x8001}, @in={0x2, 0x4e22, @loopback}], 0x48) 19:13:23 executing program 4: r0 = socket$inet(0x2, 0x800, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$IOC_PR_PREEMPT_ABORT(r2, 0x401870cc, &(0x7f0000000000)={0x8001, 0x8, 0x6, 0x800000}) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r0, 0x0, 0xfffffffffffffc6d, 0x20000800, &(0x7f0000000240)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_opts(r0, 0x0, 0x4, 0x0, 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000040), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xfffffffffffffccf, 0x240, 0x0, 0xffffffffffffff37) 19:13:23 executing program 2: unshare(0x600) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x100000000014, 0x4, 0x4, 0x39e1}, 0xfffffe50) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xb, 0x7, &(0x7f0000000000)=@framed={{}, [@map={0x18, 0x0, 0x1, 0x0, r0}, @map={0x18, 0x0, 0x1, 0x0, r0}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) 19:13:24 executing program 1: syz_open_procfs(0x0, 0x0) ftruncate(0xffffffffffffffff, 0x800) ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x3, 0x6f, 0xffff, 0x401}) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000140)='/dev/vbi#\x00', 0x0, 0x2) ioctl$UI_DEV_CREATE(r2, 0x5501) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000180)=0x2000000000000074, 0x4) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r2, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)={0x154, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_LINK={0x78, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5f5f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1b2d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe8}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NET={0x28, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffffffffffd}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x800}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x17}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xc1f}]}, @TIPC_NLA_MEDIA={0x4c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x400}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x395}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffffffffff8}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9000000000000}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000040)={0x80000000, {{0x2, 0x4e22, @empty}}}, 0x88) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000100)=0x6, 0x4) sendto$inet(r1, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 19:13:24 executing program 0: r0 = syz_open_dev$video(&(0x7f0000000200)='/dev/video#\x00', 0xe46f, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x10000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x14, r5, 0x101, 0x0, 0x0, {0x3}}, 0x14}}, 0x0) sendmsg$IPVS_CMD_DEL_DEST(r3, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0xa0c480}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0x14, r5, 0x400, 0x70bd27, 0x25dfdbfe}, 0x14}}, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8900010}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xd4, r6, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffffffff94b}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7fffffff}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x822c}, @IPVS_DEST_ATTR_TUN_TYPE={0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x100000000}]}, @IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x1c}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x9}, @IPVS_SVC_ATTR_PROTOCOL={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x41}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x100000000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6405}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfa4c}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100000001}]}, 0xd4}, 0x1, 0x0, 0x0, 0x800}, 0x40000) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f0000000300)={0x0, 0x0, [], {0x0, @reserved}}) 19:13:24 executing program 2: socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0xffffffff, 0x2) bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', 0x0, 0x18}, 0x10) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r3 = fcntl$dupfd(r2, 0x203, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$IP6T_SO_GET_REVISION_MATCH(r3, 0x29, 0x1d, 0x0, &(0x7f0000000000)=0x390) 19:13:24 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)=0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f00000000c0)={{0x7, 0x0, 0xfffffffffffffffd, 0x0, 'syz1\x00'}, 0x3, 0x0, 0x0, r2, 0x0, 0x0, 'syz0\x00', 0x0, 0x397}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$DRM_IOCTL_MARK_BUFS(r4, 0x40206417, &(0x7f0000000040)={0x3, 0x319f, 0xa4f, 0x6, 0x4, 0x3}) 19:13:24 executing program 4: r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r1 = creat(&(0x7f0000001380)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ftruncate(r2, 0x2081ff) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) io_setup(0x8, &(0x7f0000000180)=0x0) write$tun(r2, &(0x7f0000000240)={@void, @void, @ipv6={0x0, 0x6, "b03671", 0x10, 0x0, 0x0, @mcast1, @initdev={0xfe, 0x88, [], 0x0, 0x0}, {[], @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "ea75a9", 0x0, "dec79d"}}}}}, 0x38) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$TUNSETNOCSUM(r6, 0x400454c8, 0x0) io_submit(r4, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x3, 0x1, 0x0, r3, &(0x7f0000000000), 0x10000}]) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) write$capi20_data(r8, &(0x7f0000000280)={{0x10, 0x0, 0x87, 0x83, 0x9, 0x4}, 0x86, "950daba5c99652d77e40d849675717747c33910bda16a4d4e86b4f2a303461372291abb7727e3866b3f09409f39a94fd87c393a096768e4a9dc238ac7679a8c66981650ce5797f1c0366728371aed7894be49f22e5428a5837a0bb682909a20667729b337b8f3090aea81e10d88b362bb1622521a5dff588479e8d2912e4627ecc0eecf97154"}, 0x98) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000200)={0x0, r1}) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r8, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)={0x13c, r9, 0x302, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x14, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4b6d}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}]}, @TIPC_NLA_MEDIA={0x3c, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}]}, @TIPC_NLA_BEARER={0xb4, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_PROP={0x4}, @TIPC_NLA_BEARER_PROP={0x54, 0x2, [@TIPC_NLA_PROP_PRIO={0x4, 0x1, 0x1f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2c3}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x80, @rand_addr="14a5c32257f12131a07d7970c2b3689d", 0xffffffff}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x829e, @loopback, 0xffffffff}}}}]}, @TIPC_NLA_NET={0x24, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x80000001}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x400}]}]}, 0x13c}, 0x1, 0x0, 0x0, 0x2000000}, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = dup(r10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r13 = dup(r12) ioctl$PERF_EVENT_IOC_ENABLE(r13, 0x8912, 0x400200) ioctl$DRM_IOCTL_ADD_BUFS(r13, 0xc0206416, &(0x7f0000000500)={0x6, 0x4, 0xd21, 0x800, 0x1, 0x8}) ioctl$PERF_EVENT_IOC_ENABLE(r11, 0x8912, 0x400200) r14 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r14, &(0x7f000026cfff)="c6", 0x1, 0x0, &(0x7f0000033ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) shutdown(r14, 0x1) r15 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r15, 0x84, 0x1d, &(0x7f0000000580)=ANY=[@ANYBLOB="510000080b719f6a6decfaa651d4220e8169e4a727363adcfdf328977836fb6916c73d258384cf28735c84340bbcd2a88c46d28d8c58a47df52b2469630c4b56353dd809ae5caf00"/91, @ANYRES32=0x0], &(0x7f000095dffc)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r14, 0x84, 0xa, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r16}, &(0x7f0000000080)=0x20) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r11, 0x84, 0x7c, &(0x7f00000004c0)={r16, 0x1ff, 0x1}, 0x8) 19:13:24 executing program 3: r0 = syz_open_dev$vbi(&(0x7f0000000180)='/dev/vbi#\x00', 0x0, 0x2) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f00000001c0)={0x0, 0x7000000000000, 0x0, {0x7, @raw_data="6adff5edb3cc8b3d4e309eef717611560f0242fcd1eaf6aaafc7065b768c64520a65fe3afec92a7c9a98bcb860b1f76facddc16c9c132c25d755d4b2d7e1bcb1102c0dcddb243aeb46d92556b21904781481e32437dc7b28ec82d7d1eaca75c47e9e2a2352c790919cdd843d15a7c513cb4c4b22eb1d0f70fbfc25b43e472ab3a7ff9e4081f82e34bcd410cf43cdf0c000dc4a743de5ac4d72f369a4e2071eb782006513107f37bcbccf518d39a0ab1bef98c0580a4448a31a1a31164984da203b0d9f34c87e11e1"}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000040)={0x80000000, 0x4, 0xfb1, {0x77359400}, 0x7, 0xfffffffffffffff8}) r1 = semget(0x0, 0x0, 0x200) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f00000000c0)={0xfe, 0x2741984b809e4a85, 0x4000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) r2 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x3, 0x2) accept$ax25(r2, &(0x7f00000002c0)={{0x3, @null}, [@null, @default, @default, @remote, @default, @null]}, &(0x7f0000000140)=0x48) semctl$SETVAL(r1, 0x0, 0x10, &(0x7f0000000000)=0x1) 19:13:24 executing program 2: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x408902, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008915, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$TUNSETCARRIER(r2, 0x400454e2, &(0x7f0000000000)=0x1) creat(0x0, 0x0) r3 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r3, 0x4020565b, &(0x7f00000000c0)={0x18003001, 0x1ff, 0x2}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000140)={0x2ec, 0x0, 0x10001, 0x1}) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000180)={0xfffffffffffffa30, r6, 0x10001, 0xfffffffffffff801}) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x81009431, 0x0) pipe2(&(0x7f0000000340), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x60000000) 19:13:24 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @empty}, 0x10) 19:13:24 executing program 3: ioctl$EVIOCGABS0(0xffffffffffffffff, 0x80184540, 0x0) r0 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r0, 0x4, 0x2400) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', 0x0}) r2 = open(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0x0) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x0, 0x0, 0x0) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) rt_sigpending(&(0x7f0000000080), 0x8) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000002c0)=0x596, 0x4) open$dir(0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000d00), 0x400004e, 0x0) [ 134.970256][ T9448] IPVS: ftp: loaded support on port[0] = 21 19:13:24 executing program 4: syz_open_procfs(0x0, &(0x7f0000000000)='\x00\a\x00\x00\x00\x00\x00\x00\x00G\xe3U:Q<\x16%\x98\xff\xf2\xda\xeb\x88i\x16\x02\xb5\x83\x19\xf3w\x18\xc7\x96\x05\x00y\x93\xd3W\xc4-l\xcf\xa5\xed\xc8RF\xf2.Ihm\xe2\x86\xd2\xf1\xd6\xb6\xff<\xa4}\xcb\x99\x9fq\x1dF\xe0\x05Y\xfex\x0f\x17\xf7s\xd51\xdf\xeb\x87tT&|i\xc9\xa8\x95\\\xf2\xb5\ay\xc8\xc8R\x92\xf1#\x9bsm\xf6F\x83\xd7\x13L\x94\xf8}\xc7m>\xe4]\xde\xfa=d\xc5\xf7\x115\xd7\xf3\xbc\x0f\xe3V\x9d\xf8\x8b|1\r\xd4X\xae\\\xd5\x9a4J\n\xac\xd1\x9f\a\xa0\xf6\x97zr\x0f\x04\x00\x00\x00\x1f\xe0\f,\x9e\x13\xdf\xf4\xc3)mzB\xe0Y\xc3n|M\xc5\xf7\xd0\x94\xfb\x19\x9b\xefS\xf8zi0\xb5v\xde\xed\xccl\xe9\x0e-\xef\x9dN&%\x80A\xacn\x8c~7\x18\x94\x94\xd9\x8f\xd1\xe13\xd9\xa6\xb3\xa7\xf3\xcf\xb3,\x9b\xd8x\x94\xb7\x8f\xcf?\xda\v\xe7\xd2!\x8c\xa8\xe3F\x81\xee\x1c\x1c\xa7\xbcnU!R\xbc\x9fJ\xc1Z\xeeu\'\x7f\xc1\x1c\xcb\x04\xf34F[\xf7\xc8VK\xad\x90\x00'/307) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f00000001c0)={0x0, 0x2, 0x7610, 0x7}) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r3, 0xc0385720, &(0x7f0000000180)={0x0, {0x77359400}, 0x3, 0x7}) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000300)='/dev/rtc0\x00', 0x800, 0x0) inotify_init() write(r5, &(0x7f0000000580)="f948fac3e8138e6575ad4edf55ecc0fc2be24af7f0bbe4289ca12c041c5e5856280efc44d5bb9c5a41bacafaf22dd25d7d23f58bcab29ed095cbf2113045a5b08f42be8197d3c0670157f1a056eab215ec89e88d398a687986cbb714000001000000000054be58d73020f2f6af2b0f314f17ea", 0xffffffe4) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) pselect6(0x2b, &(0x7f00000000c0)={0x0, 0x4000000000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, &(0x7f0000000200)={0x0, r6+30000000}, 0x0) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) [ 135.151558][ T9458] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 19:13:25 executing program 1: syz_open_procfs(0x0, 0x0) ftruncate(0xffffffffffffffff, 0x800) ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x3, 0x6f, 0xffff, 0x401}) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000140)='/dev/vbi#\x00', 0x0, 0x2) ioctl$UI_DEV_CREATE(r2, 0x5501) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000180)=0x2000000000000074, 0x4) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r2, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)={0x154, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_LINK={0x78, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5f5f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1b2d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe8}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NET={0x28, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffffffffffd}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x800}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x17}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xc1f}]}, @TIPC_NLA_MEDIA={0x4c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x400}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x395}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffffffffff8}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9000000000000}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000040)={0x80000000, {{0x2, 0x4e22, @empty}}}, 0x88) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000100)=0x6, 0x4) sendto$inet(r1, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 19:13:25 executing program 2: getrandom(0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x0) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, 0x0, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='stat\x00') r2 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000014c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ADD(r3, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000001500)={0x28, r4, 0x1, 0x0, 0x0, {0x5}, [@TIPC_NLA_BEARER={0x14, 0x1, [@TIPC_NLA_BEARER_NAME={0x4, 0x1, @udp='udp:syz0\x00'}]}]}, 0x28}}, 0x0) fchdir(r2) r5 = memfd_create(&(0x7f00000001c0)='\xb3', 0x0) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20\x00', 0x20000, 0x0) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r6, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xb, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, r7, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x100000000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) ioctl$TCSETXF(0xffffffffffffffff, 0x5434, &(0x7f00000003c0)={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0xd2e], 0x7}) write$FUSE_DIRENT(r5, &(0x7f0000000080)=ANY=[], 0x29) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x81, 0x11, r5, 0x0) r8 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) pread64(r8, 0x0, 0x0, 0x0) 19:13:25 executing program 0: mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x2004, 0x32, 0xffffffffffffffff, 0x0) socket(0xa, 0x1, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x400, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) r2 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0xc47b, 0x82080) ioctl$VIDIOC_OVERLAY(r2, 0x4004560e, &(0x7f0000000240)=0xb9) r3 = getpid() socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000280)={0x43, 0x1, 0x1}, 0x10) sched_setscheduler(r3, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f0000000100)={0x4, 0x70, 0x81, 0x80000001, 0x400, 0x1800000000000, 0x0, 0x3, 0x112042, 0x1, 0x101, 0x3eb0, 0x0, 0x9, 0xbf1, 0x10001, 0xffffffff, 0xc7, 0x3, 0x6, 0x42, 0x2, 0x80, 0x1bc0, 0x4, 0x10b, 0x7f07, 0x9, 0x4, 0xfffffffffffffffb, 0x5, 0x4, 0x0, 0x2a73, 0x200, 0x8001, 0xb8, 0x1, 0x0, 0x1f, 0x0, @perf_bp={&(0x7f0000000000), 0x8}, 0xa018, 0x5, 0x2, 0x3, 0x3, 0x9, 0x6}, r3, 0x0, r1, 0x3) r6 = shmget(0x0, 0x6000, 0x1, &(0x7f0000ff8000/0x6000)=nil) shmctl$SHM_STAT(r6, 0xd, &(0x7f00000004c0)=""/133) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(0xffffffffffffffff, 0x40bc5311, &(0x7f0000000180)={0x6, 0x2, 'client0\x00', 0x4, "466be45c0e1dfdc3", "697f4922a619a1dffd9cdf4317e263623c117e032a67788fc68b490253502968", 0x547, 0x5}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0xfe) getsockopt$inet6_int(r1, 0x6, 0x4c, 0x0, 0xfffffffffffffffe) recvfrom$x25(r1, &(0x7f00000003c0)=""/246, 0xf6, 0xddb5b05364cec0f9, &(0x7f00000002c0)={0x9, @null=' \x00'}, 0x12) 19:13:25 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f00000000c0)={0x3f, 0x0, 0x0, {0x0, 0x989680}}) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x4, 0x90000) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000140)={'filter\x00', 0x4}, 0x68) 19:13:25 executing program 3: ioctl$EVIOCGABS0(0xffffffffffffffff, 0x80184540, 0x0) r0 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r0, 0x4, 0x2400) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', 0x0}) r2 = open(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0x0) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x0, 0x0, 0x0) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) rt_sigpending(&(0x7f0000000080), 0x8) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000002c0)=0x596, 0x4) open$dir(0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000d00), 0x400004e, 0x0) 19:13:25 executing program 4: syz_open_procfs(0x0, &(0x7f0000000000)='\x00\a\x00\x00\x00\x00\x00\x00\x00G\xe3U:Q<\x16%\x98\xff\xf2\xda\xeb\x88i\x16\x02\xb5\x83\x19\xf3w\x18\xc7\x96\x05\x00y\x93\xd3W\xc4-l\xcf\xa5\xed\xc8RF\xf2.Ihm\xe2\x86\xd2\xf1\xd6\xb6\xff<\xa4}\xcb\x99\x9fq\x1dF\xe0\x05Y\xfex\x0f\x17\xf7s\xd51\xdf\xeb\x87tT&|i\xc9\xa8\x95\\\xf2\xb5\ay\xc8\xc8R\x92\xf1#\x9bsm\xf6F\x83\xd7\x13L\x94\xf8}\xc7m>\xe4]\xde\xfa=d\xc5\xf7\x115\xd7\xf3\xbc\x0f\xe3V\x9d\xf8\x8b|1\r\xd4X\xae\\\xd5\x9a4J\n\xac\xd1\x9f\a\xa0\xf6\x97zr\x0f\x04\x00\x00\x00\x1f\xe0\f,\x9e\x13\xdf\xf4\xc3)mzB\xe0Y\xc3n|M\xc5\xf7\xd0\x94\xfb\x19\x9b\xefS\xf8zi0\xb5v\xde\xed\xccl\xe9\x0e-\xef\x9dN&%\x80A\xacn\x8c~7\x18\x94\x94\xd9\x8f\xd1\xe13\xd9\xa6\xb3\xa7\xf3\xcf\xb3,\x9b\xd8x\x94\xb7\x8f\xcf?\xda\v\xe7\xd2!\x8c\xa8\xe3F\x81\xee\x1c\x1c\xa7\xbcnU!R\xbc\x9fJ\xc1Z\xeeu\'\x7f\xc1\x1c\xcb\x04\xf34F[\xf7\xc8VK\xad\x90\x00'/307) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f00000001c0)={0x0, 0x2, 0x7610, 0x7}) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r3, 0xc0385720, &(0x7f0000000180)={0x0, {0x77359400}, 0x3, 0x7}) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000300)='/dev/rtc0\x00', 0x800, 0x0) inotify_init() write(r5, &(0x7f0000000580)="f948fac3e8138e6575ad4edf55ecc0fc2be24af7f0bbe4289ca12c041c5e5856280efc44d5bb9c5a41bacafaf22dd25d7d23f58bcab29ed095cbf2113045a5b08f42be8197d3c0670157f1a056eab215ec89e88d398a687986cbb714000001000000000054be58d73020f2f6af2b0f314f17ea", 0xffffffe4) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) pselect6(0x2b, &(0x7f00000000c0)={0x0, 0x4000000000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, &(0x7f0000000200)={0x0, r6+30000000}, 0x0) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:13:25 executing program 0: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x1c641, 0x0) r1 = socket$inet6(0xa, 0xffffffffffffffff, 0x1) r2 = fcntl$getown(r1, 0x9) ptrace$pokeuser(0x6, r2, 0x7fe, 0x2) r3 = creat(&(0x7f0000000380)='./bus\x00', 0x4) ioctl$PIO_UNISCRNMAP(r3, 0x4b6a, &(0x7f0000000fc0)="31d96da88b0cce5062747ce237ca24f05b05df66b34814c1cdb2db3642a7c880224c03d6cffd67b36c7f1a51ae9aeaa3892b040ba2105d77d4e4579d745ad601f19c26d1260bcd5435ae4ad35d123f7e809a7b0576431fde9f78c3260a3837b52ef6437c404147add96892a9d3a67dcf93c198c3b7727cd266c20c5e584c28ae0843064b8f7f199db8641f71a407775e0090bbedee63a4640e1f012e5ca95bd14b5aa0da642b552ae4aa2b869458dec283c16f25c67068fc528a793f75c81acac8ee6596d79c449ade5eeee332c460ebc0d46c076e871b6426d521c571a95d0fa800de30a110e719ffde8f103773daaaec8c313aa3be0bdaa6e7e796df3975a8e37aee6d10579f8afe6552f187c242c731375f5d64cd40ab8904400f00000000000000000000000000000058b4721949da012002cb7f4ac8fe195c1388861be8cd45020083b0089b23f86603321faf83e794bea1ece8051e9996306347bd562aa2437fa6bdb57086302926b8af069b8d331ebf5c0e1a7f163e6d711af330efdfae413fafef9acf1d53e6aaf4f2dec9ddfb4ca321583e35a14a92e82bdbea3c127a033b32059fbadce23a3e87957f8238886aa9380000000018888c4c20ba104342e8c9d85a9dcf06abbb7a2905d37839bff6f8641ebce172c60a8d368cd4a94af484749dc4ccdd380bbf5d501302d50e79d3536eab5a12abdd347dac985c4349ec712661df947315514e45a515417e6b00000000000000002bdacdb2631c83a90dbca3aa7e5936f8aa413a75c7780309e1c178bce65ed205154ab4f55241cd2b6e83b29fc6cefe050d7d662360718e25bbdb2d34264d6a741cbbed50422f5d") r4 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000880)={@remote, 0x800, 0x0, 0x3, 0x1}, 0x20) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000000)={@local, 0x0, 0x2, 0xfe, 0x3}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000040)={@dev={0xfe, 0x80, [], 0x28}, 0x0, 0x1000000000, 0x1, 0x3, 0x3b9}, 0x20) connect$inet6(r4, &(0x7f0000000500)={0xa, 0x0, 0x40f7, @mcast2, 0x7ff}, 0x9) r5 = syz_open_procfs(r2, &(0x7f00000009c0)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd0\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7\x95\xaeV\x0f\x9e\xed\x13\xc6H\v\xb7\xd0g!`\x18\x0f\x99\xadD-\xc8{\xbc\xb2\xb9Y\xe2P\x9b\xec\x1e_\xb4\x01\xf1\x1e\xa8\xf8\xdf?#p-\xbd3\"L\xe5\x7f\nC\x00}\x0eb\xbc\xa4}\x93\x9a\t\xf4\xfa\xbew D\x00\xb0Z\xc0\x1a\xf9\x924\a\x1c4\xfa\xe4\xe2\x8e\xe8\x19\x00\x05\xb7\xd51)\b\xf2#[-\xbf\x7f\x10\x14vy\x86\x85\xa4W\r\xe8i\x95\xc9\xe6\xf8\a\xd8\xe2\xdf\xc8\x97\xa2\b{b\xca\x95u:\v\x97\b\r@g\x80\x8d_\x18y\xd1\x8d\xc1)U`\xb9\xe2\xd7\x88\xc2\xaf\xdc\xc1\xda\xcc\xca\x9a\v\xact8Z\x1c\x06\x1b\xdf\xb5\xc1\"\x05,Yw\vP\xcc\xfa\xf9\x9f<\xbd\x1c\x1a\xcb*\x06\xb7\xcd\x7f\xba\xadr\xbb/\"2p\xf8\b\x1e\x04\xac*\x88\xb0\xa7\xc6\xb4M\x97n\xdck\xd1\\\x9f\x9d\x1a4 Y\xac\xcb\xf9f\xcf>qd\vn:\x12\xc0\xdca\xfd\x8d\x9dL\x92\x17\x8fe\xd1\xaa$\x12\x02R\x96t?\x9a\x1a') sendfile(r4, r5, &(0x7f00000000c0)=0x202, 0x8) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00') pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x10c800) r9 = open(&(0x7f0000000340)='./file0/file0\x00', 0x8040, 0x32) setsockopt$sock_linger(r9, 0x1, 0xd, &(0x7f0000000200)={0xfffffffffffffffe, 0xfffffffffffffffb}, 0xfffffffffffffed7) setsockopt$inet6_int(r9, 0x29, 0xcf, &(0x7f0000000840)=0x1, 0x4) sendmsg$NBD_CMD_RECONFIGURE(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="040027bd7000ffdbdf25030000000c00050002000000000000002400070008000100", @ANYRES32, @ANYBLOB, @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r9, @ANYBLOB="0c00060002000000000000000c00020007000000000000000c0005002000000000000000"], 0xfffffffffffffe5f}, 0x1, 0x0, 0x0, 0x4000800}, 0x81) r10 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_CONG_MONITOR(r10, 0x114, 0x6, &(0x7f00000000c0), 0x4) r11 = accept4(r10, &(0x7f0000000340)=@can, &(0x7f00000003c0)=0x80, 0x80800) getsockopt$TIPC_SRC_DROPPABLE(r11, 0x10f, 0x80, &(0x7f0000000440), &(0x7f0000000480)=0x4) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r11, 0x28, 0x6, &(0x7f0000000040)={0x77359400}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r11, 0x10f, 0x88) sendmsg$NBD_CMD_DISCONNECT(r11, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="00000001ea9efca3cab2ee741f1ed18aefac93d0126d4e101d3df2d85cd7c12cab5a1443e6c04540a70e9d1674071177d278adf9396f839d2bd0a1691aae46a32282e8d850c639cce6465ae5c90e9602057d0bbb4d54a631d57fc62573bbcd0bc897dc9183b20c374c959dd8811127f3e4f48a37b54e0d901f6ff2052773427be4536b5fbaa6da40ba2c2043f5ff03b48c491f11683a55591890ccf239d3d9fab7c84edc7b1fe211627fb7848bdbcd4e0f759966871eb2", @ANYRES16=r6, @ANYBLOB="04002700000000dbdf25020000000c0006000200000000003f00"/38], 0x3}, 0x1, 0x0, 0x0, 0x40}, 0x4004000) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x44200}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="84000000", @ANYRES16=r6, @ANYBLOB="000a29bd7000fddbdf250500000008000100000000000c000800060000000000040008000100000000000c00030802000000000000000c00220000000000000000000c00060002000000000000000c0004eaffffffffffffff0c000300fdffffffffffff0000000000003f0c000800200000000000000037521b30b2b1dedd33235f105542292be8"], 0x84}, 0x1, 0x0, 0x0, 0xfaf0784a88b8abb9}, 0x10) r12 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x4, 0x100) r13 = open(&(0x7f0000000280)='.\x00', 0x2000, 0x70) symlinkat(&(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r13, &(0x7f00000000c0)='./file0\x00') r14 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r14, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") sendmsg$NBD_CMD_STATUS(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYRESHEX=r7, @ANYRES16=r6, @ANYRES64=r14, @ANYRES32=r12, @ANYBLOB="663e0100", @ANYRESHEX=r3], 0x6}, 0x1, 0x0, 0x0, 0x10}, 0x40000c0) r15 = socket$nl_generic(0x10, 0x3, 0x10) r16 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000140)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r15, &(0x7f0000000200)={0x0, 0x4a8, &(0x7f0000000240)={&(0x7f0000000180)={0x14, r16, 0x301}, 0x14}}, 0x0) 19:13:25 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x3c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x0, 0x1000, @mcast1, 0x3f}, 0x1c) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440), 0x1, 0x0, 0x30e}, 0xc100) writev(r0, &(0x7f0000000400)=[{&(0x7f0000000480)="a9772d9bea4824cc3854a62ffb84c4fb114d80fe462fd727b6f682cf0f9ccfe45f46ed18fc8af0505df86b4230370bfacd1f7266fae5859a3608357c69f51cfa473ef19a9dc2aeb43f9ed68acc034cf841229fbbe3f57130fe2ad707c56a92dbe64e59aa78e24db8e9b50597ab0024ca2564fbdb50e7b8cfa5c7028d556977ad6a90adf768a5ac0505ab07f8256368c6e71dd4b5a1c2e3c9946b610ab2b324099beb706b6a510c134ad18c928be3af6cf20e5016c9a050e35e30716e4913c882272bbfc8f0e1ee9c31484af6953e7d967640eff8accacee6daf3f98051a3ee281555a41340273dcb0bd8cc8cd549676f3ec23cbca42d4b76a178376eefb3da036d60cb88b5cb9c0ae0135be1d4f598c564fbe97ad4b691f59ba4063b898482d9cde4497009884d75b1965874e9c4d5a7cf8a640433c02acd340a98eff73e5948611184c7c60da3b233367d58aaf4e407e2e2c506b871fd822ec231389734d23a2aa5dc197831d8fee19361e5b99d0b51e5b1f0cadf296b91aa9477fa72879b4a3a3040777cf778cee1de32619701d71cb5316c7234a910b497b5f1b2cd2a0d39e92b6b92e091b470da2cec0e1b1fd3ce1a15d559b3733b97b2ddb1dd2aa73c9e03f189b8dd48c9093daddcd2c3fd0e1a9d16046d85c8934d2f9094aa5fa7b8ff061cb753dea2637ac2a8d523c9791ae454ea2e8cb10ce4a3ad8937ed583cd653bdb05b965e658f9c5f06a43bb1e61cfa4cb9be2cb4ef264d10f37e5292576bfdc97b2e1f8b692f0b64f76287e67805df914273677a9c39bd1e4f73d3c1afd99ad18a210caee42ab5c87969f6f99d7423dbb72d436ef3a3dead8eda03274d2e8e7f107eb04fdc3e36d6d4022dbc5c2fe388aaa3234950588ef56362708189826b98d3c9ed4dabcb33582a7e55327e82686aac973a5d0292afd7175a9c57b4fc1e5ba7cb0a34e35e50526d40bdb51a224e5b89e74e8752c1b39ab250b178adfab91c73c04d3c012b244cb7745dde4f716203ffcddaa096186ed0403b323c3aaa79aa4a0e6d1231ce99f83788ba0dc86da01cdad25816c26bf8e523b287d7ee83b5d0c55599ddbd202f743a1bc3d107a9c9610dc62537af48eecdd174ee4e796943250b81af0da28c57955aea149010ede13eb973dbe959500afe5e77b32ad5a11a353555b48eb7684596eadc481c291f185d0d47c639fa5bcb2dffe859a9d4a0e184a640e30f0afe83f2096faef9c0129289688a5267e0d2dadadd0f8cb13f35827f0337d2edf6220a244dd8c135563051f6fcd7fdad7879ff3ef01975938bc6e47aee745d4701cfc5e5546f05903bbcde0120ad847c32658c1384a6d8f188544df337a25f806051a346fb980a4e84fee06b0d367bc81161e96072b2e7e47999ac93437749d11864fa4c03a2d333135660aa17bd421623e6654eeae956e51a0157cb876db3e9cb324641d132cda7aabd9dcaa51f090c1955d20c2618466a0ea5acbaeac5a46e00b8869ca9a337eb5d9406592a790678a1f0bbe729054abb4810f4fdf50c517d4dd312b2d382412d45b9f60464c107c0735b16ceced73484f37cdcc8b9a4a62bc997bbd1d23b993fc5cfed9a43d2f4d335570e76715b020664bedb0db88816bc97ec37d13d64f604b71fc73f3c38954ae554e45997209afb0ff102dc170986e2d72e4178a7e6131308afa29ba732e251ebdf6254c0589752bfca3bef7fd0fc60ba683c6016b16234216bdcf8975bebafd8ee4606a96c1993d1f096b435fa84279344b914dec8e56566e103592a7ed44c63c8b5c18e01fa873032b1087622f225747339d38fa89e7008695ce0b3d6f505ab7ecdf99182ab7aa264d9108af35b0a373da18a8183f696dc70a8ac88c5663a866e89c7d7dbdf7296d63e5167978b38463ae9f36fe4121229e92cce", 0x551}], 0x1) 19:13:25 executing program 2: syz_open_procfs(0x0, &(0x7f0000000000)='\x00\a\x00\x00\x00\x00\x00\x00\x00G\xe3U:Q<\x16%\x98\xff\xf2\xda\xeb\x88i\x16\x02\xb5\x83\x19\xf3w\x18\xc7\x96\x05\x00y\x93\xd3W\xc4-l\xcf\xa5\xed\xc8RF\xf2.Ihm\xe2\x86\xd2\xf1\xd6\xb6\xff<\xa4}\xcb\x99\x9fq\x1dF\xe0\x05Y\xfex\x0f\x17\xf7s\xd51\xdf\xeb\x87tT&|i\xc9\xa8\x95\\\xf2\xb5\ay\xc8\xc8R\x92\xf1#\x9bsm\xf6F\x83\xd7\x13L\x94\xf8}\xc7m>\xe4]\xde\xfa=d\xc5\xf7\x115\xd7\xf3\xbc\x0f\xe3V\x9d\xf8\x8b|1\r\xd4X\xae\\\xd5\x9a4J\n\xac\xd1\x9f\a\xa0\xf6\x97zr\x0f\x04\x00\x00\x00\x1f\xe0\f,\x9e\x13\xdf\xf4\xc3)mzB\xe0Y\xc3n|M\xc5\xf7\xd0\x94\xfb\x19\x9b\xefS\xf8zi0\xb5v\xde\xed\xccl\xe9\x0e-\xef\x9dN&%\x80A\xacn\x8c~7\x18\x94\x94\xd9\x8f\xd1\xe13\xd9\xa6\xb3\xa7\xf3\xcf\xb3,\x9b\xd8x\x94\xb7\x8f\xcf?\xda\v\xe7\xd2!\x8c\xa8\xe3F\x81\xee\x1c\x1c\xa7\xbcnU!R\xbc\x9fJ\xc1Z\xeeu\'\x7f\xc1\x1c\xcb\x04\xf34F[\xf7\xc8VK\xad\x90\x00'/307) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f00000001c0)={0x0, 0x2, 0x7610, 0x7}) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r3, 0xc0385720, &(0x7f0000000180)={0x0, {0x77359400}, 0x3, 0x7}) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000300)='/dev/rtc0\x00', 0x800, 0x0) inotify_init() write(r5, &(0x7f0000000580)="f948fac3e8138e6575ad4edf55ecc0fc2be24af7f0bbe4289ca12c041c5e5856280efc44d5bb9c5a41bacafaf22dd25d7d23f58bcab29ed095cbf2113045a5b08f42be8197d3c0670157f1a056eab215ec89e88d398a687986cbb714000001000000000054be58d73020f2f6af2b0f314f17ea", 0xffffffe4) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) pselect6(0x2b, &(0x7f00000000c0)={0x0, 0x4000000000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, &(0x7f0000000200)={0x0, r6+30000000}, 0x0) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:13:25 executing program 0: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x1c641, 0x0) r1 = socket$inet6(0xa, 0xffffffffffffffff, 0x1) r2 = fcntl$getown(r1, 0x9) ptrace$pokeuser(0x6, r2, 0x7fe, 0x2) r3 = creat(&(0x7f0000000380)='./bus\x00', 0x4) ioctl$PIO_UNISCRNMAP(r3, 0x4b6a, &(0x7f0000000fc0)="31d96da88b0cce5062747ce237ca24f05b05df66b34814c1cdb2db3642a7c880224c03d6cffd67b36c7f1a51ae9aeaa3892b040ba2105d77d4e4579d745ad601f19c26d1260bcd5435ae4ad35d123f7e809a7b0576431fde9f78c3260a3837b52ef6437c404147add96892a9d3a67dcf93c198c3b7727cd266c20c5e584c28ae0843064b8f7f199db8641f71a407775e0090bbedee63a4640e1f012e5ca95bd14b5aa0da642b552ae4aa2b869458dec283c16f25c67068fc528a793f75c81acac8ee6596d79c449ade5eeee332c460ebc0d46c076e871b6426d521c571a95d0fa800de30a110e719ffde8f103773daaaec8c313aa3be0bdaa6e7e796df3975a8e37aee6d10579f8afe6552f187c242c731375f5d64cd40ab8904400f00000000000000000000000000000058b4721949da012002cb7f4ac8fe195c1388861be8cd45020083b0089b23f86603321faf83e794bea1ece8051e9996306347bd562aa2437fa6bdb57086302926b8af069b8d331ebf5c0e1a7f163e6d711af330efdfae413fafef9acf1d53e6aaf4f2dec9ddfb4ca321583e35a14a92e82bdbea3c127a033b32059fbadce23a3e87957f8238886aa9380000000018888c4c20ba104342e8c9d85a9dcf06abbb7a2905d37839bff6f8641ebce172c60a8d368cd4a94af484749dc4ccdd380bbf5d501302d50e79d3536eab5a12abdd347dac985c4349ec712661df947315514e45a515417e6b00000000000000002bdacdb2631c83a90dbca3aa7e5936f8aa413a75c7780309e1c178bce65ed205154ab4f55241cd2b6e83b29fc6cefe050d7d662360718e25bbdb2d34264d6a741cbbed50422f5d") r4 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000880)={@remote, 0x800, 0x0, 0x3, 0x1}, 0x20) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r2}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000000)={@local, 0x0, 0x2, 0xfe, 0x3}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000040)={@dev={0xfe, 0x80, [], 0x28}, 0x0, 0x1000000000, 0x1, 0x3, 0x3b9}, 0x20) connect$inet6(r4, &(0x7f0000000500)={0xa, 0x0, 0x40f7, @mcast2, 0x7ff}, 0x9) r5 = syz_open_procfs(r2, &(0x7f00000009c0)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd0\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7\x95\xaeV\x0f\x9e\xed\x13\xc6H\v\xb7\xd0g!`\x18\x0f\x99\xadD-\xc8{\xbc\xb2\xb9Y\xe2P\x9b\xec\x1e_\xb4\x01\xf1\x1e\xa8\xf8\xdf?#p-\xbd3\"L\xe5\x7f\nC\x00}\x0eb\xbc\xa4}\x93\x9a\t\xf4\xfa\xbew D\x00\xb0Z\xc0\x1a\xf9\x924\a\x1c4\xfa\xe4\xe2\x8e\xe8\x19\x00\x05\xb7\xd51)\b\xf2#[-\xbf\x7f\x10\x14vy\x86\x85\xa4W\r\xe8i\x95\xc9\xe6\xf8\a\xd8\xe2\xdf\xc8\x97\xa2\b{b\xca\x95u:\v\x97\b\r@g\x80\x8d_\x18y\xd1\x8d\xc1)U`\xb9\xe2\xd7\x88\xc2\xaf\xdc\xc1\xda\xcc\xca\x9a\v\xact8Z\x1c\x06\x1b\xdf\xb5\xc1\"\x05,Yw\vP\xcc\xfa\xf9\x9f<\xbd\x1c\x1a\xcb*\x06\xb7\xcd\x7f\xba\xadr\xbb/\"2p\xf8\b\x1e\x04\xac*\x88\xb0\xa7\xc6\xb4M\x97n\xdck\xd1\\\x9f\x9d\x1a4 Y\xac\xcb\xf9f\xcf>qd\vn:\x12\xc0\xdca\xfd\x8d\x9dL\x92\x17\x8fe\xd1\xaa$\x12\x02R\x96t?\x9a\x1a') sendfile(r4, r5, &(0x7f00000000c0)=0x202, 0x8) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00') pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x10c800) r9 = open(&(0x7f0000000340)='./file0/file0\x00', 0x8040, 0x32) setsockopt$sock_linger(r9, 0x1, 0xd, &(0x7f0000000200)={0xfffffffffffffffe, 0xfffffffffffffffb}, 0xfffffffffffffed7) setsockopt$inet6_int(r9, 0x29, 0xcf, &(0x7f0000000840)=0x1, 0x4) sendmsg$NBD_CMD_RECONFIGURE(r5, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="040027bd7000ffdbdf25030000000c00050002000000000000002400070008000100", @ANYRES32, @ANYBLOB, @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r9, @ANYBLOB="0c00060002000000000000000c00020007000000000000000c0005002000000000000000"], 0xfffffffffffffe5f}, 0x1, 0x0, 0x0, 0x4000800}, 0x81) r10 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_CONG_MONITOR(r10, 0x114, 0x6, &(0x7f00000000c0), 0x4) r11 = accept4(r10, &(0x7f0000000340)=@can, &(0x7f00000003c0)=0x80, 0x80800) getsockopt$TIPC_SRC_DROPPABLE(r11, 0x10f, 0x80, &(0x7f0000000440), &(0x7f0000000480)=0x4) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r11, 0x28, 0x6, &(0x7f0000000040)={0x77359400}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r11, 0x10f, 0x88) sendmsg$NBD_CMD_DISCONNECT(r11, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="00000001ea9efca3cab2ee741f1ed18aefac93d0126d4e101d3df2d85cd7c12cab5a1443e6c04540a70e9d1674071177d278adf9396f839d2bd0a1691aae46a32282e8d850c639cce6465ae5c90e9602057d0bbb4d54a631d57fc62573bbcd0bc897dc9183b20c374c959dd8811127f3e4f48a37b54e0d901f6ff2052773427be4536b5fbaa6da40ba2c2043f5ff03b48c491f11683a55591890ccf239d3d9fab7c84edc7b1fe211627fb7848bdbcd4e0f759966871eb2", @ANYRES16=r6, @ANYBLOB="04002700000000dbdf25020000000c0006000200000000003f00"/38], 0x3}, 0x1, 0x0, 0x0, 0x40}, 0x4004000) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x44200}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="84000000", @ANYRES16=r6, @ANYBLOB="000a29bd7000fddbdf250500000008000100000000000c000800060000000000040008000100000000000c00030802000000000000000c00220000000000000000000c00060002000000000000000c0004eaffffffffffffff0c000300fdffffffffffff0000000000003f0c000800200000000000000037521b30b2b1dedd33235f105542292be8"], 0x84}, 0x1, 0x0, 0x0, 0xfaf0784a88b8abb9}, 0x10) r12 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x4, 0x100) r13 = open(&(0x7f0000000280)='.\x00', 0x2000, 0x70) symlinkat(&(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r13, &(0x7f00000000c0)='./file0\x00') r14 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r14, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") sendmsg$NBD_CMD_STATUS(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYRESHEX=r7, @ANYRES16=r6, @ANYRES64=r14, @ANYRES32=r12, @ANYBLOB="663e0100", @ANYRESHEX=r3], 0x6}, 0x1, 0x0, 0x0, 0x10}, 0x40000c0) r15 = socket$nl_generic(0x10, 0x3, 0x10) r16 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000140)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r15, &(0x7f0000000200)={0x0, 0x4a8, &(0x7f0000000240)={&(0x7f0000000180)={0x14, r16, 0x301}, 0x14}}, 0x0) [ 136.345388][ T9504] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 19:13:26 executing program 4: syz_open_procfs(0x0, &(0x7f0000000000)='\x00\a\x00\x00\x00\x00\x00\x00\x00G\xe3U:Q<\x16%\x98\xff\xf2\xda\xeb\x88i\x16\x02\xb5\x83\x19\xf3w\x18\xc7\x96\x05\x00y\x93\xd3W\xc4-l\xcf\xa5\xed\xc8RF\xf2.Ihm\xe2\x86\xd2\xf1\xd6\xb6\xff<\xa4}\xcb\x99\x9fq\x1dF\xe0\x05Y\xfex\x0f\x17\xf7s\xd51\xdf\xeb\x87tT&|i\xc9\xa8\x95\\\xf2\xb5\ay\xc8\xc8R\x92\xf1#\x9bsm\xf6F\x83\xd7\x13L\x94\xf8}\xc7m>\xe4]\xde\xfa=d\xc5\xf7\x115\xd7\xf3\xbc\x0f\xe3V\x9d\xf8\x8b|1\r\xd4X\xae\\\xd5\x9a4J\n\xac\xd1\x9f\a\xa0\xf6\x97zr\x0f\x04\x00\x00\x00\x1f\xe0\f,\x9e\x13\xdf\xf4\xc3)mzB\xe0Y\xc3n|M\xc5\xf7\xd0\x94\xfb\x19\x9b\xefS\xf8zi0\xb5v\xde\xed\xccl\xe9\x0e-\xef\x9dN&%\x80A\xacn\x8c~7\x18\x94\x94\xd9\x8f\xd1\xe13\xd9\xa6\xb3\xa7\xf3\xcf\xb3,\x9b\xd8x\x94\xb7\x8f\xcf?\xda\v\xe7\xd2!\x8c\xa8\xe3F\x81\xee\x1c\x1c\xa7\xbcnU!R\xbc\x9fJ\xc1Z\xeeu\'\x7f\xc1\x1c\xcb\x04\xf34F[\xf7\xc8VK\xad\x90\x00'/307) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f00000001c0)={0x0, 0x2, 0x7610, 0x7}) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r3, 0xc0385720, &(0x7f0000000180)={0x0, {0x77359400}, 0x3, 0x7}) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x44000102, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x18) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000300)='/dev/rtc0\x00', 0x800, 0x0) inotify_init() write(r5, &(0x7f0000000580)="f948fac3e8138e6575ad4edf55ecc0fc2be24af7f0bbe4289ca12c041c5e5856280efc44d5bb9c5a41bacafaf22dd25d7d23f58bcab29ed095cbf2113045a5b08f42be8197d3c0670157f1a056eab215ec89e88d398a687986cbb714000001000000000054be58d73020f2f6af2b0f314f17ea", 0xffffffe4) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) pselect6(0x2b, &(0x7f00000000c0)={0x0, 0x4000000000000}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, &(0x7f0000000200)={0x0, r6+30000000}, 0x0) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 19:13:26 executing program 3: ioctl$EVIOCGABS0(0xffffffffffffffff, 0x80184540, 0x0) r0 = socket(0x200000000000011, 0x3, 0x0) fcntl$setstatus(r0, 0x4, 0x2400) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', 0x0}) r2 = open(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0x0) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x0, 0x0, 0x0) prctl$PR_GET_FPEXC(0xb, &(0x7f0000000000)) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) rt_sigpending(&(0x7f0000000080), 0x8) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000002c0)=0x596, 0x4) open$dir(0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000d00), 0x400004e, 0x0) 19:13:26 executing program 0: syz_open_procfs(0x0, &(0x7f00000001c0)='oom_score_adj\x00') socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$NBD_SET_SIZE(r1, 0xab02, 0x580c6be9) lseek(0xffffffffffffffff, 0x8000000, 0x1) 19:13:26 executing program 1: syz_open_procfs(0x0, 0x0) ftruncate(0xffffffffffffffff, 0x800) ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x3, 0x6f, 0xffff, 0x401}) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000140)='/dev/vbi#\x00', 0x0, 0x2) ioctl$UI_DEV_CREATE(r2, 0x5501) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000180)=0x2000000000000074, 0x4) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r2, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)={0x154, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_LINK={0x78, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5f5f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1b2d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe8}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NET={0x28, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffffffffffd}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x800}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x17}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xc1f}]}, @TIPC_NLA_MEDIA={0x4c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x400}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x395}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffffffffff8}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9000000000000}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000040)={0x80000000, {{0x2, 0x4e22, @empty}}}, 0x88) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 19:13:27 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x12, 0x0, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x80000000}, [@call={0x85, 0x0, 0x0, 0x25}, @map={0x18, 0x0, 0x1, 0x0, 0x1}, @alu={0x4, 0x3f, 0x7, 0x1, 0xb93c861535959b9e, 0x4, 0xffffffffffffffff}]}, &(0x7f0000000040)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0xa, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x3}, 0x70) 19:13:27 executing program 1: syz_open_procfs(0x0, 0x0) ftruncate(0xffffffffffffffff, 0x800) ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, 0xffffffffffffffff, 0x3, 0x6f, 0xffff, 0x401}) socketpair$unix(0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000140)='/dev/vbi#\x00', 0x0, 0x2) ioctl$UI_DEV_CREATE(r2, 0x5501) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000180)=0x2000000000000074, 0x4) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_NODE_GET(r2, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)={0x154, r4, 0x400, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x80}]}, @TIPC_NLA_LINK={0x78, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5f5f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1b2d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe8}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NET={0x28, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffffffffffd}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x800}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x17}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xc1f}]}, @TIPC_NLA_MEDIA={0x4c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x400}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x395}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffffffffff8}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9000000000000}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000040)={0x80000000, {{0x2, 0x4e22, @empty}}}, 0x88) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) [ 242.421098][ C0] rcu: INFO: rcu_preempt self-detected stall on CPU [ 242.427741][ C0] rcu: 0-....: (10515 ticks this GP) idle=d96/1/0x4000000000000004 softirq=9945/9947 fqs=5250 [ 242.438119][ C0] (t=10502 jiffies g=9257 q=1457) [ 242.443207][ C0] NMI backtrace for cpu 0 [ 242.447504][ C0] CPU: 0 PID: 9527 Comm: syz-executor.4 Not tainted 5.3.0-rc8+ #0 [ 242.455279][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 242.465308][ C0] Call Trace: [ 242.468567][ C0] [ 242.471510][ C0] dump_stack+0x1d8/0x2f8 [ 242.475816][ C0] nmi_cpu_backtrace+0xaf/0x1a0 [ 242.480640][ C0] ? nmi_trigger_cpumask_backtrace+0x16d/0x290 [ 242.486809][ C0] ? arch_trigger_cpumask_backtrace+0x20/0x20 [ 242.492846][ C0] nmi_trigger_cpumask_backtrace+0x174/0x290 [ 242.498799][ C0] arch_trigger_cpumask_backtrace+0x10/0x20 [ 242.504709][ C0] rcu_dump_cpu_stacks+0x15a/0x220 [ 242.509798][ C0] rcu_sched_clock_irq+0xb95/0x16d0 [ 242.514995][ C0] ? trace_hardirqs_off+0x74/0x80 [ 242.520012][ C0] update_process_times+0x134/0x190 [ 242.525213][ C0] tick_sched_timer+0x263/0x420 [ 242.530044][ C0] ? tick_setup_sched_timer+0x2c0/0x2c0 [ 242.535560][ C0] __hrtimer_run_queues+0x403/0x850 [ 242.540735][ C0] hrtimer_interrupt+0x38c/0xda0 [ 242.545721][ C0] smp_apic_timer_interrupt+0x109/0x280 [ 242.551244][ C0] apic_timer_interrupt+0xf/0x20 [ 242.556203][ C0] RIP: 0010:hhf_dequeue+0x5a9/0xaa0 [ 242.561398][ C0] Code: 03 42 80 3c 20 00 74 05 e8 94 27 a0 fb 4c 89 73 08 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 7a 27 a0 fb 49 89 1e 06 fb ff ff e8 7d 2b 67 fb e9 fc fa ff ff e8 73 2b 67 fb 48 8b [ 242.580974][ C0] RSP: 0018:ffff8880aea09700 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 [ 242.589365][ C0] RAX: 1ffff11014fffb4a RBX: ffff8880a7ffd9b8 RCX: ffff888058916300 [ 242.597315][ C0] RDX: 0000000000000502 RSI: ffff8880a7ffda50 RDI: ffff8880a7ffd9c0 [ 242.605269][ C0] RBP: ffff8880aea097a8 R08: ffffffff860c5d6a R09: 0000000000000000 [ 242.613213][ C0] R10: fffffbfff117be8d R11: 0000000000000000 R12: dffffc0000000000 [ 242.621156][ C0] R13: ffff8880a7ffd6c0 R14: ffff8880a7ffda50 R15: ffff8880a7ffda40 [ 242.629106][ C0] ? apic_timer_interrupt+0xa/0x20 [ 242.634191][ C0] ? hhf_dequeue+0x15a/0xaa0 [ 242.638799][ C0] __qdisc_run+0x217/0x1b30 [ 242.643298][ C0] ? dev_queue_xmit+0x17/0x20 [ 242.647952][ C0] __dev_queue_xmit+0x1161/0x3020 [ 242.652978][ C0] ? ip6_finish_output2+0xdc6/0x13d0 [ 242.658252][ C0] dev_queue_xmit+0x17/0x20 [ 242.662741][ C0] ip6_finish_output2+0xff2/0x13d0 [ 242.667846][ C0] __ip6_finish_output+0x693/0x910 [ 242.672942][ C0] ip6_finish_output+0x52/0x1e0 [ 242.677767][ C0] ? ip6_output+0x25a/0x390 [ 242.682244][ C0] ip6_output+0x26f/0x390 [ 242.686608][ C0] ndisc_send_skb+0xa35/0xe40 [ 242.691267][ C0] ndisc_send_rs+0x4ec/0x680 [ 242.695837][ C0] addrconf_rs_timer+0x22e/0x5f0 [ 242.700748][ C0] ? addrconf_disable_policy_idev+0x480/0x480 [ 242.706785][ C0] call_timer_fn+0x95/0x170 [ 242.711261][ C0] ? addrconf_disable_policy_idev+0x480/0x480 [ 242.717299][ C0] __run_timers+0x79e/0x970 [ 242.721808][ C0] ? check_preemption_disabled+0x47/0x2a0 [ 242.727509][ C0] run_timer_softirq+0x4a/0x90 [ 242.732248][ C0] __do_softirq+0x333/0x7c4 [ 242.736762][ C0] ? irq_exit+0x227/0x230 [ 242.741069][ C0] irq_exit+0x227/0x230 [ 242.745197][ C0] smp_apic_timer_interrupt+0x113/0x280 [ 242.750725][ C0] apic_timer_interrupt+0xf/0x20 [ 242.755630][ C0] [ 242.758542][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xad/0xe0 [ 242.764934][ C0] Code: b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 0c 48 c7 c7 80 87 8a 88 e8 92 95 30 fa 48 83 3d 7a 94 0e 01 00 74 2d 4c 89 f7 57 9d <0f> 1f 44 00 00 bf 01 00 00 00 e8 54 90 d4 f9 65 8b 05 a9 0a 86 78 [ 242.784522][ C0] RSP: 0018:ffff8880589279f0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 [ 242.792909][ C0] RAX: 1ffffffff11150f0 RBX: ffff8880902a8880 RCX: dffffc0000000000 [ 242.800856][ C0] RDX: ffffc9000eba3000 RSI: 000000000003ffff RDI: 0000000000000286 [ 242.808814][ C0] RBP: ffff888058927a00 R08: ffffffff81790e74 R09: ffffed1012055111 [ 242.816780][ C0] R10: ffffed1012055111 R11: 0000000000000000 R12: 0000000000000286 [ 242.824729][ C0] R13: 0000000000000001 R14: 0000000000000286 R15: 0000000000000001 [ 242.832873][ C0] ? trace_hardirqs_on+0x34/0x80 [ 242.837861][ C0] __wake_up+0xe1/0x150 [ 242.842023][ C0] splice_from_pipe_next+0x2c0/0x460 [ 242.847289][ C0] __splice_from_pipe+0x127/0x8a0 [ 242.852292][ C0] ? user_page_pipe_buf_steal+0xc0/0xc0 [ 242.857817][ C0] do_vmsplice+0x1d4/0xdf0 [ 242.862255][ C0] ? __kasan_check_write+0x14/0x20 [ 242.867377][ C0] ? _copy_from_user+0x11a/0x180 [ 242.872312][ C0] ? rw_copy_check_uvector+0x313/0x360 [ 242.877756][ C0] ? import_iovec+0x122/0x2b0 [ 242.882414][ C0] __se_sys_vmsplice+0x165/0x220 [ 242.887324][ C0] ? check_preemption_disabled+0xb7/0x2a0 [ 242.893047][ C0] ? prepare_exit_to_usermode+0x1f7/0x580 [ 242.898735][ C0] ? trace_irq_disable_rcuidle+0x23/0x1e0 [ 242.904429][ C0] ? trace_hardirqs_on_thunk+0x1a/0x20 [ 242.909856][ C0] ? trace_irq_disable_rcuidle+0x23/0x1e0 [ 242.915556][ C0] __x64_sys_vmsplice+0x9b/0xb0 [ 242.920380][ C0] do_syscall_64+0xfe/0x140 [ 242.924856][ C0] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 242.930717][ C0] RIP: 0033:0x4598e9 [ 242.934589][ C0] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 242.954181][ C0] RSP: 002b:00007ff32d911c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 242.962567][ C0] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000004598e9 [ 242.970514][ C0] RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000008 [ 242.978458][ C0] RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 [ 242.986401][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff32d9126d4 [ 242.994344][ C0] R13: 00000000004c90c8 R14: 00000000004e0338 R15: 00000000ffffffff