0100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r5, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r5, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 719.252761][T26240] IPVS: ftp: loaded support on port[0] = 21 [ 719.275587][T26241] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:13:12 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0xc, [@func={0xa, 0x5}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x61]}}, &(0x7f00000002c0)=""/143, 0x30, 0x8f, 0x1}, 0x20) [ 719.343757][T26243] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=26243 comm=syz-executor.5 [ 719.344159][T26241] device bridge134 entered promiscuous mode [ 719.393142][T26248] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 719.406436][T26248] device bridge134 left promiscuous mode 19:13:13 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x10}, [@ldst={0x6, 0x0, 0x2}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/190, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd06, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) 19:13:13 executing program 1: r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$inet6_int(r0, 0x28, 0x0, 0x0, &(0x7f0000000040)) 19:13:13 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x15, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x179, 0x10}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) 19:13:13 executing program 1: r0 = socket$inet6(0xa, 0x802, 0x88) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000002cc0), 0x1a3, 0x0) [ 719.872742][T26240] virt_wifi0 speed is unknown, defaulting to 1000 [ 719.883699][T26243] netlink: 1164 bytes leftover after parsing attributes in process `syz-executor.5'. 19:13:13 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r5, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={0x0, 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r5, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:13 executing program 5: unshare(0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000003a40)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x2000aab8) 19:13:13 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r2, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 720.181089][T26264] IPVS: ftp: loaded support on port[0] = 21 [ 720.257657][T26273] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 720.354282][T26273] device bridge135 entered promiscuous mode [ 720.427713][T26278] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 720.517911][T26278] device bridge135 left promiscuous mode [ 720.835144][T10403] net_ratelimit: 5 callbacks suppressed [ 720.835158][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 721.096775][T26264] virt_wifi0 speed is unknown, defaulting to 1000 [ 721.103384][T26240] virt_wifi0 speed is unknown, defaulting to 1000 [ 721.763659][T26264] virt_wifi0 speed is unknown, defaulting to 1000 [ 721.875828][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:15 executing program 5: r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, 0x0, 0xfffffffffffffffd) 19:13:15 executing program 2: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r0, &(0x7f0000000000)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "00f40c442848cb166b002ee8dc4da7ae20d7c965d4fab6ad71c03cb2aa506b39b663e1c4c87d263fc05a6a042b6feba7da240eb2ca83e630e3b925b24361dc"}, 0x60) sendmmsg(r0, &(0x7f000000bdc0)=[{{&(0x7f0000000180)=@xdp, 0x80, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) 19:13:15 executing program 1: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000003e00)={0xffffffffffffffff}) getsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, &(0x7f0000003e40), 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}, @IFLA_OPERSTATE={0x5, 0x10, 0x5}]}, 0x3c}}, 0x0) ioctl$SIOCRSSCAUSE(r2, 0x89e1, &(0x7f0000000040)=0x816f) r3 = socket$inet6(0xa, 0x3, 0x9) recvmmsg(r3, &(0x7f0000002b40)=[{{0x0, 0x40000, 0x0, 0x0, 0x0, 0x40000000}}], 0x4000000000003be, 0x0, 0x0) setsockopt$inet6_int(r3, 0x29, 0x4a, &(0x7f0000000480)=0x4000000000007, 0x4) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x1c) r4 = socket$inet6(0xa, 0x3, 0x9) recvmmsg(r4, &(0x7f0000002b40)=[{{0x0, 0x40000, 0x0, 0x0, 0x0, 0x40000000}}], 0x4000000000003be, 0x0, 0x0) setsockopt$inet6_int(r4, 0x29, 0x4a, &(0x7f0000000480)=0x4000000000007, 0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, &(0x7f000095dffc)) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e22, 0x1, @mcast1}}, 0x0, 0x0, 0x5, 0x8, 0x22, 0x7, 0xff}, 0x9c) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0x0) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r3, 0x8983, &(0x7f0000000000)={0x1, 'vlan0\x00'}) sendto$inet6(r1, 0x0, 0x0, 0x0, 0x0, 0x0) 19:13:15 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r5, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={0x0, 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r5, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:15 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, 0x0, 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:15 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000000c0)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0}}, {{@in=@dev}, 0x0, @in=@multicast2}}, 0xe8) 19:13:16 executing program 5: r0 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r0, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback, 0x5cc}, 0x1c) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000e80)=@raw={'raw\x00', 0x3c1, 0x3, 0x408, 0x118, 0x0, 0x0, 0x118, 0x0, 0x338, 0x338, 0x338, 0x338, 0x338, 0x3, 0x0, {[{{@uncond, 0x0, 0xf8, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}, {{@uncond, 0x0, 0x1e0, 0x220, 0x0, {}, [@common=@rt={{0x138, 'rt\x00'}, {0x0, [], 0x0, 0x30, 0x0, [@local, @remote, @dev, @empty, @ipv4={[], [], @broadcast}, @remote, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @ipv4={[], [], @multicast1}, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @ipv4={[], [], @broadcast}, @mcast1, @mcast1, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @loopback, @mcast2, @dev]}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x24a) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r1, 0x8982, &(0x7f0000000080)={0x1, 'virt_wifi0\x00', {}, 0x7acc}) [ 722.471261][T26343] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:13:16 executing program 3: r0 = socket$inet6(0xa, 0x5, 0x0) sendmmsg(r0, &(0x7f000000e080)=[{{&(0x7f0000001080)=@generic={0xa, "2179e5cac77594fa95229d9dc215c2466491a99c0dfc7a3c7ffb0ff828f444652d2d2906cf3adf85f0733341edc768785a4fa9ed1be7b06bb051dbd7bed2c3c571c8d4cb312823a31e172e64d6ab302a5016daf82dae7558e864f12677d3114ff3655168250ebf2bade4fec2f771a095eefe6d711596a8e00c39d6b06f9f"}, 0x80, &(0x7f0000000040)=[{&(0x7f0000001180)='d', 0x1}], 0x1}}], 0x1, 0x41) 19:13:16 executing program 2: r0 = socket(0x22, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000200)={0x0, 'caif0\x00', {}, 0x6}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)={0x8, 0x30, 0xad9, 0x5ff, 0x2a8, 0xffffffffffffffff, 0x200, [], 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x3}, 0x40) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000380)={r2, &(0x7f0000000280)="b80b76df13cfa56865c3da0098bd378456f667b26ddbbaf8fddbc25ea4b645be323a2082241d2e5c0dd6436e9d754cf5944480e6517ed1f7cdd35740aa21fc4bb04326285522d8dea6884e6421533ba4d8c92bf64c3ea4cc665096e72b9e253ae9f298dcde4dec02840927278cfa0642007d963b0fcb6c5183b692066cef71d408455e087fc22327e4d69a4bfc702312aa0f18cb3806627ba7c889851e37", &(0x7f0000000340)=@udp=r0, 0x1}, 0x20) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040)='devlink\x00') sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="02002abd7000ffdbdf253d000000080001007063690011000200303030303a30303a31302e30000000001c008200736f757263655f6d61635f69735f6d756c74696361737400080001007063690011000200303030303a30303a31302e30000000001c008200736f757263655f6d61635f69735f6d756c746963617374000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c008200736f757263655f6d61635f69735f6d756c74696361737400080001007063690011000200303030303a30303a31302e30000000001c008200736f757263655f6d61635f69735f6d756c74696361737400"], 0xf8}, 0x1, 0x0, 0x0, 0x80}, 0x40) [ 722.530453][T26343] device bridge136 entered promiscuous mode [ 722.554459][T26351] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 722.612938][T26351] device bridge136 left promiscuous mode [ 722.630341][T26358] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 722.639166][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:16 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1, 0x31, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_DATA_DIR(r1, 0x0, 0x3, &(0x7f00000000c0), 0x4) [ 722.906538][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:16 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r5, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={0x0, 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r5, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:16 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, 0x0, 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 723.405726][T26358] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.414132][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 724.220164][ T17] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 724.237458][T26381] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 724.259071][T26381] device bridge137 entered promiscuous mode [ 724.267835][T26385] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 724.279496][T26385] device bridge137 left promiscuous mode 19:13:17 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, 0x0, 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:18 executing program 3: sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00008feff0)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x4, 0x0, &(0x7f00008feff0)={&(0x7f0000000280)=ANY=[@ANYBLOB="020d0000100000002f3144e800000000030006000720000002004000e0060000000000f5000000000800120002000100000000000000000030006c000203009f7eae02000000adb20200000000152c000000160000000001020014bb00f2e4f18500000000000300030005000000000002"], 0x80}}, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmmsg(r0, &(0x7f00000000c0), 0x4000676, 0x0) 19:13:18 executing program 1: r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=@newqdisc={0x8c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb, 0x1, 'taprio\x00'}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x5}]}}]}, 0x8c}}, 0x0) 19:13:18 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:18 executing program 5: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100)) ioctl$PPPIOCSPASS(r0, 0x40107447, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu_sys\x00', 0x26e1, 0x0) write$cgroup_int(r1, &(0x7f0000000080), 0x15d4b87) ioctl$FS_IOC_FIEMAP(r1, 0xc020662a, &(0x7f00000000c0)={0x0, 0xfffffffffffffffa, 0x0, 0x0, 0x1, [{}]}) ioctl$TUNGETFEATURES(r1, 0x800454cf, &(0x7f0000000040)) 19:13:18 executing program 2: pipe(&(0x7f00000000c0)) r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket(0x11, 0x0, 0x0) getsockopt$kcm_KCM_RECV_DISABLE(r1, 0x107, 0x13, 0x0, 0x960000) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000100)={0x0, @in6={{0xa, 0x4e24, 0xff, @private1={0xfc, 0x1, [], 0x1}, 0x8}}, 0x9}, &(0x7f0000000080)=0x90) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc}, 0x10) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc}, 0x10) sendmmsg(r3, &(0x7f0000000a40), 0x8000000000000b0, 0x0) r4 = socket(0x1e, 0x4, 0x0) socket$inet(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000040)={0x0, @local, @local}, &(0x7f0000000280)) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x3, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x8}]}, &(0x7f00000000c0)='GPL\x00', 0x2, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffed6}, 0x56) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES16=0x0, @ANYBLOB="08022dbd7000ffdbdf250000000008000100", @ANYRES32, @ANYBLOB="7400028038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004007f00000038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400ff7f000008000100", @ANYRES32=0x0, @ANYBLOB, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276", @ANYBLOB, @ANYRES32=0x0, @ANYBLOB], 0x1d0}, 0x1, 0x0, 0x0, 0x2001}, 0x20000000) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x0, 0x2}, 0x10) sendmmsg(r4, &(0x7f0000000a40), 0x8000000000000b0, 0x0) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:13:18 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x34, 0x0, 0x8, 0x101, 0x0, 0x0, {}, [@CTA_TIMEOUT_DATA={0x4, 0x4, 0x0, 0x1, @fccp}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x6004}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x84}]}, 0x34}}, 0x0) [ 724.829576][T26414] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 724.904336][T26414] device bridge138 entered promiscuous mode [ 724.938611][T26426] netlink: 'syz-executor.4': attribute type 25 has an invalid length. 19:13:18 executing program 3: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000)={0x9, @null=' \x00'}, 0x12) ioctl$SIOCX25SDTEFACILITIES(r0, 0x89eb, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x8, "6f248024338557f1744b18c2c8269520d1da992c", "3994b11d6194ad8dc870d2a8672f6503f3984d27"}) connect$x25(r0, &(0x7f0000000080)={0x9, @remote={[], 0x2}}, 0x12) [ 724.983726][T26426] device bridge138 left promiscuous mode [ 725.076240][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:18 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(0xffffffffffffffff, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:18 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0xfffffffd) syz_emit_ethernet(0x52, &(0x7f0000000080)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a3ff2", 0x1c, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x7, 0x2, 0x0, 0x0, 0x0, {[@exp_fastopen={0xfe, 0x5, 0xf989, "b0"}]}}}}}}}}, 0x0) [ 725.233765][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:19 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x14, 0x3, 0x1, 0x401}, 0x14}}, 0x0) 19:13:19 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:19 executing program 3: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x100000002272, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mmap(&(0x7f00000dd000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) 19:13:19 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0xf000) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x2, 0x0, @broadcast}}) ioctl$BTRFS_IOC_SNAP_CREATE_V2(0xffffffffffffffff, 0x50009417, &(0x7f0000000300)={{r0}, 0x0, 0xa, @unused=[0x80000001, 0x1f, 0x9], @name="5b9f18206a353698443aab84c1b03f0e56d8a2b71b9eb657fe3c934d1caa4399527bf296e547471ab4d04dda52f67064f235ccdb03f776fb984d8b68cd477749185716c385a82745c9fec179301466ba79013a3b9baa78d3d5cf38b9dd300798cd300bfb94fb4c6017f3902ef1d580210cd7c3712bfa9b14a56fc694069a8a611a2178d8dcc3a9bdcd05a45226406e9b7072dc81247b08080b53b17777a8e5849c8a9b45ed4b3baef3b3c8516f1fbf518fe290b1a3f5ca9dba0f4e5d0ad08681da21a752b96e55efffea288348003e1ae8e7061b5a75549bdf648a6c4b4c5dd0239be8e0ceda91cfef9b8553f9c5d50f8baa740789b7fcccdc2feb8690201ec97803061087423c19ee83832b278db66d68b82d1401e780451e5f2c787ba1f6c787a3dda795b7d888421968fb874a2262347b255f84d084f14578412cfc6a0df2795e59953698f0d6336636fb89eaa4054fca9b6f1bf7d0ca8d8016468c0eb4b754c3519714bbe204745a5028c44a603f0d727a5a6c06f8df9aea7f9c08a029f22f3b6052113464e934947898d1cc19f2cf06fcd3b40f8eb433fc9a38276ca3e50e979a74a48957e60355427b6a7ce69f941c2ddf393c225b032d9daec472cc28679e54859e6c8dd955ca8b1a06229260ff839b4d4b4398033066680ee3f1b92fd415db41c9ca0617c0d329e3b2d092bd2362afe5f416f346600de8f130033144ef423ec10c631c3cc1d17e21c344c170c6a943c1edfbd8755f0ebdd89728fa0ffc565bb4a9da35649e7a63a939282a2e7834c8c181570b564f323cb63d32f0107e0c887e63d8a67305c93ac9cbd663b7ac7c70793b3ab75b544032bf8ea77b00a468eb06a5518f15043805d8f7cb1c0a90f67b6c35ca13e04107a76dd207e3b3baff095fa1b321acb0e8c5d29278051b27fc176349882ffd36c0fd45e04816324ae5ca817bdb5558b2f575cb4d8d271ce649d3351e1c5c2db63b0e20ac7115b4cf9f17c1da869d394f935b8f844493d8ff2b0f7f80398132481c5e91b59084ad82785b7711f5016608d5b98e4e518c29a2b196ffbcd1d2116b714aa18c97552f48bfa89c312fc4e6fa285e5811ef54c1267ff4e2b7d600d74b102e88f149c59b926dfbfc2f43ead760879105d9d642e3f60271b52afe7515c929e6aff596f94eca6115969c1327faf2d486357c13417bbaf214113560a583a2f04fcbeaea9fdbbab38cf7bc7853a5ded86b594d4514e3b8d17cecee2596ae7431b18079ed93a3ad6d9e11240d5255faaa032fb7f569182ee05f8e2f25a56624f115c13da06b7e7a81914dfb3a5e63636cbb8730844e66fde655e5784ba6e2d8c93b01d901457be037e0e7f10021d1870763d36a0db022264afa84c8d3663824ce30642fad37c314607d21b3e522b5c7c1b5305ecf8353b47e4b0f879fa93462a30de0fbf2369ac03c253b8814b8d567adedb51d7336e94c769fe2d9538ac81497d623cbdd18bb5f7b05924f44af56a1d72a35ab84aac51e2dbb4640c7471b3ec89674f6920517f8d2443a7f311635e8f20d987f88541db1794609ad8f598707dac5b638ad5831bef9b42074529c675420121310ab5a6585fe747af294eeb3b39bb0028147541039138626c724893429d8daeaa9a41b0cd8762e20692f64a18837604061a706e825b65ec266d699aa305fbae098a05718fbeafacd88b395b3a3952c4a2eab85f2cfe8ecfa360860aa1bdea133cdf60bd5725ba415b204e162d82f7436da4ec16b2230a99b37ea7f1620eaa0c3dd34c95ebf2bc4c7a9e3e25975c40795797501cd397effc6ebdcf75b29d76e5a6d230e1ce494724457e5416f1176ce9a273227068964387a68768dda5c6f265b685fb618e76ffa86ccd077f8720068e0c530312d3d7aa5cc3b422d50f0f757e5c683bba8c88fd1000c524281a733939930d4b89cdc59157838727653b06633d7a68d6e7fb1b2dc6cf67429e77783a9035cd547ecd380fba3bddd6c4f3b45a189d8c42a4b13abc9b0243d39525d0f87d081a3f3e66ded0cca33902a56760e6ddd54a323c0db39c894230c593b9b802ba5cb377c12cb87e1b746db58748b0eef798f428f3ec44bd5da20cdb6d5dbcc5f1b20609ab943116dc9220559dc0ddb5e2c2b4467f04b82bed9c1dd50a40736acde6348b343e05179c002074645c5314b381ac7dbfeb38e64781291bed02465d9485cb29fee54c47c634479b6c876754938a7d8554d5183e8004dceaeb2a88cd456089f22ca796590ad6bef863eb92731c7af4883e5ac888a2c6ce4768ff3fed753d7fc1e7ce4eecb5a14c528a92f95e8b10c67be04127b3beecbc33a8aeb878afeb4be48cefab7452bb1a6cacbbea2b85488079b661a8ec73c6b05f9aa18d1ba981cdedb231d57e649e13b7322456aa80758d5c0a55fb4f6b95a8d1732313bc4a68bacd4e2ba8f5a3de6bf73ae5cad933b50259d01113f01d44c348e0c103c1170c1e453c9524a729cffa901dfaeb6b609c03c6d722f7131d6f887a6e1136d1cc0d4312c8ca6aa4425b05a878004c216447ebb60ae2ddb1f017397bbe9dbf17c7ae49fbaabe69f899b80733bdaafc698a73e6788124af8d92e6726dc8ef8ebab23876943787efa1f1feacde5cf9c494fb18bd1fee2f63d2d39904d48fc03c0bdaa3cb116bc64ac4e75096440a06762584477e61902105732233f5534391ffd2f10e4336d47684bf5a464599e96fa12e2f25d6bd6303df43d12fb289e3dcc27837e84b934d8e0bf5b037e9955e9a16fb6801cd786a3b3ef57f39b24bc1a55d904d8dc10729cfe742c2f2cd0e0c79864126b33fa2b869596fb51b210a7eb3205b1f011971270820ce3bfb2b984c951b1c5ea34ec2f66741bfb97da38fc5fef368637acb322da603c3c656723dd1cf0804b7063f7f207c66f3e6831099623003067e27cface2b350f9265dccc0c46f8ca6b0bbd73de7ef7bc7aa968374917a60ee1b808d920cb23b8c1fc33c002e96a5617d768ee598ffa3cd4e0fc3b72ed054827b2f93e14de336ffe2f41d7930d2d4ff8d77118afc94bc9246106c834650541abb4f717d46ec68cba779cf51eaaaf6936d7e83a81becb504b4373130b4622ce68ea9280354f95cda2a90181675765fdef32c7089fe1606aecc7e8f42848e779c38d7d3b536b917e496cb8c3ceebb03e8a103f9b1585183a63f8f3665acc4e2263c7297bc8253ddac1acf77ddc658eeb5a39f7acfe2cff49484fc5ab639c9b0c4ae1c90f104dbd5b65ddd24d5a41c9973edf0d6c58818e57f696f27e550e58b526d61d38daac9721ad2427a5b8f2d1946bb80719fcdf6b37e3df9a6bd91c830a3a2df0103c30c9695979536a16f7ce5d18a1f5754c503d558fba84daa216578716ec08957a00393f61843b84bc76af1c8da66e59ec42b9537171c7fcc06effaac9dd762bc39669d564a4d442a2e42b9de8ea1c7f291f67a0ba219d788316965b8cbd402bb2ffb9ea70361058e2a890717ff4bc90622c8dc20632f7497d6a1822a72ce3ddc5048dafdff52b289490ab40bd3b73963d64c3c4a188c2edfdeee9e04e6e44ade27dd00ddfc85191fc55de3015c03200ac051a7becbcd595bba88d1169dff32c85deec5a4cc6e81a95050c518c67b950b3c33c154e00028f68b01acd6f1af07f0857f6ba872267d346ed726b2059d148be6f4393725f35ce91eaf882847c501a8a7eeb4ef796981e352ace49f46f192077b04cc50033b24fc9062e5595c455174fac8c79bbf6de61f79296a2f77ae3fb9d416f77a7928ed1a8bda617fe09a03c8522514cb84e3ed343b9396bb6865054a9ba52e47ecddb1d5a49f30d56f0c33d4b4dd8289deee2a062ee6dae32f5ab9abbac3b8dcb6d728245e7f1b8247932d06f969c8bf248098a57abb911f9184593a710cdb110e6be608d9ad156f5b552480504f07d3b3d7de197ad571fb736a8c56baecd1c5052db5dd81e23471ba741685041d3bc24ed3e3ced21a57c4430e8920de549d82134bb11637c7ecfdf09a20dbc4542868207c4d17b18eea5deaeb60504209259b27a88c19f9410d63249d5996efb4a054069dd11341fd653bc7c294e4789c7349ebc42fcbad037182abe7f296d350cb1a3d3800d91939d6c35a230ae99dd048210ad74336f4f47bd7915b2bea835621d9cce3846c4795112cf06229c1bf05a352b52b917efc6c37398a6978c857324ab5ed237f21528a60baf4c650f8d88a367e321c884b6b975839a3b8b269af4ec9d1206f12ef9f5037e5f92d21f1328e90dfdb945caf9565583ee7044082910e63255e4286144b938ba4011347b686ca5ab9ed9b601f72e08e4dcf8625bc525983e5260abbd056990a33bd737a394de04daef1c37bba705434ca9280ead979b9529ce4c5c50a10ebc3c0b53a0e0717f09e30f45f4c1bf64f83c14225b9982d52e7121040c84177ec52596654a819f897736c115ff98b9c2303f32afa8ae2c33e313fb86d7d701c622c380e40e32edaa4b5bb2a562e8bdab610d87252239068f988ba57780ba21e2bb67164a5e702debc8d47dd29dc931bcfbd58f1f20ad1a073f52cbc371ef42bd0fb8e3b2c60e3dd13825de112101f8437e3bcf0463b4bc1a015e5dc183c0164d5c6dfd7e3628670a6b9330a0d899eb9f0c0187ffce57416474a25c3b8d888332c20b0a3ec5eec37cf56400310282aa37c68faa044e7fc840954399817919f064dc3bda88921d0801b363abc5e3f1a5f622b41c6ea8a63a3169f622f9a68e6661173d65eebbb5be654ca50f8cadeaea7365b1f15d9ca5e562fc44218d268c6f1784b073bde8c74750f17fc4fd61e4a33ac6e0ccd8cd9bc372459c240052ecb95f3f74701a42b694760b0547b6973a53809602cd23f1ca772f31cd627677dd01ab5140bb3d2a275998e94b052d39204f31b8edb1ece4cd6c77f0093e5ae3d2e80710b851b86d6736e23bdd0e0dbf2bc079d63a7662dc34434983dcf85f1eb29596b0b3deffb3fc92c09c120bd2f5f30f5e0ad582b03cde5ec927086268e79d123cb2dc07aa9cea479c99a0f416537c4f47a65ab1a1cb4a61e8285336382317ab504275db1014dc086ba87865620530d265e8777665ae2d11f49ec56a9cf3dce7a8748147ef8dbbcf243f67b067c4a0e5bbe405aea9f7e5c5a498a28a37edf1a3232da6c326d904128a0d9b1ed88e1dba77fb61a8d518aeede08e44e070bb674e33de01b8047c6279c74c35b85cbbf9f2fdace89c7ec8d951299fd952a407394910bca1566d0363498112401257383642f9e8656317d6adfc880a0b4f11b2509f15574f53fc6e8356e4aeb21f3ef39d9419474267fa679a9b1af53663e5e4c1f2e33d561f8495c9df8fa535825b47db5ef7a338d80038b98c2b4b42898c8d16d5cbc62120e02169ca269ea4da0032185a0e1241fb2857b7f187ee64636505953a5fff890c78b0081c9a0d0664583a1c5b298c127a3fc5d0f60aca063ae8221c7e2ed2e6f5ad8e15377d87ce664336df7cf4aafc811646cf1f44c69ba33df047d3a7c7ef447397bb61bb0998d48cba982969b2d8ab12a6a245a7cea71c98f17f8297b3d6e93bf220afa0433909c361605d70e8fb6f60aab693e3bd6e2f5fea225a093b11d65834873f9ecfae66ff8ff2acafc2aefef213e8c546c634cd39e4a74ec6a95b224bde1efeed07cf08b1f6568b65f62427209731f59c80d2b2722aacfcd3"}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) write$cgroup_int(r2, &(0x7f0000000200), 0x806000) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, 0x0) 19:13:19 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) recvmsg(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0}, 0x3) 19:13:19 executing program 2: r0 = socket$inet6(0xa, 0x5, 0x0) sendmmsg$inet(r0, &(0x7f0000004740)=[{{&(0x7f0000000040)={0x2, 0x0, @remote}, 0x10, &(0x7f0000001300)=[{&(0x7f0000000080)="f2", 0x1}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) [ 725.979442][T26449] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 726.074423][T26449] device bridge139 entered promiscuous mode [ 726.145949][T26454] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 726.174476][T26454] device bridge139 left promiscuous mode [ 726.283915][T10898] net_ratelimit: 1 callbacks suppressed [ 726.283925][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:20 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00'}) socket$netlink(0x10, 0x3, 0x0) write$tun(r0, &(0x7f0000000140)={@void, @void, @eth={@broadcast, @local, @val, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x32, 0x0, @empty, @empty}}}}}}, 0x2a) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x30, r4, 0x209, 0x0, 0x0, {}, [@FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @ipv4={[], [], @multicast1}}]}, 0x30}}, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, 0xfffffffffffffffe, 0x1, 0x0, 0x0, 0x4}, 0x40000) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x10005, 0x0) 19:13:20 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(0xffffffffffffffff, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:20 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:20 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000028fc8)={0x0, 0x0, &(0x7f0000019000)}, 0x0) recvmmsg(r0, &(0x7f00000038c0), 0x3fffffffffffdf5, 0x62, 0x0) 19:13:20 executing program 2: r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000000), &(0x7f00000001c0)=0x4) 19:13:20 executing program 1: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) setsockopt$ax25_int(r0, 0x101, 0x9, &(0x7f0000000140), 0x4) [ 727.148093][ T117] tipc: TX() has been purged, node left! [ 727.154543][ T117] tipc: TX() has been purged, node left! [ 727.164151][ T117] tipc: TX() has been purged, node left! [ 727.180952][ T117] tipc: TX() has been purged, node left! [ 727.187478][ T117] tipc: TX() has been purged, node left! 19:13:20 executing program 1: socketpair(0x8000000000001e, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x100000002) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, 0x0) sendmmsg$alg(r0, &(0x7f0000003240), 0x492492492492619, 0x0) sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, 0x0, 0x1) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) close(r1) [ 727.278983][T26491] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 727.317613][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:20 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ifreq(r0, 0x8922, &(0x7f0000000040)={'bridge_slave_0\x00', @ifru_mtu}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = accept4$nfc_llcp(r1, 0x0, &(0x7f0000000000), 0x800) accept$unix(r1, &(0x7f0000000100)=@abs, &(0x7f0000000180)=0x6e) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, &(0x7f0000000080), &(0x7f00000000c0)=0xc) r3 = socket$inet_dccp(0x2, 0x6, 0x0) setsockopt(r3, 0x0, 0x82, 0x0, 0x0) getsockopt$inet_int(r3, 0x0, 0x3, &(0x7f00000001c0), &(0x7f0000000200)=0x4) 19:13:20 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 727.394200][T26491] device bridge140 entered promiscuous mode [ 727.535125][T26502] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 727.558464][T26502] device bridge140 left promiscuous mode [ 727.625288][ T8223] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 727.648824][ T311] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 727.655945][T26511] IPVS: ftp: loaded support on port[0] = 21 [ 727.659780][T11211] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 727.674308][ T8223] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 727.970558][T26518] IPVS: ftp: loaded support on port[0] = 21 [ 728.126753][T26507] bridge_slave_0: mtu less than device minimum 19:13:21 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(0xffffffffffffffff, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:21 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 728.248943][T26518] virt_wifi0 speed is unknown, defaulting to 1000 19:13:21 executing program 2: r0 = socket$phonet(0x23, 0x2, 0x1) sendto$phonet(r0, 0x0, 0x3, 0x0, &(0x7f0000000100), 0x10) [ 728.355594][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 728.376493][T26516] IPVS: ftp: loaded support on port[0] = 21 [ 728.561164][T26535] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 728.622924][T26535] device bridge141 entered promiscuous mode [ 728.755306][T26544] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 728.780910][T26544] device bridge141 left promiscuous mode [ 729.282406][T26511] virt_wifi0 speed is unknown, defaulting to 1000 [ 729.290148][T26518] virt_wifi0 speed is unknown, defaulting to 1000 [ 729.546647][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 729.960690][T26511] virt_wifi0 speed is unknown, defaulting to 1000 19:13:23 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.current\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x80000000}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='pids.current\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x40086602, &(0x7f0000000140)) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x7a05, 0x1700) sendfile(r3, r2, 0x0, 0x100000001) openat$cgroup_subtree(r3, &(0x7f0000000000)='cgroup.subtree_control\x00', 0x2, 0x0) write$cgroup_int(r1, &(0x7f0000000080), 0x87f1a7) bpf$PROG_LOAD(0x5, 0x0, 0x0) 19:13:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=ANY=[@ANYBLOB="4801000024001d0f0000000000ff000000000000", @ANYRES32=r4, @ANYBLOB="00000000f1ffffff0000000008000100726564001c0102001400010000000000000000000000000000000000040102"], 0x148}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8, 0x1, 'hhf\x00'}, {0x4}}]}, 0x30}}, 0x0) 19:13:23 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in=@empty, @in=@private, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x0, 0x3c}, 0x0, @in=@remote, 0x0, 0x0, 0x0, 0x6}}, 0xe8) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0xfe80) 19:13:23 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:23 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, 0x0, 0x0, 0x40012500, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 730.284005][T26579] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. [ 730.373216][T26581] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 730.419610][T26581] device bridge142 entered promiscuous mode [ 730.468046][T26595] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 730.495572][T26595] device bridge142 left promiscuous mode [ 730.587137][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.148064][T26584] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. 19:13:24 executing program 2: bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$rxrpc(0x21, 0x2, 0xa) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x13, 0x10, 0x3}, 0x2c) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0x9, &(0x7f00000004c0)=@raw=[@generic={0x42, 0x7, 0x6, 0x1000, 0xd7}, @generic={0x94, 0x5, 0x9, 0x54, 0x2}, @alu={0x4, 0x0, 0x2, 0x3, 0x7, 0x100, 0xfffffffffffffff0}, @ldst={0x2, 0x3, 0x0, 0x2, 0x3, 0x4, 0x1}, @generic={0x7f, 0x4, 0x2, 0x6, 0xffff}, @alu={0x7, 0x0, 0x9, 0x1, 0x6, 0xffffffffffffffff, 0x1}, @exit, @map={0x18, 0x2}], &(0x7f0000000440)='syzkaller\x00', 0x5, 0x90, &(0x7f0000000200)=""/144, 0x0, 0x0, [], 0x0, 0x15, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x78) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='pids.current\x00', 0x275a, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x2011, r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) setsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, &(0x7f0000000080)={0x6}, 0x2) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='cpu.stat\x00', 0x275a, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000003c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="c8000000", @ANYRES16=r5, @ANYBLOB="020025bd7000fbdbdf25090000000c00038008000300010300000000028014000100ac14140e00000000000000000000000006000f000900000006000f000100000058000380080003000400000008000500ac14142208000500ac1414100600040000200000060007004e240000080001000200000014000600fe8000000000000000000000000000aa080003000200000008000500e0000002080004000000000008000400020000000800050009000000080005007f0000000800040001000000"], 0xc8}, 0x1, 0x0, 0x0, 0x41}, 0x0) write$binfmt_script(r3, &(0x7f0000000300)=ANY=[@ANYRES64=r0, @ANYRES64=r4], 0xfffffd9d) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x300000a, 0x2011, r3, 0x0) mmap(&(0x7f0000a35000/0x400000)=nil, 0x400000, 0x1, 0x2013, r3, 0x0) mmap(&(0x7f0000147000/0x1000)=nil, 0x1000, 0x0, 0x2013, r3, 0x0) connect$tipc(r3, &(0x7f00000002c0)=@name={0x1e, 0x2, 0x1, {{0x42}, 0x800003}}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000018c0)={'team0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000680)=ANY=[@ANYBLOB="5c00000010000507000000000004000000ecfc00", @ANYRES32=0x0, @ANYBLOB="0940020000000000280012800b0001006d616373656300001800028005000600000000000c00010000000000000010000a000500140000000000000008000a00", @ANYRES32=r6, @ANYBLOB="f4a030c9e57a7ad7ff59974ffc82b6f025b95287a64c59c776d3d5d81821e9492ea541c101ffabad925b857089d4c444ac9b1649e975e4d0189fe3bf77622b4c"], 0x5c}}, 0x0) 19:13:24 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, 0x0, 0x0, 0x40012500, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:24 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000380)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000014c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff0000000009000100686673630000000008000200000000005b47b4b04fed4e2a21ad8beb06b167de4283ffaec56d159e56a166c9db835a8808a86292f4bea321847a42767a7b89b65e4841c9695825a4b10dd5cb8b24f89f29ceef0a428124dcefb40b6b8ce6222864e92d22b053bda211a0aa613e4d66c8a0490480cbaca2b1216ca5637c028cbe0af4fd21ed36a2ddd56830044f3ead6d80d6f3f39955a2bb6662c29c913e8356d5a58ddb4293241f2ed955ffa0b9"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=@newtfilter={0x40, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0x4}}, [@filter_kind_options=@f_matchall={{0xd, 0x1, 'matchall\x00'}, {0xc, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x6}]}}]}, 0x40}}, 0x0) r3 = socket(0x1000000010, 0x80002, 0x0) sendmmsg$alg(r3, &(0x7f0000000200), 0x4924924924926d3, 0x0) [ 731.395376][T26613] netlink: 'syz-executor.2': attribute type 5 has an invalid length. [ 731.466077][ T6840] net_ratelimit: 1 callbacks suppressed [ 731.466088][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.474332][T26613] device batadv0 entered promiscuous mode [ 731.546193][T26613] team0: Device macsec1 is up. Set it down before adding it as a team port [ 731.611569][T26613] device batadv0 left promiscuous mode [ 731.635147][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 732.460865][T26638] netlink: 'syz-executor.2': attribute type 5 has an invalid length. [ 732.487432][T26638] device batadv0 entered promiscuous mode [ 732.496015][T26638] team0: Device macsec1 is up. Set it down before adding it as a team port [ 732.517017][T26638] device batadv0 left promiscuous mode [ 732.668017][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:27 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") writev(r0, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100070c10000000000001400000", 0xfe9f}], 0x1) 19:13:27 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, 0x0, 0x0, 0x40012500, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:27 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ip6erspan={{0xe, 0x1, 'ip6erspan\x00'}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_IKEY={0x8, 0x4, 0x13}]}}}]}, 0x44}}, 0x0) 19:13:27 executing program 2: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0x10, 0xffffffffffffffff, 0x0) r0 = socket(0x0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000600)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="700100002400cd4dd607", @ANYRES32=r2, @ANYBLOB="00000000ffffffff00000000280008001c0001001000000000000000000000000000ff0f0000000000000000020002c60000020008000100726564001c01020004010200b205a34f0459cc6abb699f4e08e3b1b5f75780560a59a8480dae55818041c02d8471389f5a076eaa787f8246aef232f41fb4fd095e664069035a011afb427b4799dc17338322c9d91968bf2836bcbba734486e4d3c392ec5c40433021f006b4ddf02645062bacedcbcd61e4be8eea0e577dae0a23161a078fedf38770e055341db2eca0ca565e8c92336422a57f6adad6ed581b27ccc9155e93c542353f1681423f71cb1e44cc5b75a30512fff1d3a8f0d2bcb"], 0x170}}, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r3, 0x0, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f00000002c0)='cpuset.effective_mems\x00', 0x0, 0x0) socket$inet6_icmp(0xa, 0x2, 0x3a) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)={0x78, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0x4}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x78}}, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x891c, 0x0) 19:13:27 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 733.386623][ T21] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 733.396605][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 733.407010][T11209] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:27 executing program 5: setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_type(r0, &(0x7f0000000000)='threaded\x00', 0xb1d000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = socket$inet(0x2b, 0x801, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4) connect$inet(r2, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendfile(r2, r1, 0x0, 0xffffffff880) 19:13:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)=@can_delroute={0x1c, 0x19, 0x201, 0x0, 0x0, {}, [@CGW_LIM_HOPS={0x5, 0xd, 0x1}]}, 0x1c}}, 0x0) [ 733.562320][T26668] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 733.592118][T26668] device bridge143 entered promiscuous mode [ 733.614620][T26669] IPVS: ftp: loaded support on port[0] = 21 [ 733.636561][T26668] netlink: 'syz-executor.4': attribute type 25 has an invalid length. 19:13:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000014c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newtfilter={0x50, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0x8}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x20, 0x2, [@TCA_FLOW_EMATCHES={0x1c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x8001}}, @TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xc, 0x1}]}]}]}}]}, 0x50}}, 0x0) r3 = socket(0x1000000010, 0x80002, 0x0) sendmmsg$alg(r3, &(0x7f0000000200), 0x4924924924926d3, 0x0) [ 733.688107][T26668] device bridge143 left promiscuous mode [ 733.715596][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 733.770442][T26684] IPVS: ftp: loaded support on port[0] = 21 [ 733.809225][ T28] audit: type=1804 audit(1601752407.369:239): pid=26686 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir338366709/syzkaller.pF9bHM/484/memory.events" dev="sda1" ino=16177 res=1 errno=0 [ 733.852060][T26679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 733.946207][ T28] audit: type=1800 audit(1601752407.399:240): pid=26686 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.5" name="memory.events" dev="sda1" ino=16177 res=0 errno=0 [ 734.194050][T26669] virt_wifi0 speed is unknown, defaulting to 1000 [ 734.194827][T26690] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. 19:13:27 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 734.244565][ T28] audit: type=1804 audit(1601752407.799:241): pid=26686 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir338366709/syzkaller.pF9bHM/484/memory.events" dev="sda1" ino=16177 res=1 errno=0 [ 734.248491][T26699] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.280019][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:27 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x0, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 734.368677][T26675] IPVS: ftp: loaded support on port[0] = 21 [ 734.427262][ T28] audit: type=1800 audit(1601752407.799:242): pid=26686 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.5" name="memory.events" dev="sda1" ino=16177 res=0 errno=0 [ 734.457889][T26692] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. 19:13:28 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getsockname(r0, &(0x7f00000000c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000140)=0x80) ioctl$FIBMAP(r1, 0x1, &(0x7f0000000000)) [ 734.606850][T26711] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 734.708091][T26711] device bridge144 entered promiscuous mode [ 734.754024][T26714] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 19:13:28 executing program 5: r0 = socket$kcm(0xa, 0x3, 0x3a) recvmsg$kcm(r0, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x0) r1 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r1, &(0x7f0000000180)={&(0x7f00000001c0)=@nl=@unspec={0x0, 0x3a00, 0x3ee6}, 0x80, &(0x7f0000001300)=[{&(0x7f0000000080)="3eba0000", 0x4}], 0x1}, 0x0) 19:13:28 executing program 1: r0 = socket$phonet(0x23, 0x2, 0x1) close(r0) 19:13:28 executing program 1: unshare(0x5c010800) 19:13:29 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x0, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 735.475541][T26719] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 735.730988][T26719] device bridge144 left promiscuous mode [ 736.571798][T26684] virt_wifi0 speed is unknown, defaulting to 1000 [ 736.578441][T26669] virt_wifi0 speed is unknown, defaulting to 1000 [ 736.825282][ T2642] net_ratelimit: 4 callbacks suppressed [ 736.825292][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 737.177175][T26684] virt_wifi0 speed is unknown, defaulting to 1000 [ 737.227615][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 737.875265][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:32 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r2, 0x0, 0xf03b0000) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4}, 0x1c) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e2c, 0x0, @ipv4={[], [], @local}}, 0x1c) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0x0) sendfile(r3, r0, 0x0, 0x8000000000004) syz_genetlink_get_family_id$SEG6(&(0x7f0000000100)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, 0x0, 0x0) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, 0x0, 0x800) socket$inet6(0xa, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003480), 0x0, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) 19:13:32 executing program 1: unshare(0x6c060000) r0 = socket(0x11, 0x2, 0x0) bind(r0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0x208e19b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000200)="ad56b6cc0400aeb995298992ea5400c2", 0x10) recvmmsg(r3, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) 19:13:32 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x0, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:32 executing program 5: mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r0 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0xa00000000000000, 0x80, &(0x7f00000000c0)=@broute={'broute\x00', 0x20, 0x1, 0x990, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000e00], 0x0, 0x0, &(0x7f0000000e00)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000b00000000000000000062726964676530000000000000000000766c616e300000000000000000000000736974300000000000000000000000007465716c3000000000000000000000000000000000000000000000000180c20000000000000000000000b8080000b808000030090000616d6f6e670000000000000000000000000000000000000000000000000000002008000000000000140400003f0c000000000000000a000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f18a0afe993500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008c7f8f1b455b7331ec50674c0844f0000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009abde2255a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e0ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffff90000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f2573bd04a33729f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000003f7f1c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000c05fb847d4e868ff000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d3d2e85100000000000000000000000000000000000000000000000000000000006e666c6f670000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000a600a9e85725d89818472e65aba21d9bbc1b20e8331c6fd24a5aceaeefe102e42a013ac2c00eeb782c34eab997013e0506220c21a44cc58ff5bc83d5e4066c7700"/2448]}, 0xa08) 19:13:32 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:32 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 738.600204][T26794] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 738.617623][T26791] IPVS: ftp: loaded support on port[0] = 21 19:13:32 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000240)="2e00000010008108040f80ecdb4cb92e0a480e0e2e00000001bd6efb250309000e000100240248ff050005001201", 0x2e}], 0x1}, 0x0) [ 738.640409][T26794] device bridge145 entered promiscuous mode [ 738.664702][T26800] IPVS: ftp: loaded support on port[0] = 21 [ 738.682211][T26802] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 738.735135][T26794] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 738.783591][T26794] device bridge145 left promiscuous mode [ 738.917878][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x2, 0x3, 0x2f0, 0x0, 0x1a0, 0x0, 0x0, 0x0, 0x258, 0x258, 0x258, 0x258, 0x258, 0x3, 0x0, {[{{@uncond, 0x0, 0x180, 0x1a0, 0x0, {}, [@common=@unspec=@string={{0xc0, 'string\x00'}, {0xfffc, 0x0, 'kmp\x00', "f92fe63590ab5471c46924e95540949f0cd7e2b0a94d71d02f44acb7f0a1297674a95b30cee19db4c1725572ba928385b1635c89b58ae9a0e1ea500b26f006da3fa8a134552f7980e92de5a784cd4f46e799e191835d7d5ea776f04bef524e22f0bb6ed4b00f44ceb936943e13fa1caa6b4b159c673db1efa9a08b1ddc74ce6c"}}, @common=@osf={{0x50, 'osf\x00'}, {'syz0\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0x98, 0xb8, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x350) 19:13:32 executing program 2: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c00000002060100000000000000000000000000100003006269746d61703a706f72740005000400001000000900020073797a300000000005000500000000000500010006000000140007800600044000000000060005"], 0x1}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x10105, 0x0) 19:13:32 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x34, 0x0, 0x8, 0x101, 0x0, 0x0, {}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_DATA={0x4, 0x4, 0x0, 0x1, @gre}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x88a2}]}, 0x34}}, 0x0) [ 739.341270][T26800] virt_wifi0 speed is unknown, defaulting to 1000 19:13:33 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:33 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:33 executing program 5: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, 0x0, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) accept4$x25(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0) sendto$inet6(r0, &(0x7f0000000180)='\x00', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(0xffffffffffffffff, 0x8010661b, &(0x7f00000000c0)) [ 739.601919][T26831] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 739.680162][T26831] device bridge146 entered promiscuous mode [ 739.718326][T26833] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 739.756488][T26837] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 739.859834][T26843] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.868910][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.921546][T26837] device bridge146 left promiscuous mode [ 739.941999][T26797] IPVS: ftp: loaded support on port[0] = 21 [ 739.944191][T26844] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.957387][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.966314][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 740.392685][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 740.668239][T26791] virt_wifi0 speed is unknown, defaulting to 1000 [ 740.674962][T26800] virt_wifi0 speed is unknown, defaulting to 1000 [ 740.839190][ T117] tipc: TX() has been purged, node left! [ 740.845688][ T117] tipc: TX() has been purged, node left! [ 740.875358][ T117] tipc: TX() has been purged, node left! [ 740.918020][ T117] tipc: TX() has been purged, node left! [ 740.985941][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 741.242940][T26791] virt_wifi0 speed is unknown, defaulting to 1000 [ 742.035618][T10401] net_ratelimit: 1 callbacks suppressed [ 742.035628][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.987221][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 743.003975][T11211] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 743.065222][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.107737][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:38 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cgroup.stat\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000140)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x44}, @call={0x85, 0x0, 0x0, 0x80}, @alu={0x7, 0x1, 0x0, 0x0, 0x8, 0xfffffffffffffff0, 0xfffffffffffffffc}, @jmp={0x5, 0x1, 0x5, 0x9, 0x0, 0x2, 0xfffffffffffffffc}, @generic={0x48, 0x9, 0x0, 0x800, 0x2}, @ldst={0x0, 0x3, 0x3, 0x2, 0x3, 0x50, 0x8}, @map_val={0x18, 0x8, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0xec9}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) write$cgroup_int(r0, &(0x7f0000000200), 0x400086) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) 19:13:38 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x2, [@int={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xe, 0x4}]}}, &(0x7f0000000280)=""/237, 0x2a, 0xed, 0x1}, 0x20) 19:13:38 executing program 5: r0 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'sit0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000100)=0x6, 0x4) bind$packet(r0, &(0x7f0000000300)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @random="65ed59501ed8"}, 0x14) sendmmsg(r0, &(0x7f0000000d00), 0x400004e, 0x0) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, 0x0, 0x0) 19:13:38 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB, @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:38 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:38 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 744.789018][T26903] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:13:38 executing program 2: r0 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0xa00000000000000, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x948, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000b00000000000000000062726964676530000000000000000000626f6e645f736c6176655f3000000000736974300000000000000000000000007465716c3000000000000000000000000000000000000000000000000180c20000000000000000000800b8080000b8080000e8080000616d6f6e670000000000000000000000000000000000000000000400000000001804000000000000000000000c00070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000a74235951be70000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000095f379809ea0d0815215159132000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d6599200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000053cbf7eee533b170000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000da7728b2a10f85275591dc0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000094370000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000067a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000072656469726563740000000000000000000000000000000000000000000000000800000000000000"]}, 0x9c0) [ 744.879126][T26903] device bridge147 entered promiscuous mode [ 744.911873][T26911] IPVS: ftp: loaded support on port[0] = 21 [ 744.952925][T26909] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 744.990723][T26916] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 745.023426][T26916] device bridge147 left promiscuous mode [ 745.145691][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:38 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuacct.usage_user\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x7c774aac) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) sendfile(r2, r0, 0x0, 0x7fffffff) syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00') sendmsg$TIPC_CMD_SET_NETID(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000780), 0xc, &(0x7f0000000380)={&(0x7f00000003c0)={0x24, 0x0, 0x0, 0x70bd27, 0x25dfdbfe, {{}, {}, {0x8, 0x2, 0x100}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x0) sendfile(r2, r0, 0x0, 0x4000002) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00) 19:13:38 executing program 5: r0 = socket$kcm(0x29, 0x1000000000002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_user\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuacct.usage_user\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[@ANYRES32], 0x4) sendfile(r0, r1, 0x0, 0x7fffffff) sendmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000100)="dd", 0x1}], 0x1}, 0x0) 19:13:39 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:39 executing program 5: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmmsg$inet(r0, &(0x7f00000002c0)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10, 0x0}}], 0x1, 0x0) 19:13:39 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB, @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:39 executing program 1: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x4790, 0x4) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x3f, &(0x7f0000000000)=0x8, 0x4) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x291962b, 0x45833af92e4b39ff, 0x0) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000000)={{{@in6=@mcast2, @in=@dev={0xac, 0x14, 0x14, 0x3d}, 0x4e23, 0x1226, 0x4e20, 0x0, 0x2, 0x80, 0x20, 0x29, 0x0, 0xee00}, {0x3, 0x7, 0xc5, 0x1, 0x7, 0x4, 0x7ff, 0x8}, {0x13b0, 0x5078, 0x7ff, 0x1f}, 0x944, 0x6e6bbc, 0x1, 0x1, 0x2, 0x1}, {{@in6=@private2={0xfc, 0x2, [], 0x1}, 0x4d3, 0xff}, 0x2, @in6=@loopback, 0x0, 0x0, 0x2, 0x81, 0x8, 0x7fffffff, 0x40}}, 0xe8) close(r0) [ 746.342246][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.360684][T26946] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 746.446416][T26946] device bridge148 entered promiscuous mode [ 746.494245][T26949] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 746.523459][T26952] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 746.554589][T26952] device bridge148 left promiscuous mode 19:13:40 executing program 2: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f0000000080)={'filter\x00'}, &(0x7f0000000000)=0x44) [ 746.827966][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:40 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 746.895191][T26957] IPVS: ftp: loaded support on port[0] = 21 [ 747.190719][T26957] virt_wifi0 speed is unknown, defaulting to 1000 19:13:40 executing program 5: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newrule={0x28, 0x20, 0xf29, 0x0, 0x0, {}, [@FRA_GENERIC_POLICY=@FRA_UID_RANGE={0xc, 0x14, {0xee01}}]}, 0x28}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x19404, 0x0) 19:13:40 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB, @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 747.554596][T26974] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 747.682937][T26974] device bridge149 entered promiscuous mode [ 747.742524][T26976] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 747.777546][T26977] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 747.968557][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.026537][T26977] device bridge149 left promiscuous mode [ 748.109816][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 748.147019][T26958] IPVS: ftp: loaded support on port[0] = 21 [ 748.539664][T26957] virt_wifi0 speed is unknown, defaulting to 1000 [ 748.685654][ T117] tipc: TX() has been purged, node left! [ 748.995804][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.035664][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.067350][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:44 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:13:44 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:44 executing program 5: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$l2tp6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x7}, 0x20) sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe0}}], 0xbb00, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000010400000000ec00000000000000", @ANYRES32=r7, @ANYBLOB="00000000000000001c0012000b00010062726964676500000c0002000500070005"], 0x3c}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="2800000010000104fd0004000000000000000000", @ANYRES32=r4, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r7], 0x28}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x4c00, &(0x7f0000000280)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0xc, r7}}, 0x20}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@delnexthop={0x38, 0x69, 0x10, 0x70bd26, 0x25dfdbfe, {}, [{0x8, 0x1, 0x2}, {0x8}, {0x8, 0x1, 0x1}, {0x8, 0x1, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x1) 19:13:44 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x80000000000004) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x0, 0x0, 0xff, 0x1}, 0x20) close(r0) 19:13:44 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 751.463594][T27021] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 751.562238][T27021] device bridge150 entered promiscuous mode [ 751.622491][T27024] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 751.663391][T27028] netlink: 'syz-executor.4': attribute type 25 has an invalid length. 19:13:45 executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet(r0, &(0x7f0000008f80)=[{{&(0x7f0000004480)={0x2, 0x0, @local}, 0x10, &(0x7f0000005a40)=[{&(0x7f00000067c0)="15", 0x1}], 0x1}}, {{&(0x7f0000006a00)={0x2, 0x0, @empty}, 0x10, 0x0, 0x0, &(0x7f0000008f00)=[@ip_ttl={{0x14}}, @ip_tos_u8={{0x11}}], 0x30}}], 0x2, 0x0) [ 751.713383][T27028] device bridge150 left promiscuous mode [ 751.742973][T27040] IPVS: ftp: loaded support on port[0] = 21 19:13:45 executing program 1: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000200)=@bpf_lsm={0x3fe, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 752.115360][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:45 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@newlink={0x54, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9, 0x1, 'veth\x00'}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14}}}}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x54}}, 0x0) [ 752.291221][T27034] bridge2: port 1(bond0) entered blocking state [ 752.302902][T27034] bridge2: port 1(bond0) entered disabled state [ 752.404597][T27040] virt_wifi0 speed is unknown, defaulting to 1000 [ 752.585199][T11208] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 752.593371][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.092744][T27040] virt_wifi0 speed is unknown, defaulting to 1000 [ 753.154873][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.875896][ T7] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:47 executing program 2: r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x24) 19:13:47 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:47 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:47 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newae={0x48, 0x1e, 0x701, 0x0, 0x0, {{@in, 0x4d4, 0x0, 0x6c}, @in6=@mcast1}, [@replay_thresh={0x8}]}, 0x48}, 0x8}, 0x0) 19:13:47 executing program 5: r0 = socket$can_j1939(0x1d, 0x2, 0x7) sendmmsg$sock(r0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x100000000000000, &(0x7f00000000c0)={0x19, 0x4, 0x4, 0xb330, 0x0, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x2000000], 0x0, 0xffffffffffffffff, 0x0, 0x400}, 0x40) 19:13:47 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 754.196161][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:47 executing program 1: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f00000000c0)=@framed, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) accept4(r1, 0x0, 0x0, 0x0) r2 = socket(0x21, 0x80000, 0x0) shutdown(r2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @geneve={{0xb, 0x1, 'geneve\x00'}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GENEVE_ID={0x8, 0x1, 0x2}, @IFLA_GENEVE_COLLECT_METADATA={0x4}]}}}]}, 0x40}}, 0x0) r3 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @geneve={{0xb, 0x1, 'geneve\x00'}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GENEVE_ID={0x8, 0x1, 0x2}, @IFLA_GENEVE_COLLECT_METADATA={0x4}]}}}]}, 0x40}}, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @geneve={{0xb, 0x1, 'geneve\x00'}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GENEVE_ID={0x8, 0x1, 0x2}, @IFLA_GENEVE_COLLECT_METADATA={0x4}]}}}]}, 0x40}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = getpid() sendmmsg$unix(r5, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000300)='|', 0x3300}], 0x1, &(0x7f0000000140)=[@cred={{0x1c, 0x1, 0x2, {r6}}}], 0x20}], 0x198, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f00000001c0)={0x0, 0x3dbeb, &(0x7f0000000100)={&(0x7f0000000140)={0x34, 0x26, 0x829, 0x0, 0x0, {0x4, 0x1000000}, [@typed={0x8, 0xc, 0x0, 0x0, @uid}, @typed={0x8, 0x82, 0x0, 0x0, @ipv4=@local}, @typed={0xf, 0x1d, 0x0, 0x0, @str='}}-\xd6]{&$!\x8f\x00'}]}, 0x34}, 0x1, 0xffffff7f0e000000}, 0x84) [ 754.259842][ T117] tipc: TX() has been purged, node left! [ 754.293540][T27093] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:13:47 executing program 2: sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="7000000000011905030000000000000002000000240001001400010008000100ffffffff08000200ac1e00010c00020005000100c1000000240002000c00020005000100000000001400010008000100e000010208000200ff00000008000700000000000c000500080001007f009b552410f2d2219f0e542c5a7300019e58e0c4e489c3c21af10959a3d6a4c348e7ed141eb90b40b5ba80c6a970148de79e7fe5802250b08ab30f739390b08b7bbdc9f4411204627295fca62abc7231863f4e10bf1390f037e6c5b91c1631219de777ab2ca025dbd0fb73223d5c1d2969407507157c496584e575cd4f5d9272985b23e87d0a16268f846a83884b1092236183e5cfecdf886a32ddef2ceae9d133d48a732d2024487170238a8ec98682ce7552ace40d73c6776837cdccca60b58d63cdb266eb73b14293826db6c88c26498d0db7734945a8ffa14794b58e95c89156b90ccf7d904a919b393d6a3442eca76396c5306ef82af2a17c3d286bfc6c1b0f8405dcebc8a5e31cdda4ceca9587df114219a3f0838586993553fa44b1518ab6bc820ff8d0eb78c14368f8a1f709febd98d9f4a3b76f2f9c623178a998aebf0c2b4da2954fc67dc8e7a3873ba0063c8e5780acf361b2b813ba10adc938e6bb068ceb7668c905600b2d8fb18c4eed4d600e56501e952241faa4f932c7662ebbadd14b237caa8a47e4bde50fcddc2a9a6fd23a322a031491959a1950212786dab037b87e6544415ad722102fc12dd3c5107dd5d18e"], 0x70}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETCHAIN(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x8}, 0x0) [ 754.322068][T27093] device bridge151 entered promiscuous mode [ 754.347558][T27098] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 754.383154][T27093] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 754.400042][T27093] device bridge151 left promiscuous mode [ 754.422918][T27099] IPVS: ftp: loaded support on port[0] = 21 19:13:48 executing program 5: syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000019c0)='ns/pid\x00') syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000019c0)='ns/pid\x00') 19:13:48 executing program 2: r0 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x34, &(0x7f0000000480)={0x0, 0x0}, 0x10) [ 754.665264][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.673983][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.682353][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.690659][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.698967][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.707293][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.715605][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:48 executing program 5: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet(r0, &(0x7f0000006540)=[{{&(0x7f00000002c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000002580)=[{&(0x7f0000000300)="f2ed7ec72e946fd7cec6fd69585e37265348219f101f29dcae7c17298a45f0dd111eac2c2e7b3af3b046cb46e0e1e8976fab9c5143e861284c2350b7b0d9c59d053ca5f54137e6336b32507138c4983e0015682a05a8d3da19b3e958fdde6db0615cdc9dcf18300acfaee11f1450cc8a259df6b82f6c9990f555a98e5431e521bef9cea75cc7d23bd278c36ed7b9a692b6c05f24e923f0fa576426b18f009c0a5e43cc944117df7c25a53c10490f92ea733eee508b27752b467e1a440fb65f7f0994b9078788e9cd679e732a401d92b4d24f052c3908c6fbe0892bf08f4d65908d0eb975b2e4", 0xe6}, {&(0x7f0000000400)="1de7d3cc75dc480fa59b4cb43167b44166a4d490f90edd7d86edc7100e552d95bc0f2003e88c2aaa0d51a79b553be804af6436a12f6415c04cc720d1e1bf10c3307b523dd45eb98495f98abd0448a57da8b672b5a400a08f70e150806b3f08fb6ed59693f31cfac0f5340508fac4524c8a45993180ab7d135a062e25e6522bcce28b36c0dc080de5fb7c8f137ed15e5a54d16992c86c42b0196b1a627c2e8c0d5958377607e14cfa08149e5871d4b4320e1ffb7a9c0a6aae4b881ec25aca8eeb79ab51e814d2a99b1c3b99ef932891af774bcf3cf706c202d037f9afe9ba5edca266d6ba881644c9eabcaec4832f4b7b7f5696ec903225d813a1725e3028a5165b4ca84713856a128b4f47f91b40232c1d9f2b12f578c4c60564d7251a27edbaca63f0425906e5cd94f2cec9f226397cc73c84cafae462cd8002782dccab8dd21340ffc3fd5453e3179459ac33e45e9f72b84faa721ebb70e46225201dc9176b7fd76de505e80ac9d65e1fa31b818dc87018e9b59fda0ee83ebd629a77d1921949f49df769a6fec535fa164d4ec201a7e40b167bb1b91a2b9128ab0a4d7182a5259bb24a7a60dced4d6aae03c3a47bb05e1108113ca5e6899ffe56d63ea540e7837f57c013da0a8017768dc79635e342d4d2a93055c4330578ba0ab11f9df83f91965f1f08812b60f8896766487ab0b38630ba079faad53e9891197596be01c33eee2d4f9222e8e637378b964e2a7f0a3d0ddca8e31ee4aede1f915ed99765c8692de83ba4e0ec02b456f0ff9b456d6cd50f73a6a1d91079879c7a56b3c08ed8f0f27da25cafb7b1d2ac3b80f4c88c16fe03cf4c288ee1629d8c463eaf49207b874585c487ba2e610c30165787d20b7e0f536866f4e36591b69e6e2df8481749d8901cd142ca841c3ae659b8d560d6427e8095cd5c7e674b8c55ccf80d5f8632223649ead96a3daf241ce5b052f3ee2a5b9750564a1bef4dce9dea1a42cca0e986f4a4fb2d3765dcbda506509a90f1ca2c1cb1d86c90ed6586459b7319c101c5ce0a93853862aa2f8207cd89827ef84c11fa28288c4b3245cb13ebe395d4870a0bbea7c2e8eca4dd5336e98a4a4bf10fe33a69ca59fdd1346e56fae660dd15f9b58ef5f07a8cb900e9780f24876a47dd13386adf4267e2bc3aae05dabaf9220fd2acc9fcbce6a3fa363560fd86fe3b0d2e86de0dd48288ca53450b6ba89adfe763a64be3d293a16cb1e486617fd2763e1bb2587a3d4b8133c5e456307e758dd5e20095c26dd9b1fa848567615432c5df865d5a16b6a497051eb21426636232e9827d439321af627edfe60200dc6bfff8ea72e1bb0995db22124a3d037a6a5e6e02c97d563e55e4c6abee41069ccf9510026faa44d53b1fa49a203f7e222daa3bbfca141a7e6b5623", 0x3e8}, {&(0x7f0000001400)="f4", 0x1}, {&(0x7f00000014c0)=']', 0x1}], 0x4}}], 0x1, 0x0) 19:13:48 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}}, 0x0) 19:13:48 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:48 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/77, 0x4d}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 755.479985][T27130] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 755.533693][T27130] device bridge152 entered promiscuous mode [ 755.587025][T27134] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 755.616138][T27137] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 755.634585][T27137] device bridge152 left promiscuous mode 19:13:49 executing program 5: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/uts\x00') ioctl$TUNSETSNDBUF(r0, 0xb701, 0x0) 19:13:49 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:49 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000001640)={0x1c, 0x6, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) [ 756.331400][T27157] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 756.410631][T27157] device bridge153 entered promiscuous mode [ 756.445529][T27165] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 756.466833][T27166] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 756.484075][T27166] device bridge153 left promiscuous mode 19:13:51 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x29}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0xffffffff, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x29}}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000140)=0xffffffff, 0x4) connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r1, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) recvmmsg(r1, &(0x7f00000000c0)=[{{&(0x7f0000000000)=@nfc, 0x80, 0x0}}], 0x1, 0x2022, &(0x7f0000000100)={0x0, 0x989680}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000000080)='gtp\x00') sendmsg$GTP_CMD_DELPDP(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@GTPA_VERSION={0x8}]}, 0x1c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x800000000080002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140)=[{0x0, 0x0, 0x0}], 0x1, 0x0) getsockname$packet(r5, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4, r6}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) 19:13:51 executing program 2: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000008c0)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_dsmark={{0xb, 0x1, 'dsmark\x00'}, {0x14, 0x2, [@TCA_DSMARK_DEFAULT_INDEX={0x6}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x8}]}}]}, 0x44}}, 0x0) 19:13:51 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f5ffe0)={@loopback, 0x400, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x0, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000001c0)={@local, 0x400, 0x1}, 0x20) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000001000050700"/20, @ANYRES32=0x0, @ANYBLOB="7d000000000000001800128008000100736974000c00028008000100", @ANYBLOB="1dcd2ca4bdb83ef969d7807a93464c5d8dd61d2ff67ef3175906f21b8b46980469b2e44af9548cd2b83dd6a3f3c8dd710652d6b1e574d10e604d11d5663fc7cec85f557d8e31c3455d567eb592759c498d0bb18a3ed9a2f78075aaca2b10defe737f884d36cf6a47fbe22765584456099fefa1cc34347ad743fc82ebca2dbd6c48609c2710af38a977861d44081d7baa5fc7bed6cc7e502853f4c3f2d3e841663e22bc8b5e9f2194c6a986caa96fd83289c0af891d58e219d58b55360e8becc0a0"], 0x38}}, 0x0) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f00000000c0)={@private1={0xfc, 0x1, [], 0x1}, 0x80}) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x30, 0x0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}]}]}, 0x30}}, 0x0) socket(0x0, 0x0, 0x0) r3 = socket(0x10, 0x800000000000803, 0x0) sendto(r3, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) recvmmsg(r3, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:13:51 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/77, 0x4d}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:51 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:51 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 758.596282][ T27] net_ratelimit: 59 callbacks suppressed [ 758.596292][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 758.625730][T27188] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 758.682422][T27188] device bridge154 entered promiscuous mode [ 758.714199][T27194] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 758.774546][T27205] IPVS: ftp: loaded support on port[0] = 21 [ 758.800012][T27198] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 758.826451][T27198] device bridge154 left promiscuous mode 19:13:53 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/77, 0x4d}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:53 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 759.626920][ T311] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.636015][ T776] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:53 executing program 2: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000008c0)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_dsmark={{0xb, 0x1, 'dsmark\x00'}, {0x14, 0x2, [@TCA_DSMARK_DEFAULT_INDEX={0x6}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x8}]}}]}, 0x44}}, 0x0) 19:13:53 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r0, 0x8983, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000000)={0x7fd}, 0x10) write(r1, &(0x7f000018efdc)="1400000052001f0214f9f4070009040081000710", 0x14) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(0xffffffffffffffff, 0xc0506617, &(0x7f0000000080)={{0x0, 0x0, @descriptor="31c28552c3463797"}}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) socket$pptp(0x18, 0x1, 0x2) recvmmsg(r1, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x39}}], 0x3fffffffffffe7d, 0x10122, 0x0) 19:13:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @cfhsi={{0xa, 0x1, 'cfhsi\x00'}, {0xc, 0x2, 0x0, 0x1, [@__IFLA_CAIF_HSI_INACTIVITY_TOUT={0x8}]}}}]}, 0x3c}}, 0x0) [ 760.012469][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 760.029963][T27221] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 760.121552][T27221] device bridge155 entered promiscuous mode [ 760.185400][T27222] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 760.211349][T27223] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 760.239507][T27223] device bridge155 left promiscuous mode 19:13:54 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 760.718878][T27236] caif_hsicaif_hsi_newlink: failed to get the cfhsi_ops 19:13:54 executing program 2: syz_emit_ethernet(0x9a, &(0x7f0000000040)={@empty, @empty, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "948bde", 0x64, 0x2f, 0x0, @rand_addr=' \x01\x00', @empty, {[@hopopts={0x0, 0x2, [], [@hao={0xc9, 0x10, @dev}]}]}}}}}, 0x0) 19:13:54 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:54 executing program 5: r0 = socket(0x10, 0x80002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000010c0)={'team_slave_1\x00', &(0x7f0000001000)=@ethtool_flash={0x24, 0x3, ',\x11\xbcL\x87_\xd8\xbcd\xbb\t&7*B\f%\x11\xcbt\x99\x02.g\x7fX\xe1\"\xe3F\x7f\x99\xc4}`]\x8bK\xb3L\x06*-\x99\x17\xb4\xc9\bk\xe8\xddL\xdcXg\xfb[\xbbm\xa5\xb82,\x06\x93E}\xeanz\x9eH\xf5&?/u\xa6\xc8\x83\x8d\xe3&_\r\xdd\xd6j\xf2n)(\xf3\xc6\xce\x8e\x82\xcd\xacX\xfdEG\xf8\xae31\x8aK\x83\xf5\x96\'\xbd\xb4\x89\x12=\xf4\xda\xc2\x02\x03#\xf6\x9a\xc6a'}}) socket$netlink(0x10, 0x3, 0x0) 19:13:54 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000001180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x6, [@union={0x5}]}, {0x0, [0x0, 0x0, 0x0, 0x0]}}, &(0x7f0000001200)=""/165, 0x2a, 0xa5, 0x1}, 0x20) [ 761.047730][T27248] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 761.065805][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:54 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000200)=0x1, 0x85) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000100)={@private1, 0x0, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000000c0), 0x4) r1 = accept4(r0, &(0x7f0000000000)=@sco={0x1f, @fixed}, &(0x7f0000000080)=0x80, 0x80000) r2 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') r3 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000003c0)={0x2, 0x2, 0x4, 0x5, 0x0}, &(0x7f0000000480)=0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000540)={r5, @in={{0x2, 0x4e23, @loopback}}, 0x6, 0x8}, 0x90) r6 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_tcp_int(r1, 0x6, 0x24, &(0x7f0000000440), &(0x7f0000000400)=0x4) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, &(0x7f0000000140)={0x0, 0xc040000, &(0x7f0000000500)={&(0x7f0000000180)={0x1c, r2, 0x711, 0x0, 0x0, {0x6}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x1c}}, 0x0) [ 761.202298][T27248] device bridge156 entered promiscuous mode [ 761.269935][T27255] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 761.408129][T27255] device bridge156 left promiscuous mode [ 762.142118][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.190343][ T5] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 763.155241][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:56 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:13:56 executing program 2: r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000080)={0x11, 0x4, 0x4, 0x4, 0x0, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x40) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000080)={r0, 0x0, &(0x7f00000001c0)=""/217}, 0x20) 19:13:56 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:13:56 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:56 executing program 1: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'sha1-avx\x00'}, 0x58) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000000)="068a923642325f84cdb616149bb3d1a2db3e922baba553fa9001c7aee21e5d9d81d502dc7fef4d31300019d13ac1af402a6be629ca3067b2a479eb6ac2a243967b", 0x41}], 0x1) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, 0x0, 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 19:13:56 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512-avx2\x00'}, 0x58) r1 = accept(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000008c0)=[{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=']', 0x7ffff000}, {&(0x7f0000000180)='l', 0x1}], 0x2}], 0x600, 0x0) [ 763.313822][T27281] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:13:56 executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0x5, 0x5, 0x209e20, 0x2, 0x1}, 0x3c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28012, r0, 0x0) 19:13:57 executing program 2: socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000002300000000000000000000850000002c0000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x4, &(0x7f0000001500)=ANY=[@ANYBLOB="1802000040ffffff000000000000000085000000360000009500000000000000922ae83713ab9662ce3ae356538dda12000000cba9dd1b10fb54a8cb72d28d82de5ac54e32ad558c46fff4208d49631979a48b2a6af1653705188b8fe903ddc702e404e19a5183d7ff008a263345e44d5187cf62b3954c11ac7839dcf47b4dd0221e944a296e7359ea79a75dd098bbc4fa13aef78ca9e89615ad000000000000bbf5024b52464eac4ea04ba06b49d1238814833659646e3abdb2dfc61696e340bb8e2a2e3adc57196b40def3858ef569147fa4108328392d322ab47d4283e859a4f90e42410f57466f59e06585bc544015fed8ac1dfea506f2cef8aa17c729300d231a9f04c2919e64dfa8a0b36754ed5290a8cd8470e776d6b80630d6cbde49b29afc65211a86468e7b6cb5defc0000000000004b588c745caeada6bc44669a18439f000000000000c5eafa31b21be479451200bba6d5998f6743bf0d33427a5fb1f601b869da0000000056000000000000000000000000000000000000000000d0f2df3c4efcde67fd0e6efabb45289e5ec44497f693a468e61fd98c8dafad5440cc98426cf2e42aae5e3162b8f6b4362e556c929938d5887fb35f04b6dda6db3413431a94e1c3e62a345fc82b26e4bc93a2a370c6c7df30ab210acc035d1deb07881dc6481d000000000000000000"], &(0x7f0000000040)='GPL\x00', 0x4, 0x1076, &(0x7f0000000300)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000013c0)={r0, 0x0, 0x0, 0x0, &(0x7f0000001400), 0x0, 0x81}, 0x40) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000080), 0x800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r3, &(0x7f0000000200), 0xf000) write$cgroup_int(r2, &(0x7f0000000200), 0x806000) socketpair(0x29, 0x4, 0x9bc3, &(0x7f0000000040)={0xffffffffffffffff}) r5 = socket$inet_sctp(0x2, 0x0, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r5, 0x84, 0x6e, &(0x7f0000000000)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x66, &(0x7f0000000200)={r6}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000080)={r6, 0x1}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, 0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(r3, 0x6609) [ 763.370393][T27281] device bridge157 entered promiscuous mode [ 763.420093][T27289] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 763.438920][T27289] device bridge157 left promiscuous mode 19:13:57 executing program 1: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, &(0x7f0000001240)=ANY=[@ANYBLOB]) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 763.611275][T27299] IPVS: ftp: loaded support on port[0] = 21 19:13:57 executing program 5: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0xfffffffffffffd40, 0x2004010) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x14e24}, 0x1c) socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r1, &(0x7f0000000200), 0x38c, 0x0, 0x0) connect$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) ppoll(&(0x7f0000000040)=[{r1, 0x2, 0x3000300}], 0x1, 0x0, 0x0, 0x0) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f000000ab80)={0x0, 0x0, 0x0}, 0xc0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x7a05, 0x1700) sendfile(r3, r2, 0x0, 0x100000001) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000000180)=0x4) [ 763.991658][T27299] virt_wifi0 speed is unknown, defaulting to 1000 19:13:57 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 764.245457][T27320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:13:57 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 764.297063][T27320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.334323][T27323] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 764.350850][T27320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.409441][T27320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.423493][ T28] audit: type=1804 audit(1601752437.979:243): pid=27324 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir338366709/syzkaller.pF9bHM/505/cgroup.controllers" dev="sda1" ino=15889 res=1 errno=0 [ 764.481763][T27323] device bridge158 entered promiscuous mode [ 764.493892][T27320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.523064][T27328] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 764.530734][T27320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.563908][T27320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.598229][T27320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.624104][T27320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.637906][T27320] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.684224][T27328] device bridge158 left promiscuous mode [ 765.049177][T27299] virt_wifi0 speed is unknown, defaulting to 1000 19:13:59 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:13:59 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) sendmsg$NFNL_MSG_ACCT_NEW(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000100)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000000706010341d43a7900cf00000000e9000500010007"], 0x1}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) recvmmsg(r3, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0}}], 0x400000000000239, 0x0, 0x0) 19:13:59 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000006c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7050000000000006a0a00fe000000008500000009000000b70000000000000095000000000000004e62"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) 19:13:59 executing program 2: socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000002300000000000000000000850000002c0000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x4, &(0x7f0000001500)=ANY=[@ANYBLOB="1802000040ffffff000000000000000085000000360000009500000000000000922ae83713ab9662ce3ae356538dda12000000cba9dd1b10fb54a8cb72d28d82de5ac54e32ad558c46fff4208d49631979a48b2a6af1653705188b8fe903ddc702e404e19a5183d7ff008a263345e44d5187cf62b3954c11ac7839dcf47b4dd0221e944a296e7359ea79a75dd098bbc4fa13aef78ca9e89615ad000000000000bbf5024b52464eac4ea04ba06b49d1238814833659646e3abdb2dfc61696e340bb8e2a2e3adc57196b40def3858ef569147fa4108328392d322ab47d4283e859a4f90e42410f57466f59e06585bc544015fed8ac1dfea506f2cef8aa17c729300d231a9f04c2919e64dfa8a0b36754ed5290a8cd8470e776d6b80630d6cbde49b29afc65211a86468e7b6cb5defc0000000000004b588c745caeada6bc44669a18439f000000000000c5eafa31b21be479451200bba6d5998f6743bf0d33427a5fb1f601b869da0000000056000000000000000000000000000000000000000000d0f2df3c4efcde67fd0e6efabb45289e5ec44497f693a468e61fd98c8dafad5440cc98426cf2e42aae5e3162b8f6b4362e556c929938d5887fb35f04b6dda6db3413431a94e1c3e62a345fc82b26e4bc93a2a370c6c7df30ab210acc035d1deb07881dc6481d000000000000000000"], &(0x7f0000000040)='GPL\x00', 0x4, 0x1076, &(0x7f0000000300)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000013c0)={r0, 0x0, 0x0, 0x0, &(0x7f0000001400), 0x0, 0x81}, 0x40) accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000080), 0x800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000000)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r3, &(0x7f0000000200), 0xf000) write$cgroup_int(r2, &(0x7f0000000200), 0x806000) socketpair(0x29, 0x4, 0x9bc3, &(0x7f0000000040)={0xffffffffffffffff}) r5 = socket$inet_sctp(0x2, 0x0, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r5, 0x84, 0x6e, &(0x7f0000000000)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x66, &(0x7f0000000200)={r6}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000080)={r6, 0x1}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, 0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(r3, 0x6609) 19:13:59 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r5, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYBLOB="000000000400000008000a00", @ANYRES32=r5], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r5, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:13:59 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r2, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 765.676939][ T6840] tipc: TX() has been purged, node left! [ 765.745940][T27373] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:13:59 executing program 5: r0 = socket(0x10, 0x80002, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=@newlink={0x5c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x37}, @IFLA_VLAN_EGRESS_QOS={0x4}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x1f, 0x13}}]}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x5c}}, 0x0) [ 765.819108][ T28] audit: type=1804 audit(1601752439.379:244): pid=27372 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/483/cgroup.controllers" dev="sda1" ino=16308 res=1 errno=0 [ 765.856711][T27373] device bridge159 entered promiscuous mode [ 765.903190][T27379] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 765.905843][T27386] IPVS: ftp: loaded support on port[0] = 21 [ 765.930528][T27384] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 765.967152][T27384] device bridge159 left promiscuous mode 19:13:59 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) sendmsg$NFNL_MSG_ACCT_NEW(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000100)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000000706010341d43a7900cf00000000e9000500010007"], 0x1}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) recvmmsg(r3, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0}}], 0x400000000000239, 0x0, 0x0) 19:14:00 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r5, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYBLOB="000000000400000008000a00", @ANYRES32=r5], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r5, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 766.598596][ T28] audit: type=1804 audit(1601752440.159:245): pid=27398 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/484/cgroup.controllers" dev="sda1" ino=16308 res=1 errno=0 19:14:00 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r2, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:00 executing program 1: r0 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x88880, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @dev}, 0x1c) sendto$inet6(r0, &(0x7f00000009c0)="c7cfcaaa22e10542fca5c0195350f15147657e0bfc59d383a47190db88690e6fedc3040ab5809ae02a54cd429cc3338c5afa0c9dce3f91950d1f567f358ac21154159130e88cbb6c43197813b2f23f3e442f80877490b393408142ebcfea6821f543e5ee9e27032e2b75d78f1b79f5a6bb6f0645e267770ef7e8f3a92148091217450ce8581e54223eeb6486205a209bf1fe854d211c03f8c3140fc3979d824082990d119473d20e94f253c9621fac339560ae46cb24b88bf2d01559bb658e343257b90f233b81bc5c398be3bbddb23a1e", 0xd1, 0x4000000, 0x0, 0x0) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000040)=0x2, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x9) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000000)={@dev={0xfe, 0x80, [], 0x5}}, 0x14) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), 0x4) r2 = socket(0x10, 0x2, 0x0) write(r2, &(0x7f0000000100)="1c0000001a009b8a14000000ff0000adf87e28000000000000000000", 0x1c) recvmmsg(r2, &(0x7f0000002ec0), 0x400000000000ec0, 0x0, &(0x7f00000001c0)={0x77359400}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r4 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000040)={r5}, 0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000180)=ANY=[@ANYRES32=r5, @ANYBLOB="050e00000728abc11d"], &(0x7f0000000200)=0xd) 19:14:00 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x20000, 0x1000}, 0x18) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f00000004c0)=0x80, 0x4) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000040)=0x2, 0x4) r2 = socket(0x100000000011, 0x2, 0x0) bind(r2, &(0x7f0000000940)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836010004b0e0301a4ce875f2e3ff5f163ee340b767950080f5ff000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0}, &(0x7f00000002c0)=0x14) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f00000001c0)=0x400, 0x4) bind$xdp(r1, &(0x7f0000000900)={0x2c, 0x0, r3}, 0x10) sendmmsg(r0, &(0x7f0000006d00), 0xffffffffffffff92, 0x1ffffffe) getsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, &(0x7f0000000480)) sendmsg$IPCTNL_MSG_TIMEOUT_GET(0xffffffffffffffff, 0x0, 0x0) [ 767.030038][T27404] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 767.086294][T27404] device bridge160 entered promiscuous mode [ 767.167548][T27409] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 767.183544][T27411] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 767.198814][T27411] device bridge160 left promiscuous mode 19:14:03 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:03 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$inet6_MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) connect$phonet_pipe(r1, &(0x7f0000000140)={0x23, 0x81, 0x8}, 0x10) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_RM_DEV(0xffffffffffffffff, 0x5000940b, 0x0) getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565, 0x5}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb, 0x1, 'bridge\x00'}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x0) 19:14:03 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r5, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYBLOB="000000000400000008000a00", @ANYRES32=r5], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r5, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:03 executing program 2: r0 = socket$inet(0x10, 0x80003, 0x0) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="2400000018000303000000946f6105000a00050a1f0000080c1008000800040012000000", 0x24}], 0x1}, 0x0) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000080)=@add_del={0x3, &(0x7f0000000040)='nr0\x00'}) syz_emit_ethernet(0x300506, &(0x7f0000000600)=ANY=[@ANYBLOB="aaaaaaaaaaaa00200000fdff86dd"], 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x2, &(0x7f0000000000)=0x9, 0x4) 19:14:03 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r2, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:03 executing program 1: socketpair(0x22, 0x0, 0x6dbd, &(0x7f0000000180)) [ 769.832980][T27443] IPVS: ftp: loaded support on port[0] = 21 [ 769.860417][T27445] IPv6: Can't replace route, no match found 19:14:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x11, 0x2, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "000001000000000008fc9d71fc00000000000000f8ffff002e0b3836005404b0d6301a4ce875f2e3ff5f163ee340b76795008000f8000000000104003c5811039e15775027ecce66fd792bbf0e5bf5ff9b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ff42c65400"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000f40)=@newlink={0x34, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_TX_RATE={0xc, 0x4}]}]}]}, 0x34}}, 0x0) [ 769.888913][T27447] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 769.957418][T27447] device bridge161 entered promiscuous mode [ 769.997061][T27452] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 770.012942][T27458] IPVS: ftp: loaded support on port[0] = 21 [ 770.032255][T27457] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 770.057715][T27457] device bridge161 left promiscuous mode [ 770.114245][T10898] net_ratelimit: 95 callbacks suppressed [ 770.114255][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.426921][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:04 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r0, 0x29, 0x1f, 0x0, &(0x7f00000000c0)) [ 770.534975][T27443] virt_wifi0 speed is unknown, defaulting to 1000 19:14:04 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r5, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32, @ANYBLOB="000000000400000008000a00", @ANYRES32=r5], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r5, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:04 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000900)=ANY=[], 0x3ff800) ioctl$FITRIM(r0, 0x4030582b, &(0x7f0000000080)={0x0, 0x400000, 0xdce9}) 19:14:04 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, 0x0, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 770.808609][T27472] IPVS: ftp: loaded support on port[0] = 21 [ 771.146998][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.163927][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.462983][ T28] audit: type=1800 audit(1601752445.019:246): pid=27482 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed comm="syz-executor.2" name="memory.events" dev="sda1" ino=16318 res=0 errno=0 [ 771.549571][ T28] audit: type=1800 audit(1601752445.049:247): pid=27488 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed comm="syz-executor.2" name="memory.events" dev="sda1" ino=16318 res=0 errno=0 19:14:05 executing program 2: r0 = socket(0x200000000000011, 0xa, 0x0) getsockopt$sock_int(r0, 0x1, 0x1c, 0x0, &(0x7f0000001180)) [ 771.797540][T11211] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.867900][T27476] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 771.887474][T27476] device bridge162 entered promiscuous mode [ 771.896647][T27481] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 771.906249][T27481] device bridge162 left promiscuous mode [ 772.273206][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.453350][T27458] virt_wifi0 speed is unknown, defaulting to 1000 [ 772.460296][T27443] virt_wifi0 speed is unknown, defaulting to 1000 [ 772.944089][T27458] virt_wifi0 speed is unknown, defaulting to 1000 [ 773.127029][ T6840] tipc: TX() has been purged, node left! 19:14:06 executing program 2: r0 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x13, 0x4, &(0x7f0000000000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x8, 0x34, 0x0, 0x0, 0x98000000}, [@call={0x25}]}, &(0x7f0000000140)='GPL\x00', 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x1e}, 0x64) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r0, 0x0, 0xe, 0x0, &(0x7f0000000040)="07f9cd51b24d81a611a3a3b549b6", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) [ 773.315655][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:07 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="139b0000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) 19:14:07 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, 0x0, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:07 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r5, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32, @ANYBLOB="000000000400000008000a00", @ANYRES32=r5], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r5, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@newlink={0x58, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1f, 0x12, 0x0, 0x1, @vti={{0x8, 0x1, 'vti\x00'}, {0x24, 0x2, 0x0, 0x1, [@IFLA_VTI_REMOTE={0x8, 0x5, @remote}, @vti_common_policy=[@IFLA_VTI_LINK, @IFLA_VTI_LINK={0x8}, @IFLA_VTI_IKEY={0x8}]]}}}, @IFLA_PROTO_DOWN={0x5}]}, 0x58}}, 0x0) 19:14:07 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:07 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe847a071") r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="130000001500010100000000000000000a000000", @ANYRES32=0x0, @ANYBLOB="1400020000000000000000000000ffffac1414bb0800080000000000"], 0x34}}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) [ 774.345759][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.482190][T27559] netlink: 19 bytes leftover after parsing attributes in process `syz-executor.1'. [ 774.519939][T27560] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:14:08 executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000680)=[@in={0x2, 0x0, @rand_addr=0x40}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1}, 0x20) [ 774.568886][T27565] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 774.597088][T27560] device bridge163 entered promiscuous mode [ 774.613520][T27568] IPVS: ftp: loaded support on port[0] = 21 [ 774.654936][T27571] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 774.680520][T27571] device bridge163 left promiscuous mode 19:14:08 executing program 1: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@const={0x0, 0x0, 0x0, 0xa, 0x5000000}]}}, &(0x7f0000000200)=""/235, 0x26, 0xeb, 0x1}, 0x20) 19:14:08 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000280)={'veth0_vlan\x00', &(0x7f0000000340)=@ethtool_drvinfo={0x3, "9b673bd431278987a54108af17033bf5461bb8e195782291e61a12d689d00bea", "237b918fff0d55d2003734c10ca06d60d8d6ae489bcf4f03f9fd7f01b47d8710", "aacc6ca8fe56f8f02ac4239ecde582252fce81826313465aa0f648c45a0faf48", "31340e8a1b909784de2dfcf6df3ef08f4afa233d52d4c1542cc1b3a55ab8999b", "d28eec437405d5ef7db363035bc871f20fb7ea085347504569b37c381664646d", "3220655c49b3078fc7a5920c"}}) [ 775.213381][T27565] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 775.224942][T27568] virt_wifi0 speed is unknown, defaulting to 1000 19:14:08 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r5, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32, @ANYBLOB="000000000400000008000a00", @ANYRES32=r5], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r5, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:08 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="139b0000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) 19:14:08 executing program 1: socketpair$unix(0x1, 0x4000000000002, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x347, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) r3 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$SIOCGSTAMPNS(0xffffffffffffffff, 0x8907, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{r3, 0x0, 0x64}, {r1, 0x8124}, {}], 0x3, &(0x7f00000002c0)={0x0, r2+10000000}, 0x0, 0x0) 19:14:09 executing program 2: socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r0, 0x10f, 0x84, &(0x7f0000000100), &(0x7f0000000240)=0x4) 19:14:09 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, 0x0, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 775.516084][T27595] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 775.562842][T27597] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:14:09 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="139b0000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) [ 775.646669][T27597] device bridge164 entered promiscuous mode 19:14:09 executing program 2: r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2718, 0x0, &(0x7f0000000e40)) [ 775.702908][T27607] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 775.865639][T27614] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 775.878228][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.923291][T27607] device bridge164 left promiscuous mode [ 776.370276][T27568] virt_wifi0 speed is unknown, defaulting to 1000 [ 776.905922][ T7] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 776.925607][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:10 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:10 executing program 2: mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x2, 0x840000000000a132, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000140), 0xff4d) sendfile(r2, r1, 0x0, 0xffffffff800) sendfile(r2, r1, &(0x7f0000000040), 0x100000001) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) 19:14:10 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:10 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="139b0000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) 19:14:10 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x28, 0x3, 0x8, 0x201, 0x0, 0x0, {}, [@CTA_TIMEOUT_L3PROTO={0x6}, @CTA_TIMEOUT_DATA={0x4, 0x4, 0x0, 0x1, @sctp}, @CTA_TIMEOUT_L4PROTO={0x5}]}, 0x28}}, 0x0) 19:14:10 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x97}], 0x1, &(0x7f00000001c0)=""/4, 0x4, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 777.176054][ T28] audit: type=1804 audit(1601752450.739:248): pid=27648 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/534/memory.events" dev="sda1" ino=16382 res=1 errno=0 [ 777.192383][T27653] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 777.214184][T27651] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 777.227516][ T28] audit: type=1800 audit(1601752450.739:249): pid=27648 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16382 res=0 errno=0 [ 777.257361][T27656] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=27656 comm=syz-executor.4 19:14:10 executing program 1: r0 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) ioctl$SIOCAX25GETUID(r0, 0x89e0, &(0x7f0000000100)={0x3, @default}) [ 777.288391][T27653] device bridge165 entered promiscuous mode [ 777.339882][T27661] IPVS: ftp: loaded support on port[0] = 21 [ 777.348830][T27662] netlink: 'syz-executor.4': attribute type 25 has an invalid length. 19:14:11 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="139b0000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) [ 777.404309][T27662] device bridge165 left promiscuous mode [ 777.407143][ T28] audit: type=1804 audit(1601752450.739:250): pid=27648 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/534/memory.events" dev="sda1" ino=16382 res=1 errno=0 19:14:11 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000800)='/dev/ppp\x00', 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)) [ 777.594657][ T28] audit: type=1804 audit(1601752450.859:251): pid=27648 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/534/memory.events" dev="sda1" ino=16382 res=1 errno=0 [ 777.625193][T27672] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 777.955591][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:11 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="139b0000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) [ 777.986083][ T28] audit: type=1804 audit(1601752451.549:252): pid=27648 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/534/memory.events" dev="sda1" ino=16382 res=1 errno=0 [ 778.040713][T27661] virt_wifi0 speed is unknown, defaulting to 1000 19:14:11 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:11 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f00000000c0)='cgroup.threads\x00', 0x2, 0x0) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) [ 778.169082][ T28] audit: type=1804 audit(1601752451.549:253): pid=27678 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/534/memory.events" dev="sda1" ino=16382 res=1 errno=0 [ 778.321128][T27691] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 778.348401][ T28] audit: type=1804 audit(1601752451.549:254): pid=27678 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/534/memory.events" dev="sda1" ino=16382 res=1 errno=0 [ 778.354592][T27692] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 778.412671][T27695] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=27695 comm=syz-executor.4 [ 778.527525][T27692] device bridge166 entered promiscuous mode [ 778.560100][T27699] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 778.586253][T27699] device bridge166 left promiscuous mode [ 778.940960][T27661] virt_wifi0 speed is unknown, defaulting to 1000 [ 779.137388][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:13 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:13 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x97}], 0x1, &(0x7f00000001c0)=""/4, 0x4, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:13 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="139b0000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) 19:14:13 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000001c0)={0x14, 0x14, 0x1}, 0x14}}, 0x0) 19:14:13 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:13 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000300)='westwood\x00', 0x9) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000004540)={0xa, 0x4e20, 0x0, @private2={0xfc, 0x2, [], 0x1}}, 0x1c) sendmmsg$inet(r1, &(0x7f00000010c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) write$cgroup_int(r2, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0xf000) sendfile(r4, r5, 0x0, 0xf03b0000) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r5, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, 0x0, 0x4, 0x70bd25, 0x25dfdbfe, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10008080}, 0x20048004) ioctl$FITRIM(r3, 0x40305839, &(0x7f0000000100)={0x0, 0x40000000, 0x2be20004}) sendto$inet6(r0, &(0x7f0000000200)="03", 0x1, 0x20000000, 0x0, 0x0) r6 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_SIOCGSKNS(r6, 0x894c, &(0x7f00000002c0)=0x7fffffff) [ 779.403406][ T6840] tipc: TX() has been purged, node left! [ 779.409925][ T6840] tipc: TX() has been purged, node left! [ 779.536462][T27734] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 779.602336][T27736] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:14:13 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080), 0xe) 19:14:13 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="139b0000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) [ 779.661022][T27743] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=27743 comm=syz-executor.4 [ 779.699001][T27736] device bridge167 entered promiscuous mode [ 779.729231][T27749] IPVS: ftp: loaded support on port[0] = 21 [ 779.771998][T27748] device bridge167 left promiscuous mode 19:14:13 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000280)={0x1f, 0xffff, 0x4}, 0x6) write$binfmt_misc(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0000002c03000002000eac0ae4ddc39e6e1a7e7dfc87d0e6942ee14315221f1488b1364520d767e284a450bd39627da5ee19433862a979523a6738666ff637daa6"], 0x9) 19:14:13 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:13 executing program 2: sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000600), 0x4) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860073ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 19:14:14 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, 0x0, 0x0) sendfile(r2, r1, 0x0, 0x100000001) [ 780.455104][T27769] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=27769 comm=syz-executor.4 [ 780.558439][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 780.602182][T27767] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 780.642572][T27767] device bridge168 entered promiscuous mode [ 780.668568][T27771] validate_nla: 2 callbacks suppressed [ 780.668579][T27771] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 780.702196][T27771] device bridge168 left promiscuous mode [ 780.763760][ T28] audit: type=1804 audit(1601752454.319:255): pid=27775 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/497/cgroup.controllers" dev="sda1" ino=16364 res=1 errno=0 [ 781.385252][T11211] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.634470][ T8194] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 782.031725][ T7] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 782.666589][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:16 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0xf000) sendfile(0xffffffffffffffff, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:16 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x97}], 0x1, &(0x7f00000001c0)=""/4, 0x4, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:16 executing program 2: sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000600), 0x4) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860073ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 19:14:16 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="139b0000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) 19:14:16 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:16 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, 0x0, 0x0) sendfile(r2, r1, 0x0, 0x100000001) [ 783.149723][T27791] netlink: 'syz-executor.5': attribute type 2 has an invalid length. 19:14:16 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) [ 783.216292][T27795] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 783.270051][T27799] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=27799 comm=syz-executor.4 [ 783.322374][ T28] audit: type=1804 audit(1601752456.879:256): pid=27800 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/498/cgroup.controllers" dev="sda1" ino=16369 res=1 errno=0 [ 783.387954][T27795] device bridge169 entered promiscuous mode [ 783.388841][T27803] IPVS: ftp: loaded support on port[0] = 21 [ 783.431764][T27805] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 783.460858][T27805] device bridge169 left promiscuous mode [ 783.530374][T27810] netlink: 'syz-executor.5': attribute type 2 has an invalid length. 19:14:17 executing program 2: setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000000)="a2e6fa9a", 0x4) r0 = socket$inet(0x2, 0x100000000805, 0x0) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000280)={r2}, 0x8) [ 783.731901][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:17 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, 0x0, 0x0) sendfile(r2, r1, 0x0, 0x100000001) 19:14:17 executing program 2: socket$inet_udp(0x2, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580)='batadv\x00') socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000400)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)={0x1c, 0x0, 0x0, 0x0, 0x0, {0xf, 0x10}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}]}, 0x1c}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r3, @ANYRES32=r6], 0x4}}, 0x0) sendfile(r2, r1, 0x0, 0x10000fff9) 19:14:17 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) 19:14:17 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, 0x0, 0x0, &(0x7f00000001c0)=""/4, 0x4, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 784.288733][T27824] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 784.303403][ T28] audit: type=1804 audit(1601752457.859:257): pid=27825 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/499/cgroup.controllers" dev="sda1" ino=16365 res=1 errno=0 [ 784.367110][T27823] netlink: 1066 bytes leftover after parsing attributes in process `syz-executor.2'. [ 784.395946][ T28] audit: type=1804 audit(1601752457.909:258): pid=27823 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/542/cgroup.controllers" dev="sda1" ino=16379 res=1 errno=0 [ 784.586796][ T776] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.601538][ T28] audit: type=1804 audit(1601752457.919:259): pid=27823 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/542/cgroup.controllers" dev="sda1" ino=16379 res=1 errno=0 [ 784.709432][ T28] audit: type=1804 audit(1601752458.139:260): pid=27827 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/542/cgroup.controllers" dev="sda1" ino=16379 res=1 errno=0 [ 784.740427][ T28] audit: type=1804 audit(1601752458.159:261): pid=27823 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/542/cgroup.controllers" dev="sda1" ino=16379 res=1 errno=0 [ 784.776490][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 784.808867][ T28] audit: type=1804 audit(1601752458.189:262): pid=27827 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/542/cgroup.controllers" dev="sda1" ino=16379 res=1 errno=0 [ 785.794300][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.985635][ T6840] tipc: TX() has been purged, node left! 19:14:20 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0xf000) sendfile(0xffffffffffffffff, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:20 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:20 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 19:14:20 executing program 2: socket$inet6(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) socket$inet6_sctp(0xa, 0x0, 0x84) 19:14:20 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, 0x0, 0x0) sendfile(r2, r1, 0x0, 0x100000001) 19:14:20 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, 0x0, 0x0, &(0x7f00000001c0)=""/4, 0x4, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 786.563125][T27847] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 786.595881][T27849] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 786.620208][T27855] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=27855 comm=syz-executor.4 [ 786.623409][T27847] device bridge170 entered promiscuous mode [ 786.650401][T27858] ipt_CLUSTERIP: ipt_CLUSTERIP is deprecated and it will removed soon, use xt_cluster instead [ 786.665204][ T28] audit: type=1804 audit(1601752460.219:263): pid=27857 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/500/cgroup.controllers" dev="sda1" ino=16370 res=1 errno=0 [ 786.699406][T27866] ipt_CLUSTERIP: Please specify destination IP [ 786.708355][T27862] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 786.739870][T27863] IPVS: ftp: loaded support on port[0] = 21 [ 786.769592][T27862] device bridge170 left promiscuous mode [ 786.826957][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 786.997654][T27878] ipt_CLUSTERIP: Please specify destination IP 19:14:20 executing program 2: socket$inet6(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) socket$inet6_sctp(0xa, 0x0, 0x84) 19:14:20 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 787.367829][T27863] virt_wifi0 speed is unknown, defaulting to 1000 19:14:21 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) [ 787.414965][ T28] audit: type=1804 audit(1601752460.969:264): pid=27888 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/501/cgroup.controllers" dev="sda1" ino=16384 res=1 errno=0 [ 787.431433][T27884] ipt_CLUSTERIP: no config found for 224.0.0.1, need 'new' 19:14:21 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="28000000100001040000", @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:21 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, 0x0, 0x0, &(0x7f00000001c0)=""/4, 0x4, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:21 executing program 2: socket$inet6(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) socket$inet6_sctp(0xa, 0x0, 0x84) [ 787.665802][T27896] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 787.787831][ T311] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 787.877641][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 787.941606][T27904] ipt_CLUSTERIP: no config found for 224.0.0.1, need 'new' [ 788.039302][T27899] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 788.118800][T27899] device bridge171 entered promiscuous mode [ 788.164448][T27903] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 788.183114][T27907] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 788.205236][T27907] device bridge171 left promiscuous mode [ 788.465192][T27863] virt_wifi0 speed is unknown, defaulting to 1000 [ 788.944165][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:22 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0xf000) sendfile(0xffffffffffffffff, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:22 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x100000001) 19:14:22 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) 19:14:22 executing program 2: socket$inet6(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) socket$inet6_sctp(0xa, 0x0, 0x84) 19:14:22 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="28000000100001040000", @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:22 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000), 0x0, &(0x7f00000001c0)=""/4, 0x4, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 789.150547][T27949] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 789.172026][T27953] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 789.251047][T27953] device bridge172 entered promiscuous mode [ 789.259721][T27964] ipt_CLUSTERIP: Please specify destination IP [ 789.280758][T27959] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 789.291236][ T28] audit: type=1804 audit(1601752462.839:265): pid=27960 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/502/cgroup.controllers" dev="sda1" ino=16377 res=1 errno=0 19:14:22 executing program 5: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) 19:14:22 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x100000001) [ 789.341740][T27966] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 789.375313][T27966] device bridge172 left promiscuous mode [ 789.400894][T27969] IPVS: ftp: loaded support on port[0] = 21 19:14:23 executing program 2: socket$inet6(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) socket$inet6_sctp(0xa, 0x0, 0x84) 19:14:23 executing program 5: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) [ 789.715721][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 789.724053][ T28] audit: type=1804 audit(1601752463.279:266): pid=27981 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/503/cgroup.controllers" dev="sda1" ino=15877 res=1 errno=0 19:14:23 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x100000001) 19:14:23 executing program 5: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) [ 789.846222][T27988] ipt_CLUSTERIP: Please specify destination IP [ 789.945211][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 789.992116][T27969] virt_wifi0 speed is unknown, defaulting to 1000 [ 790.168476][ T28] audit: type=1804 audit(1601752463.729:267): pid=27999 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/504/cgroup.controllers" dev="sda1" ino=16379 res=1 errno=0 [ 790.630018][T27969] virt_wifi0 speed is unknown, defaulting to 1000 [ 790.995042][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 791.003216][ T5] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:24 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, 0xffffffffffffffff, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:24 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="28000000100001040000", @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:24 executing program 5: r0 = socket$kcm(0x10, 0x0, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) 19:14:24 executing program 2: socket$inet6(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) 19:14:24 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000), 0x0, &(0x7f00000001c0)=""/4, 0x4, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:24 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:24 executing program 5: r0 = socket$kcm(0x10, 0x0, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) [ 791.314267][T28031] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 791.411710][T28045] ipt_CLUSTERIP: Please specify destination IP [ 791.422069][ T28] audit: type=1804 audit(1601752464.979:268): pid=28043 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/505/cgroup.controllers" dev="sda1" ino=15736 res=1 errno=0 [ 791.446298][T28047] IPVS: ftp: loaded support on port[0] = 21 [ 791.451045][T28031] device bridge173 entered promiscuous mode [ 791.531322][T28041] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 791.562542][T28049] netlink: 'syz-executor.4': attribute type 25 has an invalid length. 19:14:25 executing program 2: socket$inet6(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) socket$inet_tcp(0x2, 0x1, 0x0) 19:14:25 executing program 5: r0 = socket$kcm(0x10, 0x0, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) [ 791.584206][T28049] device bridge173 left promiscuous mode 19:14:25 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:25 executing program 5: socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) 19:14:25 executing program 2: socket$inet6(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) socket$inet_tcp(0x2, 0x1, 0x0) [ 792.025507][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.068650][ T28] audit: type=1804 audit(1601752465.629:269): pid=28071 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/506/cgroup.controllers" dev="sda1" ino=15890 res=1 errno=0 [ 792.915033][T11211] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 793.071122][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 793.196493][ T6840] tipc: TX() has been purged, node left! [ 793.205176][ T6840] tipc: TX() has been purged, node left! [ 793.545926][ T776] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:27 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, 0xffffffffffffffff, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:27 executing program 5: socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) 19:14:27 executing program 2: socket$inet6(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) 19:14:27 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000), 0x0, &(0x7f00000001c0)=""/4, 0x4, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:27 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400000000000000", @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:27 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 794.105206][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 794.200591][T28088] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 794.242532][T28088] device bridge174 entered promiscuous mode [ 794.258314][T28096] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:14:27 executing program 5: socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0xfeff0000, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500bd", 0x2e}], 0x1}, 0x0) [ 794.297758][T28088] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 794.306860][ T28] audit: type=1804 audit(1601752467.859:270): pid=28104 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/507/cgroup.controllers" dev="sda1" ino=16242 res=1 errno=0 [ 794.363959][T28088] device bridge174 left promiscuous mode [ 794.390961][T28103] IPVS: ftp: loaded support on port[0] = 21 19:14:28 executing program 2: socket$inet6(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) 19:14:28 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, 0x0, 0x0) 19:14:28 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r1, 0xffffffffffffffff, 0x0, 0x100000001) 19:14:28 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, 0x0, 0x0) 19:14:28 executing program 2: socket$inet6(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) [ 795.206067][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.467590][ T7] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 796.305915][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:30 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, 0xffffffffffffffff, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:30 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r1, 0xffffffffffffffff, 0x0, 0x100000001) 19:14:30 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, 0x0, 0x0) 19:14:30 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400000000000000", @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:30 executing program 2: socket$inet6(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) 19:14:30 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000)=[{0x0}], 0x1, &(0x7f00000001c0)=""/4, 0x4, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 797.385818][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:31 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) [ 797.471624][T28149] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:14:31 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r1, 0xffffffffffffffff, 0x0, 0x100000001) [ 797.543878][T28149] device bridge175 entered promiscuous mode [ 797.595490][T28156] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 797.632149][T28161] netlink: 'syz-executor.4': attribute type 25 has an invalid length. 19:14:31 executing program 2: socket$inet6(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) [ 797.645947][T28162] IPVS: ftp: loaded support on port[0] = 21 [ 797.667085][T28161] device bridge175 left promiscuous mode 19:14:31 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) 19:14:31 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:31 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) [ 798.025672][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 798.271098][T28162] virt_wifi0 speed is unknown, defaulting to 1000 [ 798.714931][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 798.846587][ T28] audit: type=1804 audit(1601752472.409:271): pid=28188 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/511/cgroup.controllers" dev="sda1" ino=16307 res=1 errno=0 [ 798.871537][T28162] virt_wifi0 speed is unknown, defaulting to 1000 19:14:32 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:32 executing program 2: socket$inet6(0xa, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) 19:14:32 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)}, 0x0) 19:14:32 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400000000000000", @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:32 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000)=[{0x0}], 0x1, &(0x7f00000001c0)=""/4, 0x4, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:32 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 799.267114][ T21] tipc: TX() has been purged, node left! [ 799.305993][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 799.355281][T28225] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:14:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)}, 0x0) 19:14:33 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) [ 799.453302][T28225] device bridge176 entered promiscuous mode [ 799.508000][T28233] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 799.536609][T28238] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 799.573810][T28238] device bridge176 left promiscuous mode 19:14:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)}, 0x0) [ 799.794286][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:33 executing program 2: socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) 19:14:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) 19:14:33 executing program 2: socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) [ 800.147955][ T28] audit: type=1804 audit(1601752473.709:272): pid=28235 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/512/cgroup.controllers" dev="sda1" ino=16371 res=1 errno=0 19:14:33 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:33 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:33 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/18, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) 19:14:33 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000)=[{0x0}], 0x1, &(0x7f00000001c0)=""/4, 0x4, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:33 executing program 2: socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0xffffffff, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) 19:14:34 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) 19:14:34 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, 0x0, 0x0) 19:14:34 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)}], 0x1}, 0x0) [ 800.773598][ T28] audit: type=1804 audit(1601752474.329:273): pid=28282 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/513/cgroup.controllers" dev="sda1" ino=16365 res=1 errno=0 [ 800.804722][T28270] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:14:34 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, 0x0, 0x0) [ 800.847516][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:34 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 800.909600][T28270] device bridge177 entered promiscuous mode [ 800.949278][T28273] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 800.973974][T28277] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 800.995432][T28277] device bridge177 left promiscuous mode 19:14:34 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)}], 0x1}, 0x0) [ 801.225880][ T776] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:34 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:34 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, 0x0, 0x0) 19:14:35 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/18, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:35 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:35 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)}], 0x1}, 0x0) 19:14:35 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) 19:14:35 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:35 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x97}], 0x1, 0x0, 0x0, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:35 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) [ 801.725212][T28313] ipt_CLUSTERIP: Please specify destination IP 19:14:35 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012", 0x17}], 0x1}, 0x0) 19:14:35 executing program 1: write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r1, r0, 0x0, 0x100000001) [ 801.953694][T28327] ipt_CLUSTERIP: Please specify destination IP 19:14:35 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0x0, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) [ 802.066219][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 802.087702][T28319] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:14:35 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012", 0x17}], 0x1}, 0x0) 19:14:35 executing program 1: write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r1, r0, 0x0, 0x100000001) [ 802.176685][T28319] device bridge178 entered promiscuous mode [ 802.230236][T28324] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 802.257983][T28329] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 802.278961][T28329] device bridge178 left promiscuous mode [ 802.297239][T28338] ipt_CLUSTERIP: Please specify destination IP [ 802.511055][T11211] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:36 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/18, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:36 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0x0, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) 19:14:36 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012", 0x17}], 0x1}, 0x0) 19:14:36 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:36 executing program 1: write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r1, r0, 0x0, 0x100000001) 19:14:36 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x97}], 0x1, 0x0, 0x0, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 802.982751][T28353] ipt_CLUSTERIP: Please specify destination IP 19:14:36 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:36 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e", 0x23}], 0x1}, 0x0) 19:14:36 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0x0, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) [ 803.112851][T28359] IPVS: ftp: loaded support on port[0] = 21 [ 803.161841][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:36 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:36 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e", 0x23}], 0x1}, 0x0) [ 803.320458][T28373] ipt_CLUSTERIP: Please specify destination IP [ 803.353034][ T8223] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 803.382788][T28358] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:14:37 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) [ 803.467065][T28358] device bridge179 entered promiscuous mode [ 803.514638][T28362] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 803.543389][T28365] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 803.567890][T28365] device bridge179 left promiscuous mode [ 803.578684][T28380] ipt_CLUSTERIP: no config found for 224.0.0.1, need 'new' 19:14:37 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/19, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:37 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) 19:14:37 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 804.041863][T28386] ipt_CLUSTERIP: no config found for 224.0.0.1, need 'new' [ 804.150571][T28389] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 804.208664][T28389] device bridge180 entered promiscuous mode [ 804.234998][T28390] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 804.247075][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 804.263101][T28389] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 804.281801][T28389] device bridge180 left promiscuous mode [ 804.426185][ T7] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 805.334929][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:39 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:39 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x97}], 0x1, 0x0, 0x0, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:39 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e", 0x23}], 0x1}, 0x0) 19:14:39 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:39 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x2, 0x3, 0x238, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x1a0, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0xffffffff, 'team0\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local}}}, {{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'wg0\x00', 'team_slave_1\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x298) 19:14:39 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/19, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 806.345711][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 806.356362][ T311] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 806.366365][ T38] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 806.376153][ T8223] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 806.377478][T28404] ipt_CLUSTERIP: no config found for 224.0.0.1, need 'new' [ 806.411759][T28406] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:14:40 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e", 0x29}], 0x1}, 0x0) 19:14:40 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb, 0x1, 'erspan\x00'}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x5}]}}}]}, 0x40}}, 0x0) 19:14:40 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 806.518258][T28406] device bridge181 entered promiscuous mode [ 806.571779][T28411] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 806.600347][T28416] netlink: 'syz-executor.4': attribute type 25 has an invalid length. 19:14:40 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e", 0x29}], 0x1}, 0x0) [ 806.630366][T28416] device bridge181 left promiscuous mode [ 806.643684][T28421] IPVS: ftp: loaded support on port[0] = 21 19:14:40 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:40 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e", 0x29}], 0x1}, 0x0) [ 807.050207][ T28] audit: type=1804 audit(1601752480.609:274): pid=28435 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/525/cgroup.controllers" dev="sda1" ino=16365 res=1 errno=0 [ 807.633146][ T27] net_ratelimit: 1 callbacks suppressed [ 807.633155][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.665441][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e256425", 0x2c}], 0x1}, 0x0) 19:14:42 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, 0x0, 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:42 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:42 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000000)='NLBL_UNLBL\x00') r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket(0x11, 0x80002, 0x0) setsockopt$packet_int(r2, 0x107, 0x7, &(0x7f0000000000)=0x2, 0x4) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000001000250800000000000000000a000000", @ANYRES32=r5, @ANYBLOB="168c5a70a49a847cac7b2ae63b81ba6365c7d5f599e6585fc68b964618c75ab366bcfdb115a77df4491910640686a6bd5c8cff84fae21b1f49554229f474a808"], 0x20}, 0x1, 0x0, 0x0, 0x44000}, 0x0) bind$packet(r2, &(0x7f0000000480)={0x11, 0x3, r5, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt$inet_sctp_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000000140)={0x6, 0x0, 0xc7e7, 0x3}, 0x8) setsockopt(r2, 0x107, 0x5, &(0x7f0000001000), 0xc5) setsockopt$packet_buf(r2, 0x107, 0x2, &(0x7f0000000000)="78a03c2a59c2bfd9a139d6852b73e774578d55cb9edb9833b85a6bc2fe7d77819d676f0e7ff8cdbbe7517a4bb6d423a1e85cdbcdd1f7d029d7d1cf9cec4ff2905136079aca8aed53d4349bfa71f9560acd7c3bae1276d7a4267aa4d02269e5fde979df08837a06e7b21c12f6c52021876212adeac592c9016851b7e9", 0x7c) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000200)={0x0, {0x2, 0x4e22, @private}, {0x2, 0x4e22, @local}, {0x2, 0x0, @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc6, 0x101}) socket$inet6(0xa, 0x4, 0xdda7) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x74, 0x0, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@NL80211_ATTR_BSS_CTS_PROT={0x5, 0x1c, 0x3}, @NL80211_ATTR_BSS_CTS_PROT, @NL80211_ATTR_BSS_CTS_PROT={0x5, 0x1c, 0x1}, @NL80211_ATTR_BSS_CTS_PROT={0x5, 0x1c, 0xff}, @NL80211_ATTR_BSS_HT_OPMODE={0x6, 0x6d, 0x6316}, @NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x1}, @NL80211_ATTR_BSS_CTS_PROT, @NL80211_ATTR_BSS_CTS_PROT, @NL80211_ATTR_BSS_CTS_PROT]}, 0x74}, 0x1, 0x0, 0x0, 0x4090}, 0x4004040) sendmsg$NL80211_CMD_GET_REG(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="48000200", @ANYRES16=0x0, @ANYBLOB="000425bd7000fedbdf251f0000000400cc0005009200c500000008009a000000000008009a000300000008009a0001000000050092000200000008009a0002000000"], 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x4010) getsockname$l2tp6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, &(0x7f0000000100)=0x20) write$binfmt_misc(r0, &(0x7f0000000100)=ANY=[], 0x6) 19:14:42 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/19, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:42 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:42 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, 0x0, 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 809.027987][T28453] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:14:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e256425", 0x2c}], 0x1}, 0x0) [ 809.140448][T28453] device bridge182 entered promiscuous mode 19:14:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e256425", 0x2c}], 0x1}, 0x0) [ 809.184194][T28458] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 809.200425][T28463] netlink: 'syz-executor.4': attribute type 25 has an invalid length. 19:14:42 executing program 2: ioctl$SIOCRSSCAUSE(0xffffffffffffffff, 0x89e1, &(0x7f0000000080)) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='vegas\x00', 0x6) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000200)='\n', 0xfffffdef, 0x46812, 0x0, 0x1f4) ioctl$sock_SIOCDELRT(0xffffffffffffffff, 0x890c, &(0x7f0000000240)={0x0, @xdp={0x2c, 0x1}, @isdn={0x22, 0xfa, 0x7f, 0x6}, @hci={0x1f, 0x0, 0x2}, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000140)='veth0_to_hsr\x00', 0x1ff, 0x7fffffff, 0x2}) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x46812, 0x0, 0x1f4) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000800)=@newsa={0x154, 0x10, 0x713, 0x0, 0x0, {{@in=@local, @in=@empty}, {@in6=@empty, 0x0, 0x32}, @in6=@empty}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @encap={0x1c, 0x4, {0x1, 0x0, 0x0, @in6=@dev}}]}, 0x154}}, 0x0) [ 809.236376][T28463] device bridge182 left promiscuous mode [ 809.255463][T28470] IPVS: ftp: loaded support on port[0] = 21 19:14:42 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, 0x0, 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500", 0x2d}], 0x1}, 0x0) 19:14:43 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500", 0x2d}], 0x1}, 0x0) [ 809.707235][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:43 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000034000511d25a80648c63940d0135fc60100012400c0002000200000037153e370a0001802e25642500", 0x2d}], 0x1}, 0x0) 19:14:43 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 810.187964][ T7] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 810.406175][T28500] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 810.458569][T28500] device bridge183 entered promiscuous mode [ 810.480302][T28503] bridge183: port 1(bridge_slave_0) entered blocking state [ 810.502506][T28503] bridge183: port 1(bridge_slave_0) entered disabled state [ 810.524868][T28503] device bridge_slave_0 entered promiscuous mode [ 810.532495][T28503] bridge183: port 1(bridge_slave_0) entered blocking state [ 810.539840][T28503] bridge183: port 1(bridge_slave_0) entered forwarding state [ 810.568882][T28505] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 810.745681][ T8194] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.485662][ T7] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:45 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:45 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:45 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000000)={0x50, 0x2, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x50}}, 0x0) 19:14:45 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe847a071") r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r1, 0x29, 0x4d, &(0x7f0000b67000), &(0x7f0000000000)=0x4) 19:14:45 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:45 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 811.785274][ T8194] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:45 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuacct.usage_user\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x7c774aac) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) sendfile(r2, r0, 0x0, 0x7fffffff) socket$inet6_sctp(0xa, 0x0, 0x84) sendfile(r2, r0, 0x0, 0x4000002) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00) [ 811.904290][T28522] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 811.943134][T28522] device bridge184 entered promiscuous mode 19:14:45 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newsa={0x158, 0x10, 0x713, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}, 0x0, 0x32}, @in=@multicast2, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x96}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @replay_esn_val={0x20, 0x17, {0x1, 0x0, 0x0, 0x0, 0x0, 0x2, [0x0]}}]}, 0x158}}, 0x0) [ 811.959239][T28527] device bridge_slave_0 left promiscuous mode [ 811.981407][T28527] bridge183: port 1(bridge_slave_0) entered disabled state [ 812.034396][T28527] bridge184: port 1(bridge_slave_0) entered blocking state [ 812.066477][T28527] bridge184: port 1(bridge_slave_0) entered disabled state 19:14:45 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 812.115398][T28527] device bridge_slave_0 entered promiscuous mode [ 812.130482][T28536] IPVS: ftp: loaded support on port[0] = 21 [ 812.171696][T28527] bridge184: port 1(bridge_slave_0) entered blocking state [ 812.179162][T28527] bridge184: port 1(bridge_slave_0) entered forwarding state [ 812.263521][T28522] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 812.300163][T28536] virt_wifi0 speed is unknown, defaulting to 1000 19:14:46 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:46 executing program 2: r0 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'ip6_vti0\x00', 0x0}) readv(r0, &(0x7f0000000280)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000002c0)=0x596, 0x4) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000d00), 0x400004e, 0x0) 19:14:46 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x10, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 812.708816][T28562] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 812.806375][T28562] device bridge185 entered promiscuous mode [ 812.825771][ T8194] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 812.856346][T28564] device bridge_slave_0 left promiscuous mode [ 812.870418][T28564] bridge184: port 1(bridge_slave_0) entered disabled state [ 812.945840][T28564] bridge185: port 1(bridge_slave_0) entered blocking state [ 812.998861][T28564] bridge185: port 1(bridge_slave_0) entered disabled state [ 813.033049][T28564] device bridge_slave_0 entered promiscuous mode [ 813.068415][T28564] bridge185: port 1(bridge_slave_0) entered blocking state [ 813.075802][T28564] bridge185: port 1(bridge_slave_0) entered forwarding state [ 813.114496][T28569] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 813.294048][T28536] virt_wifi0 speed is unknown, defaulting to 1000 19:14:47 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:47 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x10, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:47 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r2, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:47 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:47 executing program 5: r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$sock_timeval(r0, 0x1, 0x28, 0x0, &(0x7f0000000040)) [ 813.711633][ T7] tipc: TX() has been purged, node left! 19:14:47 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x6db6e559) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) listen(r2, 0x6) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x1e, &(0x7f00000000c0)=[@in], 0x10) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000040), 0xfdf5) [ 813.801439][T28609] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 813.865512][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 813.901970][T28609] device bridge186 entered promiscuous mode [ 813.964994][T28613] device bridge_slave_0 left promiscuous mode [ 813.974672][T28613] bridge185: port 1(bridge_slave_0) entered disabled state [ 813.997348][T28619] IPVS: ftp: loaded support on port[0] = 21 [ 814.037279][T28613] bridge186: port 1(bridge_slave_0) entered blocking state [ 814.080288][T28613] bridge186: port 1(bridge_slave_0) entered disabled state 19:14:47 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000cc0)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000c5b000/0x3000)=nil, 0x3000, 0x0, 0x2011, r0, 0x0) r1 = socket$inet6(0xa, 0x806, 0x0) mmap(&(0x7f0000cd7000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) mmap(&(0x7f0000ff4000/0xb000)=nil, 0xb000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") mmap(&(0x7f0000196000/0x4000)=nil, 0xc07000, 0xffffffffefffffff, 0x8032, 0xffffffffffffffff, 0x0) [ 814.125793][T28613] device bridge_slave_0 entered promiscuous mode [ 814.160566][T28613] bridge186: port 1(bridge_slave_0) entered blocking state [ 814.168062][T28613] bridge186: port 1(bridge_slave_0) entered forwarding state [ 814.295634][T28619] virt_wifi0 speed is unknown, defaulting to 1000 19:14:48 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:48 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x10, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 814.538711][ T28] audit: type=1804 audit(1601752488.099:275): pid=28611 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/533/cgroup.controllers" dev="sda1" ino=16380 res=1 errno=0 [ 814.667540][T28635] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:14:48 executing program 2: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x8000, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000000)=0x1000008, 0x4) 19:14:48 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r2, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 814.773494][T28635] device bridge187 entered promiscuous mode [ 814.821484][T28638] device bridge_slave_0 left promiscuous mode [ 814.841035][T28638] bridge186: port 1(bridge_slave_0) entered disabled state [ 814.906175][T28638] bridge187: port 1(bridge_slave_0) entered blocking state [ 814.917952][ T8194] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:48 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x6db6e559) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) listen(r2, 0x6) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x1e, &(0x7f00000000c0)=[@in], 0x10) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000040), 0xfdf5) [ 814.950268][T28638] bridge187: port 1(bridge_slave_0) entered disabled state [ 815.008588][T28638] device bridge_slave_0 entered promiscuous mode [ 815.050979][T28638] bridge187: port 1(bridge_slave_0) entered blocking state [ 815.058428][T28638] bridge187: port 1(bridge_slave_0) entered forwarding state [ 815.338485][T28619] virt_wifi0 speed is unknown, defaulting to 1000 [ 815.815318][ T28] audit: type=1804 audit(1601752489.369:276): pid=28651 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/534/cgroup.controllers" dev="sda1" ino=16379 res=1 errno=0 [ 815.945994][ T311] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 815.954183][ T8194] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 815.985015][ T28] audit: type=1800 audit(1601752489.369:277): pid=28651 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16379 res=0 errno=0 19:14:49 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:49 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:49 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") unshare(0x2a000400) r1 = socket(0x40000000015, 0x5, 0x0) getsockopt(r1, 0x1, 0x27, &(0x7f0000000100)=""/57, &(0x7f0000000140)=0x39) 19:14:49 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:49 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r2, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:14:49 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000004780)='batadv\x00') ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00', 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000480)={0x24, r3, 0x205, 0x0, 0x0, {0x5}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r5}]}, 0x24}}, 0x0) sendmsg$BATADV_CMD_GET_MESH(r0, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x5c, r3, 0x10, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x4}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1800}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x80000000}]}, 0x5c}}, 0x20000091) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(r7, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) socket$netlink(0x10, 0x3, 0x0) r10 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r9, 0x3}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @local}]}}}]}, 0x40}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c0000001000010800"/20, @ANYRES32=r8, @ANYBLOB="00000000000000001c001a8018000a8014000700fe"], 0x3c}}, 0x0) 19:14:50 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000dec000)={0x9, 0x4, 0x338d, 0x7}, 0x40) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={r0, &(0x7f0000000040), &(0x7f0000000100), 0x3}, 0x20) [ 816.433615][T28688] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 816.554003][T28688] device bridge188 entered promiscuous mode [ 816.556020][T28694] IPVS: ftp: loaded support on port[0] = 21 [ 816.605503][T28693] device bridge_slave_0 left promiscuous mode [ 816.613180][T28693] bridge187: port 1(bridge_slave_0) entered disabled state [ 816.689376][T28693] bridge188: port 1(bridge_slave_0) entered blocking state [ 816.743705][T28693] bridge188: port 1(bridge_slave_0) entered disabled state 19:14:50 executing program 2: connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x0, 0x0, @empty, 0x8000}, 0x1c) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r4, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r7 = accept$alg(r6, 0x0, 0x0) sendmsg$alg(r7, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) splice(r7, 0x0, r5, 0x0, 0x400fffe, 0x0) write(r7, &(0x7f0000000180)="1c0000002200", 0x6) splice(r0, 0x0, r1, 0x0, 0x10000, 0x0) [ 816.807616][T28693] device bridge_slave_0 entered promiscuous mode [ 816.856027][T28693] bridge188: port 1(bridge_slave_0) entered blocking state [ 816.863361][T28693] bridge188: port 1(bridge_slave_0) entered forwarding state 19:14:50 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 816.989610][ T8194] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 817.163689][T28694] virt_wifi0 speed is unknown, defaulting to 1000 [ 817.170527][ T28] audit: type=1800 audit(1601752490.729:278): pid=28691 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16380 res=0 errno=0 19:14:50 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 817.284849][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:50 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x100000000009) accept(r0, 0x0, 0x0) listen(r0, 0x0) sendto$inet(r0, &(0x7f0000000000)="d2", 0x1, 0x0, &(0x7f0000a04000)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) [ 817.327769][T28719] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 817.430777][T28719] device bridge189 entered promiscuous mode 19:14:51 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, 0x0, 0x0) [ 817.483914][T28726] IPVS: ftp: loaded support on port[0] = 21 [ 817.493726][T28721] device bridge_slave_0 left promiscuous mode [ 817.501690][T28721] bridge188: port 1(bridge_slave_0) entered disabled state [ 817.571681][T28721] bridge189: port 1(bridge_slave_0) entered blocking state [ 817.603434][T28721] bridge189: port 1(bridge_slave_0) entered disabled state [ 817.635281][T28721] device bridge_slave_0 entered promiscuous mode [ 817.673584][T28721] bridge189: port 1(bridge_slave_0) entered blocking state [ 817.681019][T28721] bridge189: port 1(bridge_slave_0) entered forwarding state [ 818.036003][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 818.201014][T28726] virt_wifi0 speed is unknown, defaulting to 1000 [ 818.209613][T28694] virt_wifi0 speed is unknown, defaulting to 1000 [ 818.420211][ T28] audit: type=1804 audit(1601752491.979:279): pid=28733 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/536/cgroup.controllers" dev="sda1" ino=16381 res=1 errno=0 [ 818.488883][T28742] IPVS: ftp: loaded support on port[0] = 21 [ 818.570790][ T28] audit: type=1800 audit(1601752491.979:280): pid=28733 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16381 res=0 errno=0 [ 819.044955][T28742] virt_wifi0 speed is unknown, defaulting to 1000 [ 819.062441][T28726] virt_wifi0 speed is unknown, defaulting to 1000 [ 819.069750][ T8194] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:52 executing program 3: connect$netrom(0xffffffffffffffff, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(0xffffffffffffffff, 0x0) unshare(0x40000000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:14:52 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:52 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:52 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, 0x0, 0x0) [ 819.431708][T28773] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 819.556594][T28773] device bridge190 entered promiscuous mode [ 819.617923][T28778] device bridge_slave_0 left promiscuous mode [ 819.624609][T28778] bridge189: port 1(bridge_slave_0) entered disabled state [ 819.727250][T28788] IPVS: ftp: loaded support on port[0] = 21 [ 819.740006][T28778] bridge190: port 1(bridge_slave_0) entered blocking state [ 819.753618][T28778] bridge190: port 1(bridge_slave_0) entered disabled state [ 819.794625][T28778] device bridge_slave_0 entered promiscuous mode [ 819.808903][T28778] bridge190: port 1(bridge_slave_0) entered blocking state [ 819.816386][T28778] bridge190: port 1(bridge_slave_0) entered forwarding state 19:14:53 executing program 2: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000000c0)={{{@in=@rand_addr=0x64010102, @in6=@remote, 0x4e23, 0x2, 0x4e21, 0x918, 0x2, 0x20, 0x20, 0x2f, 0x0, 0xee00}, {0x6, 0x7f, 0x5, 0x800, 0x3, 0x3ff, 0x4, 0x7f}, {0x0, 0x3, 0x2, 0xb1f1}, 0x10001, 0x6e6bbb, 0x2, 0x1, 0x0, 0x2}, {{@in=@remote, 0x4d5, 0x33}, 0x2, @in=@loopback, 0x3502, 0x2, 0x3, 0x2, 0x80, 0x8001, 0x4}}, 0xe8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000004c0)={r0, 0x7, 0x8db}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001600)=ANY=[@ANYBLOB="380000001000050700"/20, @ANYRES32=0x0, @ANYBLOB="7d000000000000001800128008000100736974000c00028008000100", @ANYBLOB="65ebdf9b674aaa8a1f1269e2c0d7109b9b934250b5394e8990f4a5ef2229d9ce8efa09c38ab83ad04dd23cfe76965f07b7dd6f8020af20fa62b423b9852c4e4c1f58c52550844374a725e1a130a5325bfd6055af99ba597e9014de44130d49bf39ea1d61e9a9293ad56bff32539d564cbec84607e25e992376d815763ff2431ed54791ee97c0f82073fe7bdc99455bf92436b9013ac330d3543d85f753"], 0x38}}, 0x0) sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x2000000, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1ceb", 0xf7}, {&(0x7f00000012c0), 0x80fe}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e2c812a5eefbd78546783b6bd280dc4ec1cd015bee7d07f0993d6", 0xd5}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}, 0x631b0000}], 0x400000000000132, 0x4002bcb) 19:14:53 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 820.115590][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 820.129232][T28788] virt_wifi0 speed is unknown, defaulting to 1000 [ 820.146512][ T28] audit: type=1804 audit(1601752493.709:281): pid=28775 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/537/cgroup.controllers" dev="sda1" ino=16361 res=1 errno=0 [ 820.188809][T28742] virt_wifi0 speed is unknown, defaulting to 1000 19:14:53 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:54 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, 0x0, 0x0) [ 820.610068][T28807] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 820.685912][T28807] device bridge191 entered promiscuous mode [ 820.751590][T28813] device bridge_slave_0 left promiscuous mode [ 820.767938][T28813] bridge190: port 1(bridge_slave_0) entered disabled state [ 820.846602][T28813] bridge191: port 1(bridge_slave_0) entered blocking state 19:14:54 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 820.901451][T28813] bridge191: port 1(bridge_slave_0) entered disabled state [ 820.957391][T28813] device bridge_slave_0 entered promiscuous mode [ 821.010330][T28813] bridge191: port 1(bridge_slave_0) entered blocking state [ 821.017804][T28813] bridge191: port 1(bridge_slave_0) entered forwarding state 19:14:54 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect(r0, &(0x7f00000001c0)=@in={0x2, 0x0, @remote}, 0xf) [ 821.065901][ T21] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 821.156162][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 821.318023][T28788] virt_wifi0 speed is unknown, defaulting to 1000 [ 822.195216][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 822.626125][ T7] tipc: TX() has been purged, node left! [ 822.632182][ T7] tipc: TX() has been purged, node left! [ 822.642638][ T7] tipc: TX() has been purged, node left! [ 822.649654][ T7] tipc: TX() has been purged, node left! [ 822.985367][ T5] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 822.996913][ T38] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 823.225663][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:14:57 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x100000000009) accept(r0, 0x0, 0x0) listen(r0, 0x0) sendto$inet(r0, &(0x7f0000000000)="d2", 0x1, 0x0, &(0x7f0000a04000)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:14:57 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:57 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:57 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000030c0)={0x14, 0x26, 0x829, 0x0, 0x0, {0x4, 0x1000000}}, 0x14}, 0x1, 0xffffff7f0e000000}, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:14:57 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)}, 0x0) 19:14:57 executing program 3: connect$netrom(0xffffffffffffffff, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(0xffffffffffffffff, 0x0) unshare(0x40000000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 823.793538][T28891] IPVS: ftp: loaded support on port[0] = 21 [ 823.874261][T28897] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:14:57 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 823.941715][T28910] IPVS: ftp: loaded support on port[0] = 21 [ 823.967361][T28897] device bridge192 entered promiscuous mode [ 824.039017][T28909] device bridge_slave_0 left promiscuous mode [ 824.058457][T28909] bridge191: port 1(bridge_slave_0) entered disabled state [ 824.149119][T28909] bridge192: port 1(bridge_slave_0) entered blocking state [ 824.197004][T28909] bridge192: port 1(bridge_slave_0) entered disabled state [ 824.255287][T28909] device bridge_slave_0 entered promiscuous mode [ 824.269274][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 824.303807][T28909] bridge192: port 1(bridge_slave_0) entered blocking state [ 824.311273][T28909] bridge192: port 1(bridge_slave_0) entered forwarding state [ 824.324594][ T28] audit: type=1804 audit(1601752497.879:282): pid=28930 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/541/cgroup.controllers" dev="sda1" ino=16002 res=1 errno=0 [ 824.430198][T28915] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. [ 824.470083][T28891] virt_wifi0 speed is unknown, defaulting to 1000 19:14:58 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:14:58 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000030c0)={0x14, 0x26, 0x829, 0x0, 0x0, {0x4, 0x1000000}}, 0x14}, 0x1, 0xffffff7f0e000000}, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:14:58 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:14:58 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)}, 0x0) [ 824.788646][T28940] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 824.852582][T28940] device bridge193 entered promiscuous mode [ 824.890748][T28943] device bridge_slave_0 left promiscuous mode [ 824.898605][T28943] bridge192: port 1(bridge_slave_0) entered disabled state [ 824.964328][T28943] bridge193: port 1(bridge_slave_0) entered blocking state [ 824.987010][T28943] bridge193: port 1(bridge_slave_0) entered disabled state [ 825.000422][T28943] device bridge_slave_0 entered promiscuous mode [ 825.010370][T28943] bridge193: port 1(bridge_slave_0) entered blocking state [ 825.018002][T28943] bridge193: port 1(bridge_slave_0) entered forwarding state [ 825.056550][ T28] audit: type=1804 audit(1601752498.619:283): pid=28953 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/542/cgroup.controllers" dev="sda1" ino=16002 res=1 errno=0 [ 825.091569][T28951] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. 19:14:58 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 825.305727][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 825.422021][T28910] virt_wifi0 speed is unknown, defaulting to 1000 [ 825.450922][ T28] audit: type=1804 audit(1601752499.009:284): pid=28968 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/543/cgroup.controllers" dev="sda1" ino=15891 res=1 errno=0 [ 825.935075][T28891] virt_wifi0 speed is unknown, defaulting to 1000 [ 826.328095][T28910] virt_wifi0 speed is unknown, defaulting to 1000 [ 826.346930][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:00 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000030c0)={0x14, 0x26, 0x829, 0x0, 0x0, {0x4, 0x1000000}}, 0x14}, 0x1, 0xffffff7f0e000000}, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:00 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x100000000009) accept(r0, 0x0, 0x0) listen(r0, 0x0) sendto$inet(r0, &(0x7f0000000000)="d2", 0x1, 0x0, &(0x7f0000a04000)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:00 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:00 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:15:00 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)}, 0x0) 19:15:00 executing program 3: connect$netrom(0xffffffffffffffff, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(0xffffffffffffffff, 0x0) unshare(0x40000000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 826.826129][ T311] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 826.889424][T29022] IPVS: ftp: loaded support on port[0] = 21 [ 826.900696][T29025] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 826.950281][ T28] audit: type=1804 audit(1601752500.509:285): pid=29032 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/544/cgroup.controllers" dev="sda1" ino=16193 res=1 errno=0 [ 827.014437][T29025] device bridge194 entered promiscuous mode [ 827.032146][T29035] IPVS: ftp: loaded support on port[0] = 21 [ 827.073675][T29034] device bridge_slave_0 left promiscuous mode [ 827.107958][T29034] bridge193: port 1(bridge_slave_0) entered disabled state [ 827.208326][T29034] bridge194: port 1(bridge_slave_0) entered blocking state [ 827.251343][T29034] bridge194: port 1(bridge_slave_0) entered disabled state [ 827.315068][T29034] device bridge_slave_0 entered promiscuous mode 19:15:00 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 827.356936][T29034] bridge194: port 1(bridge_slave_0) entered blocking state [ 827.364446][T29034] bridge194: port 1(bridge_slave_0) entered forwarding state [ 827.385701][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 827.421859][T29038] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. [ 827.497343][T29022] virt_wifi0 speed is unknown, defaulting to 1000 19:15:01 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:01 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000030c0)={0x14, 0x26, 0x829, 0x0, 0x0, {0x4, 0x1000000}}, 0x14}, 0x1, 0xffffff7f0e000000}, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 827.782042][ T28] audit: type=1804 audit(1601752501.339:286): pid=29060 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/545/cgroup.controllers" dev="sda1" ino=16084 res=1 errno=0 [ 827.805197][T29061] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:15:01 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) [ 827.885526][T29061] device bridge195 entered promiscuous mode [ 827.924319][T29063] device bridge_slave_0 left promiscuous mode [ 827.933831][T29063] bridge194: port 1(bridge_slave_0) entered disabled state [ 827.983919][T29063] bridge195: port 1(bridge_slave_0) entered blocking state [ 828.019527][T29063] bridge195: port 1(bridge_slave_0) entered disabled state [ 828.065645][T29063] device bridge_slave_0 entered promiscuous mode 19:15:01 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 828.107700][T29063] bridge195: port 1(bridge_slave_0) entered blocking state [ 828.115165][T29063] bridge195: port 1(bridge_slave_0) entered forwarding state [ 828.181396][T29067] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. 19:15:01 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 828.430117][T29087] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 828.440199][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 828.443865][ T28] audit: type=1804 audit(1601752501.999:287): pid=29088 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/546/cgroup.controllers" dev="sda1" ino=16099 res=1 errno=0 19:15:02 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 828.553626][T29087] device bridge196 entered promiscuous mode [ 828.620938][T29090] device bridge_slave_0 left promiscuous mode [ 828.631310][T29090] bridge195: port 1(bridge_slave_0) entered disabled state [ 828.682069][T29090] bridge196: port 1(bridge_slave_0) entered blocking state [ 828.720326][T29090] bridge196: port 1(bridge_slave_0) entered disabled state [ 828.747789][ T21] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 828.760406][T29090] device bridge_slave_0 entered promiscuous mode [ 828.788518][T29090] bridge196: port 1(bridge_slave_0) entered blocking state [ 828.795934][T29090] bridge196: port 1(bridge_slave_0) entered forwarding state [ 828.828417][T29091] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. [ 828.858402][T29035] virt_wifi0 speed is unknown, defaulting to 1000 [ 828.865821][T29022] virt_wifi0 speed is unknown, defaulting to 1000 [ 829.475877][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 829.518880][T29035] virt_wifi0 speed is unknown, defaulting to 1000 19:15:03 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x100000000009) accept(r0, 0x0, 0x0) listen(r0, 0x0) sendto$inet(r0, &(0x7f0000000000)="d2", 0x1, 0x0, &(0x7f0000a04000)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:03 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:15:03 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:03 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:03 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) 19:15:03 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(0xffffffffffffffff, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 830.187867][T29146] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 830.261494][ T28] audit: type=1804 audit(1601752503.819:288): pid=29151 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/547/cgroup.controllers" dev="sda1" ino=16379 res=1 errno=0 [ 830.269302][T29146] device bridge197 entered promiscuous mode [ 830.307529][T29150] IPVS: ftp: loaded support on port[0] = 21 [ 830.353321][T29156] IPVS: ftp: loaded support on port[0] = 21 [ 830.483358][T29152] device bridge_slave_0 left promiscuous mode [ 830.493773][T29152] bridge196: port 1(bridge_slave_0) entered disabled state [ 830.506095][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 830.569548][T29152] bridge197: port 1(bridge_slave_0) entered blocking state 19:15:04 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 830.618260][T29152] bridge197: port 1(bridge_slave_0) entered disabled state [ 830.674467][T29152] device bridge_slave_0 entered promiscuous mode [ 830.729873][T29152] bridge197: port 1(bridge_slave_0) entered blocking state [ 830.737332][T29152] bridge197: port 1(bridge_slave_0) entered forwarding state [ 830.841984][T29158] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. 19:15:04 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 830.910365][T29156] virt_wifi0 speed is unknown, defaulting to 1000 19:15:04 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 831.007387][ T28] audit: type=1804 audit(1601752504.569:289): pid=29172 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/548/cgroup.controllers" dev="sda1" ino=16379 res=1 errno=0 19:15:04 executing program 0: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, &(0x7f0000000240)) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) 19:15:04 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:15:04 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 831.312413][T29179] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 831.432066][T29179] device bridge198 entered promiscuous mode [ 831.490730][ T28] audit: type=1804 audit(1601752505.049:290): pid=29192 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/549/cgroup.controllers" dev="sda1" ino=16383 res=1 errno=0 [ 831.518100][T29184] device bridge_slave_0 left promiscuous mode [ 831.524413][T29184] bridge197: port 1(bridge_slave_0) entered disabled state [ 831.556124][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 831.608984][T29184] bridge198: port 1(bridge_slave_0) entered blocking state [ 831.672596][T29184] bridge198: port 1(bridge_slave_0) entered disabled state [ 831.745119][T29184] device bridge_slave_0 entered promiscuous mode [ 831.782459][T29184] bridge198: port 1(bridge_slave_0) entered blocking state [ 831.789872][T29184] bridge198: port 1(bridge_slave_0) entered forwarding state [ 831.851427][T29187] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. [ 831.875587][T29187] bridge198: port 1(bridge_slave_0) entered disabled state [ 831.904977][T29187] device bridge198 left promiscuous mode [ 832.211751][T29150] virt_wifi0 speed is unknown, defaulting to 1000 [ 832.218458][T29156] virt_wifi0 speed is unknown, defaulting to 1000 [ 832.587168][ T21] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 832.599799][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 832.898777][T29150] virt_wifi0 speed is unknown, defaulting to 1000 19:15:06 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x100000000009) accept(r0, 0x0, 0x0) listen(r0, 0x0) sendto$inet(r0, &(0x7f0000000000)="d2", 0x1, 0x0, &(0x7f0000a04000)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:06 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:06 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:15:06 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:06 executing program 0: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000030c0)={0x14, 0x26, 0x829, 0x0, 0x0, {0x4, 0x1000000}}, 0x14}, 0x1, 0xffffff7f0e000000}, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 833.293861][T29229] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 833.363628][T29235] IPVS: ftp: loaded support on port[0] = 21 [ 833.378768][T29229] device bridge199 entered promiscuous mode [ 833.457418][T29236] device bridge_slave_0 left promiscuous mode [ 833.469454][T29236] bridge198: port 1(bridge_slave_0) entered disabled state [ 833.544378][T29236] bridge199: port 1(bridge_slave_0) entered blocking state [ 833.582252][T29236] bridge199: port 1(bridge_slave_0) entered disabled state [ 833.624673][T29236] device bridge_slave_0 entered promiscuous mode [ 833.635817][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 833.656995][T29236] bridge199: port 1(bridge_slave_0) entered blocking state [ 833.664283][T29236] bridge199: port 1(bridge_slave_0) entered forwarding state [ 833.732953][T29239] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. [ 833.753639][T29239] bridge199: port 1(bridge_slave_0) entered disabled state [ 833.779722][T29239] device bridge199 left promiscuous mode [ 834.137407][T29235] virt_wifi0 speed is unknown, defaulting to 1000 19:15:07 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:07 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:07 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:15:08 executing program 0: r0 = socket(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0x1c, 0x2, [@TCA_CODEL_INTERVAL={0x8}, @TCA_CODEL_CE_THRESHOLD={0x8}, @TCA_CODEL_LIMIT={0x8}]}}]}, 0x4c}}, 0x0) 19:15:08 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(0xffffffffffffffff, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 834.505958][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 834.555926][T29278] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:15:08 executing program 2: sendto(0xffffffffffffffff, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(0xffffffffffffffff, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:08 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 834.689021][T29278] device bridge200 entered promiscuous mode [ 834.692389][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 834.733469][T29288] IPVS: ftp: loaded support on port[0] = 21 [ 834.769950][T29281] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. [ 834.908416][T29284] device bridge_slave_0 left promiscuous mode [ 834.915349][T29284] bridge199: port 1(bridge_slave_0) entered disabled state [ 834.999748][T29284] bridge200: port 1(bridge_slave_0) entered blocking state [ 835.052956][T29284] bridge200: port 1(bridge_slave_0) entered disabled state [ 835.063938][ T28] audit: type=1804 audit(1601752508.609:291): pid=29305 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/552/cgroup.controllers" dev="sda1" ino=16364 res=1 errno=0 [ 835.104690][T29284] device bridge_slave_0 entered promiscuous mode [ 835.143607][T29284] bridge200: port 1(bridge_slave_0) entered blocking state [ 835.151207][T29284] bridge200: port 1(bridge_slave_0) entered forwarding state [ 835.243211][T29287] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. [ 835.283133][T29287] bridge200: port 1(bridge_slave_0) entered disabled state [ 835.345274][T29287] device bridge200 left promiscuous mode [ 835.579969][T29281] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. [ 835.600077][T29235] virt_wifi0 speed is unknown, defaulting to 1000 [ 835.786345][ T7] tipc: TX() has been purged, node left! [ 835.795734][ T7] tipc: TX() has been purged, node left! [ 835.827397][ T7] tipc: TX() has been purged, node left! [ 835.837632][ T7] tipc: TX() has been purged, node left! [ 835.872341][ T7] tipc: TX() has been purged, node left! [ 835.900728][ T7] tipc: TX() has been purged, node left! [ 836.085614][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 837.156062][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 838.226176][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 838.346592][ T38] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 839.325434][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 839.625845][ T38] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:13 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x100000000009) accept(r0, 0x0, 0x0) listen(r0, 0x0) sendto$inet(r0, &(0x7f0000000000)="d2", 0x1, 0x0, &(0x7f0000a04000)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:13 executing program 2: sendto(0xffffffffffffffff, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(0xffffffffffffffff, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:13 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:15:13 executing program 0: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) connect$x25(r0, &(0x7f0000000000)={0x2, @remote={[], 0x2}}, 0x12) 19:15:13 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:13 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(0xffffffffffffffff, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:15:13 executing program 0: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) r0 = socket$packet(0x11, 0xa, 0x300) syz_emit_ethernet(0x62, &(0x7f0000000040)=ANY=[], 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) [ 839.895965][T29347] IPVS: ftp: loaded support on port[0] = 21 [ 839.898518][T29349] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:15:13 executing program 2: sendto(0xffffffffffffffff, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(0xffffffffffffffff, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 839.920439][ T28] audit: type=1804 audit(1601752513.479:292): pid=29352 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/553/cgroup.controllers" dev="sda1" ino=16370 res=1 errno=0 [ 839.983957][T29354] IPVS: ftp: loaded support on port[0] = 21 19:15:13 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 840.042267][T29349] device bridge201 entered promiscuous mode [ 840.095461][T29355] device bridge_slave_0 left promiscuous mode [ 840.108013][T29355] bridge200: port 1(bridge_slave_0) entered disabled state 19:15:13 executing program 2: r0 = socket(0x0, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 840.162660][T29355] bridge201: port 1(bridge_slave_0) entered blocking state [ 840.202092][T29355] bridge201: port 1(bridge_slave_0) entered disabled state 19:15:13 executing program 0: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000080)={0x0, 0x94c98aa8668467aa, 0x1000}, 0x20) [ 840.261201][T29355] device bridge_slave_0 entered promiscuous mode [ 840.303858][T29355] bridge201: port 1(bridge_slave_0) entered blocking state [ 840.311341][T29355] bridge201: port 1(bridge_slave_0) entered forwarding state [ 840.335055][ T28] audit: type=1804 audit(1601752513.889:293): pid=29372 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/554/cgroup.controllers" dev="sda1" ino=16366 res=1 errno=0 [ 840.397426][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 840.421461][T29358] bridge201: port 1(bridge_slave_0) entered disabled state [ 840.434605][T29358] device bridge201 left promiscuous mode 19:15:14 executing program 2: r0 = socket(0x0, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 840.930788][T29347] virt_wifi0 speed is unknown, defaulting to 1000 [ 841.376791][T29347] virt_wifi0 speed is unknown, defaulting to 1000 [ 841.378422][T29354] virt_wifi0 speed is unknown, defaulting to 1000 [ 841.484831][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 841.777868][T29354] virt_wifi0 speed is unknown, defaulting to 1000 19:15:15 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x100000000009) accept(r0, 0x0, 0x0) listen(r0, 0x0) sendto$inet(r0, &(0x7f0000000000)="d2", 0x1, 0x0, &(0x7f0000a04000)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340)='ethtool\x00') sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)={0x2c, r1, 0x1, 0x0, 0x0, {0x5}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}]}]}, 0x2c}}, 0x0) 19:15:15 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:15:15 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:15 executing program 2: r0 = socket(0x0, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:15 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, 0x0, 0x0) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 842.189453][T11211] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:15 executing program 2: r0 = socket(0x10, 0x0, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 842.344625][T29439] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 842.393220][T29440] IPVS: ftp: loaded support on port[0] = 21 [ 842.422346][T29444] IPVS: ftp: loaded support on port[0] = 21 [ 842.425082][T29439] device bridge202 entered promiscuous mode 19:15:16 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=@can_delroute={0x20, 0x19, 0x1, 0x0, 0x0, {}, [@CGW_FILTER={0xc}]}, 0x20}}, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r1, &(0x7f0000000140), 0xa, 0x0) [ 842.441983][ T28] audit: type=1804 audit(1601752515.999:294): pid=29448 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/555/cgroup.controllers" dev="sda1" ino=16372 res=1 errno=0 [ 842.501140][T29445] device bridge_slave_0 left promiscuous mode [ 842.510360][T29445] bridge201: port 1(bridge_slave_0) entered disabled state [ 842.554660][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 842.564717][T29445] bridge202: port 1(bridge_slave_0) entered blocking state 19:15:16 executing program 2: r0 = socket(0x10, 0x0, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 842.616230][T29445] bridge202: port 1(bridge_slave_0) entered disabled state [ 842.663224][T29445] device bridge_slave_0 entered promiscuous mode [ 842.713369][T29445] bridge202: port 1(bridge_slave_0) entered blocking state [ 842.720816][T29445] bridge202: port 1(bridge_slave_0) entered forwarding state 19:15:16 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 842.802293][T29451] bridge202: port 1(bridge_slave_0) entered disabled state [ 842.830798][T29451] device bridge202 left promiscuous mode 19:15:16 executing program 2: r0 = socket(0x10, 0x0, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:16 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 843.147192][ T28] audit: type=1804 audit(1601752516.709:295): pid=29467 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/556/cgroup.controllers" dev="sda1" ino=16382 res=1 errno=0 [ 843.467111][ T28] audit: type=1804 audit(1601752517.029:296): pid=29474 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/557/cgroup.controllers" dev="sda1" ino=16376 res=1 errno=0 [ 843.496125][T29473] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. [ 843.920164][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 844.115915][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 844.922889][ T7] tipc: TX() has been purged, node left! [ 844.930237][ T7] tipc: TX() has been purged, node left! [ 844.985666][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 845.385946][ T776] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 846.042141][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:19 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x100000000009) accept(r0, 0x0, 0x0) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:19 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(0xffffffffffffffff, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:19 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:19 executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'gre0\x00'}}]}, 0x38}}, 0x0) 19:15:19 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 846.457044][T29488] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 846.471714][ T28] audit: type=1804 audit(1601752520.029:297): pid=29491 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/558/cgroup.controllers" dev="sda1" ino=16382 res=1 errno=0 [ 846.532365][T29492] IPVS: ftp: loaded support on port[0] = 21 [ 846.564164][T29488] device bridge203 entered promiscuous mode [ 846.600055][ T28] audit: type=1800 audit(1601752520.039:298): pid=29491 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.1" name="cgroup.controllers" dev="sda1" ino=16382 res=0 errno=0 [ 846.622954][T29493] device bridge_slave_0 left promiscuous mode [ 846.636337][T29493] bridge202: port 1(bridge_slave_0) entered disabled state [ 846.689056][T29493] bridge203: port 1(bridge_slave_0) entered blocking state [ 846.712406][T29493] bridge203: port 1(bridge_slave_0) entered disabled state [ 846.734367][ T28] audit: type=1804 audit(1601752520.069:299): pid=29489 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/558/cgroup.controllers" dev="sda1" ino=16382 res=1 errno=0 [ 846.792087][T29493] device bridge_slave_0 entered promiscuous mode [ 846.807740][T29493] bridge203: port 1(bridge_slave_0) entered blocking state [ 846.815162][T29493] bridge203: port 1(bridge_slave_0) entered forwarding state [ 846.840090][T29495] bridge203: port 1(bridge_slave_0) entered disabled state [ 846.857989][T29495] device bridge203 left promiscuous mode [ 847.065702][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:20 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, 0x0, 0x0) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:15:20 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(0xffffffffffffffff, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:20 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000640)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020feffff7a0af0fff8ffffff79a4f0ff00000000b70600000018d1fe2d640500000000007504000000ffffffdc04000040000000b704000010000020620700fe00000000850000002f000000b70000000a00000095000000000000006458c2c62fc2868f5ff0d4033eb799009f2ad60399d909a63796c113940c19aab9d6070002000200000000f0d3253730e711f5969f62c28b22756bedf3cf393d14c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dd87235b44174f7c03c3185119e31975e551558055dc2dc2739c2e735d0ab961dac07f4f6d8aa1c3f16765d427c0ecd795e67ec4c16737d5fe95987d63ba25eb45265a2e327a702983b0ae161fda726ee6bdd09f6f806c8f6954e569a12aeb35b791c7f91a63eaef40bb65f32f1488a7fa633bdc286ca34a1897d586c5c22116089ce08958e8a6c73f76756fe51bbdf86de4165f9d262993c49eaf0cc4f6e3beb61f7696adb6d553bda42aceabc38c40641676aece6c3144e68d6d9c5c60bfaee1369519d959485528773344705016ea2282543226fb1a9b28130b46da1130219035ed40dd0b320bd570bb46288edee915da2a26805f891517082f5bfa1721e71f44a8f273761f13762184aa6801699dcf0951d4845f102a74bf330af913f"], &(0x7f0000000280)='GPL\x00'}, 0x48) 19:15:20 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 847.142082][T29492] virt_wifi0 speed is unknown, defaulting to 1000 19:15:20 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c00020008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:21 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(0xffffffffffffffff, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 847.405531][ T28] audit: type=1804 audit(1601752520.969:300): pid=29514 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/559/cgroup.controllers" dev="sda1" ino=16369 res=1 errno=0 [ 847.478911][T29511] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 847.501985][T29516] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 847.542407][T29517] IPVS: ftp: loaded support on port[0] = 21 [ 847.610722][T29516] device bridge204 entered promiscuous mode 19:15:21 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 847.664657][T29519] device bridge_slave_0 left promiscuous mode [ 847.676034][T29519] bridge203: port 1(bridge_slave_0) entered disabled state [ 847.766043][T29519] bridge204: port 1(bridge_slave_0) entered blocking state [ 847.833933][T29519] bridge204: port 1(bridge_slave_0) entered disabled state [ 847.889350][T29519] device bridge_slave_0 entered promiscuous mode [ 847.940701][T29519] bridge204: port 1(bridge_slave_0) entered blocking state [ 847.948119][T29519] bridge204: port 1(bridge_slave_0) entered forwarding state [ 848.039678][T29523] bridge204: port 1(bridge_slave_0) entered disabled state [ 848.057429][T29523] device bridge204 left promiscuous mode [ 848.078076][ T28] audit: type=1804 audit(1601752521.639:301): pid=29531 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/560/cgroup.controllers" dev="sda1" ino=16369 res=1 errno=0 [ 848.111124][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 848.119855][T29530] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 848.535959][T29492] virt_wifi0 speed is unknown, defaulting to 1000 [ 849.145297][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:22 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x100000000009) accept(r0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:22 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:22 executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x5, [@func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{}, {0x0, 0x3}]}]}, {0x0, [0x0, 0x0, 0x0]}}, &(0x7f00000003c0)=""/221, 0x39, 0xdd, 0x1}, 0x20) pipe(0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000080)={@private1, @ipv4={[], [], @multicast1}, @mcast2, 0x6, 0x0, 0x2, 0x100, 0x8001, 0x2000000}) unshare(0x40000000) 19:15:22 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:15:22 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c00020008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 849.422690][T29561] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 849.459023][T29562] IPVS: ftp: loaded support on port[0] = 21 [ 849.486465][ T28] audit: type=1804 audit(1601752523.049:302): pid=29566 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/561/cgroup.controllers" dev="sda1" ino=16376 res=1 errno=0 [ 849.516106][T29560] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 849.538425][T29561] device bridge205 entered promiscuous mode [ 849.550599][T29564] IPVS: ftp: loaded support on port[0] = 21 [ 849.592234][T29565] device bridge_slave_0 left promiscuous mode [ 849.605421][T29565] bridge204: port 1(bridge_slave_0) entered disabled state [ 849.648900][T29565] bridge205: port 1(bridge_slave_0) entered blocking state [ 849.678335][T29565] bridge205: port 1(bridge_slave_0) entered disabled state [ 849.711014][T29565] device bridge_slave_0 entered promiscuous mode [ 849.740290][T29565] bridge205: port 1(bridge_slave_0) entered blocking state [ 849.747717][T29565] bridge205: port 1(bridge_slave_0) entered forwarding state [ 849.817581][T29569] bridge205: port 1(bridge_slave_0) entered disabled state [ 849.839791][T29569] device bridge205 left promiscuous mode [ 849.866822][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 850.195535][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 850.248390][T29578] IPVS: ftp: loaded support on port[0] = 21 [ 850.300712][T29562] virt_wifi0 speed is unknown, defaulting to 1000 [ 850.515842][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 850.851325][T29564] virt_wifi0 speed is unknown, defaulting to 1000 [ 850.858536][T29562] virt_wifi0 speed is unknown, defaulting to 1000 [ 851.237301][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 851.293609][T29578] virt_wifi0 speed is unknown, defaulting to 1000 [ 851.399088][T29564] virt_wifi0 speed is unknown, defaulting to 1000 [ 851.833383][T29578] virt_wifi0 speed is unknown, defaulting to 1000 [ 852.234122][ T7] tipc: TX() has been purged, node left! [ 852.245203][ T7] tipc: TX() has been purged, node left! [ 852.265540][ T7] tipc: TX() has been purged, node left! [ 852.277467][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:26 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:15:26 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:26 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c00020008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:26 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x100000000009) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:26 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, 0x0, 0x0) listen(r0, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:15:26 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 852.606626][T29649] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 852.615265][T29648] IPVS: ftp: loaded support on port[0] = 21 [ 852.627275][ T28] audit: type=1804 audit(1601752526.189:303): pid=29650 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/562/cgroup.controllers" dev="sda1" ino=15890 res=1 errno=0 19:15:26 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 852.710395][T29649] device bridge206 entered promiscuous mode [ 852.769083][T29653] device bridge_slave_0 left promiscuous mode [ 852.790226][T29653] bridge205: port 1(bridge_slave_0) entered disabled state [ 852.815740][T29659] IPVS: ftp: loaded support on port[0] = 21 [ 852.838023][T29653] bridge206: port 1(bridge_slave_0) entered blocking state 19:15:26 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 852.872286][T29653] bridge206: port 1(bridge_slave_0) entered disabled state [ 852.914423][T29653] device bridge_slave_0 entered promiscuous mode [ 852.964017][T29653] bridge206: port 1(bridge_slave_0) entered blocking state [ 852.971409][T29653] bridge206: port 1(bridge_slave_0) entered forwarding state 19:15:26 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 853.068944][T29657] bridge206: port 1(bridge_slave_0) entered disabled state [ 853.082584][T29657] device bridge206 left promiscuous mode [ 853.297662][ T28] audit: type=1804 audit(1601752526.859:304): pid=29674 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/563/cgroup.controllers" dev="sda1" ino=15890 res=1 errno=0 [ 853.325783][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 853.577499][T29648] virt_wifi0 speed is unknown, defaulting to 1000 [ 853.957834][T29648] virt_wifi0 speed is unknown, defaulting to 1000 [ 854.355158][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 855.385337][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 855.626277][ T21] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 855.639949][ T38] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 856.435428][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:30 executing program 0: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, 0x0, 0x0) 19:15:30 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:30 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:15:30 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c000200080019"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:30 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:30 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(0xffffffffffffffff, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 857.407688][T29724] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 857.423748][T29723] IPVS: ftp: loaded support on port[0] = 21 19:15:31 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d01", 0x9, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 857.458992][ T28] audit: type=1804 audit(1601752531.019:305): pid=29729 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/564/cgroup.controllers" dev="sda1" ino=16227 res=1 errno=0 [ 857.472003][T29728] IPVS: ftp: loaded support on port[0] = 21 [ 857.500959][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 857.560205][T29724] device bridge207 entered promiscuous mode 19:15:31 executing program 0: syz_emit_ethernet(0x22, &(0x7f0000000180)={@multicast, @multicast, @val={@void}, {@can={0xc, {{}, 0x0, 0x0, 0x0, 0x0, "fa83e407f7ecf295"}}}}, 0x0) [ 857.608012][T29730] device bridge_slave_0 left promiscuous mode [ 857.614324][T29730] bridge206: port 1(bridge_slave_0) entered disabled state [ 857.696740][T29730] bridge207: port 1(bridge_slave_0) entered blocking state 19:15:31 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d01", 0x9, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 857.742700][T29730] bridge207: port 1(bridge_slave_0) entered disabled state [ 857.820975][T29730] device bridge_slave_0 entered promiscuous mode 19:15:31 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 857.875006][T29730] bridge207: port 1(bridge_slave_0) entered blocking state [ 857.882373][T29730] bridge207: port 1(bridge_slave_0) entered forwarding state 19:15:31 executing program 0: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt(r0, 0x0, 0x0, 0x0, 0x0) 19:15:31 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d01", 0x9, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 858.043877][T29733] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 858.070567][T29733] bridge207: port 1(bridge_slave_0) entered disabled state 19:15:31 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x73, 0x11, 0x98}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) [ 858.113937][T29733] device bridge207 left promiscuous mode [ 858.191415][ T28] audit: type=1804 audit(1601752531.749:306): pid=29751 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/565/cgroup.controllers" dev="sda1" ino=15862 res=1 errno=0 19:15:31 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000", 0xe, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:32 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 858.515490][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:32 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c000200080019"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 858.641642][ T28] audit: type=1804 audit(1601752532.199:307): pid=29765 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/566/cgroup.controllers" dev="sda1" ino=15862 res=1 errno=0 [ 858.979531][T29768] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 859.026368][T29768] device bridge208 entered promiscuous mode [ 859.041837][T29770] device bridge_slave_0 left promiscuous mode [ 859.051024][T29770] bridge207: port 1(bridge_slave_0) entered disabled state [ 859.068091][T29770] bridge208: port 1(bridge_slave_0) entered blocking state [ 859.075950][T29770] bridge208: port 1(bridge_slave_0) entered disabled state [ 859.086762][T29770] device bridge_slave_0 entered promiscuous mode [ 859.100014][T29770] bridge208: port 1(bridge_slave_0) entered blocking state [ 859.107406][T29770] bridge208: port 1(bridge_slave_0) entered forwarding state [ 859.120161][T29771] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 859.145921][T29771] bridge208: port 1(bridge_slave_0) entered disabled state [ 859.153686][T29771] device bridge208 left promiscuous mode [ 859.471831][T11211] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 859.495712][ T776] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 859.505723][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 859.515419][T11211] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 860.594394][T10403] net_ratelimit: 1 callbacks suppressed [ 860.594404][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 860.700791][ T7] tipc: TX() has been purged, node left! [ 861.385867][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 861.396480][ T776] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 861.625127][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:35 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet_sctp(0x2, 0x800000000001, 0x84) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) [ 862.013109][T29781] IPVS: ftp: loaded support on port[0] = 21 [ 862.088673][T29781] virt_wifi0 speed is unknown, defaulting to 1000 19:15:35 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(0xffffffffffffffff, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:15:35 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:15:35 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000", 0xe, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:35 executing program 0: r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) bind(r1, &(0x7f0000000080)=@in={0x2, 0x4e20}, 0x7c) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000080)={0x2, 'veth0_to_hsr\x00', 0x4}, 0x18) r2 = socket$inet(0x2, 0x2, 0x0) r3 = socket(0x40000000015, 0x805, 0x0) getsockopt(r3, 0x114, 0x5, 0x0, &(0x7f00000000c0)) ioctl$IMHOLD_L1(r3, 0x80044948, &(0x7f0000000140)=0x8) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000100)=0xffffffffffffffff, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x3f) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) 19:15:35 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c000200080019"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 862.382383][T29792] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:15:36 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000", 0xe, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 862.460400][T29792] device bridge209 entered promiscuous mode [ 862.487988][ T28] audit: type=1804 audit(1601752536.049:308): pid=29799 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/567/cgroup.controllers" dev="sda1" ino=16383 res=1 errno=0 [ 862.543306][T29796] device bridge_slave_0 left promiscuous mode [ 862.552382][T29796] bridge208: port 1(bridge_slave_0) entered disabled state [ 862.618912][T29803] IPVS: ftp: loaded support on port[0] = 21 [ 862.620435][T29796] bridge209: port 1(bridge_slave_0) entered blocking state [ 862.663429][T29796] bridge209: port 1(bridge_slave_0) entered disabled state [ 862.675334][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 862.711621][T29796] device bridge_slave_0 entered promiscuous mode [ 862.749416][T29796] bridge209: port 1(bridge_slave_0) entered blocking state 19:15:36 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e", 0x10, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 862.756840][T29796] bridge209: port 1(bridge_slave_0) entered forwarding state 19:15:36 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 862.840180][T29800] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 862.866114][T29800] bridge209: port 1(bridge_slave_0) entered disabled state [ 862.904137][T29800] device bridge209 left promiscuous mode 19:15:36 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e", 0x10, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 863.157821][ T28] audit: type=1804 audit(1601752536.719:309): pid=29815 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/568/cgroup.controllers" dev="sda1" ino=16384 res=1 errno=0 19:15:36 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e", 0x10, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:36 executing program 0: r0 = socket$inet_smc(0x2b, 0x1, 0x0) sendmmsg$inet(r0, &(0x7f0000003f00)=[{{0x0, 0x0, &(0x7f0000001d80)=[{&(0x7f0000000c40)="87", 0x1}], 0x1}}], 0x1, 0x0) [ 863.564151][T29781] virt_wifi0 speed is unknown, defaulting to 1000 [ 863.715172][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:38 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet_sctp(0x2, 0x800000000001, 0x84) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) [ 864.609627][T29851] IPVS: ftp: loaded support on port[0] = 21 [ 864.686747][T29851] virt_wifi0 speed is unknown, defaulting to 1000 [ 864.755822][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 865.184873][T29851] virt_wifi0 speed is unknown, defaulting to 1000 [ 865.785086][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 865.995620][ T7] tipc: TX() has been purged, node left! [ 866.001713][ T7] tipc: TX() has been purged, node left! 19:15:39 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(0xffffffffffffffff, 0x0) unshare(0x40000000) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:15:39 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e15", 0x11, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:39 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xa, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000085000000270000009500000009000000ea74ec8cebae2778212caea6af470041d9ef444718f3bad530e4f0d9cc19211c6d7ebc95b66ad7a5b036c5c96a3b5c92ae3b6c496037fe3d5d6b1f0e911cb8e35bd3a642b2acd9968ce3cb0a9d650d1e9ded49cb7c841e5733e6024ed1b8de11e185415d24de89409c793c157c8610e688"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x5d06a6062f96ca6c, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) r0 = socket$kcm(0x29, 0x5, 0x0) getsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}]}, &(0x7f0000000180)=0x10) 19:15:39 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) 19:15:39 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c00020008001900"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:39 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet_sctp(0x2, 0x800000000001, 0x84) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:40 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e15", 0x11, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 866.425945][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 866.426011][T29883] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 866.479173][T29884] IPVS: ftp: loaded support on port[0] = 21 19:15:40 executing program 0: r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1100000018003f00f37f973b00ff0000238a98bc99561cd89d0c240a"], 0x1c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") [ 866.546534][T29883] device bridge210 entered promiscuous mode [ 866.560628][ T28] audit: type=1804 audit(1601752540.119:310): pid=29895 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/569/cgroup.controllers" dev="sda1" ino=16380 res=1 errno=0 [ 866.587881][T29889] device bridge_slave_0 left promiscuous mode [ 866.600113][T29889] bridge209: port 1(bridge_slave_0) entered disabled state [ 866.647003][T29889] bridge210: port 1(bridge_slave_0) entered blocking state [ 866.674633][T29889] bridge210: port 1(bridge_slave_0) entered disabled state 19:15:40 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e15", 0x11, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 866.716841][T29899] IPVS: ftp: loaded support on port[0] = 21 [ 866.724247][T29889] device bridge_slave_0 entered promiscuous mode [ 866.769253][T29889] bridge210: port 1(bridge_slave_0) entered blocking state [ 866.776624][T29889] bridge210: port 1(bridge_slave_0) entered forwarding state [ 866.825992][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 866.828448][T29891] netlink: 'syz-executor.4': attribute type 25 has an invalid length. 19:15:40 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x100000001) [ 866.872810][T29891] bridge210: port 1(bridge_slave_0) entered disabled state [ 866.915241][T29891] device bridge210 left promiscuous mode 19:15:40 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(0xffffffffffffffff, &(0x7f0000004e00), 0x27b, 0x0, 0x0) [ 867.149678][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:40 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(0xffffffffffffffff, r1, 0x0, 0x100000001) [ 867.553880][ T28] audit: type=1804 audit(1601752541.109:311): pid=29920 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/571/cgroup.controllers" dev="sda1" ino=16380 res=1 errno=0 [ 868.006145][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 869.075169][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 870.115366][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:44 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:15:44 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(0xffffffffffffffff, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:44 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c00020008001900"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:44 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(0xffffffffffffffff, r1, 0x0, 0x100000001) 19:15:44 executing program 0: r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @rand_addr=0xdd}}, 0x24) sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="18000000000000001001000001000000ec0000000000003ecc755d7d366fe039a29f9f3ab89f5a4ff43c06d0365ac9e993b7292f0df283aa24d8fca8040f5bbf3bf0d63c25daea50e5958749692a0b621c7d8a66b93d5c0ea387d9a596ed740f5c0848595d3688a9479fffe24fe0d05f0b23d4b8183db258e9ce3386fed943677597209dcde20d247a69c7c775caf632417ed07649076f6cbbba2eb35136087e35a6bf3f4054652ecf5d277007ba023be8d2b350dfd8d6ce63baa01aaa029ca25294cf04a0097dbbb9631ae3fe27"], 0x18}}], 0x1, 0x48010) sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[{0x18, 0x110, 0x1, "ec"}], 0x18}}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000003480)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x40010000, 0x0) [ 870.606651][T29935] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 870.637321][ T28] audit: type=1804 audit(1601752544.199:312): pid=29937 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/572/cgroup.controllers" dev="sda1" ino=16369 res=1 errno=0 [ 870.722172][T29935] device bridge211 entered promiscuous mode [ 870.757103][T29939] device bridge_slave_0 left promiscuous mode [ 870.773294][T29939] bridge210: port 1(bridge_slave_0) entered disabled state [ 870.813599][T29939] bridge211: port 1(bridge_slave_0) entered blocking state [ 870.833865][T29939] bridge211: port 1(bridge_slave_0) entered disabled state [ 870.864637][T29939] device bridge_slave_0 entered promiscuous mode [ 870.891482][T29939] bridge211: port 1(bridge_slave_0) entered blocking state [ 870.898826][T29939] bridge211: port 1(bridge_slave_0) entered forwarding state [ 870.967139][T29943] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 870.988914][T29943] bridge211: port 1(bridge_slave_0) entered disabled state [ 871.030634][T29943] device bridge211 left promiscuous mode [ 871.146331][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:45 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet(0xffffffffffffffff, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:45 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(0xffffffffffffffff, &(0x7f0000004e00), 0x27b, 0x0, 0x0) 19:15:45 executing program 0: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0xb871, 0xffffffffffffffff, 0x0) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, 0x0, 0x0) r0 = socket$inet(0x2, 0x5, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000280)={'lo\x00', {0x2, 0x0, @remote}}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8918, &(0x7f0000000100)={'lo\x00', {0x2, 0x0, @local}}) 19:15:45 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(0xffffffffffffffff, r1, 0x0, 0x100000001) 19:15:45 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:15:45 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c00020008001900"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 871.855775][T29962] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 871.884410][T29961] IPVS: ftp: loaded support on port[0] = 21 19:15:45 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) [ 871.942485][ T28] audit: type=1804 audit(1601752545.499:313): pid=29969 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/573/cgroup.controllers" dev="sda1" ino=16374 res=1 errno=0 [ 871.981451][T29967] IPVS: ftp: loaded support on port[0] = 21 [ 872.002775][T29962] device bridge212 entered promiscuous mode 19:15:45 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r1, 0xffffffffffffffff, 0x0, 0x100000001) [ 872.069292][T29966] device bridge_slave_0 left promiscuous mode [ 872.080095][T29966] bridge211: port 1(bridge_slave_0) entered disabled state [ 872.170579][T29966] bridge212: port 1(bridge_slave_0) entered blocking state [ 872.186787][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 872.231915][T29966] bridge212: port 1(bridge_slave_0) entered disabled state [ 872.265898][ T21] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 872.269807][T29966] device bridge_slave_0 entered promiscuous mode [ 872.320044][T29966] bridge212: port 1(bridge_slave_0) entered blocking state [ 872.327435][T29966] bridge212: port 1(bridge_slave_0) entered forwarding state [ 872.448284][T29973] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 872.478991][T29973] bridge212: port 1(bridge_slave_0) entered disabled state 19:15:46 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r1, 0xffffffffffffffff, 0x0, 0x100000001) [ 872.508069][T29973] device bridge212 left promiscuous mode 19:15:46 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 872.865220][ T28] audit: type=1804 audit(1601752546.429:314): pid=29991 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/575/cgroup.controllers" dev="sda1" ino=16366 res=1 errno=0 19:15:46 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r1, 0xffffffffffffffff, 0x0, 0x100000001) 19:15:46 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 873.054924][T29961] virt_wifi0 speed is unknown, defaulting to 1000 [ 873.344658][T29964] IPVS: ftp: loaded support on port[0] = 21 [ 873.610901][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 873.829540][T29961] virt_wifi0 speed is unknown, defaulting to 1000 [ 873.829633][T29964] virt_wifi0 speed is unknown, defaulting to 1000 [ 874.187044][ T7] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 874.354370][ T117] tipc: TX() has been purged, node left! [ 874.373720][T29964] virt_wifi0 speed is unknown, defaulting to 1000 [ 874.677229][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:49 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet(0xffffffffffffffff, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:49 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) [ 875.716257][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 875.780764][T30061] IPVS: ftp: loaded support on port[0] = 21 [ 875.852782][T30061] virt_wifi0 speed is unknown, defaulting to 1000 [ 876.243266][T30061] virt_wifi0 speed is unknown, defaulting to 1000 [ 876.755975][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 877.385985][ T38] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 877.794256][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 877.994078][ T117] tipc: TX() has been purged, node left! 19:15:51 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x0) 19:15:51 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:51 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:15:51 executing program 2: r0 = socket(0x10, 0x800000000000803, 0x0) sendto(r0, &(0x7f0000000140)="120000001600e70d017b00000000008e1584", 0x28f, 0x0, 0x0, 0x3d4) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) 19:15:51 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet(0xffffffffffffffff, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:51 executing program 0: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000002, 0xb871, 0xffffffffffffffff, 0x0) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, 0x0, 0x0) r0 = socket$inet(0x2, 0x5, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000280)={'lo\x00', {0x2, 0x0, @remote}}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8918, &(0x7f0000000100)={'lo\x00', {0x2, 0x0, @local}}) 19:15:51 executing program 2: sendmsg$NFQNL_MSG_VERDICT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="d800000001030000000000000000000000000000c4000b8038000e801400018008000100e000000208000200ac1e000114000180080001006401010208000200e00000020c00028005003b0100be0000000400164080000e800c00028005000100880000000600034000030000060003400001"], 0xd8}}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xa, 0x2, 0x400, 0xc, 0x142}, 0x40) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000300), &(0x7f00000000c0), 0x1081, r0}, 0x38) [ 878.199354][T30095] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 878.206234][T30093] IPVS: ftp: loaded support on port[0] = 21 [ 878.293407][T30095] device bridge213 entered promiscuous mode [ 878.302583][ T28] audit: type=1804 audit(1601752551.859:315): pid=30106 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/577/cgroup.controllers" dev="sda1" ino=16366 res=1 errno=0 19:15:51 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 878.339444][T30101] IPVS: ftp: loaded support on port[0] = 21 19:15:51 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x0) [ 878.379048][T30103] device bridge_slave_0 left promiscuous mode [ 878.389260][T30103] bridge212: port 1(bridge_slave_0) entered disabled state [ 878.446471][T30103] bridge213: port 1(bridge_slave_0) entered blocking state [ 878.468725][T30103] bridge213: port 1(bridge_slave_0) entered disabled state [ 878.538979][T30103] device bridge_slave_0 entered promiscuous mode [ 878.578795][T30103] bridge213: port 1(bridge_slave_0) entered blocking state [ 878.586196][T30103] bridge213: port 1(bridge_slave_0) entered forwarding state [ 878.659713][T30109] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 878.670123][T29308] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:52 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xa4d976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x11, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="340000000906010110000007000000100000000005000100060000000c00078008000940000000000900020073797a30"], 0x34}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r2, r1, 0x0, 0x0) [ 878.693443][ T28] audit: type=1804 audit(1601752552.249:316): pid=30122 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/578/cgroup.controllers" dev="sda1" ino=16366 res=1 errno=0 [ 878.746166][T30093] virt_wifi0 speed is unknown, defaulting to 1000 19:15:52 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 878.826323][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:52 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 879.066749][T30134] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 879.173431][T30134] device bridge214 entered promiscuous mode [ 879.205403][T30136] device bridge_slave_0 left promiscuous mode [ 879.212672][T30136] bridge213: port 1(bridge_slave_0) entered disabled state 19:15:52 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$llc_int(r0, 0x10c, 0x5, &(0x7f0000002400)=0x40, 0x4) [ 879.284389][T30136] bridge214: port 1(bridge_slave_0) entered blocking state [ 879.321134][T30136] bridge214: port 1(bridge_slave_0) entered disabled state 19:15:52 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r2 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, r3}, &(0x7f0000000100)=0x10) 19:15:52 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 879.381364][T30136] device bridge_slave_0 entered promiscuous mode [ 879.426758][T30136] bridge214: port 1(bridge_slave_0) entered blocking state [ 879.434102][T30136] bridge214: port 1(bridge_slave_0) entered forwarding state 19:15:53 executing program 2: socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 879.475177][T30140] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 879.718667][T30101] virt_wifi0 speed is unknown, defaulting to 1000 [ 879.876425][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 879.946977][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 879.987559][T30093] virt_wifi0 speed is unknown, defaulting to 1000 [ 880.202746][T30101] virt_wifi0 speed is unknown, defaulting to 1000 19:15:53 executing program 5: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) [ 880.385527][T30179] IPVS: ftp: loaded support on port[0] = 21 [ 880.416014][T30179] virt_wifi0 speed is unknown, defaulting to 1000 19:15:54 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000240)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 19:15:54 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:54 executing program 1: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe847a071") close(r1) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x17f) write(0xffffffffffffffff, &(0x7f0000000180)="110000002200", 0x6) splice(r0, 0x0, r1, 0x0, 0x10000, 0x0) 19:15:54 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:15:54 executing program 2: clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), &(0x7f0000000100)={0x7f}, &(0x7f0000000140), &(0x7f00000001c0)={0x0, r0+10000000}, 0x0) [ 880.907975][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:54 executing program 2: r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000001c0)="24000000190007021dfffd946f610500022800001f000000000001000800060004000400", 0x24}], 0x1}, 0x0) [ 881.000094][T30212] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:15:54 executing program 1: r0 = socket(0xa, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000000c0)=@nat={'nat\x00', 0x19, 0x2, 0x348, [0x20000280, 0x0, 0x0, 0x200002b0, 0x200002e0], 0x11, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000030000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000010100000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff020000000300000000c56be9d4907947ce6e300000000000000000e6ffff61726964676530000000000000000000736974300000000000000000000000007465616d300000000000000000000000aaaaaaaaaaaa000000000000aaaaaaaaaabb0000000000800000d8010000d801000010020000636f6d6d656e740000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400065d9596df2f67ca00000073746174697374696300000000000000001000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa2eca5d9cffffff000000001b00000000f1ffffffff7365616d5f736c6176655f310000000069726c616e300000000000000000000069726c616e3000e575dd73000000000073797a6b616c6c6572300000000000000180c2000000000000000000f646793b7b3900000000000000007000000070000000a8000000590ae360000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa000000ffffffff00000000"]}, 0x3c0) [ 881.088576][T30212] device bridge215 entered promiscuous mode 19:15:54 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000240)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) [ 881.133592][T30179] virt_wifi0 speed is unknown, defaulting to 1000 [ 881.133662][T30216] device bridge_slave_0 left promiscuous mode [ 881.172613][T30216] bridge214: port 1(bridge_slave_0) entered disabled state 19:15:54 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 881.216223][T30216] bridge215: port 1(bridge_slave_0) entered blocking state [ 881.223539][T30216] bridge215: port 1(bridge_slave_0) entered disabled state 19:15:54 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup/syz0\x00', 0x200002, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0xe, &(0x7f0000002740)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0ff1100000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7040000050000006a0af2fe00000000850000001a000000b700000000000000950000000000000000e154cd844a14eeabb140172c26b1954b26c933f7ffffffffffffff55bb2007ee51050512b5b42128aa090a79507df79f298129da4871307b534bf901115e17392ac66ad029d1c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b217369c8eb6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1efc5f9094fa737c28b994a8512c816fdcceaede3faedc51d29a47fc813ce3d32cfc7a53ac271d6b3fdc4b4861004eefbda7f54f82a804d4a69bf9bc5fa77ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b8496da787e814c4fd21a18986252a70f8f92eb6f0e8c7db3503680e5e5971ff4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa909ac06b57479321a0574fb304bc2a1681989328c8ddc20ea011bf5742e0ef94234db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a4aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc61e058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde0745db06753a7ac7fe13cab6692422a46e9ffe2d4a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c9585638c2153a6eee01738b0c10671f4f619b7dcb98a6273b8c5f1e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55d000abcdb040f6266e548b01623258a141bd587cc9dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6e657b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d87cbb54e588ee5d6944ee4de5c10163c64973722799f157c51b00688b83c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a0aa9a104e16bb1a2bacf13464ca03aff14b9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c363000000000223201780200c6ed79547dbf8b497adda77f52f2cd1d0000002000000001c800000000000000000000000928ee53595a779d243a48cea769470424d28804c026ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2c01808b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef40662d7836d252c566f5ee938a836804ed3a1079b0282a12043408cd61b687dcff910700000000000000456f7d2a42bd13da2022f23daec61854f640f701db0276652f6c74f20675eb781925441578e93046aaddea7e980f1f4d96c803a7ea8ae0dc214e1cc275b26adfa892e6de9200000000e50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab50fe82d5a96b09c68c73de2fea65559eb00e76e9d0ada209bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cdfba05e2bbf9ec5499f79650f2e33bc3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2f085185cc92fe7f7919309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5d81e750d50515a59a3ad09e8802e8f4f535437dc0fc9d5f99a73145dfcedad69da9c11f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d310ab16bce9c764c714c9402c21d181aae59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9e2d1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4000000000000000749efd3763655500344bae34347f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419a5c16e2055b850580994484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0a2e9120be61e58c79d497247d278888901d44bf77ff246605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f3101987602688888ccb85c86b4f8ffffff5f000000002c331fca0e541b7ca2119ff0d61c5224550346115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000000000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77a23b0000e49666c464d35ca9b50f3ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a2102fa1296dfff4a979369b0e8ebc62887aa46e820a98e353047d5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76b0d3958f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d1b8b90bc0df4cfb0b9c8c80158b44ecae9420654f7016b0aac117087406d343e27b372d6027ab2aec8f2bcad7fe6bb932bc5751d2974e95455a277f9a9aeb29aa185d7fe74b25a3b472bc7bbdd2ac5a1ea608e8137ace03361607cc1a84be659355629ab13ad49008c3fcfa2423439aaf3e36cbf537801d3b384d63b95a3607961d5b59da48a0155e8e42cc13c702cc40c89cf86c2021d72f9f4ab1b00de555a5a39593c93871ff7eb5ecadb64837a2d887236cedaa5152e3d5864e57581b61f2b0960600000000000000265f091e7bce17d20604c5ab751773a5cf2ed6c94682ebf13548209b8a719a7abc06ed03832bf274707c7c970edc20d2cb639ecd58709b05a20097208d03f7a146a6901913618738679d4e0af53eae997eecfa0dc3dcec19d3d901ee75c8710470d9eb6f62c5c721883f1544ba6627a9d2b58e8fbade7716f159af1c8dab05a933746c16b6e93294b561c6715a32a394ed1e6c014e0c931bfa52c58c6f34d64e758a7a7f7dcba2bab170ad7556a45774dfcc55257215c8ae719dc1c232fc6699ef83f85887d04a543030b4328ab48744ac23ff56fd2da52eb9fb2eefcdd2d92d73ac1b111ea8b1e1fec36a3579879acfe366d393f1fa9cbe08d9ba57a443643e9cd2519c88e91a5e458e66ea26822d27a45e0a9c10a127fed19e36b5264660665dfdbeab3ec99495639bc57155d4dd919a95eb4c25a08cb6e1a9b4d6813a0fd07a4ad9df661ab8b86a932db0df838b178540d88be2983200703864a3b9e1482cb479dad6d34d211b05267eb1355520e9ec0c5014b0832f7fb35782fdbfcbf5e23a7f5d51ea480371748d18d8e10608ab8261fe058d1732f28814a9981d84a04a2bb36c89bdd245e3293a14df1ac567300000514f103abd387d6ef2d99a3e88530f6135c8921279573e9ef585980789a92b9848906f545559d32112b5040f0776703363249ca98499efbb9e7362e4999594c1086d8954e9469db01d85fb0b9b3148663e9ea2e755d96c2986712d25a9a32565e947d03c42215118426d5451c262f45bd571c363d260faea1db53e2cf3427c90aefa2662a1c2b28b0e020e872bda1d39da508de5dbc37d03ee056b2579a1d16799589a265ba6ae3ece8887c5daca8ade81ab9fc79a69822c9fba4500b1f68ebd695a5163007f2f9ef8b3c6b1b13340671f1ffc483528000000000000b9a4d370302b12101dab71d3e31160a40250ef0cbfffded601dce47f40f96e4646787cef5ad6ad4ee2d3876f9cf50e45d021a81ba62340c4c352581163c4893800000000000000000000000000000000000000000043c7c7ae4c97f84a1d915001be32e9ea33cf516b038ab39ae350871b53643abeae7aecd272074ad85cd3b9b83a5d3bec0b47b6c37d852d6390610ecdb9fddf0b2661f0d5755f5d150aad2006f22f7879451a641172b40dd7bdd3a1bac2dcfe59888bb563128388fbece5411d012812a3334fe72289b5f0b8b88f8ead6160694ac59f4620a9f46fcf86c494c9184bc31356e7789303702ba30cc4449e09ae83dd026d73b8c4fb638c9307c5f6aed151b8faf568b5489e4ce31b59cf40c0b9f5fcfd98a8d0af390efdb666897b03b005d495db23ccbc16a4316c7400a23300bf49d9e85f2f948ad3b820c4e586b50c7b4af30a413d065e29ff323ae32fc33444eb795e36d3b5aed431c90763416ef92e4a40883895078a900df59e9e3f472478d80ef53e50c954c8adb478b749ea36c23645c635b817f61e896f43507b894452d3588286f4c2d563939346ee1858402b3bb8895ecca132d73cd84f15b0df149b32d49f91d6e5f41f6ecee17114890c5a531d49f2e9351e57b0fbcb74a3deb584786ba481e36c438121455014cd61e903d1f86fcbd567d4670d4a5fbe6f2943c0130314fc14b06048d9be88"], &(0x7f0000000100)='GPL\x00'}, 0x48) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000040)={r1}, 0x10) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x200002, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0xe, &(0x7f0000002740)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0ff1100000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7040000050000006a0af2fe00000000850000001a000000b700000000000000950000000000000000e154cd844a14eeabb140172c26b1954b26c933f7ffffffffffffff55bb2007ee51050512b5b42128aa090a79507df79f298129da4871307b534bf901115e17392ac66ad029d1c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b217369c8eb6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1efc5f9094fa737c28b994a8512c816fdcceaede3faedc51d29a47fc813ce3d32cfc7a53ac271d6b3fdc4b4861004eefbda7f54f82a804d4a69bf9bc5fa77ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b8496da787e814c4fd21a18986252a70f8f92eb6f0e8c7db3503680e5e5971ff4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa909ac06b57479321a0574fb304bc2a1681989328c8ddc20ea011bf5742e0ef94234db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a4aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc61e058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde0745db06753a7ac7fe13cab6692422a46e9ffe2d4a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c9585638c2153a6eee01738b0c10671f4f619b7dcb98a6273b8c5f1e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55d000abcdb040f6266e548b01623258a141bd587cc9dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6e657b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d87cbb54e588ee5d6944ee4de5c10163c64973722799f157c51b00688b83c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a0aa9a104e16bb1a2bacf13464ca03aff14b9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c363000000000223201780200c6ed79547dbf8b497adda77f52f2cd1d0000002000000001c800000000000000000000000928ee53595a779d243a48cea769470424d28804c026ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2c01808b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef40662d7836d252c566f5ee938a836804ed3a1079b0282a12043408cd61b687dcff910700000000000000456f7d2a42bd13da2022f23daec61854f640f701db0276652f6c74f20675eb781925441578e93046aaddea7e980f1f4d96c803a7ea8ae0dc214e1cc275b26adfa892e6de9200000000e50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab50fe82d5a96b09c68c73de2fea65559eb00e76e9d0ada209bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cdfba05e2bbf9ec5499f79650f2e33bc3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2f085185cc92fe7f7919309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5d81e750d50515a59a3ad09e8802e8f4f535437dc0fc9d5f99a73145dfcedad69da9c11f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d310ab16bce9c764c714c9402c21d181aae59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9e2d1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4000000000000000749efd3763655500344bae34347f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419a5c16e2055b850580994484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0a2e9120be61e58c79d497247d278888901d44bf77ff246605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f3101987602688888ccb85c86b4f8ffffff5f000000002c331fca0e541b7ca2119ff0d61c5224550346115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000000000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77a23b0000e49666c464d35ca9b50f3ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a2102fa1296dfff4a979369b0e8ebc62887aa46e820a98e353047d5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76b0d3958f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d1b8b90bc0df4cfb0b9c8c80158b44ecae9420654f7016b0aac117087406d343e27b372d6027ab2aec8f2bcad7fe6bb932bc5751d2974e95455a277f9a9aeb29aa185d7fe74b25a3b472bc7bbdd2ac5a1ea608e8137ace03361607cc1a84be659355629ab13ad49008c3fcfa2423439aaf3e36cbf537801d3b384d63b95a3607961d5b59da48a0155e8e42cc13c702cc40c89cf86c2021d72f9f4ab1b00de555a5a39593c93871ff7eb5ecadb64837a2d887236cedaa5152e3d5864e57581b61f2b0960600000000000000265f091e7bce17d20604c5ab751773a5cf2ed6c94682ebf13548209b8a719a7abc06ed03832bf274707c7c970edc20d2cb639ecd58709b05a20097208d03f7a146a6901913618738679d4e0af53eae997eecfa0dc3dcec19d3d901ee75c8710470d9eb6f62c5c721883f1544ba6627a9d2b58e8fbade7716f159af1c8dab05a933746c16b6e93294b561c6715a32a394ed1e6c014e0c931bfa52c58c6f34d64e758a7a7f7dcba2bab170ad7556a45774dfcc55257215c8ae719dc1c232fc6699ef83f85887d04a543030b4328ab48744ac23ff56fd2da52eb9fb2eefcdd2d92d73ac1b111ea8b1e1fec36a3579879acfe366d393f1fa9cbe08d9ba57a443643e9cd2519c88e91a5e458e66ea26822d27a45e0a9c10a127fed19e36b5264660665dfdbeab3ec99495639bc57155d4dd919a95eb4c25a08cb6e1a9b4d6813a0fd07a4ad9df661ab8b86a932db0df838b178540d88be2983200703864a3b9e1482cb479dad6d34d211b05267eb1355520e9ec0c5014b0832f7fb35782fdbfcbf5e23a7f5d51ea480371748d18d8e10608ab8261fe058d1732f28814a9981d84a04a2bb36c89bdd245e3293a14df1ac567300000514f103abd387d6ef2d99a3e88530f6135c8921279573e9ef585980789a92b9848906f545559d32112b5040f0776703363249ca98499efbb9e7362e4999594c1086d8954e9469db01d85fb0b9b3148663e9ea2e755d96c2986712d25a9a32565e947d03c42215118426d5451c262f45bd571c363d260faea1db53e2cf3427c90aefa2662a1c2b28b0e020e872bda1d39da508de5dbc37d03ee056b2579a1d16799589a265ba6ae3ece8887c5daca8ade81ab9fc79a69822c9fba4500b1f68ebd695a5163007f2f9ef8b3c6b1b13340671f1ffc483528000000000000b9a4d370302b12101dab71d3e31160a40250ef0cbfffded601dce47f40f96e4646787cef5ad6ad4ee2d3876f9cf50e45d021a81ba62340c4c352581163c4893800000000000000000000000000000000000000000043c7c7ae4c97f84a1d915001be32e9ea33cf516b038ab39ae350871b53643abeae7aecd272074ad85cd3b9b83a5d3bec0b47b6c37d852d6390610ecdb9fddf0b2661f0d5755f5d150aad2006f22f7879451a641172b40dd7bdd3a1bac2dcfe59888bb563128388fbece5411d012812a3334fe72289b5f0b8b88f8ead6160694ac59f4620a9f46fcf86c494c9184bc31356e7789303702ba30cc4449e09ae83dd026d73b8c4fb638c9307c5f6aed151b8faf568b5489e4ce31b59cf40c0b9f5fcfd98a8d0af390efdb666897b03b005d495db23ccbc16a4316c7400a23300bf49d9e85f2f948ad3b820c4e586b50c7b4af30a413d065e29ff323ae32fc33444eb795e36d3b5aed431c90763416ef92e4a40883895078a900df59e9e3f472478d80ef53e50c954c8adb478b749ea36c23645c635b817f61e896f43507b894452d3588286f4c2d563939346ee1858402b3bb8895ecca132d73cd84f15b0df149b32d49f91d6e5f41f6ecee17114890c5a531d49f2e9351e57b0fbcb74a3deb584786ba481e36c438121455014cd61e903d1f86fcbd567d4670d4a5fbe6f2943c0130314fc14b06048d9be88"], &(0x7f0000000100)='GPL\x00'}, 0x48) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000040)={r3, r2}, 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000200)={@cgroup=r0, r3}, 0x5) [ 881.302959][T30216] device bridge_slave_0 entered promiscuous mode [ 881.349791][T30216] bridge215: port 1(bridge_slave_0) entered blocking state [ 881.357103][T30216] bridge215: port 1(bridge_slave_0) entered forwarding state 19:15:55 executing program 0: unshare(0x40000000) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f0000000340), 0x41395527) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000200)=0x5) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000080)={r0}, 0x8) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x14, r3, 0x1, 0x0, 0x0, {0xd}}, 0x14}}, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f00000002c0), 0x4) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="940000009c0b7ccf2d7d05351bc6bb31b38f149d95f34fd492463bfe7e63a221309a28eeebbfce12a16169cb956e11fa7aab8b8fd1ac87337aedc18485ab6b570e673cf83cbf5ca5fcae6e0af5de3978e8ed9dae63be3a8e839c033fd7d1d0be762b221aa4a9f01f43d7a2ff0103c0f545232cb1ebad410ecd69000a0fcd94b5", @ANYRES16=r3, @ANYBLOB="08002cbd7000fedbdf2505000000140002800800060007000000080007000500000008000500010000806400038006000400c90a000008000500ac1414bb060007004e23000008000100f0000000080001000000000014000600fc010000000000000000000000000000050008000400000014000600fc01000000000000000000a45160cf6f308b000000000006a16f1332cf55d2340cee26a4ff183679864a7075939632825069b19c3f2f116967756af65a73228f0bb6a5d0849b88b358bb"], 0x94}}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0xc031, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r4 = socket$inet(0x10, 0x3, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00', 0x19, 0x2, 0x348, [0x20000280, 0x0, 0x0, 0x200002b0, 0x200002e0], 0x11, 0x0, &(0x7f0000000280)=ANY=[]}, 0x78) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_PORTS(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x89f3, &(0x7f0000000000)={'macvtap0\x00', &(0x7f0000000040)=@ethtool_cmd={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x3]}}) ioctl$sock_ifreq(r4, 0x89f1, &(0x7f0000000180)={'ip6gre0\x00', @ifru_flags}) [ 881.435538][T30220] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 881.681131][T30239] IPVS: ftp: loaded support on port[0] = 21 [ 881.791723][T30239] virt_wifi0 speed is unknown, defaulting to 1000 [ 881.966113][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:55 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:55 executing program 2: r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0x0, 0x5}}, 0x1c) 19:15:55 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:15:55 executing program 1: syz_emit_ethernet(0x5e, &(0x7f0000000bc0)={@link_local, @empty, @val, {@ipv6={0x86dd, @tipc_packet={0x0, 0x6, "404fcd", 0x20, 0x6, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}, @local, {[], @payload_direct={{{{0x20, 0x0, 0x0, 0x0, 0x0, 0x8}}}}}}}}}, 0x0) 19:15:55 executing program 5: unshare(0x40000000) r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) [ 882.426011][ T776] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:56 executing program 1: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x1e, &(0x7f0000000500)={0x0, @in={{0x2, 0x0, @multicast2}}}, 0x84) [ 882.492802][T30274] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 882.574774][T30274] device bridge216 entered promiscuous mode [ 882.595871][T30278] IPVS: ftp: loaded support on port[0] = 21 [ 882.608657][T30239] virt_wifi0 speed is unknown, defaulting to 1000 [ 882.608830][T30279] device bridge_slave_0 left promiscuous mode [ 882.623426][T30279] bridge215: port 1(bridge_slave_0) entered disabled state [ 882.663047][T30279] bridge216: port 1(bridge_slave_0) entered blocking state 19:15:56 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, 0x0, 0x0) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 882.699261][T30279] bridge216: port 1(bridge_slave_0) entered disabled state 19:15:56 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20040218, &(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmmsg(r0, &(0x7f0000006740)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20000014) [ 882.744420][T30279] device bridge_slave_0 entered promiscuous mode [ 882.790861][T30279] bridge216: port 1(bridge_slave_0) entered blocking state [ 882.798336][T30279] bridge216: port 1(bridge_slave_0) entered forwarding state [ 882.835699][T30284] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 882.910912][T30278] virt_wifi0 speed is unknown, defaulting to 1000 19:15:56 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 882.995548][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:56 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000cc0)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x0, 0x2011, r0, 0x0) mmap(&(0x7f0000d4d000/0x2000)=nil, 0x2000, 0x0, 0x2013, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000f44000/0x4000)=nil, 0x50707c, 0x0, 0x2013, r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000cc0)='cpu.stat\x00', 0x275a, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00005f5000)={0x0, 0x0, 0x0}, 0x0) mmap(&(0x7f0000d1c000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r4, 0x0) mmap(&(0x7f0000ff4000/0xb000)=nil, 0xb000, 0x2, 0x840000000000a132, 0xffffffffffffffff, 0x0) 19:15:56 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, 0x0, 0x0) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 883.153192][T30301] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 883.237958][T30301] device bridge217 entered promiscuous mode [ 883.298274][T30304] device bridge_slave_0 left promiscuous mode [ 883.304731][T30304] bridge216: port 1(bridge_slave_0) entered disabled state [ 883.374335][T30304] bridge217: port 1(bridge_slave_0) entered blocking state [ 883.430531][T30304] bridge217: port 1(bridge_slave_0) entered disabled state [ 883.478104][T30304] device bridge_slave_0 entered promiscuous mode [ 883.516265][T30304] bridge217: port 1(bridge_slave_0) entered blocking state [ 883.523565][T30304] bridge217: port 1(bridge_slave_0) entered forwarding state [ 883.567262][T30308] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 883.654353][T30278] virt_wifi0 speed is unknown, defaulting to 1000 19:15:57 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, 0x0, 0x0) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:15:57 executing program 2: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet(r0, &(0x7f0000003100)=[{{&(0x7f0000000000)={0x2, 0x0, @private=0xa010101}, 0x10, &(0x7f0000001440)=[{&(0x7f0000000040)='U', 0x1}], 0x1}}], 0x1, 0x6044054) 19:15:57 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001440)={&(0x7f00000013c0)={0x1c, 0x7, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x5}]}, 0x1c}}, 0x0) 19:15:57 executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @local}, 0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x78, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0x48, 0x12, 0x0, 0x1, @gre={{0x8, 0x1, 'gre\x00'}, {0x3c, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r4}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x5}, @IFLA_GRE_FWMARK={0x8, 0x14, 0x1ff}, @IFLA_GRE_ERSPAN_DIR={0x5, 0x17, 0x1}, @IFLA_GRE_TTL={0x5, 0x8, 0x40}, @IFLA_GRE_TOS={0x5}, @IFLA_GRE_TTL={0x5, 0x8, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x78}}, 0x0) 19:15:57 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 884.038192][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 884.170026][T30343] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 884.291880][T30343] device bridge218 entered promiscuous mode [ 884.349440][T30345] bond0: (slave gre1): slave is up - this may be due to an out of date ifenslave [ 884.645062][T30347] device bridge_slave_0 left promiscuous mode [ 884.652887][T30347] bridge217: port 1(bridge_slave_0) entered disabled state [ 884.689354][T30347] bridge218: port 1(bridge_slave_0) entered blocking state [ 884.704352][T30347] bridge218: port 1(bridge_slave_0) entered disabled state [ 884.713940][T30347] device bridge_slave_0 entered promiscuous mode [ 884.723150][T30347] bridge218: port 1(bridge_slave_0) entered blocking state [ 884.730503][T30347] bridge218: port 1(bridge_slave_0) entered forwarding state [ 884.741851][T30349] netlink: 'syz-executor.4': attribute type 25 has an invalid length. [ 884.828914][T30345] bond0: (slave gre1): slave is up - this may be due to an out of date ifenslave [ 885.066986][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 885.075156][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:58 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:58 executing program 1: r0 = socket$rxrpc(0x21, 0x2, 0xa) sendto$rxrpc(r0, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$RXRPC_SECURITY_KEY(r0, 0x110, 0x1, 0x0, 0x0) 19:15:58 executing program 2: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000280)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c58110308d9123127ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) bind$packet(r1, &(0x7f0000000040)={0x11, 0xf8, r2, 0x1, 0x0, 0x6, @local}, 0x14) r3 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000200)) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x20, r5, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x5}]}]}, 0x20}}, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(r3, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x70, r5, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7ed2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x10}}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x12, 0x29}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}]}, 0x70}}, 0x800) ioctl$sock_SIOCGIFINDEX(r0, 0x8914, &(0x7f0000000000)={'lo\x00', r2}) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$FITRIM(r6, 0x40305829, &(0x7f0000000240)={0x0, 0x0, 0x4002be20000}) sendmsg$key(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2, 0x10, 0x8, 0x9, 0x13, 0x0, 0x70bd27, 0x25dfdbfb, [@sadb_x_policy={0x8, 0x12, 0x4, 0x1, 0x0, 0x6e6bc0, 0x2, {0x6, 0x33, 0xff, 0x7, 0x0, 0x0, 0x0, @in6=@empty, @in=@local}}, @sadb_lifetime={0x4, 0x4, 0x1, 0x81, 0xfff, 0x42}, @sadb_sa={0x2, 0x1, 0x4d5, 0x8, 0x40, 0xa9, 0x4}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e24}, @sadb_ident={0x2, 0xb, 0xd7d, 0x0, 0xfff}]}, 0x98}}, 0x800) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000001a80)={@ipv4={[], [], @remote}}, 0x14) socket$inet6(0xa, 0x80002, 0x0) 19:15:58 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(0xffffffffffffffff, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:15:58 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:15:58 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIXLEN={0x6, 0xd, 0xb3}, @IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x40}}, 0x0) [ 885.297884][T30388] IPVS: ftp: loaded support on port[0] = 21 [ 885.308680][T30389] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:15:58 executing program 0: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x7) 19:15:58 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x16}]}, 0x10) close(r0) [ 885.412984][T30389] device bridge219 entered promiscuous mode [ 885.457055][T30400] device bridge_slave_0 left promiscuous mode [ 885.465710][T30400] bridge218: port 1(bridge_slave_0) entered disabled state 19:15:59 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(0xffffffffffffffff, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:15:59 executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x3, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x3a}, 0x1, 0xa800}, 0x0) [ 885.541174][T30400] bridge219: port 1(bridge_slave_0) entered blocking state 19:15:59 executing program 1: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) socketpair$unix(0x1, 0x80000000001, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x7fffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000560, 0x44000102, 0x0) ioctl$F2FS_IOC_SET_PIN_FILE(0xffffffffffffffff, 0x4004f50d, 0x0) recvfrom(r3, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012500, 0x0, 0xffffffffffffff49) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 885.595175][T30400] bridge219: port 1(bridge_slave_0) entered disabled state [ 885.603774][T30400] device bridge_slave_0 entered promiscuous mode [ 885.683981][T30400] bridge219: port 1(bridge_slave_0) entered blocking state [ 885.691364][T30400] bridge219: port 1(bridge_slave_0) entered forwarding state 19:15:59 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x14}, [@ldst={0x6, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffffe}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x0, 0x10, &(0x7f0000000080), 0x1f1}, 0x48) [ 885.748436][T30418] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.0'. [ 885.766003][T30388] virt_wifi0 speed is unknown, defaulting to 1000 [ 886.115681][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:15:59 executing program 5: r0 = socket$inet_sctp(0x2, 0x0, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:15:59 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 886.221455][T30395] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 886.421779][T30433] IPVS: ftp: loaded support on port[0] = 21 [ 886.560469][T30447] netlink: 'syz-executor.2': attribute type 1 has an invalid length. [ 886.669042][T30436] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 886.709825][T30436] device bridge220 entered promiscuous mode [ 886.746217][T30439] device bridge_slave_0 left promiscuous mode [ 886.753828][T30439] bridge219: port 1(bridge_slave_0) entered disabled state [ 886.782959][T30439] bridge220: port 1(bridge_slave_0) entered blocking state [ 886.800950][T30439] bridge220: port 1(bridge_slave_0) entered disabled state [ 886.820443][T30439] device bridge_slave_0 entered promiscuous mode [ 886.837763][T30439] bridge220: port 1(bridge_slave_0) entered blocking state [ 886.845175][T30439] bridge220: port 1(bridge_slave_0) entered forwarding state [ 887.118610][T30388] virt_wifi0 speed is unknown, defaulting to 1000 [ 887.158334][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 887.841106][ T117] tipc: TX() has been purged, node left! [ 887.848002][ T117] tipc: TX() has been purged, node left! [ 887.854124][ T117] tipc: TX() has been purged, node left! [ 887.861844][ T117] tipc: TX() has been purged, node left! [ 887.871445][ T117] tipc: TX() has been purged, node left! [ 887.878438][ T117] tipc: TX() has been purged, node left! [ 888.185541][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 888.267020][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:02 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd, 0x1, 'fq_codel\x00'}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000), 0xc, 0x0}, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r4, &(0x7f0000000000), 0xb, 0x0) 19:16:02 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(0xffffffffffffffff, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:16:02 executing program 5: r0 = socket$inet_sctp(0x2, 0x0, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:16:02 executing program 0: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0) recvmsg(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000940)=""/211, 0xd3}], 0x1, &(0x7f0000000740)=""/125, 0x7d}, 0x100) close(r1) 19:16:02 executing program 1: r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x2, @broadcast, 'batadv0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000005b40), 0x4000000000001a9, 0x0) 19:16:02 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:16:02 executing program 5: r0 = socket$inet_sctp(0x2, 0x0, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) [ 888.749992][T30488] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:16:02 executing program 0: r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000002980)={0x0, 0x0, &(0x7f0000002940)={&(0x7f0000000100)=@newtaction={0x84, 0x30, 0x53b, 0x0, 0x0, {}, [{0x70, 0x1, [@m_vlan={0x6c, 0x1, 0x0, 0x0, {{0x9, 0x1, 'vlan\x00'}, {0x58}, {0x4}}}]}]}, 0x84}}, 0x0) [ 888.818800][T30488] device bridge221 entered promiscuous mode 19:16:02 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, 0xffffffffffffffff, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 888.885003][T30491] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 888.962536][T30494] device bridge_slave_0 left promiscuous mode [ 888.971739][T30494] bridge220: port 1(bridge_slave_0) entered disabled state 19:16:02 executing program 5: socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(0xffffffffffffffff, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) [ 889.060892][T30494] bridge221: port 1(bridge_slave_0) entered blocking state [ 889.079429][T30494] bridge221: port 1(bridge_slave_0) entered disabled state [ 889.133859][T30494] device bridge_slave_0 entered promiscuous mode [ 889.164372][T30494] bridge221: port 1(bridge_slave_0) entered blocking state [ 889.171847][T30494] bridge221: port 1(bridge_slave_0) entered forwarding state 19:16:02 executing program 5: socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(0xffffffffffffffff, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) [ 889.234730][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 889.275393][T30513] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. [ 889.284643][T30513] netlink: 'syz-executor.0': attribute type 6 has an invalid length. 19:16:02 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 889.349473][T30491] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 19:16:03 executing program 2: bpf$OBJ_PIN_MAP(0x4, 0x0, 0x0) 19:16:03 executing program 1: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) setsockopt$rose(r0, 0x104, 0x7, &(0x7f0000000000)=0x6, 0x4) 19:16:03 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, 0xffffffffffffffff, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:16:03 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0xbcda34450b800b7a, 0x40000000000a132, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x84) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) getsockopt$bt_hci(r1, 0x84, 0x83, &(0x7f0000000080)=""/4100, &(0x7f00000010c0)=0x1004) 19:16:03 executing program 5: socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(0xffffffffffffffff, &(0x7f0000f6fff0)={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) [ 889.512734][T30529] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 889.556026][T30529] device bridge222 entered promiscuous mode [ 889.616337][T30532] device bridge_slave_0 left promiscuous mode [ 889.632197][T30532] bridge221: port 1(bridge_slave_0) entered disabled state 19:16:03 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x17, 0x9, 0x240002, 0x2, 0x0, 0x1}, 0x40) pipe(&(0x7f0000000300)={0xffffffffffffffff}) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r1, 0x6, 0x24, &(0x7f0000000240)=0x1, 0x4) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000040)) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0x14}]}, 0x28}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000640)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x25dfdbff, {0x5, 0x0, 0x0, r6, 0x0, 0x4}}, 0x20}, 0x1, 0x3f00}, 0x8004) [ 889.698796][T30532] bridge222: port 1(bridge_slave_0) entered blocking state [ 889.737432][T30532] bridge222: port 1(bridge_slave_0) entered disabled state 19:16:03 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) [ 889.782208][ T28] audit: type=1804 audit(1601752563.339:317): pid=30545 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir013064415/syzkaller.0cfH0A/585/cgroup.controllers" dev="sda1" ino=16367 res=1 errno=0 [ 889.827153][T30532] device bridge_slave_0 entered promiscuous mode 19:16:03 executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) socket$kcm(0x2, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$can_j1939(0x1d, 0x2, 0x7) socket$inet6_tcp(0xa, 0x1, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) socket$kcm(0xa, 0x5, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0x11, 0x800000003, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) socket$kcm(0xa, 0x2, 0x0) socket$kcm(0xa, 0x5, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$kcm(0x2, 0x2, 0x0) socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f0000000000)) r0 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0x14, &(0x7f0000000080), 0x4) sendmsg$kcm(r0, &(0x7f0000007780)={&(0x7f0000000000)=@caif, 0x80, 0x0}, 0x0) [ 889.858303][T30532] bridge222: port 1(bridge_slave_0) entered blocking state [ 889.865769][T30532] bridge222: port 1(bridge_slave_0) entered forwarding state 19:16:03 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, 0xffffffffffffffff, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:16:03 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{}, {0xa, 0x0, 0x0, @empty, 0x1}}, 0x5c) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x40, &(0x7f0000001fde), 0x3) [ 889.939421][T30551] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. [ 889.939672][ T28] audit: type=1804 audit(1601752563.499:318): pid=30540 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir013064415/syzkaller.0cfH0A/585/cgroup.controllers" dev="sda1" ino=16367 res=1 errno=0 19:16:03 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:16:03 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) [ 890.062591][T30553] batman_adv: batadv0: Adding interface: veth23 [ 890.077804][T30553] batman_adv: batadv0: The MTU of interface veth23 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. 19:16:03 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c000000030601"], 0x3c}}, 0x0) [ 890.133055][T30553] batman_adv: batadv0: Not using interface veth23 (retrying later): interface not active [ 890.154600][T30555] batman_adv: batadv0: Removing interface: veth23 [ 890.273671][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:03 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x0) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 890.356651][T30581] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:16:04 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:16:04 executing program 0: sendmsg$DEVLINK_CMD_PORT_SET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[], 0x14}}, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000080)={@local, @dev, @void, {@ipv4={0x800, @generic={{0x9, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@lsrr={0x83, 0xb, 0xb, [@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast]}, @timestamp={0x44, 0x4, 0x0, 0x3}]}}}}}}, 0x0) [ 890.419367][T30583] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.2'. [ 890.439911][T30581] device bridge223 entered promiscuous mode 19:16:04 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="4800000010000507000000000000c40000000000", @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r6, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=ANY=[@ANYBLOB='P\x00\x00\x00(\x00\'\r\x00'/20, @ANYRES32=r6, @ANYBLOB="0400000000000000000000000b0001006367726f75700000200002001c00010018"], 0x50}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=@newtfilter={0x44, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0xe6c}}, [@filter_kind_options=@f_cgroup={{0xb, 0x1, 'cgroup\x00'}, {0x14, 0x2, [@TCA_CGROUP_POLICE={0x10, 0x2, [@TCA_POLICE_PEAKRATE64={0xc}]}]}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=@newtfilter={0x44, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0xfff2}}, [@filter_kind_options=@f_cgroup={{0xb, 0x1, 'cgroup\x00'}, {0x14, 0x2, [@TCA_CGROUP_POLICE={0x10, 0x2, [@TCA_POLICE_PEAKRATE64={0xc}]}]}}]}, 0x44}}, 0x0) [ 890.494454][T30553] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. [ 890.590670][T30555] batman_adv: batadv0: Adding interface: veth23 [ 890.609581][T30555] batman_adv: batadv0: The MTU of interface veth23 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 890.740069][T30555] batman_adv: batadv0: Not using interface veth23 (retrying later): interface not active [ 890.781813][T30582] device bridge_slave_0 left promiscuous mode [ 890.793224][T30582] bridge222: port 1(bridge_slave_0) entered disabled state 19:16:04 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000002c0), 0x1c) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=@newqdisc={0x60, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa, 0x1, 'netem\x00'}, {0x30, 0x2, {{0x0, 0xff, 0x800000, 0x9, 0x80}, [@TCA_NETEM_RATE={0x14, 0x6, {0x1}}]}}}]}, 0x60}}, 0x0) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 19:16:04 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:16:04 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=@newlink={0x40, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xf0ffff}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x40}}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xb, 0x91, 0x7, 0x5, 0x1}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000000), &(0x7f0000000080)}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000400)={r1, &(0x7f0000000180), &(0x7f0000000240)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r1, &(0x7f0000000000), &(0x7f0000000080)=""/21}, 0x20) r2 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000140)={'virt_wifi0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x2, 0x0) sendmsg$TIPC_NL_LINK_SET(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x19813}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc, 0x1, 'macvtap\x00'}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r3}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x44}}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r7, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x1a, 0x3f, 0x8, 0x8001, 0x2a0, r1, 0x3, [], r6, r7, 0x0, 0x2}, 0x40) 19:16:04 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x0) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 890.826632][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 890.828881][T30582] bridge223: port 1(bridge_slave_0) entered blocking state [ 890.876147][T30582] bridge223: port 1(bridge_slave_0) entered disabled state [ 890.933612][T30582] device bridge_slave_0 entered promiscuous mode [ 890.967339][T30582] bridge223: port 1(bridge_slave_0) entered blocking state [ 890.974714][T30582] bridge223: port 1(bridge_slave_0) entered forwarding state [ 891.002589][T30601] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 19:16:04 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:16:04 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x0) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 891.104713][T30612] netlink: 'syz-executor.0': attribute type 5 has an invalid length. [ 891.163269][T30612] device gretap0 entered promiscuous mode [ 891.196115][T30612] device macvlan2 entered promiscuous mode [ 891.221262][T30612] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan2: link becomes ready [ 891.336807][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:05 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 891.701998][T30603] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 891.725194][T30634] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:16:05 executing program 2: syz_genetlink_get_family_id$team(&(0x7f0000000000)='team\x00') r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000d40)) 19:16:05 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000080)='memory.current\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xf03b0001) sendfile(r1, r0, 0x0, 0x800000000000c) socket$netlink(0x10, 0x3, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="2321202e2f66696c659385943d30205e2d20656d6f72792e6c616e317b206d656d6f72792e657665007473000ae0a44301e35f6ea70565eb521d078e8331cc494cda1a5bcdce7a367fc22372c64b9cd509bf542d6943a89ac7f0a5cd01ffc671f4afd52f9209dfb706a9a6ef38a967c34a000e6aa52f4a78b569fa02527b598a39c56ad5eeeacb5d65f04751f1caca27b2b1f3608c09e7c2d66a18c484aee2d1b950a92e2214ac483a01233932e93608ed16149749f7a53c09db4ca9722d602042e641c1d511a45053d271dfbf354ba38683474f457763558cd893e1b22d112c4601c79e1e72bbabf385b3c47cfb0af700000051a400000000000000000000003db85b12618c42624a043e5132da3377e49c53bee9bdead00ea8681361c18a124419bb93e420e42ed65f78a573a1f06887e0afbdf007f4deea9c76473499025de3b7ee00"/338], 0x111) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'gre0\x00'}) close(r2) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000000)) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000180)={0x1, 0xfffffffd, 0x2, 0x8308, 0x40000009}) pwrite64(0xffffffffffffffff, &(0x7f0000000480)="2af0dde598f948d944dc405c4f5bed0c9ce1c12db5b23814269ece032a0041d87388d04c58437557da1cc12b4939ad73bb897db6f1c6279d475113459bceec268ab0d1033065c5b6e391f071dfe9da31b7766e68e3cfb3a35a467a9ad15badd4f75425ce2923a03ad61952722700f76d192992f05b38971a7f04bdb85324b0d9d62870f061cd330999cf749a28f3c375d3d726642f52721b9e04eba551cc37259d7f01f079d4bb2c99b63ac6005328b8bdccf5a367ae6031c0350a40c6aef78b4dfbeddc1809526f2029003a51a0", 0xce, 0x100008000006) r3 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0x3e, &(0x7f00000000c0)=0x7, 0x4) bind$llc(r3, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x10) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) 19:16:05 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) [ 891.786744][T30634] device bridge224 entered promiscuous mode [ 891.858187][T30636] device bridge_slave_0 left promiscuous mode [ 891.867987][T30636] bridge223: port 1(bridge_slave_0) entered disabled state [ 891.939472][T30636] bridge224: port 1(bridge_slave_0) entered blocking state 19:16:05 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0xcc, 0x9}, 0x2c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00004f9fe4)={0xc, 0x4, 0x4, 0x100000001, 0x0, r0}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r1, &(0x7f0000000040), 0x0}, 0x20) [ 891.985709][T30636] bridge224: port 1(bridge_slave_0) entered disabled state [ 892.046179][T30636] device bridge_slave_0 entered promiscuous mode [ 892.096733][T30636] bridge224: port 1(bridge_slave_0) entered blocking state [ 892.104249][T30636] bridge224: port 1(bridge_slave_0) entered forwarding state 19:16:05 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, r1, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x71}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'dh\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8}]}]}, 0x4c}}, 0x0) sendmsg$IPVS_CMD_FLUSH(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001440)={&(0x7f0000001400)={0x14, r1, 0x1}, 0x14}}, 0x0) [ 892.187904][T11211] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan2: link becomes ready 19:16:05 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e00)={&(0x7f0000003f40)={0xec4, 0x0, 0x0, 0x0, 0x25dfdbff, {}, [@ETHTOOL_A_FEATURES_WANTED={0x4b0, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0xfd, 0x5, "0bfc93fabd1d1bdde8e5e6214c71013a9dc41d01844c5eb72771e2d0cf4168e85374db26ce82cd7749a7639e2bd2afdab2efe64ca60c018de0162d934e07480a20daab3ec2656c9f3363daa801c474cc951112ca211d38fc168187e6ee0dbfa965c9f20f317cc0e1b916fac15b793e2ec1dea75252ac0527b1721805edaf721168371c76b70d22354b3fcde1f270fa5746d2cae80ed338f1660b7c60fe6aa2fa8349c5b45e9f11466eac08d1b53da206734b12b7e1d2c0e2cff5709691ce784f1a8557df8b5456df7711ea5687b74cc501d18570de5110df3557c9ca5927bdfb74f9c5e4425da58e45910848bfc67913db41c179c9274b721c"}, @ETHTOOL_A_BITSET_MASK={0xd9, 0x5, "9688f6ec2434a8703c2707dc3e9eb73b2b96bfd1025fe50c1de47939a0e11d8f9027ce83c483fcfcbe859534e2eb49517dae4ac5ab863731e8cec4af948df3a07158aa9387661bdced1b58b26b9342f5577f16ffcd426817e3af12bb969d389b054cd8d3239495fcbcad8d885e3a49bd8d8483577f490a715c33a4e86daec48cc6458c5ad85c10c47adb81979735aea237e43c4478def5b647451dc2707de045d7c1e5efa3082bfbabb07a222057745eef630a6ca3e2b76ff31e3e5e5f702994fe47499ccdbee5ccfba9e852e0cea9aaa435a9f781"}, @ETHTOOL_A_BITSET_VALUE={0x5d, 0x4, "3af7b6f575e42626aae41ed967263f716136b6e525313bb685e1ef062fd9f57624d641c2b667f190dc0c8a682ef9f6197b82fc434f5fbab049266bdb6a159d0867e6a8125e85498bc3827e92b996f49bd7af9d468f7f547116"}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0x19, 0x4, "ef19d52f67f047e12f14cca58fb01e60366a3bd06f"}, @ETHTOOL_A_BITSET_VALUE={0x79, 0x4, "90d5ef159d32dcb5274f38302013f63361569d8a99368a4b0677cd8ceff571b2af24e45b0650cec9f16d10870653c2209eaad96d518de8b8723d57c9e2c9a2b7105ae0f94aa8e4ab41d05f490a928e058ef310f9df1eebb989b3e19abd3acb8520676d20e0cb4d5df8b1304e987d8d214fd0e751f4"}, @ETHTOOL_A_BITSET_VALUE={0x59, 0x4, "5a634805c6205b43cc2cccad65a90ec054923d88bf5ef3f95e9b4b2955c725a9145cba00aada90dbc7cc509c0f018f32182b4a8cd46d49c450bedb7fd9c48bc592ca9d829a2eea0e07299e7cc5c09c55552de77998"}, @ETHTOOL_A_BITSET_MASK={0x87, 0x5, "f01c59d224970c73c1b116a4d65195c243e9325949fdebfbb43e3a8cf2a5c59e20814817c77a2638154c5b9fe340abf8375f67dd66b3bc6baee69f91c2c24533b269c1f413c3f17d6b0d5db98748c5fd62c0d2e1ba042cd32e21b2d606fad93cd4379ae1b6c010028300d8f303955f59b07b4e5de4ad68d9f7f917ea4cc2257f7105a0"}, @ETHTOOL_A_BITSET_MASK={0xe9, 0x5, "cc03b381b646606e231c751443aeecf0785f1557ce54e4d436062b51ae151573acccabd444aad95380ef9012ea3daa5da0bbaa2283f5abc7d130d17383608144e39c67c746d5054247c96bd118ef0ee5fc7fa983bf8f2d3fee928954de8b1bb7e5910ea3a87a82acdda560744826d0d8e19075c16699151ad74c0c235d5ebff60e7fb97c1ffc9bf4515210b749c8482a479306aa062b8a3868c0731bff65dc8c914ac4f5209fbcb89b04455a17dae0e95f73c67a4e5649019e450ff0c53805f672681e237b5939cf89195f3ba34246ef819e1d4601cce8b5a82e8e0a3cef43c248f7e13df6"}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_FEATURES_WANTED={0x198, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0x2d, 0x5, "c5edb99d7d7629d6cd129bfb55a085fbd4901d3e1ed91f564fb9f883d24f6494ce2439270af3414628"}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0x21, 0x4, "23a7a16ccb36f5068567ecf2e23eb5596036606694596062cf56f07a28"}, @ETHTOOL_A_BITSET_BITS={0x120, 0x3, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x9, 0x2, '&)%)\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '[\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, '[-\'^%%\x94\'[&\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '$('}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}]}, {0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ip_vti0\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, ']\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '\'\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}, {0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xffffffff}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '/\x00'}]}, {0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, 'ip_vti0\x00'}]}, {0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x5}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, ')},-{@} \x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xd, 0x2, '\'[r({}&/\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xc, 0x2, '-(\xe8#+\x11^\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8}, @ETHTOOL_A_BITSET_BIT_NAME={0x6, 0x2, '!\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}, @ETHTOOL_A_BITSET_SIZE={0x8}, @ETHTOOL_A_BITSET_SIZE={0x8}, @ETHTOOL_A_BITSET_SIZE={0x8}]}, @ETHTOOL_A_FEATURES_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_FEATURES_WANTED={0x834, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x8, 0x3, 0x0, 0x1, [{0x4}]}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_MASK={0x824, 0x5, "1dbca582469870c749eae9a2e673b670a94200d43a5fabedd56059b6691bf91e893906464e57fc75ccf5b9dd50b3e4e9f483545aad7c18936077c9a97bd046ec777e1cf7253fc6eadea47c0908aab122a86948ff70922fd0bda631e50439605e38497f3a3d50f931f2fa98c4d0be5c85d09c0bb2726febc5f421f5a96b220a49d7be9dd6878647ddde86a1aeeb8f8865694dc6a71cf71ca2cbfe8f0e76e8444d0663b3b116b2511f591565cb677ae79269258c66dccfa8ce020fba5af8beb982fe328a4c3afb4a2bc9436caafa3c568501c391467972ab6803f1c659b3039f3d8df48141d0c8c83e49452b6949a96515fd6dfafaa737a7c1cba6b8ab23427ed0a2de19931a34a7053db58c65669e417cba66c22a8ef93ffd82a9817516b4b3728e6873606e848962777fd63ea83286038b1853c1f06b0186a8b01f107dbe61e5242bd0b717148b1db5af8e7316d6a6a30e5d7811f6a2fac7b64f57182fb50f19dd1d5233446bfc604bde1b0967e978d23294f43cf0e85abf08e27e9b43a99981efd48974c586b52351c9ddf340932c12591135adbb7794d4d5a54586e1a0350e34430960c1b46c2966250db081089c5826029f9e25495950faf8cc2daed284bdcc052d2e5b55a588bb53b572bf582098ebc2c32c7a59e37b8d31de57996ee01adf785d5239ce55a2fc5acfdebf9f8e2dd3f51450ac0aa3d70d20fa2fd29ef8dc9925a79dbdf4859e13a78f2023f0e5e2c9905a56afbd395974329613da8dbe87800ae3b9d7a1f0aa32ede42017e58d174ebd4a7e973ad85b5b0da3826f27545aa7f44587da52498613cc1b5f077c32031c4a21c2d7d2c12ab1217b580f2e0bc360b4e0bfa9666944b19ff13e8ce526b85cdef18c92f059d1c1a59484246107020c38db4394ec5e26b5c2bfcf4e27928e05432f37f0de19169a1b7358c4877fa49076085aec8161737952ae4e3093c2dd787d4279f3f1842ad0980a12e9e267d5a1a53ddcef1e7b4c4a93bc9dec0a575559d8b7a09e471a9aaab1fc2094c9a1f75789994ab3c137c2012ee0cae722d34a68a5207a49557121a18b6946c604ec949187a62b03fe29fced73ec61aaba316202258c836d66c287aecd0188dfdd72e41453dc9552f9e8039ce0dd904f3012c04a11515c2c8209f49cf9469823b7231b0cd0fe1a46607822a08676ec2cd53d51c7a2eeedbe8114142ccb783ea1864dd5e135dd3cf67fd8ffe03d87e2f750aac62a22de6fb8e963eced331508f24058b421cf3f5f111c52d05197e33db7aa64921b5ffacbaf957207d7d4d23d8eb00db7bad5fb474b7cfbcec5298e892e6a2a8e020987fefce74818c2d16bde0440ada0facab087e5ef51d008eba272fb62b5996a96e22dc549de832ec92eff46858c4729e34c7d26536b6c6488a43db3c1dcfb098c3654c247960d6747b5c26b1c31088d7105e22fb57ed846ae3cea4f635c13963126cc745c4e24f4b9a19a342e77fd683054e8d812ef7eda6340c1e100755ea7d87f56ee357476347b3777fe304af139a8648a2b8125064e6cd70638b1e4f7102021ab24ea3786439bb6498b24b1d6776e3fabe1442027bbbcec9b2f876816663c8b8dfa30d84c317650616fb6d82ad00ddbb510a99396d9d2532ded7f58a7726b4dd69ae978adddf41a53650c050b8760e7d41ef81c85d3f233dabac1b42901dc98d21a0da7acf041829eb73a2e8a42e2c83065662bfab8b40ff7c32af9097fec5743773ec113769d70c6d30364c1d245d9771923709446ed997d27d914918a591a3d5c40690588d7e068c433666d7112e623d624bb0f5f1695e6552efaa985d0ebf8d3b4df4f7150c126cdb739fdb8d30e15ebefa899b7b0578da58b83d1d620d0f22ff3ad992fd783d48b83f7cce84023321825f876a515451f99d27ab3965a23addf9da2c691b7b29e0a2445767eb74c24a94ee624fa2ffc6004bd87b4fc03f2ac12a3cbcef5bd45cc79a26b7d6942d2dd87e333752c0f07a0918277223c216a08381a9d308f206a76e4119a647771859436130c193454e14629a35eccad754da656320c48514b31d5600796965edf188e52f20c87ea772379ef620058ac21528119c952182dcebc01381bdf1ad9be4b685fca0f12aa59db287137967f21cd11880c8b2a4868182b272e3490ce6786a066b9580f2f2f16610fd3efc26877f811e30a1f3c7ee0caf4992602cef5733557d0e82584e83b13c3bc898251a3949b01d35fca73d663e6b09e1332d2adb4229df7469b601121d3143796687e01591f95e67aae3260bd5bd7b13bcbda08259c3c53635e75e975cea201026637dca7a484c080f772dbde9cca318f7bbbefe450ebcbbf0121a632357e26ccef001256e999c013fb5968f1648605d0dc73b0cba0ac96895e20ec9c6626a228c908ab85981caa7e6e9a4fb4ea9d6d6bda7ad53bed212eea7659c7053de7605cc81dfdd3ea6d12bf2a3e3efe3ad89330c78cd16688d7622aad5f2bea81fbaa8190c351852695e652d777ed06c4ad413576421de008a22f802811fe3a9cf2e5e8e35e92aaff59bb736104ff70b1b4194a0179054b3f297649351af532efc2b8c41f0c4de1ca78cf0fa938fa86acd996bfed4323e96d121af6d05eb9c4fc63d87728c45d06cf60fa37b0a0e8e9023cd96bfcd6f0133f426b0a36be927653412cdf357460d81095100743ade63a36f470b93b64f0b0b5ba6fb029912a8c362970bc134d910fb5431bbe6c9b517db50a0aa9c4bbe9537a1cb2e60c72ff7d378320d84b900a0aef4e8c332c25b2a44e0530c76e3f8663d1bdc5f86593957fb14ba12af38f76d82e9a33d2b6454f854a0a6102c845873fa5c8f4f5f2a06a4d05db6a15a7eac9f3d091107cc7ddee4c55f8dfbb1cf53ac20bbbccfa5ef1ac41e80bd6e49343f0922daef8618d71624a6c7252ec7f79bc"}]}, @ETHTOOL_A_FEATURES_WANTED={0x4}]}, 0xec4}}, 0x0) 19:16:05 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:16:05 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b040000", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 892.355986][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:06 executing program 2: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000000006c0000000000000000000a20000000000a01000000000000000000000000000900010073797a300000000038000000120a0102000000000000000000000000040004800900020002000000000000000900010073797a3000000000080003"], 0x1}}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000100)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000008) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040), 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r4, r1, 0x0, 0x100000005) 19:16:06 executing program 0: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/ipc\x00') ioctl$PPPIOCSNPMODE(r0, 0x4008744b, 0x0) [ 892.682506][T30673] device bridge225 entered promiscuous mode 19:16:06 executing program 0: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) recvmmsg(r0, &(0x7f0000007980)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) [ 892.711895][ T28] audit: type=1804 audit(1601752566.269:319): pid=30674 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/647/cgroup.controllers" dev="sda1" ino=16379 res=1 errno=0 [ 892.741456][T30678] device bridge_slave_0 left promiscuous mode [ 892.763379][T30678] bridge224: port 1(bridge_slave_0) entered disabled state [ 892.842979][ T28] audit: type=1804 audit(1601752566.299:320): pid=30674 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/647/cgroup.controllers" dev="sda1" ino=16379 res=1 errno=0 [ 892.856365][T30678] bridge225: port 1(bridge_slave_0) entered blocking state 19:16:06 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:16:06 executing program 0: getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000000)=""/97, &(0x7f0000000080)=0x61) socket$inet_udp(0x2, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.events\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0xffffff7f, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000100)=[@window, @mss, @mss, @window={0x3, 0x0, 0x30}, @window={0x3, 0x3, 0x9}], 0x5) sendmsg$rds(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$SEG6(0x0) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000240)='\b', 0x1, 0x4004001, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x3, 0x0, 0xfffffffffffffd25) [ 893.038792][T30678] bridge225: port 1(bridge_slave_0) entered disabled state [ 893.108967][T30678] device bridge_slave_0 entered promiscuous mode [ 893.118774][ T28] audit: type=1804 audit(1601752566.679:321): pid=30679 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/647/cgroup.controllers" dev="sda1" ino=16379 res=1 errno=0 [ 893.164740][T30678] bridge225: port 1(bridge_slave_0) entered blocking state [ 893.172116][T30678] bridge225: port 1(bridge_slave_0) entered forwarding state [ 893.210797][ T28] audit: type=1804 audit(1601752566.679:322): pid=30674 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/647/cgroup.controllers" dev="sda1" ino=16379 res=1 errno=0 19:16:06 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000200)={0xa, 0x14e24}, 0x1c) pipe(&(0x7f0000000340)) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000200), 0x38c, 0x0, 0x0) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) 19:16:06 executing program 2: unshare(0x6c060000) socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x80002, 0x0) r1 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000002980)={0x0, 0x0, &(0x7f0000002940)={&(0x7f0000000680)=@newtaction={0x50, 0x30, 0x53b, 0x0, 0x0, {}, [{0x3c, 0x1, [@m_connmark={0x38, 0x1, 0x0, 0x0, {{0xd, 0x1, 'connmark\x00'}, {0x3, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c}]}, {0x4}}}]}]}, 0x50}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000002980)={0x0, 0x0, &(0x7f0000002940)={&(0x7f0000000680)=ANY=[@ANYBLOB="6800000030003b0500000000000000000000000054000100500001000d000100636f6e6e6d61726b00000000200002801c000100000000000200000000000000000000000000000000070000000000000000000c0008000000000000000000"], 0x68}}, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f0000000080)=0x7, 0x8) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000480)={0xffffffffffffffff, 0x86, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000)={r2}, 0xc) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, &(0x7f0000000040)=r3) write$tun(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, &(0x7f0000000040)) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002980)={0x0, 0x0, &(0x7f0000002940)={&(0x7f0000000680)=@newtaction={0x50, 0x30, 0x53b, 0x0, 0x0, {}, [{0x3c, 0x1, [@m_connmark={0x38, 0x1, 0x0, 0x0, {{0xd, 0x1, 'connmark\x00'}, {0x3, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c}]}, {0x4}}}]}]}, 0x50}}, 0x0) ioctl$sock_FIOGETOWN(r4, 0x8903, &(0x7f0000000140)) 19:16:06 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b040000", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 893.396949][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:07 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 893.539857][T30702] device bridge226 entered promiscuous mode [ 893.548264][T30701] IPVS: ftp: loaded support on port[0] = 21 [ 893.567493][T30702] device bridge_slave_0 left promiscuous mode [ 893.587197][T30702] bridge225: port 1(bridge_slave_0) entered disabled state [ 893.631580][T30702] bridge226: port 1(bridge_slave_0) entered blocking state [ 893.667914][T30702] bridge226: port 1(bridge_slave_0) entered disabled state [ 893.713915][T30702] device bridge_slave_0 entered promiscuous mode [ 893.756763][T30702] bridge226: port 1(bridge_slave_0) entered blocking state [ 893.764139][T30702] bridge226: port 1(bridge_slave_0) entered forwarding state [ 893.850309][T30701] virt_wifi0 speed is unknown, defaulting to 1000 19:16:07 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b040000", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:16:07 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) [ 894.198779][T30723] device bridge227 entered promiscuous mode 19:16:07 executing program 0: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2ea400001b00056bd25a80648c69940d0124fc60100009400a000048053582c137153e370948038002000000d1bd", 0x33fe0}], 0x1}, 0x7a000000) syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) [ 894.248913][T30729] device bridge_slave_0 left promiscuous mode [ 894.258172][T30729] bridge226: port 1(bridge_slave_0) entered disabled state [ 894.278805][T30703] IPVS: ftp: loaded support on port[0] = 21 [ 894.340298][T30729] bridge227: port 1(bridge_slave_0) entered blocking state [ 894.383190][T30729] bridge227: port 1(bridge_slave_0) entered disabled state [ 894.404404][T30729] device bridge_slave_0 entered promiscuous mode 19:16:08 executing program 1: r0 = epoll_create(0x101) r1 = socket$unix(0x1, 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)) [ 894.435702][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 894.437419][T30729] bridge227: port 1(bridge_slave_0) entered blocking state [ 894.451239][T30729] bridge227: port 1(bridge_slave_0) entered forwarding state 19:16:08 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 894.530817][T30736] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 894.578803][T30736] netlink: 'syz-executor.0': attribute type 3 has an invalid length. [ 894.607708][T30731] __nla_validate_parse: 11 callbacks suppressed [ 894.607720][T30731] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. [ 894.650804][T30736] netlink: 23550 bytes leftover after parsing attributes in process `syz-executor.0'. [ 894.668131][T30732] netlink: 48 bytes leftover after parsing attributes in process `syz-executor.5'. 19:16:08 executing program 1: r0 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) ioctl$SIOCAX25DELUID(r0, 0x89e2, &(0x7f0000000180)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}) [ 894.698095][T30710] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 894.721656][T30712] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.2'. 19:16:08 executing program 0: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2ea400001b00056bd25a80648c69940d0124fc60100009400a000048053582c137153e370948038002000000d1bd", 0x33fe0}], 0x1}, 0x7a000000) syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) [ 894.750777][T30701] virt_wifi0 speed is unknown, defaulting to 1000 19:16:08 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:16:08 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'hash\x00', 0x0, 0x0, 'streebog512-generic\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000008e00)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000004380)="8c", 0x7ffff000}], 0x1}}], 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000040)=ANY=[], 0x208e24b) socket$inet_sctp(0x2, 0x0, 0x84) sendmmsg$inet_sctp(0xffffffffffffffff, 0x0, 0x0, 0x20044045) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRES32=0x0], 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x3) getsockopt$inet_sctp_SCTP_STATUS(r2, 0x84, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) [ 895.012669][T30750] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 895.042359][T30751] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 895.080513][T30751] netlink: 'syz-executor.0': attribute type 3 has an invalid length. [ 895.133280][T30750] device bridge228 entered promiscuous mode [ 895.165802][T30751] netlink: 23550 bytes leftover after parsing attributes in process `syz-executor.0'. [ 895.201279][T30752] device bridge_slave_0 left promiscuous mode [ 895.210319][T30752] bridge227: port 1(bridge_slave_0) entered disabled state [ 895.281344][T30752] bridge228: port 1(bridge_slave_0) entered blocking state [ 895.332535][T30752] bridge228: port 1(bridge_slave_0) entered disabled state [ 895.397880][T30752] device bridge_slave_0 entered promiscuous mode [ 895.444587][T30752] bridge228: port 1(bridge_slave_0) entered blocking state [ 895.452005][T30752] bridge228: port 1(bridge_slave_0) entered forwarding state [ 895.466217][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 895.553278][T30756] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. [ 896.515366][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 896.586160][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:11 executing program 2: socketpair(0x0, 0x0, 0x0, 0x0) socketpair(0x22, 0x0, 0x6dbd, &(0x7f0000000180)) 19:16:11 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socket$netlink(0x10, 0x3, 0x4) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:16:11 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:16:11 executing program 0: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="2ea400001b00056bd25a80648c69940d0124fc60100009400a000048053582c137153e370948038002000000d1bd", 0x33fe0}], 0x1}, 0x7a000000) syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, 0x0, 0x0) 19:16:11 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) 19:16:11 executing program 1: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ac000000660001ff000000ffc2c7cf0000e20000", @ANYRES32], 0x2}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4bfdc, 0x0) [ 897.554923][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 897.713200][T30799] netlink: 'syz-executor.0': attribute type 9 has an invalid length. [ 897.737234][T30800] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 897.744080][T30799] netlink: 'syz-executor.0': attribute type 3 has an invalid length. [ 897.768968][T30799] netlink: 23550 bytes leftover after parsing attributes in process `syz-executor.0'. [ 897.802247][T30800] device bridge229 entered promiscuous mode 19:16:11 executing program 2: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x37cb1133) socket$inet(0x2, 0x3, 0x33) r3 = socket$packet(0x11, 0x3, 0x300) bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x0, "000001000000000008fc9d71fc00000000000000f8ffff002e0b3836005404b0d6301a4ce875f2e3ff5f163ee340b76795008000f8000000000104003c5811039e15775027ecce66fd792bbf0e5bf5ff9b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ff42c65400"}, 0x80) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0)='nl80211\x00') r6 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000140)={'virt_wifi0\x00'}) sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000780)={0x1c, r5, 0x0, 0x0, 0x0, {}, [@NL80211_ATTR_WIPHY_NAME]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140), 0xc, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="040025bd7000ffdb5f251a0048adbfe74a000008000100040000000c32fd1b99ba14daf298a3f4a8938373c45bb378e11313578f17b025e77ba4d45c5077e83a09ae9856112180729ff90742c5c11a337c17fcaf7389a6137b0962dbc5d2d77361ab761b94227336239261fde4d1e90e82e28341c5881209b3d9189a793451d7ef3d1d1a30d6dae8b66445ad98f66418f0e415a8cc91a55a78119ca6d0ea89f4a290919f88ed826d63c9e7d136adf905535be33d0434907184f1dfb0e04c8b93c35b7093a4a37bbc9c64c610504a5a4d85bc9c86c9baddcb814e219b150447eb7756c3d7ede3099c9c0c0076857c3290d3c5458292cff83175d5a526a5d66b7140a2d9304c04cdfa4ba9323f8beadde769e69a501cf4f1a990d10e155231de5190f8aaabec90a3dab14271863e2853a5944663b2b93c1510bd70f5d42bba0e3a56156c0e2bfa3b79dc4fb72e9ccbecae4dc3de263fedb5c7d8c049908f62e38607aab57f239334d532199a1af6d8880b0e7c650257dcd80d711218b40784141fbf6b4777fc6efefe"], 0x1c}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, 0x0, 0x0) sendmsg$DEVLINK_CMD_SB_GET(0xffffffffffffffff, 0x0, 0x4000000) bind$inet(r2, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x27}}, 0x10) connect$inet(r2, &(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x19404, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, 0x0, 0x0) [ 897.838844][T30808] device bridge_slave_0 left promiscuous mode [ 897.846781][T30808] bridge228: port 1(bridge_slave_0) entered disabled state [ 897.865877][T29308] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 897.890260][T30808] bridge229: port 1(bridge_slave_0) entered blocking state [ 897.918582][T30808] bridge229: port 1(bridge_slave_0) entered disabled state [ 897.946199][T30808] device bridge_slave_0 entered promiscuous mode [ 897.965147][T30808] bridge229: port 1(bridge_slave_0) entered blocking state [ 897.972807][T30808] bridge229: port 1(bridge_slave_0) entered forwarding state 19:16:11 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:16:11 executing program 0: r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2a, &(0x7f0000000340)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) close(r0) [ 898.200388][T30818] device bridge230 entered promiscuous mode [ 898.218952][T30818] device bridge_slave_0 left promiscuous mode [ 898.226592][T30818] bridge229: port 1(bridge_slave_0) entered disabled state [ 898.258709][T30818] bridge230: port 1(bridge_slave_0) entered blocking state [ 898.271465][T30818] bridge230: port 1(bridge_slave_0) entered disabled state [ 898.284739][T30818] device bridge_slave_0 entered promiscuous mode [ 898.295557][T30818] bridge230: port 1(bridge_slave_0) entered blocking state [ 898.302984][T30818] bridge230: port 1(bridge_slave_0) entered forwarding state 19:16:12 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2b", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:16:12 executing program 0: r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2a, &(0x7f0000000340)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r1, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) close(r0) 19:16:12 executing program 1: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x9, [@enum={0x8}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, &(0x7f0000000180)=""/138, 0x2d, 0x8a, 0x1}, 0x20) 19:16:12 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socket$netlink(0x10, 0x3, 0x4) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:16:12 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x40012062, 0x0) [ 898.596540][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 898.684021][T30830] device bridge231 entered promiscuous mode [ 898.739340][T30835] device bridge_slave_0 left promiscuous mode [ 898.749843][T30835] bridge230: port 1(bridge_slave_0) entered disabled state 19:16:12 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@remote, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x3c}, 0x0, @in, 0x0, 0x0, 0x0, 0x6}}, 0xe8) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0x0) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="3400000097f4ec359ce743cb70d86706cf71fdb61c527c3d97da3970f1846aa467a427107821df59abf29fee2a884366d52660966eb4120ad4aa621b45c2a0a1d3e3ebe2b6dd5d8e3c9b2be47ccb360d5e837f82c2a9af93f31c906cf02255e2313cf0a96f32f927216153", @ANYRESOCT, @ANYBLOB="00012dbd7000fbdbdf251a000000050092000300000008009a000000000008009a000000e3ff07009a000100d20bd1cc7e91988b00006fb9cf8b45206b3523f9c38de87b000000000006000000"], 0x34}, 0x1, 0x0, 0x0, 0x359fef00b25c8a8a}, 0x20004080) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="88000000", @ANYRES16=0x0, @ANYBLOB="330a2dbd7000040004000000000000003c00038008000100ffffffff08000200070000000800010000040000080003003d00000008000200e50000000800020029040000080002000002000004000380240005800c000280080003000300000014000280080002009d01000008000200060000000000000000000000000000000000e413349768af442c6accff7c373624582ff13e623e9f4b91e90e6fb157943e515d07af5254370e9241557453"], 0x88}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000000a00850600000000000e000000000000", @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) socket(0x11, 0x800000003, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)=@bridge_newvlan={0x18, 0x70, 0x2, 0x70bd25, 0x25dfdbfc}, 0x18}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_SET_REG(r3, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="3400000097f4ec359ce743cb70d86706cf71fdb61c527c3d97da3970f1846aa467a427107821df59abf29fee2a884366d52660966eb4120ad4aa721b45c2a0a1d3e3ebe2b6dd5d8e3c9b2be47ccb360d5e837f82", @ANYRESOCT, @ANYBLOB="00012dbd7000fbdbdf251a000000050092000300000008009a000000000008009a000000e3ff07009a000100d20bd1cc7e91988b00006fb9cf8b45206b3523f9c38de87b000000000006000000"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x20004080) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$TIPC_NL_MON_GET(r4, &(0x7f0000000600)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="88000000", @ANYRES16=0x0, @ANYBLOB="330a2dbd7000040004000000000000003c00038008000100ffffffff08000200070000000800010000040000080003003d00000008000200e50000000800020029040000080002000002000004000380240005800c000280080003000300000014000280080002009d01000008000200060000000000000000000000000000000000e413349768af442c6accff7c373624582ff13e623e9f4b91e90e6fb157943e515d07af5254370e9241557453"], 0x88}, 0x1, 0x0, 0x0, 0x1}, 0x20000040) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006000000"], 0x3c}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x60, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x41100, 0x50404}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @ipip6={{0xb, 0x1, 'ip6tnl\x00'}, {0x28, 0x2, 0x0, 0x1, [@IFLA_IPTUN_PROTO={0x5, 0x9, 0x29}, @IFLA_IPTUN_FLOWINFO={0x8, 0x7, 0x8001}, @IFLA_IPTUN_COLLECT_METADATA={0x4}, @IFLA_IPTUN_FLAGS={0x8, 0x8, 0x1d}, @IFLA_IPTUN_ENCAP_DPORT={0x6, 0x12, 0x4e24}]}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x60}}, 0x0) [ 898.807085][T30835] bridge231: port 1(bridge_slave_0) entered blocking state [ 898.830234][T30835] bridge231: port 1(bridge_slave_0) entered disabled state [ 898.874405][T30835] device bridge_slave_0 entered promiscuous mode 19:16:12 executing program 2: r0 = socket$inet6(0xa, 0x5, 0x0) sendmmsg$inet(r0, &(0x7f00000040c0)=[{{&(0x7f0000000040)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000200)=[{&(0x7f0000000080)='w', 0x1}], 0x1}}], 0x1, 0x0) [ 898.927695][T30835] bridge231: port 1(bridge_slave_0) entered blocking state [ 898.935440][T30835] bridge231: port 1(bridge_slave_0) entered forwarding state [ 899.006589][T30849] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=62615 sclass=netlink_route_socket pid=30849 comm=syz-executor.1 19:16:12 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000340)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020fe30057a0af0fff8ffffff79a4f0ff00000000b70600000018d1fe6e640500000000007504000000ffffffd404000040000000b7040000100000206a0700fe00000000850000002f000000b70000000a00000095000000000000006458c2c62fc2868f0399d909a63796c113a80c19aab9d607000000b6cd483be3f0d3253730e711f5969f62c28b22756bedf3cf393d14c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dd87235b44174f7c0343185089a0f119e31975e551558055dc2dc"], &(0x7f0000000280)='GPL\x00'}, 0x48) [ 899.049260][T30849] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=30849 comm=syz-executor.1 19:16:12 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2b", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 899.107961][T30853] netlink: 'syz-executor.1': attribute type 1 has an invalid length. [ 899.330019][T30849] bond1: (slave ip6tnl1): The slave device specified does not support setting the MAC address [ 899.423800][T30849] bond1: (slave ip6tnl1): Error -95 calling set_mac_address 19:16:13 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socket$netlink(0x10, 0x3, 0x4) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b910000", 0x104}], 0x1) 19:16:13 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, 0x0, 0x0, 0x40012062, 0x0) [ 899.639636][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 899.808336][T30902] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=62615 sclass=netlink_route_socket pid=30902 comm=syz-executor.1 [ 899.863402][T30904] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=30904 comm=syz-executor.1 [ 899.917855][T30896] __nla_validate_parse: 6 callbacks suppressed [ 899.917872][T30896] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:16:13 executing program 2: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @remote}, 0x1}}, 0x2e) [ 899.971238][T30896] device bridge232 entered promiscuous mode [ 899.992170][T30897] device bridge_slave_0 left promiscuous mode [ 900.001200][T30897] bridge231: port 1(bridge_slave_0) entered disabled state [ 900.056451][T30897] bridge232: port 1(bridge_slave_0) entered blocking state [ 900.108648][T30897] bridge232: port 1(bridge_slave_0) entered disabled state [ 900.174445][T30897] device bridge_slave_0 entered promiscuous mode 19:16:13 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='9p_client_req\x00'}, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000003e00)={0x0, 0x0, &(0x7f0000003dc0)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x1405, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x58, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x2, 'geneve1\x00'}]}]}]}], {0x14, 0x10}}, 0xa0}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000003e00)={0x0, 0x0, &(0x7f0000003dc0)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x1405, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x58, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x2, 'geneve1\x00'}]}]}]}], {0x14, 0x10}}, 0xa0}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000003e00)={0x0, 0x0, &(0x7f0000003dc0)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x1405, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x58, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x2, 'geneve1\x00'}]}]}]}], {0x14, 0x10}}, 0xa0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x6c, &(0x7f0000000040)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_PROTO_DOWN={0x8, 0x1c, 0xffffffef}]}, 0x28}}, 0x0) [ 900.253737][T30897] bridge232: port 1(bridge_slave_0) entered blocking state [ 900.261467][T30897] bridge232: port 1(bridge_slave_0) entered forwarding state [ 900.343318][T30898] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 900.372820][T30902] netlink: 'syz-executor.1': attribute type 1 has an invalid length. 19:16:14 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000026c0)=@setlink={0x30, 0x13, 0x1, 0x0, 0x0, {}, [@IFLA_NET_NS_PID={0x8}, @IFLA_TARGET_NETNSID={0x8}]}, 0x30}}, 0x0) 19:16:14 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2b", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:16:14 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x7) socket(0x11, 0x800000003, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x328, 0x128, 0x0, 0x0, 0x0, 0x0, 0x258, 0x240, 0x240, 0x258, 0x240, 0x3, 0x0, {[{{@ipv6={@local, @ipv4={[], [], @loopback}, [], [], 'ip6gretap0\x00', 'veth1_to_bond\x00', {}, {}, 0x3a}, 0x0, 0xf8, 0x128, 0x0, {}, [@common=@inet=@socket2={{0x28, 'socket\x00'}, 0x2}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xffffffffffffffff, 0x2, 0x2}, {0x3}}}}, {{@ipv6={@remote, @initdev={0xfe, 0x88, [], 0x0, 0x0}, [], [], 'caif0\x00', 'lo\x00'}, 0x0, 0x108, 0x130, 0x0, {}, [@common=@srh={{0x30, 'srh\x00'}, {0x3c, 0x0, 0x5}}, @common=@ah={{0x30, 'ah\x00'}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x388) 19:16:14 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, 0x0, 0x0) 19:16:14 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0xc, 0x400, 0xc}, 0x40) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000001c0), &(0x7f00000000c0), 0x1081, r0}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000bc0)={r0, &(0x7f0000000a40), &(0x7f0000000b40)=""/82}, 0x20) socket$kcm(0x29, 0x0, 0x0) [ 900.675465][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:14 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, 0x0, 0x0, 0x40012062, 0x0) [ 900.834654][T30937] Cannot find del_set index 3 as target [ 900.843604][T30936] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:16:14 executing program 0: syz_genetlink_get_family_id$batadv(0x0) socketpair$unix(0x1, 0x4000000000002, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000003c0)={&(0x7f0000000280)={0x10c, 0x0, 0x910, 0x70bd26, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x5c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x9}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4a}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xc, 0xa}}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3c}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x80}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x6, 0x1}}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @broadcast}}]}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve1\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @private=0xa010102}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xfff}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}]}, 0x10c}, 0x1, 0x0, 0x0, 0x20000810}, 0x44080) r3 = epoll_create(0x200) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r4, 0x1) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r5, 0x1) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ppoll(&(0x7f0000000000)=[{r0, 0x84b2}, {r3, 0xa29a6b58c1bbcfaa}, {r4, 0x8000}, {r1, 0x5000}, {0xffffffffffffffff, 0x11c}, {r0, 0x90}, {r6, 0x2091}], 0x7, &(0x7f0000000040), &(0x7f0000000140)={[0x1]}, 0x8) ppoll(&(0x7f0000000500)=[{r1, 0x2103, 0x64}], 0x1, &(0x7f0000000580)={0x0, r2+10000000}, 0x0, 0x0) accept$unix(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) bind$llc(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$ax25(0x3, 0x0, 0x0) [ 900.883520][T30940] Cannot find del_set index 3 as target [ 900.950637][T30936] device bridge233 entered promiscuous mode [ 900.989099][T30941] device bridge_slave_0 left promiscuous mode 19:16:14 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r1, 0xc0406618, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000180)={@map=r0, r3, 0x10}, 0x10) write$binfmt_misc(r2, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x1, 0x61bd, 0x1c2dc0000}) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f00000001c0), &(0x7f0000000200)=0x4) pwritev(0xffffffffffffffff, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x6, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$FS_IOC_RESVSP(r4, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r5 = accept4$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x0) getsockopt$PNPIPE_ENCAP(r5, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) [ 900.998618][T30941] bridge232: port 1(bridge_slave_0) entered disabled state [ 901.088539][T30941] bridge233: port 1(bridge_slave_0) entered blocking state [ 901.126842][T30941] bridge233: port 1(bridge_slave_0) entered disabled state 19:16:14 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x35, &(0x7f0000000000)=0x1, 0x4) [ 901.184601][T30941] device bridge_slave_0 entered promiscuous mode [ 901.231747][T30941] bridge233: port 1(bridge_slave_0) entered blocking state [ 901.239539][T30941] bridge233: port 1(bridge_slave_0) entered forwarding state [ 901.327451][T30946] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 19:16:15 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:16:15 executing program 2: r0 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r0, &(0x7f0000000380)={0x2, 0x0, @remote}, 0x10) [ 901.705581][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:15 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, 0x0, 0x0) [ 901.909745][T30973] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 901.983077][T30973] device bridge234 entered promiscuous mode 19:16:15 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, 0x0, 0x0, 0x40012062, 0x0) [ 902.048833][T30977] device bridge_slave_0 left promiscuous mode [ 902.059177][T30977] bridge233: port 1(bridge_slave_0) entered disabled state [ 902.135355][T30977] bridge234: port 1(bridge_slave_0) entered blocking state [ 902.149571][T30977] bridge234: port 1(bridge_slave_0) entered disabled state [ 902.174581][T30977] device bridge_slave_0 entered promiscuous mode 19:16:15 executing program 1: syz_genetlink_get_family_id$mptcp(&(0x7f0000001040)='mptcp_pm\x00') [ 902.217980][T30977] bridge234: port 1(bridge_slave_0) entered blocking state [ 902.225695][T30977] bridge234: port 1(bridge_slave_0) entered forwarding state [ 902.307858][T30981] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. [ 902.348693][ T38] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 902.358587][ T776] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:16 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:16:16 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cdfa146ec56175037958e271f60d25b7937f02c8695e5a076d83923dd29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b318e2ec0e0700897a74a0091ff110026e6d2ef831ab7ea0c34f17e3ad6ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a2d7cbdb9cd38bdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e060e3670ef0e789f65f1328d6704902c0a0d084ea415c03149ebbe7bc04b82d2789cb132b8667c21476619f28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fbcbbf35b1e7be6148ba532e6ea09c346dfebd31a08b32108b80200020000000000334d83239dd27080e71113610e10d858e8327ef01fb6c86adac1222fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9db697a6ea0182babc18cae2ed4b4390af9a9ceafd07ed00b0000002cab154ad029a119ca3c972780870014601c3c975d5aec84222fff0d7216fdb0d3a0ec4be3e563112f4b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a2a71bc85018e5ff2c910496f18afc9ffc2cc783db01a469398685211bbae3e2ed0a5670e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcdcc22ee17476d738992533ac2a9f5a699593f084419cae0b4187fb01c73f99857399537f5dc2acb72c7eae993fc9eb22d130665b6341da114f08cd0509d380578673f8b6e74ce23877a6b7fdb0e067345560942fa629fbef2461c96a08707671315c302fae29187d4f5c06a960fd37c10223fdae7ed04935ccda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398c88607a67e18c2977aab37d9a44cfc1c7b4000000000000fa47742f6c5b9c4b11e7d7262a1457c39474c826b956ba859ac8e3c177b91bd7d5ca1664fe2f3ced8468911806e8916dc15e21644db60c2499d5d16d7d915836ab2605033a64482008ef069dc42749289f854797f2f900c2a12d8c38a967c1bbe09315c29877a331bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a9e90d767671414c99d4894ee7f8249dc1e3428d2129369ee1b85afa1a5be5f6eb2eea0d0df414b315f651c8412392191fa83ee8229c017048243765ee41da30548f0fe1038debd64cbe359454a3f2239cfe35f81b7aded448859968ff0e90500d0b07c0dd00490f167e6d5c1109681739dc33f75b2042b8ff8c21ad702ccccf9c7a84ccd903890f064c496facf6b4c6d5a842f8c703ddd879f8a85d76f8964dfe6482e62855fe2c77b61977ff3d9601c37f38c38dbfc2f34a328bdf006001b600025868063e3a8fd273693146186b977a0bc3aae5869ef4cdd221e265d2d4e7fb46706b47ba3c0a18ce25dac4b1c2b977c8ae71835737e0334a19cb5bc964b1ca87339282a13ef131d11a28bbb4efbb697b82fb3ee31b07c48b85aa553067ba07a5898336cbded11c9c136f8a1ab5a8a17b67431c004e6eb08ba28d6b09a85efb6d067ea74a7140cadda7a7790ac814a68ed9c41208fbcb5518431791211826605b6a9b5237d2ed8dc9dcc3b259424349b439b53644e0606683706a00000000009c9a586e268effeb04b64872eb9ec7756fcfa9b2adb701dd59016c44bdd8ecb56fed28c1493943c7f7edf41cbb9780da4d3ff185a30b109dc1d7878f611a765a9256b9638dfc509eea563e477208265f89fe419ae3d89a9f3f159eefe0f9b3a8f97618d97b1b7b5185471e11f910bb98220cb5a40f8ea1c1a5a1953b03574041640b70e5160c6bd23f7207b23dfb9d84ff9e9348b0041a952311653c85838a53dccfe85b96aa36be2c5bc8b992b507efcf54d13d706758cebf382a6e9783747b4cae7d4e1c404209033d7577d393c0a5de3dd4c794dbeb23b0f3b6be93b941f65d1cc1abb483fa007bc554b5f65ebefee4f3fb4c2d77b61f27218a6b38c069e607742ef99df167979ced10e81b2c484e6d2292c41a7af82d849f3a064de22906fb9be01955c4bcb37f6e7ff9fb9b5f134d4d8b64040baf379dd83deb48b7e2e2059a45f9bbffa1ce2944685ff33e70eea835b9e389c849e1a3e725f41fe03cc56b53a2bf97b86ba3915b6795f95814ada79a64d43f4789d726f967e6e50219c9c4b4433df55a7550ed7e419e13933adbca2194ea1ecdde21eab778cb0812caeeaa3dbb4b7565a6303a56b2595d3e83427f17ec0bd7a1d2cad18cb522428a1a2714752d582ce32f7a1d5f8e82c9778637dcdf03f307f05cba76b6915838a9e5275c5959b34ee69cc3dc19aea25f6f2389215ddc7498ebf6c736a90472baccfddfa2b9c9d4c6ec99e58ddcd198cd62651638637a46257200000000000000000000000000d2d6675d211e3817534b8336e680f2b4944d02bdb4745dd3280e4580e01b33df0537482cb49841305a26f4d7cb2170"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x28, 0xfffff000, &(0x7f0000000100)="b9ff03006044238cb89e14f008001bffffff00004000633377fbace0143ae934a0a662079f4b4d2f87e50bca6aab845013f2325f1a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0xfe, 0x60000000}, 0x2c) [ 902.644658][T30995] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:16:16 executing program 2: r0 = socket(0x18, 0x0, 0x1) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8914, &(0x7f0000000000)={'batadv_slave_1\x00'}) [ 902.693149][T30995] device bridge235 entered promiscuous mode [ 902.725768][T30999] device bridge_slave_0 left promiscuous mode [ 902.746980][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 902.759165][T30999] bridge234: port 1(bridge_slave_0) entered disabled state [ 902.813619][T30999] bridge235: port 1(bridge_slave_0) entered blocking state 19:16:16 executing program 1: pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) close(r2) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'wp512\x00'}, 0x58) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r4, 0x0) r5 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, 0x0, 0xfffffdea) splice(r0, 0x0, r5, 0x0, 0x2000000000a, 0x0) [ 902.858751][T30999] bridge235: port 1(bridge_slave_0) entered disabled state [ 902.918558][T30999] device bridge_slave_0 entered promiscuous mode [ 902.960208][T30999] bridge235: port 1(bridge_slave_0) entered blocking state [ 902.967626][T30999] bridge235: port 1(bridge_slave_0) entered forwarding state [ 902.992603][T30995] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. [ 903.013991][T31002] batman_adv: batadv0: Interface deactivated: batadv_slave_1 19:16:17 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000000140)={0x20}) pwrite64(r1, &(0x7f00000002c0)='_', 0x1, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0xffffff6a) ioctl$FIBMAP(r1, 0x1, &(0x7f00000000c0)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) write$cgroup_int(r2, &(0x7f0000000380), 0x101bf) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000001300)={0x2880008, r1, 0x0, 0x8}) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040000}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) socketpair(0x1a, 0x0, 0x3, 0x0) bind$inet(r3, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x34) sendmmsg(r3, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000180), 0x0) sendto$llc(r0, &(0x7f00000003c0)="b16c19727b5145c55a83f8c65ce6792638774313465fe16df9010183be160a0b333d2ea4a64ac1c1d9c4f17c1c0f093f2275200eeb5ade6feb2ef578b5704a6cc600c5bb02f749316d9e46f667d21fba096df5d45c2dde1547e0bff8ac44b7514ded39fdc849dc09087b75877710a17a4eed0ffade0615f2a471321531a6cd74337d8edddbc79980056db3979dad33fb6dff469c0b2ed77ff0b40f1d26ee88c0b20715796757d6a5b81be6ff3d4e", 0xae, 0x0, &(0x7f0000000300)={0x1a, 0xfef0, 0xfc, 0xff, 0x2, 0x7, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x10) recvmmsg(r3, 0x0, 0x0, 0x0, &(0x7f0000005340)={0x0, 0x1c9c380}) 19:16:17 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, 0x0, 0x0) 19:16:17 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40012062, 0x0) 19:16:17 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:16:17 executing program 1: r0 = socket(0x2b, 0x1, 0x1) sendto$ax25(r0, 0x0, 0x0, 0x20004010, 0x0, 0x0) 19:16:17 executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0x4, &(0x7f0000000100), &(0x7f0000000140)=0x4) 19:16:17 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x0, @dev}, {0x2, 0x0, @remote}, {0x2, 0x0, @remote}, 0x1b6, 0x0, 0x0, 0x0, 0x6c00}) 19:16:17 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000280)) socket$xdp(0x2c, 0x3, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) write$binfmt_elf32(r0, &(0x7f0000003040)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x4, 0x1f, 0x7, 0x2, 0x2, 0x6, 0x5, 0x1f8, 0x38, 0x149, 0x1, 0x475, 0x20, 0x1, 0x7ff, 0xeb2b, 0x200}, [{0x2, 0x0, 0x4b9f, 0x44, 0xc4, 0xfff, 0xb769, 0xfffff1c3}], "3b2fda54b27e0b13037b7a920a5b68f57bc4df586e0b46809f19ea13cb397ee5e338ffc8e1fdb3894b7e1be1e02ce56a056dcb757b95fc7c548e8d7911e8937ced639dc3445c14bc2dba646f41a0e58f220a26516d0d1dbe6438bd8be5203b42e4e55dad36b2d7aa5d64815437db0fd00e61b5ba851e17bd7e6562ae380487da0a3aeb13dfd90fa0bb4cebd213003ab4760175bea74ace0316a8e551167739c2be91b2323483c7fba5e1cb13e0f5cd6425b1b889ffc46f7f5c55f44c0391b4157812c932c5bc31f439e479bcee11", [[], [], [], []]}, 0x526) close(r0) socket$inet6(0xa, 0x80003, 0x6b) r2 = socket(0x10, 0x80002, 0x0) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe8697071") close(r1) r3 = socket(0x1000000010, 0x80002, 0x0) sendmmsg$alg(r3, &(0x7f0000000200), 0x10efe10675dec16, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r3, 0x28, 0x2, &(0x7f0000000300)=0x1, 0x8) setsockopt$netrom_NETROM_T2(r2, 0x103, 0x2, &(0x7f0000000040)=0x8, 0x4) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) setsockopt$SO_J1939_PROMISC(0xffffffffffffffff, 0x6b, 0x2, &(0x7f00000023c0), 0x4) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) r7 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$pppl2tp_PPPOL2TP_SO_DEBUG(0xffffffffffffffff, 0x111, 0x1, 0x0, 0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl(r9, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") sendfile(0xffffffffffffffff, r9, &(0x7f0000003580)=0x100000001, 0x1) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, &(0x7f0000000180)={r8}, 0x8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000003a40)=ANY=[@ANYRES32=r8, @ANYRES64], &(0x7f0000000000)=0xf0) recvmmsg(r3, &(0x7f0000002e80)=[{{&(0x7f0000000600)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000001a40)=[{&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/221, 0xdd}, {&(0x7f0000001780)=""/123, 0x7b}, {&(0x7f0000000140)=""/10, 0xa}, {&(0x7f0000002680)=""/134, 0x86}, {&(0x7f0000001880)=""/212, 0xd4}, {&(0x7f0000001980)=""/180, 0xb4}], 0x7}, 0xfffffffc}, {{&(0x7f0000001ac0)=@l2tp={0x2, 0x0, @multicast2}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000240)=""/24, 0x18}], 0x1}, 0x6}, {{&(0x7f0000001b40)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, 0x80, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/146, 0x92}], 0x1}, 0x1}, {{&(0x7f0000001cc0)=@xdp, 0x80, &(0x7f0000002240)=[{&(0x7f0000001d40)=""/172, 0xac}, {&(0x7f0000001e00)=""/106, 0x6a}, {&(0x7f0000001e80)=""/217, 0xd9}, {&(0x7f0000001f80)=""/96, 0x60}, {&(0x7f0000002000)=""/37, 0x25}, {&(0x7f0000002040)=""/201, 0xc9}, {&(0x7f0000002140)=""/214, 0xd6}], 0x7, &(0x7f00000022c0)=""/77, 0x4d}, 0x3ff}, {{&(0x7f0000002340)=@rc={0x1f, @none}, 0x80, &(0x7f0000002840)=[{&(0x7f00000000c0)=""/3, 0x3}, {&(0x7f0000002400)=""/54, 0x36}, {&(0x7f0000002440)=""/102, 0x66}, {&(0x7f00000024c0)=""/9, 0x9}, {&(0x7f0000002500)=""/73, 0x49}, {&(0x7f0000002580)=""/206, 0xce}, {&(0x7f0000000340)=""/143, 0x8f}, {&(0x7f0000002740)=""/237, 0xed}], 0x8, &(0x7f00000028c0)=""/119, 0x77}, 0x10001}, {{&(0x7f0000002980)=@in={0x2, 0x0, @empty}, 0x80, &(0x7f0000002d40)=[{&(0x7f0000002a00)=""/76, 0x4c}, {&(0x7f0000002a80)=""/10, 0xa}, {&(0x7f0000002ac0)=""/40, 0x28}, {&(0x7f0000002b00)=""/154, 0x9a}, {&(0x7f0000002bc0)=""/181, 0xb5}, {&(0x7f0000002c80)=""/137, 0x89}], 0x6, &(0x7f0000002dc0)=""/179, 0xb3}, 0xffff}], 0x6, 0x400000c0, &(0x7f0000003000)={0x0, 0x989680}) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f00000036c0)=ANY=[@ANYRES32=r10, @ANYBLOB="7d000000382f8c6b5a728d0c8d733384b5218f0002107cbbac078e93650c926d62d0631b88823fe2bc0d1a5798d6dd324f8ce4f53f6dd3c34d6fc095e2b95196b860c13226dbb97abf340e7b079253181d29c31c3b03457ffb751d94978315da8cb6856bd24c362cf4a589a592dd65d1eec2301e87b0019db824f40a06f7324c7c8f6f926349bf9fa6c22fa6c9892c6a02045b8640184712033f1a2abe6c7606007d358552f3ed038f99ae259e5f76dea893e0b1731ddbe9d0f9c0bc3cfdc09083b3047376911716d777b8ec559f517a3b2e6066093b125379eb048c88faadd223e60222470b8bf9d9b000fcd843f8bb1eb67005a483c8372404d7ef6eadb295b242226b06b3e1046dcd21ad5cffefae91a4d5f09417ce88830d7358e207cc7dbae34f627d3ba656b0ef4eec23a1ac67d49fef57d8de2ff56e9cc0254640b6becc6397b3686fdd32981240fc073d720b4a2a00198d2d1e2012248f65727962cd46fbad2de115d23a69db814978c4a4bc32b0390261ab71b5e93021ab9d1a"], &(0x7f0000000080)=0x85) sendmsg$nl_route(r4, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=@newlink={0x54, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x304}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6erspan={{0xe, 0x1, 'ip6erspan\x00'}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_ERSPAN_HWID={0x6, 0x18, 0x9}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x8}]}}}, @IFLA_MASTER={0x8}]}, 0x54}}, 0x0) [ 904.035062][T31017] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 904.039842][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 904.126777][T31017] device bridge236 entered promiscuous mode [ 904.206501][T31023] device bridge_slave_0 left promiscuous mode [ 904.216564][T31023] bridge235: port 1(bridge_slave_0) entered disabled state [ 904.260137][T31023] bridge236: port 1(bridge_slave_0) entered blocking state [ 904.268165][T31023] bridge236: port 1(bridge_slave_0) entered disabled state [ 904.282696][T31023] device bridge_slave_0 entered promiscuous mode [ 904.298899][T31023] bridge236: port 1(bridge_slave_0) entered blocking state [ 904.306290][T31023] bridge236: port 1(bridge_slave_0) entered forwarding state [ 904.319980][T31027] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'. 19:16:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=@ipv6_newnexthop={0x34, 0x68, 0x201, 0x0, 0x0, {}, [@NHA_ENCAP={0x18, 0x8, 0x0, 0x1, @LWTUNNEL_IP6_SRC={0x14, 0x3, @local}}, @NHA_BLACKHOLE={0x4}]}, 0x34}}, 0x0) 19:16:18 executing program 4: socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r5, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r2, @ANYBLOB="000000000400000008000a00", @ANYRES32=r5], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r5, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:16:18 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x358, 0x0, 0x0, 0x148, 0x0, 0x148, 0x288, 0x288, 0x288, 0x288, 0x288, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0x100, 0x148, 0x0, {}, [@common=@inet=@ecn={{0x28, 'ecn\x00'}, {0x20}}, @common=@inet=@tcp={{0x30, 'tcp\x00'}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz1\x00'}}}, {{@ipv6={@mcast1, @loopback, [], [], 'vxcan1\x00', 'ip6gre0\x00'}, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@mh={{0x28, 'mh\x00'}, {"aa3e"}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b8) 19:16:18 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40012062, 0x0) [ 904.729415][T31047] device bridge237 entered promiscuous mode [ 904.782630][T31053] device bridge_slave_0 left promiscuous mode [ 904.798331][T31053] bridge236: port 1(bridge_slave_0) entered disabled state 19:16:18 executing program 0: r0 = socket$kcm(0x10, 0x2, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'ip6tnl0\x00', &(0x7f0000000000)=@ethtool_sset_info={0x25}}) 19:16:18 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000), 0x0) 19:16:18 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb, 0x1, 'gretap\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x5}]}}}]}, 0x3c}}, 0x0) 19:16:18 executing program 1: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9, 0x1, 'cake\x00'}, {0xc, 0x2, [@TCA_CAKE_AUTORATE={0x8}]}}]}, 0x3c}}, 0x0) [ 904.869465][T31053] bridge237: port 1(bridge_slave_0) entered blocking state [ 904.899837][T31053] bridge237: port 1(bridge_slave_0) entered disabled state [ 904.967280][T31053] device bridge_slave_0 entered promiscuous mode [ 905.004183][T31053] bridge237: port 1(bridge_slave_0) entered blocking state [ 905.011808][T31053] bridge237: port 1(bridge_slave_0) entered forwarding state [ 905.076241][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:18 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x4, &(0x7f0000000100)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x55, 0x0, 0x1b0001}, [@ldst={0xffffffbd, 0x2, 0x4f04}]}, &(0x7f0000003ff6)='syzkaller\x00', 0x5, 0x481, &(0x7f00000001c0)=""/195}, 0x48) 19:16:18 executing program 1: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000440)) 19:16:18 executing program 4: socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r5, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r2, @ANYBLOB="000000000400000008000a00", @ANYRES32=r5], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r5, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000180), 0x4000000000002bc, 0x0) [ 905.177404][ T117] tipc: TX() has been purged, node left! 19:16:18 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000000)="080db5055e0bcfe847a071") setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfffff020}, {0x6}]}, 0x10) 19:16:19 executing program 1: socketpair$unix(0x1, 0x4000000000002, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x0, 0x64}, {r1, 0x8124}], 0x2, &(0x7f00000002c0)={0x0, r2+10000000}, 0x0, 0x0) [ 905.370543][T31078] __nla_validate_parse: 1 callbacks suppressed [ 905.370555][T31078] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 905.469591][T31078] device bridge238 entered promiscuous mode [ 905.517516][T31081] device bridge_slave_0 left promiscuous mode [ 905.529965][T31081] bridge237: port 1(bridge_slave_0) entered disabled state [ 905.568962][T31081] bridge238: port 1(bridge_slave_0) entered blocking state [ 905.577735][T31081] bridge238: port 1(bridge_slave_0) entered disabled state [ 905.590737][T31081] device bridge_slave_0 entered promiscuous mode [ 905.601896][T31081] bridge238: port 1(bridge_slave_0) entered blocking state [ 905.609308][T31081] bridge238: port 1(bridge_slave_0) entered forwarding state 19:16:19 executing program 2: r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @empty}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000005a80), 0x0, 0x0, 0x0) ppoll(&(0x7f0000001380)=[{r0}], 0x1, &(0x7f00000013c0)={0x0, 0x3938700}, 0x0, 0x0) 19:16:19 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuacct.usage_user\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x7c774aac) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) sendfile(r2, r0, 0x0, 0x7fffffff) socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendfile(r2, r0, 0x0, 0x4000002) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00) 19:16:19 executing program 4: socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r5, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r2, @ANYBLOB="000000000400000008000a00", @ANYRES32=r5], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r5, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000180), 0x4000000000002bc, 0x0) 19:16:19 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40012062, 0x0) 19:16:19 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000), 0x0) [ 906.080811][T31105] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 906.105522][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 906.164712][T31105] device bridge239 entered promiscuous mode [ 906.200413][T31108] device bridge_slave_0 left promiscuous mode [ 906.208521][T31108] bridge238: port 1(bridge_slave_0) entered disabled state [ 906.253174][T31108] bridge239: port 1(bridge_slave_0) entered blocking state [ 906.271679][T31108] bridge239: port 1(bridge_slave_0) entered disabled state [ 906.306303][T31108] device bridge_slave_0 entered promiscuous mode [ 906.344938][T31108] bridge239: port 1(bridge_slave_0) entered blocking state [ 906.352322][T31108] bridge239: port 1(bridge_slave_0) entered forwarding state 19:16:20 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, 0x0, 0x0, 0x0) [ 906.673568][T31120] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:16:20 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000080)=@raw={'raw\x00', 0x3c1, 0x3, 0x420, 0x0, 0x280, 0x0, 0x0, 0x0, 0x350, 0x350, 0x350, 0x350, 0x350, 0x3, 0x0, {[{{@ipv6={@remote, @mcast2, [], [], 'veth1_to_bond\x00', 'netpci0\x00'}, 0x0, 0x250, 0x280, 0x0, {}, [@common=@inet=@hashlimit2={{0x150, 'hashlimit\x00'}, {'team_slave_1\x00', {0x0, 0x0, 0x3e, 0x30010000, 0x0, 0x1ab618fe, 0x800}}}, @common=@inet=@hashlimit1={{0x58, 'hashlimit\x00'}, {'syzkaller1\x00'}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@CLASSIFY={0x28, 'CLASSIFY\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x480) [ 906.803887][T31120] device bridge240 entered promiscuous mode 19:16:20 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'crc32c\x00'}, 0x58) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) gettid() r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000200)={0xa, 0x14e24, 0x80000000}, 0x1c) pipe(&(0x7f0000000340)={0xffffffffffffffff}) close(0xffffffffffffffff) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x4ffe0, 0x8) sendmsg$IPSET_CMD_SWAP(r2, 0x0, 0x4000000) recvmmsg(r1, &(0x7f0000000200), 0x38c, 0x0, 0x0) connect$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) ppoll(&(0x7f0000000040), 0x0, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f000000ab80)={0x0, 0xfffffffffffffd57, 0x0, 0x1, 0x0, 0x0, 0x10000}, 0x0) write$binfmt_script(r0, &(0x7f0000000400)=ANY=[@ANYRESOCT, @ANYRESHEX, @ANYRES64], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x7a05, 0x1700) sendfile(r4, r3, 0x0, 0x100004100) [ 906.855850][T31122] device bridge_slave_0 left promiscuous mode [ 906.867376][T31122] bridge239: port 1(bridge_slave_0) entered disabled state 19:16:20 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000), 0x0) 19:16:20 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40012062, 0x0) [ 906.945363][T31130] xt_hashlimit: size too large, truncated to 1048576 [ 906.960102][T31122] bridge240: port 1(bridge_slave_0) entered blocking state [ 906.991271][T31130] xt_hashlimit: overflow, rate too high: 0 [ 907.016486][T31122] bridge240: port 1(bridge_slave_0) entered disabled state [ 907.059022][T31122] device bridge_slave_0 entered promiscuous mode 19:16:20 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, 0x0) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000040)={r3}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000040)=@assoc_id=r3, &(0x7f0000000080)=0x4) ioctl$SIOCX25CALLACCPTAPPRV(0xffffffffffffffff, 0x89e8) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r4, &(0x7f0000000200), 0xf000) write$cgroup_int(r1, &(0x7f0000000200), 0x806000) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) [ 907.107505][T31122] bridge240: port 1(bridge_slave_0) entered blocking state [ 907.115697][T31122] bridge240: port 1(bridge_slave_0) entered forwarding state [ 907.155509][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 907.475838][ T311] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 907.520265][ T28] audit: type=1804 audit(1601752581.079:323): pid=31149 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir013064415/syzkaller.0cfH0A/605/cgroup.controllers" dev="sda1" ino=16377 res=1 errno=0 [ 908.106123][ T21] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 908.196043][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:22 executing program 1: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_sco_SCO_OPTIONS(r0, 0x11, 0x1, 0x0, &(0x7f0000000740)) 19:16:22 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, 0x0, 0x0, 0x0) 19:16:22 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{0x0}], 0x1) 19:16:22 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40012062, 0x0) 19:16:22 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000006c0)=@newtaction={0x78, 0x30, 0x17b, 0x0, 0x0, {}, [{0x64, 0x1, [@m_bpf={0x60, 0x1, 0x0, 0x0, {{0x8, 0x1, 'bpf\x00'}, {0x38, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_PARMS={0x18}, @TCA_ACT_BPF_OPS={0x14, 0x4, [{}, {0x6}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x78}}, 0x0) 19:16:22 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 908.742252][ T28] audit: type=1804 audit(1601752582.299:324): pid=31166 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/666/memory.events" dev="sda1" ino=16372 res=1 errno=0 [ 908.799652][T31171] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. 19:16:22 executing program 0: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000280)=@security={'security\x00', 0xe, 0x4, 0x380, 0xffffffff, 0xf0, 0x200, 0xf0, 0xffffffff, 0xffffffff, 0x300, 0x300, 0x300, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz0\x00'}}}, {{@ipv6={@loopback, @private0, [], [], 'wlan0\x00', 'ip_vti0\x00', {}, {}, 0x0, 0x0, 0x0, 0xf0}, 0x0, 0xa8, 0xe8}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x0, 0x0, "f7672a9fb4466808f02c589b4e6cb5dae2fe3bac8c68d9169a44b07d2e58"}}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@inet=@SET2={0x30, 'SET\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e0) 19:16:22 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0x7) connect$inet6(r0, &(0x7f0000000040), 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) recvmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x0, 0x0}}], 0x1, 0xfc, 0x0) [ 908.893081][T31171] device bridge241 entered promiscuous mode [ 908.899502][ T28] audit: type=1800 audit(1601752582.299:325): pid=31166 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16372 res=0 errno=0 19:16:22 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 908.990864][T31175] device bridge_slave_0 left promiscuous mode [ 909.004222][T31175] bridge240: port 1(bridge_slave_0) entered disabled state [ 909.053539][T31175] bridge241: port 1(bridge_slave_0) entered blocking state [ 909.066927][ T28] audit: type=1804 audit(1601752582.299:326): pid=31166 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/666/memory.events" dev="sda1" ino=16372 res=1 errno=0 [ 909.124660][T31175] bridge241: port 1(bridge_slave_0) entered disabled state [ 909.171928][T31175] device bridge_slave_0 entered promiscuous mode 19:16:22 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 909.214615][T31175] bridge241: port 1(bridge_slave_0) entered blocking state [ 909.222096][T31175] bridge241: port 1(bridge_slave_0) entered forwarding state [ 909.237061][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 909.246372][ T28] audit: type=1804 audit(1601752582.389:327): pid=31173 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/666/memory.events" dev="sda1" ino=16372 res=1 errno=0 19:16:23 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3400000010000104539300"/20, @ANYRES32=r6, @ANYBLOB="ddffffffffffffff140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="280000001000010400"/20, @ANYRES32=r3, @ANYBLOB="000000000400000008000a00", @ANYRES32=r6], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010000b0400008076af43ef4a9a2bcc00", @ANYRES32=r6, @ANYBLOB="00000002000000001c0012000c00010062726964676500000c0002000800190008"], 0x3c}}, 0x0) sendmmsg(r0, 0x0, 0x0, 0x0) [ 909.463182][ T28] audit: type=1800 audit(1601752582.399:328): pid=31166 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16372 res=0 errno=0 19:16:23 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{0x0}], 0x1) 19:16:23 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40012062, 0x0) 19:16:23 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 909.654509][ T28] audit: type=1804 audit(1601752582.399:329): pid=31173 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/666/memory.events" dev="sda1" ino=16372 res=1 errno=0 [ 909.730267][T31194] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 909.818582][T31194] device bridge242 entered promiscuous mode [ 909.855057][T31196] device bridge_slave_0 left promiscuous mode [ 909.865417][T31196] bridge241: port 1(bridge_slave_0) entered disabled state [ 909.879869][ T28] audit: type=1804 audit(1601752582.859:330): pid=31189 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/667/memory.events" dev="sda1" ino=16358 res=1 errno=0 [ 909.958526][T31196] bridge242: port 1(bridge_slave_0) entered blocking state 19:16:23 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 910.012237][ T28] audit: type=1800 audit(1601752582.859:331): pid=31189 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16358 res=0 errno=0 [ 910.064587][T31196] bridge242: port 1(bridge_slave_0) entered disabled state [ 910.138893][T31196] device bridge_slave_0 entered promiscuous mode [ 910.176461][ T28] audit: type=1804 audit(1601752582.899:332): pid=31187 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/667/memory.events" dev="sda1" ino=16358 res=1 errno=0 [ 910.226851][T31196] bridge242: port 1(bridge_slave_0) entered blocking state [ 910.234359][T31196] bridge242: port 1(bridge_slave_0) entered forwarding state [ 910.276457][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:24 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:24 executing program 4: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x0, @dev}]}, &(0x7f0000000600)=0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000000), 0x4) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000640)={r1, 0x380, "cffbf13cf3c599c11762388d5a8290da62f705d0bb5e922b9a4755d9bc206c3d3a7e6edd06f1b2e8855a76ff52316c74b0cbb1bc3a3e149183a5338f49ee7a1fc8e5b058bd5c67294c41a680b85c4adc76018d4ee4cf34244528cfed081f879d3d61f4dbd5c868029e3c26a606655c25549b9124dc71f2bd7202d72ebe1d0de5dc57fc9a8aa2adc9c7f8ca5b1d91c6468f3eafbb7f4a1f6e73f2caa7143781492c8f04142d713057157ce3c158433f1e0601ace9af343874f9edebcc418d9c062290068b40152d0caaef13ddfc6d68512ce8bbe9b4551c836f76cf80a3f6c8aa5c63b4837697b606483aea1c1c35069f5bc0363cd99629e35c74534c578cd76823520495da4c60936f4003ce24b361cea8bb5174026c47a97d5d90d6b5ab1c4f70798e981aee266d80c6551c59f6dedccb2f654047865837ef024a1a26ed521a2bb738160a0b43f41cbe4bb1e9b16cec0e1e61ac499134691285cb6c7b9c4c67782f39137b3e7e1718f79da1494a4c2def9b4a5f4684cd3a1db7baf55ef514a270be0bded1d561ee7f40e64f545348f6c48b2d1b756ba8f3b9cacd32e0d576c9a5b3ab12451e3533e18c162167e6b820e8af7b4f335b572fe35597474f2b8b7579029841dca34392d8c95d33977293e9487e8f828d9e9689754811b5ccb21f57431c65dff882a6f2ec5b2c15ac432fab2c3911255fc7229d797272f879a9cb85c17fb3de3974b799dc6df23832da41ea9dfb9f269287d604260427f8eef76e8acf6bd8cd76ea25da28463cbb7208ddf43c6803edf60e428f79bd0d289048bdbd17e14656ef83fa7df91a61c4accabf1bcb4d599e8ace572d6d2a88e97237fa8337af4ea2163466416b14faa2a6265c687adcc61a41c0ecb93ceedc7606ad26809939e4bcc443757cd03c36fadf9213768eec385feb5452760b7e4f3cfe1674f5c05f99b639afcd836cb198332834f3643f6d1ac3db0d470000000000000020cdd49c2ec8f3d02f502a68ea0e08b8fad4ca669a05109be21a6505371add65117f685753e2f46d4549731d17948e14b6283f7164df7eb9889d181b29d874f2d4414150eb4019f4c38aeb33ba280b0229d39bc80d91ea9644cd908a3fef5ac4713a332959e22b8ba614070d856f31b6fd0324dfbb278054b137436959464d3e68020e693551950f98e526208ce6255f557804a7726dfec9c666527b20efe20c200f7f05f3620360e7c5178a46bdef1292bbb97388e5cbf990db95b86c877a0f49ae"}, &(0x7f0000000080)=0x388) 19:16:24 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{0x0}], 0x1) 19:16:24 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:24 executing program 1: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000840)=@bpf_lsm={0x1d, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f00000007c0), 0x8, 0x10, 0x0}, 0x78) 19:16:24 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x0, 0x0) 19:16:24 executing program 4: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000040)='cgroup.subtree_control\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f00000000c0)={[{0x2b, 'pids', 0x2f}]}, 0x6) 19:16:24 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) 19:16:24 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) 19:16:24 executing program 4: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@sndrcv={0x30, 0x84, 0x1, {0x0, 0x0, 0x8005}}], 0x30}, 0x0) sendmmsg$inet_sctp(r0, &(0x7f0000000080)=[{&(0x7f0000000180)=@in={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10, &(0x7f0000562000), 0x0, &(0x7f00000c3000)=[@sndinfo={0x20, 0x84, 0x2, {0x0, 0x241}}], 0x20}], 0x4924924924924d0, 0x0) 19:16:24 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f0000000180)=')', 0x1) getsockopt$inet_opts(r0, 0x0, 0x9, 0x0, &(0x7f000021affc)) [ 911.316841][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:25 executing program 1: r0 = accept4(0xffffffffffffffff, &(0x7f0000000280)=@l2tp6, &(0x7f0000000340)=0x80, 0x0) sendmsg$IPSET_CMD_PROTOCOL(r0, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, 0x1, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4040040}, 0x4040005) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0x208e24b) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) write$cgroup_type(r2, &(0x7f0000000000)='threaded\x00', 0x9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) vmsplice(r1, &(0x7f0000000240)=[{&(0x7f0000000140)="b7c7dd463b3c95a8b9c118f7ef7c9ae78a53504dd8de4755f170a4f088eb895f0a2ca323b4607a9b2685e6c0dc6d99bdeee2626ba68b1e87e6e527bdaa7f4fc49c099d343bd90fdc91c4c89727b2d5cb46e97124b22176", 0x57}, {&(0x7f00000000c0)="429213c64f03a5b6dd2b39cfbb504e3ab4ed640af521a83e", 0x18}, {&(0x7f00000001c0)="dfee32fd73f8c0992bf50a2b66c675e7473323397c52bc32335b0fdacb24671a5ece5347d3d6b0eb8973487c49e4f40226dfe89641f667509bda3c6540939be33d10e01a23bb0a9de05e026d47f8c32bdd323baf632b76", 0x57}], 0x3, 0x4) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket(0x200000000000011, 0x3, 0xfffffffe) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40106614, &(0x7f0000000100)) setsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000000300)=0x80000000, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc, 0x0, 0x2}, 0x10) r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r4, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x3, 0x0, 0x0, @dev}, 0x10) sendmmsg(r4, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:16:25 executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@union={0x0, 0x0, 0x0, 0x2, 0x0, 0x0, [{0x0, 0x1000000}]}]}}, &(0x7f0000000340)=""/142, 0x32, 0x8e, 0x8}, 0x20) 19:16:25 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)}], 0x1) [ 911.804520][T31256] BPF:[2] INT (anon) [ 911.812096][T31256] BPF: [ 911.822026][T31256] BPF:meta_left:0 meta_needed:4 [ 911.844487][T31256] BPF: [ 911.844487][T31256] [ 911.866451][T31256] BPF:[2] INT (anon) [ 911.871346][T31256] BPF: [ 911.883478][T31256] BPF:meta_left:0 meta_needed:4 [ 911.893103][T31256] BPF: [ 911.893103][T31256] 19:16:25 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) socket$netlink(0x10, 0x3, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000340)='batadv\x00') socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000400)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)={0x1c, 0x0, 0x0, 0x0, 0x0, {0xf, 0x10}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r3, @ANYBLOB="ff830a00000016000a00", @ANYRES32=r4], 0x4}}, 0x0) sendfile(r2, r1, 0x0, 0x10000000a) 19:16:25 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x0, 0x0) 19:16:25 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) 19:16:25 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) accept$alg(r0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) [ 912.345615][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 912.620834][ T28] kauditd_printk_skb: 32 callbacks suppressed [ 912.620851][ T28] audit: type=1804 audit(1601752586.179:365): pid=31277 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir013064415/syzkaller.0cfH0A/612/memory.events" dev="sda1" ino=16363 res=1 errno=0 19:16:26 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x10000000012, 0x4, &(0x7f00000000c0)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x7, 0x0, 0x1, 0x60}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0xb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) 19:16:26 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)}], 0x1) 19:16:26 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) accept$alg(r0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) 19:16:26 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, 0x6, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x5}]}, 0x1c}}, 0x0) [ 912.824379][ T28] audit: type=1800 audit(1601752586.239:366): pid=31277 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.0" name="memory.events" dev="sda1" ino=16363 res=0 errno=0 19:16:26 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x2, [@enum, @volatile={0x0, 0x0, 0x0, 0x9, 0x1}, @struct={0x0, 0x1, 0x0, 0x4, 0x1, 0x0, [{0x0, 0x2, 0x24000000}]}]}}, &(0x7f0000000040)=""/219, 0x4a, 0xdb, 0x8}, 0x20) 19:16:26 executing program 4: r0 = socket$inet6(0xa, 0x6, 0x4827) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0x0) sendto$x25(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x0) [ 913.003899][ T28] audit: type=1804 audit(1601752586.249:367): pid=31277 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir013064415/syzkaller.0cfH0A/612/memory.events" dev="sda1" ino=16363 res=1 errno=0 19:16:26 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000080)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) listen(r0, 0x0) unshare(0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x800000000000c) socket(0x0, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5dd, 0x0, 0x0) [ 913.196309][ T28] audit: type=1804 audit(1601752586.719:368): pid=31293 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir013064415/syzkaller.0cfH0A/613/memory.events" dev="sda1" ino=16358 res=1 errno=0 [ 913.207694][T31295] BPF: (anon) type_id=1 bitfield_size=36 bits_offset=0 [ 913.230463][ T21] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:26 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) [ 913.239859][ T311] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:26 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) accept$alg(r0, 0x0, 0x0) [ 913.329918][T31295] BPF: [ 913.355803][T31295] BPF:Invalid member bitfield_size [ 913.370248][ T28] audit: type=1800 audit(1601752586.719:369): pid=31293 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.0" name="memory.events" dev="sda1" ino=16358 res=0 errno=0 [ 913.395537][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 913.397345][T31295] BPF: [ 913.397345][T31295] [ 913.463211][ T28] audit: type=1804 audit(1601752586.729:370): pid=31290 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir013064415/syzkaller.0cfH0A/613/memory.events" dev="sda1" ino=16358 res=1 errno=0 [ 913.503966][T31303] BPF: (anon) type_id=0 bitfield_size=36 bits_offset=0 [ 913.564992][T31303] BPF: [ 913.588719][T31303] BPF:Invalid type_id [ 913.623264][T31303] BPF: [ 913.623264][T31303] 19:16:27 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) [ 913.678519][ T28] audit: type=1804 audit(1601752587.059:371): pid=31302 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/672/memory.events" dev="sda1" ino=16381 res=1 errno=0 19:16:27 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)}], 0x1) 19:16:27 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000080)={{0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x1, @link_local}, 0x2, {0x2, 0x0, @multicast2}, 'veth0_to_hsr\x00'}) [ 913.876678][ T28] audit: type=1800 audit(1601752587.059:372): pid=31302 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16381 res=0 errno=0 [ 913.964415][ T28] audit: type=1804 audit(1601752587.069:373): pid=31302 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/672/memory.events" dev="sda1" ino=16381 res=1 errno=0 19:16:27 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) 19:16:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000)='TIPCv2\x00') sendmsg$TIPC_NL_PUBL_GET(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000002c0)={0x20, r1, 0xdaa3b002485c5b6d, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8}]}]}, 0x20}}, 0x0) [ 914.002818][ T28] audit: type=1804 audit(1601752587.119:374): pid=31304 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir013064415/syzkaller.0cfH0A/614/memory.events" dev="sda1" ino=16379 res=1 errno=0 19:16:27 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x12, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x79, 0x11, 0x30}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) 19:16:27 executing program 3: r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000940)={0x18, 0x0, {0x1, @dev, 'veth1_to_bridge\x00'}}, 0x1e) 19:16:27 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$xdp(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000240)="6354a9690bcc78b046902a6123e5", 0xe}], 0x1}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r0, 0x890c, &(0x7f0000000200)={'sit0\x00', 0x0}) 19:16:27 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) 19:16:27 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:28 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000280)='syzkaller\x00', 0x3, 0xfc, &(0x7f00000002c0)=""/252, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 19:16:28 executing program 1: r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x49, 0x0, 0x0) [ 914.436408][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:28 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x213) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0xffffffffffffffcd, &(0x7f0000000080)={&(0x7f0000000580)=@ipv6_getroute={0x24, 0x1a, 0x1, 0x0, 0x0, {0x1c}, [@RTA_MARK={0x3, 0x1c}]}, 0x24}}, 0x0) 19:16:28 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f", 0x24}], 0x1) 19:16:28 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) 19:16:28 executing program 3: r0 = socket$inet(0x2, 0xa, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0xa, &(0x7f0000000080)=0xfd1, 0x4) bind$inet(r0, &(0x7f0000001440)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x2600cff9, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) sendmmsg$inet(r0, &(0x7f0000001500)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000002d00)="43abe0d984e51ead820231c53a90fa104be9a70e8bbcbb3ae24732fdc3d5982ce82abd65c3c74a2fa2f55455fe1a39225ccfb3793b694b11a79ac93f71648f6bcc9861598b9efc0192f78fca7da4ab121f82790e3a6880901368b4710da08e55776eb7ddd8f00a167ee50002f80b8439d11d81a69245fbf14bf940d236918ac281b669232276bcad8f7333cd65e07097b5e350e801c7f7207a136ac42cdb95452dff658a073b06aa43461c21da484c0168033c1c3ab0cde3cd278d2fc26b4baaff0e9557b81251bbeab482ff747afd1673d6eb5ab0a2476714649cec193e0a92cbb9c73fca432992879d6cd0138143ea86c04850f3b50b5d5cc9359fe4c96446978220c282ccd4163c11bd2d45361318494561377bc21df4a1d3f070aa2b1daaa3bef566d4785a7b60bd2555d5a6195682767c69f6513e46f84d3f81ce4316e5e9e8c6575e2af3f395a468d6f5cec96f8de692dc4bf1f7e1f5123a66f720c04cf1a54e515c199852673ae8d92150d07ab43f5764f01c63c8330e0cc8557e46ca51a7d8aaebe84ef8765b78cff95a0bfed1daac3cd1a4f5b88ade16a4b50abec0538a136e80c7a5a70b2fa857d5b1bc32166105843747183c51a942cd5d706ba587bdb44cca416d5f58ea3ada493f25535181f4f6278fee21046bee5355b617ed73510c00da19a28b1720ff9ce5fca07191e49299cb63ef02f6f713e5a431e5c60e6982d5438d5767efae070bf2e302388f1f89d5ac7406fcfd635da33c49c3ad237ac6dcdded418ffe06ac3f7218e686b123749a139ae590b6db8f7a1e88afdb56eac363a29254f0faa02bdef02a36db4beafb041b84dce08345f7d88d78a00c1a6dc017c26a9e7ae426d874f6f2300c3599b3da0d18547b999a38acafb97db8a471a51a2c3b4c06bd87630ae38ea1a39a0420141436f9f6933f9bea3488c5d897323438dacda688b019a89349601cdd42cd984ed70057b810c0a1b6f8630733a0ce3ede74425d972251ab3bd8e2a93cc209644692c633b85998bd706bd402a709baa4176ce43c7e9437395434c64dcdd0c43a0ec8d2391d9e81e52b777a41cd70f76e99d5d20e33481218ed2df1324dca4b86bc851071258e7cdeca763d8e0146247741e7fd2ff1b18062d21d396037840fd5767e245455f39bf3c57e7caab14078633ede3d2d6c2e22aca3fc6173359c9e3ab619adf0b1ba2f3f0fa85471ce5d6cad7dd0ef9b18f240733c0ea190ea517ba53bd9df5e3f4dd497829f139cd4ca2aff88536793b438beef0d52c810ff2f20db9b6c6b824453fc09324ef9748a8b605c7f3e08298f9bfb1691b8fdf853be290f8029d2ae9b9bea7fa0b409ac0e83911ef5676f53bff3f899c306c8ddbb73f8332ffbd80a91a52f1901ba1facfbe39bb44f2ee1bfa914d267b6cb77d2d382b6f776bb629cc65caadcee5ef286a157e432bad56e7a444d47d9badd34ad582f767ba6e1ee0e60dd8bdf765e9896ba0a7e9851fef370c90fc95627099b90e0833b1a9fd0d51e335d9fd3b8883426d3889010b08f21af6c76f337d8c11fed3c95d2122ea2ce3f2363410850d4e128829f1e737e447015df60c23b31f3aa8c01ede64159f2d7ec997c4fe3af86d14eb465175882291b6f5d46fa14099a869a4ef73ec5132238f84a90c8390e9602a466e9f2847d2ec15b7ce47edbf95d85d4bf758765785ec84b755d580a6d2e031be8acd592d3a309590a12c17e41d1ebc74c93c2735f7692e515e2a7366c2b0dbbebed592ba4487d8380822c1912606b47dfc819093afc8f5bc246ff04afc88528d852e8afbc9c3f904f6a05b6eed14361ea4ce0053e254f7acfc96ef03209bb2d268a05effdd11de4674d276d55f0e83e8531b189c6b85907d559c46fc52a1731abca61cc39c2fb0b439a9b285287830d53b26b96f4077ed601f797c29fd883c93e4eed5b1eaf5303ed5e34046ce700b00287367c2f3642072ff2cd26dbf98eb595a45b3e8cb16f81acd3256528295621c89d19df2101e9e609d2c33a8ed7a77d7162f839c092854537dac75a7da45050a4266d3c6b366f0a37400524a99d2b1e7215ac248e834ece53322c230535679f34dbed48cee24599435b8e66ba1bb14a079a6759f5fe892fb9e00da6bec093a16f23ac4939f7118d83b0a308b47fcbed8c32c5223c88f604e64ea75c83eed1afb7734eff41759a38e30e93153718a3f1fd853760a5f22ffb88535b8de59a790eec1a829eb2049afba0db455a9d50c9f3cf2b61cb8a81d70502b9f578bef30cd6dac09cc983053acedec550929e0ee920d3b05d488452f9057759dcca7d7446fd0e8c95c716fce3005b1cd4b0aa4dd50f10df1315f38dcfd9c13a716577d9ecff7ea56db265954d0062300e4005f8ff7555253ded97a9360fb99263d3eb1ef857e9e755301282b17381cdadd9891f728f740868758d4017988cd75f79a2ed0e41fdd2d8e756812edbcf40196e7cf70c5438b02ad1f854b4934ea873e7e9e33620a74d957c628f84237db11ed2bae1f98beb00ebe557d0f9b5f46da22785e341276a71b1a11b990dcac45cd50cd48709ba5c8c0522a24acea44ba48cd5e622dff084bf0096d637d744de308ac8b8f35564fb454527e72f881a7dcdf458bb0898a8bce8359bc81adc994c02bda541441ce428c36f5965c3958938e47b3f64e170d46db4b59b6dd3cdc9cee6490ed338a16d87137b929934e14b4e828a2aa0938c5b41c23d68dace4c95a53285a936908e0a98cadf71a77561a0909bfd5860c888065228c0bb32f516803806515502ac6ee737a5d74374e066859ed1b5d219c18ad07417aa8597accf47468b5afd3a7231a3a4", 0x7e0}, {&(0x7f0000003700)="7195ca06e8f754c0b532", 0xa}], 0x2}}], 0x1, 0x488b5) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000140)=[{0x6, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000001480)}], 0x1, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000001400)='nl80211\x00') r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000003040)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000003100)={0x0, 0x0, &(0x7f00000030c0)={&(0x7f0000003080)={0x14, r3, 0xc98ed0929655bf6f}, 0x14}}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000280)={0x2c, r3, 0x1, 0x70bd2c, 0x25dfdbfc, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xff}, @L2TP_ATTR_DEBUG={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004001}, 0x4) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000500)={0x0, 0x2c, 0x30}, 0xc) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) setsockopt$inet_udp_int(r0, 0x11, 0xa, &(0x7f0000000780)=0xd6d7, 0x4) recvfrom$unix(r4, &(0x7f0000000300)=""/207, 0xcf, 0x2100, &(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x4d, &(0x7f0000000140)={&(0x7f0000000800)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x32b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb, 0x1, 'geneve\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TTL={0x5, 0x3, 0x9}]}}}, @IFLA_LINK={0x8}, @IFLA_MASTER={0x8}]}, 0x4c}}, 0x20000040) 19:16:28 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:28 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 914.743045][T31341] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 914.781024][T31342] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 19:16:28 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000000)={0x0, 0xfffffffffffffff7}) [ 914.929247][T31349] device geneve4 entered promiscuous mode 19:16:28 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:28 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:28 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) [ 914.978324][T31349] IPv6: ADDRCONF(NETDEV_CHANGE): geneve4: link becomes ready 19:16:28 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000000)={0x0, 0xfffffffffffffff7}) 19:16:28 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:28 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) [ 915.465595][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:29 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f", 0x24}], 0x1) 19:16:29 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:29 executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000040)={r2}, &(0x7f00000001c0)=0x8) 19:16:29 executing program 4: r0 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000480)='wireguard\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[], 0x208e292) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) sendmsg$WG_CMD_GET_DEVICE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="070700000000000000000000000014000200776731"], 0x28}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r3, r2, 0x0, 0x100005003) syz_genetlink_get_family_id$tipc2(&(0x7f0000001480)='TIPCv2\x00') 19:16:29 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:29 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) 19:16:29 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:29 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, 0xffffffffffffffff, 0x0, 0xf03b0000) sendfile(r1, r0, 0x0, 0x800000000000c) socket$netlink(0x10, 0x3, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="2321202e2f66696c659385943d30205e2d20656d2083c89dc472792e657665007473000ae0a44301e35f6ea70542cb971b9d08dd53759d65eb521d078e8331cc494cda1a5bcdce7a367fc22372c64b9cd509bf542d6943a89a0000000000000006f4afd52f9209dfb706a9a6ef38a967c34a000e00000000000000000252595a78e2ee7b598a39c56ad5eeea927b51c14751f1caca27b2b1f3608c09e7c2d66a18c484aee2d1b950a92e2214ac483a01233932e93608ed16149749f7a53c09db4ca9722d602042e641c1d511a45053d271dfbf354ba38683474f457763558cd893e1b22d112c4601c79e1e72bbabf385b3c47cfb0af700000051a400000000000000000000003db85b12618c42624a043a5132da3377e49c53bee9bdead00ea8681361c18a124419e0afbdf007f4deea9c4add76473499025de3b7ee00000000000000000000c9564fcd125f9e3c77902ddf466f17fe0c000000000000f5f3be72621cbefd631dd678a4333686a75e40df97f280af0a5fbb4c2bf45ea9c2bd2cdc8c2646a2baa103d45b41702b4cd1704ebfc5405d75f4aa41bbdcaba9300000000009f8da2a009fa36ec33f38768221a61912ce37e25c855927982ff3d3ba43680586a9225495a6db98c24229249c3373d49451974329ec588e2961c393077e308d438fe2dcc85b93348e27ccb063f5ce6dea9d720000000000000000000000000000007678e1b0215bb185e85db59e334fa1ec2a1ed29e5655c7512a13d6a9ff72861026f3aa7cf79772d9e849acd705850eeb9772a350f5dd4024adfb1ffd7f1f8becfcf74621c4f644784c373beba882f6487adce2aa1e918e7d4cdb384933ae2805bfa4d03ebc26167c51b7bc5cfff19a512fc7c248a05c067b77c5d2d545d2b739465540ff1270a0cc98ab1b2e43ed7409b9b5ff988b13f381f85e6fbb85632469e15f"], 0x111) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) close(r2) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000100)) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000080)={0x0, 0x7ffffffd, 0x2, 0x0, 0xb}) pwrite64(0xffffffffffffffff, &(0x7f0000000600), 0x0, 0x0) r3 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0x3e, &(0x7f00000000c0)=0x7, 0x4) bind$llc(r3, &(0x7f0000000000)={0x1a, 0x0, 0x9, 0x0, 0x0, 0x2}, 0x10) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) 19:16:29 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) 19:16:29 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:29 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:29 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) [ 916.506051][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:30 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f", 0x24}], 0x1) 19:16:30 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:30 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f000014f000)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f00000009c0)=@updpolicy={0xb8, 0x19, 0x305, 0x0, 0x0, {{@in6=@mcast2={0xff, 0x2, [0x0, 0x0, 0x3]}, @in=@empty}, {}, {}, 0x0, 0x0, 0x0, 0x2}}, 0xb8}}, 0x0) 19:16:30 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:30 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) 19:16:30 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:30 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 917.065417][ T2546] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:30 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'syztnl2\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f1, &(0x7f0000000280)={'ip6tnl0\x00', &(0x7f0000000200)={'syztnl2\x00', r2, 0x0, 0x0, 0x0, 0x0, 0x3, @dev, @private0}}) 19:16:30 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) 19:16:30 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$netlink(r0, &(0x7f00000047c0)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000000c0)={0x30, 0x5e, 0x101, 0x0, 0x0, "", [@typed={0xc, 0x0, 0x0, 0x0, @u64}, @typed={0x14, 0x0, 0x0, 0x0, @ipv6=@remote}]}, 0x30}], 0x1}, 0x0) 19:16:30 executing program 4: syz_emit_ethernet(0x2f2, &(0x7f0000000080)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "966ad3", 0x2bc, 0x11, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @local, {[@srh={0x0, 0x0, 0x4, 0x0, 0x0, 0x50, 0x1f}, @srh={0x0, 0xa, 0x4, 0x5, 0x0, 0x0, 0x0, [@mcast2, @private1, @mcast2, @loopback, @private2]}, @hopopts={0x0, 0x8, [], [@hao={0xc9, 0x10, @ipv4={[], [], @loopback}}, @calipso={0x7, 0x30, {0x0, 0xa, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}}]}, @hopopts={0x0, 0x14, [], [@hao={0xc9, 0x10, @mcast2}, @hao={0xc9, 0x10, @ipv4={[], [], @broadcast}}, @hao={0xc9, 0x10, @remote}, @ra, @generic={0x0, 0x4b, "5dea74ca50bf9140a7996a405d27f4acd3a3a8bd344f1d26abefadef730a74d554fc471f219a3fb7452d896f35964b5650a1147faef8f7e2970c8680a69cd040a5237c362fddb0a8dab41b"}, @calipso={0x7, 0x18, {0x0, 0x4, 0x0, 0x0, [0x0, 0x0]}}]}, @srh={0x0, 0xc, 0x4, 0x6, 0x0, 0x0, 0x0, [@private2, @mcast2, @empty, @remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast1]}, @hopopts={0x0, 0x1b, [], [@generic={0x0, 0xd7, "94b3a02b3a548462aa56051891eef6b48d9d0786bd04a2ec71edac2985469db9ec36f10f00536d6eac07493e69736d0da88b65695b7a2d1631cc46d3f0f9d50866645825f7e1813fd59730231457af39d222460b61083c002b827d292225b1ed8f0918c31aee00e7de2ca2ce214b8ebcaffa1f9503a825570c4d5d88dd0ffd557092f2be1d52fd3389b7547dce9177ef144ebbe423efb99341adf1b1a3a1760e1ec73dc060ddf47d9b2f2354ecd407fca833861a61f50ac23b9f70900a62afb006cc9e6d65dc2846c6456d1bb79ec84f1632516a396567"}]}], {0x0, 0x0, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}}, 0x0) 19:16:30 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) [ 917.546478][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:31 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff", 0x36}], 0x1) 19:16:31 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) 19:16:31 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:31 executing program 4: bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000540)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000008009500f10100000000487591731cba12c07d57d995b61e89a4530f92304f242b416ae9eeefc0e9c60ebab1c176bf9bb4dde984510c82dc2b9381b72b100d0682fd0a0c4a06b29e220dc28dac72599456d464419e5b2fc70b72c0bb8e90f61cc4e6f3fe2d1dee18f638ac947b5e036a3287c84ccc727d6ef3834293812e927c01c7da1322da44c7f2ed1084a12f56d1cb398dff1db3df9858837458a4ca03767c69cee1b6be484e4c9507af216bd8ed42f7dd5adb8e49f4a94615e49c08c9a20819e02cc22e6b652b1673773ae3cab8d7674c6c4dca2f1b4d745fd95c41f9d441d42f49db6d4a4762e5cc23dfc1adafd1e5a3e7f2e888961cb43e438c4e41ae43ea118e1407a601dae4b8b99bffffb1ac006c67767b03b95151aeb89e6d4a43c625aa2285b6e4afd8c1cc3eb215ba22f43115f4d39dc7beedb130d9f2be90133a0e3ed34258b8c9370634060105baa664953514605fba3973aa021945b985a8a66e9cfa9d9e57033815717b4fdbe55b37cb8d7f41aacfbd9b5a759a703e71f358e11ac8e13df15d792e604a4f279b3bd6621bdf2c17bc0400000000000000ff8dc4006200607a9a76e5d9656a7154c75773902a1bdf399df3925130312d095e9c1f973d091c198c1a11a755761fe46169b2b5b8cdedb695cc425fe203d2f2655a76865c2cb4e2470fcfb1248c0add5431a7fbcb0ef4f66809af93a09fab1daae4b518d7a5d95a017864487366d6d7ee7bb00200000000000000c60fca2e2981b22d08f874e0a9cb6fca78d6f1b18fe380df4bf024f120bd505d82033f2fb7d8fc9e0d773294e097e293db58993c0024ab2fd8e5e7003af92d11de48e8b4d32972cba6f49051cec1bf6f16231bbb90a2d201e5a47811a2278a03bf7700b06fa191ebd3a0c2ef0058ffebd7ccde24f18e4bf7156edc4ef81f74a7cdac01d998c24f34a5ba9a4a2039d0416e3f83074192c48c63384f52b8eeb70571e5bbb3e6d2b5eba52bee6f81968981811f832d064048c0e0bbe46984b2f0d0504255c22ee8674053d0e160e525536edf56a93d0a7a6f088925e872ef8b4f31e6f57ba631baa729031aae25c5e8ca4f78d5a01308243b08f1caa46be5244d64f8e875858e083144c642f71cdc8e5634c1360c056430f677ee7ed7ac1f9743786b2fb8d0fcfcc3d36c93230b7b059bc295aa0e38b1c3edc349ab96e73d2060acfd8145e4a5851bc4a51ab87068468d3ba396d6fd6741fce0834c65c5ad939d7795f3879baa88bd0c84892c97c80987e5c7954e9f3694d116b01ce0b8ef953de70e7ce0311c8b018956f8a42ca26ab295f1ecf617a8dc38e525f415a1bd46b38845ebca04061bacbf627f798c7f520078fee48f83b5989543729e57a9e1d686bc86cd51704f309130f5347413776a7b7bea3c46c0c4c4b7c27c45057d95ac85ac1cdcee8e6fa31fc02137ed1fb4b21c13b9a2c5e3f7c9ef9c45a314a6f0b9352be92986d63263b1aa5264cb4a82cf083de3b4ab6368e95dd4fdf6710cd4a79651dc3e1e056c3ecd6b51f30663cc256094c840662e09ab831b7bae9aec6d7259250016795cf91f12dbb72fc321c3dfb5f9181529906b43f9d6b8ce9fad13e1085cafd41183908173e16e40037681835aa080f34b87bba0be276340295062f671e933292e32036cbd03f9a4cd660a94374b013e9f32a6bfb65417b537cd8f67f975358140384a1ca0537fd3a2a2c37006e4b30ffe469bba4251aa3ba4626acd810000000000000000ee37c63f7f295579f542b12f248f4b6ba14448abab540fb7d98a081f3d3c946455d61734855005bcc876bd15a76dd552f9bfeb091a4e82a5d11033e528b133103f5592d5684a57dd70556818ea30e03dc2a6eb69423e4f27034351809da4e5002aa346d4d3e0e2a5a9ba1130b4fe983fc344c1de9f536cff06187599523cbddcd8ffc2d11d5db7712be78ff6e65238bb23ea2a979d3e8ab83857a1607dc612f0d8449226897d4d94ef0ddf9794f01ffe2a819c3ae05ff5ff1154a20e223f1472f4f56031fec54200122473f87e6c8cf816433d5157c0184aadc21aaeca04c6f4375e9bd40bd09b00eb19f2bc16d69320895e406e6cfa20a691b610c187a15d691c1a32f5ea7b500f627a89709c0b5ac029edc213fd54c73cb5105a1516d8f771459600d2e952a02802d82935b7"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x222}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="bf16000000000000b70700000100e0ff5070000000000000770000000000000095000200000000007ae9413df8ff0af5aa35339f4b382c4caf9db6fa7a9b857b7aabaca1d0fb2b2ff50237440040fa80af1ba23d699b89e890c1000037bb00000000000000000000ac0e064c27bdfbd30100000000000000dd76bfdc995279d64072aacbb0595b95060000009ad3bf16a461e48e955a772d40622abad2085401f098eb039ae4f4103699b9e079227e98cc07c09c1a72cb6d47cef1595e84d21951010f0274b1445a2ad6a7ad73827cccc21842599e0ae7b91f0b878b9267aa0b28d69a74ffdea613e892f0f9ff94e68f994b409760f359401d142f90b6ad68e4cb6dd65fd7bf3124702c6b1c2aea53ee0cb83ff1807459c7cba77cedca0bff6d8370c33e2bd9cebd29c14accdd52ff9dc8c2772fe552fecfcd1778b0838100000031d521207e5223166153f5ef4b80"], &(0x7f0000000140)='GPL\x00'}, 0x48) socket(0x5, 0x80004, 0xffffffff) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180)='ethtool\x00') r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x0, @dev}, {0x2, 0x0, @remote}, {0x2, 0x0, @remote}, 0x1b6}) 19:16:31 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r0, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:31 executing program 3: socketpair$unix(0x1, 0x4000000000002, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r3, &(0x7f0000000380)={0x28, 0x0, 0x0, @host}, 0x10) getsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000000), 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$SIOCGSTAMPNS(0xffffffffffffffff, 0x8907, &(0x7f0000000000)) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x80) listen(r3, 0x0) ppoll(&(0x7f00000000c0)=[{r3, 0x0, 0x64}, {r1, 0x8124}], 0x2, &(0x7f00000002c0)={0x0, r2+10000000}, 0x0, 0x0) 19:16:31 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) [ 917.860357][ T28] kauditd_printk_skb: 47 callbacks suppressed [ 917.860374][ T28] audit: type=1804 audit(1601752591.419:422): pid=31469 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/681/memory.events" dev="sda1" ino=15799 res=1 errno=0 19:16:31 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r0, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:31 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:31 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) [ 918.071962][ T28] audit: type=1800 audit(1601752591.419:423): pid=31469 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=15799 res=0 errno=0 19:16:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0)='nl80211\x00') sendmsg$NL80211_CMD_REQ_SET_REG(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1b}]}, 0x1c}}, 0x0) 19:16:31 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r0, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) [ 918.181497][ T28] audit: type=1804 audit(1601752591.459:424): pid=31469 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/681/memory.events" dev="sda1" ino=15799 res=1 errno=0 [ 918.253884][ T28] audit: type=1804 audit(1601752591.489:425): pid=31469 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/681/memory.events" dev="sda1" ino=15799 res=1 errno=0 [ 918.328908][ T28] audit: type=1804 audit(1601752591.809:426): pid=31487 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/682/memory.events" dev="sda1" ino=16380 res=1 errno=0 [ 918.408218][ T28] audit: type=1800 audit(1601752591.809:427): pid=31487 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16380 res=0 errno=0 [ 918.478952][ T28] audit: type=1804 audit(1601752591.849:428): pid=31487 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/682/memory.events" dev="sda1" ino=16380 res=1 errno=0 [ 918.523653][ T28] audit: type=1804 audit(1601752591.879:429): pid=31487 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/682/memory.events" dev="sda1" ino=16380 res=1 errno=0 19:16:32 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff", 0x36}], 0x1) 19:16:32 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) 19:16:32 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:32 executing program 4: r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000200)={0x18, 0x0, {0x2, @link_local, 'team0\x00'}}, 0x1e) ioctl$PPPOEIOCSFWD(r0, 0x4008b100, 0x0) 19:16:32 executing program 1: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r0 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r0, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) [ 918.598498][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x2, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="4800000024000705000000000000000000001f00", @ANYRES32=r5, @ANYBLOB="00000400f1ffffff0000000008000100687462001c0002001800020003"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=@delchain={0x64, 0x28, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x4}, {0x0, 0xffff}}, [@filter_kind_options=@f_cgroup={{0xb, 0x1, 'cgroup\x00'}, {0x34, 0x2, [@TCA_CGROUP_ACT={0x30, 0x1, [@m_mpls={0x2c, 0x0, 0x0, 0x0, {{0x9, 0x1, 'mpls\x00'}, {0x4}, {0x15, 0x6, "51802af90fe8e869355e7fc5f2e68c6394"}}}]}]}}]}, 0x64}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=@delchain={0x24, 0x66, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x4, 0xffff}}}, 0x24}}, 0x0) 19:16:32 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) 19:16:32 executing program 4: syz_emit_ethernet(0x22, &(0x7f0000001340)={@multicast, @link_local, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @broadcast}}}}}, 0x0) [ 918.787642][ T28] audit: type=1804 audit(1601752592.349:430): pid=31505 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/683/memory.events" dev="sda1" ino=16380 res=1 errno=0 19:16:32 executing program 1: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r0 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r0, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:32 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 918.916552][ T28] audit: type=1800 audit(1601752592.349:431): pid=31505 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16380 res=0 errno=0 [ 918.996157][ T21] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 919.004295][ T38] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:32 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, 0x0, &(0x7f0000000080)=0x20) [ 919.052035][T31516] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 19:16:32 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) 19:16:33 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff", 0x36}], 0x1) 19:16:33 executing program 1: setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r0 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r0, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:33 executing program 3: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, 0x0, &(0x7f0000000200)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x2, 0x0, @empty}}) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x62) 19:16:33 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:33 executing program 4: mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x2, 0x840000000000a132, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000140), 0xff4d) sendfile(r2, r1, 0x0, 0xffffffff800) sendfile(r2, r1, &(0x7f0000000040), 0x100000001) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r3, &(0x7f0000000200), 0x0) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0xfef0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r4, 0x0, 0x0) pipe(&(0x7f0000008f40)={0xffffffffffffffff}) r6 = socket$netlink(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x20, r7, 0xb03, 0x0, 0x0, {0x13}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x5}]}]}, 0x20}}, 0x0) syz_genetlink_get_family_id$fou(0x0) sendmsg$FOU_CMD_DEL(r6, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000004c0)={0x1c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@FOU_ATTR_IPPROTO={0x5, 0x3, 0x29}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000008fc0)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r5, &(0x7f00000091c0)={&(0x7f0000008f80)={0x10, 0x0, 0x0, 0x800100}, 0xc, &(0x7f0000009180)={&(0x7f00000016c0)={0x60, 0x0, 0x8e6767b8eef245b5, 0x70bd2b, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0xc}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PORT={0x6}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfffffffd}]}, 0x60}}, 0x4) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000001780)={0x3c, r8, 0x0, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x40c}, @IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x76}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffe00}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) r9 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'macvlan1\x00'}) writev(r9, &(0x7f0000000240)=[{&(0x7f0000000580)="1ee7f5c114f301897833b4ee5be81e76b0076a46b2f7468ac5628e1a4502b57bb5f20e619b8a81fcb84e9ea4131068bf3aed3b7f0e007ddc92d0785cccca837fb113143bcacf5837ecb45ea8cec8471e0d89d488e6d3c581377665cd9521f2be87e400768b0b1de3b80e0aa35daadea65ee311e7250176bcf7c2a2acf8c1599c8dca183eb4d5337526f9d9e845777c4a9aaaad56d2312b5fe498fce90a66ffadc8d2308fa680da948fe4ea290f5c7fd8e9b3ea5e7903e5d594493ead330bb69afbfe0e6b6abb875ae494983d07f6ad0f205c78e766519378c4e107daea6c96e9a4670308823ca2dd0833422d9db3994f3e7d334239a907c30f07719b225ab969f2f94f771caebc2a93c7eb7e3b1bc89cf230e44b16c1089a3650854aeb790527e2ed4cf2423ae96d49341984278612080fa8e37f942157bf6c91c5624514d54a81b13f59c05b2fa88691e49febd3783222666f2fdef3c186d2351aa606799e81ea0fb2e5ec9fc177a5bf680a2d762ea95132d0f6a03c26ce673432fa6e2a3dc43382ecce2ac519f2c6b46be91be490c2f8fcb9a6e8406c539141dab66863cbff550b2c87cb28579e20aaa73cd3b31fe5727fa1ce0f3553eea94404c7c57eec102cdeba890c61a16a193dc547cc0bb4e47fa3ff2a4688595ea0b11ccb246738dfd6a1c3068d96bb66a5dc78beb2e393ceebca4f0732b105066a1c245ee81c73d596167c0fc3e951dcac688e3409540babf69ccec8bce750e45b3c4d6e62e0a5e29bc0125425dfddd6be09a325363b9bb828e6fe6872b56058f1132fef1c61c1f236c5a06b27537d71a850d604c5219eb4df9057354cef00e70309da12e213d9961917278423df7c3ab98624768f25ef4e88555564dc322a87d934d9ad0de3f1e39c5f946b802139de1d05d9460ad7e978b26f01facea7a2acc23f1137b39f6442d60d38847641775907f0e9a97fb082d8882993135a90a98e1585783d5dc572a7c973f52cd92d190cfdb4e76171a4244af33ec5e08b831e992cbbeabe0826a842ae97e1b3007afe805879996243a1b2d38984f79638b8f59fffa2c58325b1905ba01c59f6880d4694eb554634ba67f55d888174f612a9bfe525eb15c140bfee07a90507398443413579f37a54650fefc53f14a879a5b857a1b8c6e38e91cc2540202cef81a51492698c3440cca2b6b100706a07da142f168d7819ebf95e7e8b90ae2f0873e3081a94aeef87152dabafccc7fd633e452b7ab28a3ed00ff0944cd23cd547989fc6a073bbf3b8013420eb018c7fdf288cd8e1a570e2671e5adf216b29f1c9c256fd50293da7dffd0b2cd186a8463c177738c74a8f2297ef231d316ce83b0f80b31c084f4d7d8fa5b38b6fc3d99969966900fb80412faf568caf6858cddf0df0a6a475e54e97a406a399e9a03e683ecaf46dcd8fc1333001c60fa107deb60bc3be8f57164aa6de9837459703db42ea692cdcfbf0d9ef1c0bb2a678223b430a8158b413d823eb32e2cdf4a46daaa92f4dc2dea2e1e695bf9fbc9defc666031a350f611ffd7e31849571249b110b6f342133aa1bfd85b19228e9168c4716ed79cbc3660bc3f5074ef54d6a2a812c7cf8c45a34ed75d0fc5ee9f6d28d4a8cda52881d230238bc2d64074a8b4d74b93a3eba4d001f9287eae3d563f61221c62ceb067b0a4989f547e62c40f89401fb812715b256e4533218b9c110e4c2eb9ecfca5ff7f47280d0b3982614136cbac13da0ecb2dda3e183272b9d88a56f0b236d05eab7a2df18861b75b92d75271ac8cfdadb98485038255fcf58a507dbbfae77ecb40b6cc6d480abddafb148e82a3172c96654681e6c9bc2e33c5ea9ec6076d06fc49645e8f9a5c1508eb0d7f16b6001239604774e3f930da93b08753653058c5d30c8c05ffa5b7ff803406f71784a5e9953ee05011e9f43b4aa4701803b2d6565bd2e793f0652cbe64d90de7315c88be38c74824b31ae0ac98eb53b72d38633b57c079c6966694b50c3f9e597cd5e3554f84175c4baff9fbcf5d46fcc6da1a8bce3cfe069acc7c8b7868c14f6828bce0600359297c1a2e14045abcc89423004f40b1eccea9343b92ee66cbfb18ae8020d108b71a7fdbfa1c388bb61e5a88f09d540b353505ed53b295fbd74a6fb8b029692c2984750faee3ad0994fe1510c919130d9e8728ee0045dda84768e8305eb8e64edd2b656f7179b00cde3b5d06540f27c825cb76cea2b6897c8cd6dc6fae066d8c591c62a295417dc3d1830bf4b6df2c93a7a5c9cd638134dd4f11675bb4356519d954f212e8c81be12e276502e552157e3461b4bc57edcecf0de045b7e17ce92992a6918f56ed799f40900af58d30d3c41875a6e1ce1ec968359a91c7db681775ba97e50fc29ea0d61e8abfed0796b6459617243eb84342d1a6f80d7ddd5c9ef8eeaddee5e5af1a09c185b0c6f0499ca6641558cc9f0d68eb0d64db5be28c84f3f0b42bb8fa1a324b9fa0a3d643b8a2b338daa632a23a90d1408d69ee3cdc42340d3e6d849b8118c55d0956c287608129c0c223d97e11b7ac92d50ddd334a64486bd3ca4a799c56dbf47612d53d04b85585f52870a8f3eb013399d770e062ca559253e3a9415c8f13c37d99033ffcb1e7aa4aa4d459e0d45526533f88e25498a128bb382fca690b954b0b1c5eda8f861bd646ad0cc0b3c3307fa0ca7c2f8bc75bf02b3b70ea9bb3a96dc3f7b2ceddc64d882230fd946fd8770e67461b07c6912b38fc7ee7cc61cf50cbaacafa9dae74938baa4d9d0f42c2b7dd260f55d69cd59695a801286a02e7b2f9babad3c4392f869cdf130ba44a7817f102d249753910d4cb1720496927f8bca22aad4e974a5d0eca972ab06e0659c0a50c76873b833cca0f848a902e7197d7de17677479fb19304a97fada0003e9da14b52213b2f773ea433cec51ed827c746526f80e1c83fc51071507f5ed580322c70d14a2f61e0d6f7ff5c1229cd18f911f9e12c81e446e0f9aa841375bd748565e3336592ca918eb7c1f4a53b7f6fa79433b740891f552272841a938659801430e334b6b07b0ce53374ba61e7670c0916bdcb72e8b4743ed1766e9de27740830803a2395c93c5a1f69eac4c63f1233aa0a0a5bfcfa245a48c102c9e269013f1e6232f68f2ff2b85de88dcd36551b33e0df4238f4b7fc1b0a085a64590638d1e5a33f629c50bd52b23d3e6e69e92de9c8b7fbf86f8a48fd295a7208ee5832902e5733f278b6aec017a6af96fd5f0edc684b64f98e2de1d8d2d123b342d371434edfdb8544c118f3f7de298de0791a1dab5fd57c226d4f9dd80fabf97b5f466d79d94082ea9a9187ed1522de02101fa392c37ae3685ba8d1364a1638736d2da2d02e898c5fa450787b3df83cdcb874aca56fb4f5bdc9bdc2e9ad9fe8c8656fa38d4e4108a743064dce0ae29c12d4bc7405b91108787fb01644486fbc4f025171f43b434d978155ace6410b002b3ab687dbbe293d63927b13f46a0ecf2eb713776a0d49933e4182d583040922944b64968a197e81d10ea61e9e94858a8dea185ba39199ce58707f481b2533db5ef4c9d23fb99af2216a16fadae47e2c02d9b194e82ffe1700261b643625c959d54027835bc9223e90172b424bc1e43c963011c6b99e5acad01af3887e7ae25c2d55cb343cf98abf597df0af80d6f125223af1320ebe321ef16b7e1468ff2ff5629358030fa4769f1a34f79042843fe34c0869d048af49f21efb9862d0bad4b656e4f50580e785fdf64abd80c30338c23ce0924eb15a81d8b8a53d98161689e1c65ad1d418b4465f253b3f5744d312e8797ae7ef4b02ddc3fe967d2f964a1982492091f291825e1b6bdbff55379e92326c02831ce60ee4726a0cab569013b4627715b18ccaa581423533a3b9fdd4bd31883c5ca7a4bd64e98991dd0945da4a93f10eaab9b78048b849afc46c6f821f0202c30cfa5269ed30bb5db43664c5a9446b251d6baef27bfb013480643538efabb2d68f35f58ecfa15e82df792ac98f2a91b1740295fbc75f72cc360d80c8ef3b625627b0d77c5c271016d0a2dccf356b1e4014c9ea0aa6a1994a58a76edaf81e4da523765a43a6ff55c8f50f36e21b3d424ae4d22bada8c82ff0c46b44047e2799c82833d55c7cdacf0f4eb56eec81194b56fe4dae86d6b435f8430597c21005411cc85bbd594730f9b6b32c7c77b11508892e7aa2b5f6462f9767b379ac728cff76d362111b1eadbfcc546a932fcb6eead0af287cab04923c17df8504200c7cc7e6b94edb1bbe38953b7161b4e060d01644a05260b5c5ed5939a82141b59699a65280aee4facde049af4cbabd7a924a3cb95ad8a88ba750c33671b8907384c80b7e9c7778f895aa4c940a03783e6b83e7277d095f640090b004a16e1db0440d04ba0d27a43fba1fcff2044132b4a43e302c28577a626e8d813701bb874aeb4834dfe4fce9e811b6c7b4be9ecd2824dd6e65388f3f8c723706710b40c12b2eb16d64119e70867878e3137932e626509b7d54fc653d501bd658bfaedf8c5001a3444c98fcfbd0a5d81fb40cabf4c7b78298992fd7f033f85175e156f5a0bc6afd1d72697729fcb80531b80a487e4e62d961e47c5459a71904f87d5d276dcbf2084f8d1f60830e73bd4769bfe5ab9e11c2d7a9cad1f3217ad363d492c644d7c8da4afe23eb654e89c473d6693e6b6b47efba48451231330639cc38f474494facfe4ccfd630d79cfe116d7e9d01cc44d60bedbd0b571d0a4acadde04e07d8257ff3b033df11c6b45d9a228d0df7486854451bbf63c4a7fce803cf946e73d341b6a6f13d168ac1679329eb456d7671308f466d423b93ff65d322fb5828f3d7bcd3e7b3edab2e0dff2dd0c9d5fa360a5045b072e166a78a37d5eb3519110a0bc561b2e1a515d3d199872bed29628b9ec1bb1ff3591672f7a2724f12786b7b76fcd5f527cc0f8a2ba7234e2a6af08dd7cbe9ad47f2449524d2b4d80606134e4cec65fca19a2841b0c671d8143722bc03fed54d6f4dcacdf759c2b9a58a6f57a7cb9362efaff5783b4a62649a17010f4df5ecc1637978d6915b84a96beb89d2eaede837568daa663d4fe0c5f620a387a414be97defbe842ebec2f3a393d039131c8c1adf2a6fbd672db32dff65f4202e848f5864860963fd78c91b6c3daae5faceef20aa79c6e58cf75ed31a30c4f1bee658bf3604c05cf0678b866605d0dfdea06089ac4f9c9b48c85001fb7055b91323330bb0f20e70a921e9fedd56b4417f65e5d5a7a70091ad74457a5ed496a43bebff391df1a0c804640170852fed4f9d67a09ffffd855f06b195949f3d10728a3abca346a504b4f06adde29cf25bbc1b8f67d57115980b51b9d4b97eb8f38f964ad77e3519e0f55a1cc9cca97c306af1c15922999f83ab69e9d31d27db236641f6f4e3c0c0f77f5ac239bd845e10cb1cbb8e30a33cce092c34960b6516623f8215db75a2bd2d1f40d4654d93343481153a62d0e14fe6c7b516f997693f922af2f539ba947bd78ff07edae96b4991586dab11330747c4bfb7e6141158d3d1919bae4cebc42fcae9f9bd5afa97aa780986b9b63d8c3468ced5c048a15d4fd6eca42c011f647c050e6bec74fedf0050d33b6a236f0fede42adbeefa8b27ae3529c704aa36919de44a107cf48273a4bcd3d957556e4cef5a4cde7d97a025dc065563a65c067423b7c55563e3c54922cc4dee577837e22158e594e347e980fc95bb6120eb6f03878011afcf17880b10c8944cec66069887771e0ef28f879f3fa4ea570d7359572a07b325910dc545", 0x1000}], 0x1) socket$inet_sctp(0x2, 0x0, 0x84) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) 19:16:33 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) [ 919.645965][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:33 executing program 1: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) [ 919.800753][T31545] IPVS: ftp: loaded support on port[0] = 21 19:16:33 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 19:16:33 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 919.901709][T31545] virt_wifi0 speed is unknown, defaulting to 1000 19:16:33 executing program 1: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:33 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 19:16:33 executing program 1: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:34 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e23", 0x3f}], 0x1) 19:16:34 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 920.678488][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 920.743510][T31549] IPVS: ftp: loaded support on port[0] = 21 [ 920.895662][T31549] virt_wifi0 speed is unknown, defaulting to 1000 [ 920.909987][T31545] virt_wifi0 speed is unknown, defaulting to 1000 [ 921.417873][T31549] virt_wifi0 speed is unknown, defaulting to 1000 [ 921.560383][ T38] tipc: TX() has been purged, node left! [ 921.716290][T10898] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 922.748616][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 923.788847][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:37 executing program 3: r0 = socket(0x11, 0x80002, 0x0) getsockopt$packet_int(r0, 0x107, 0x9, &(0x7f0000000040), &(0x7f0000000340)=0x4) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000200), 0x10efe10675dec16, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000300)=@req={0x798, 0xfff, 0x1000, 0x2}, 0x10) r1 = accept4$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, &(0x7f0000000140)=0x10, 0x80000) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f00000001c0)=0x78) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r2, &(0x7f0000000240)={0x2, 0x4e21, @local}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window, @mss, @window, @window], 0x20000000000000e4) socket$netlink(0x10, 0x3, 0x0) getpid() sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000200), 0x88) sendto$inet(0xffffffffffffffff, 0x0, 0xfffffffffffffdd5, 0x0, 0x0, 0x45) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x0, 0x0, 0xfffffffffffffd25) 19:16:37 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 19:16:37 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'blake2s-224\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, 0x0, 0x0) 19:16:37 executing program 1: socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r0 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r0, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:37 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(0xffffffffffffffff, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r1, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:37 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e23", 0x3f}], 0x1) 19:16:37 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080), 0x0) 19:16:38 executing program 1: socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r0 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r0, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:38 executing program 4: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) [ 924.401515][ T28] kauditd_printk_skb: 25 callbacks suppressed [ 924.401532][ T28] audit: type=1804 audit(1601752597.959:457): pid=31651 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/688/memory.events" dev="sda1" ino=16365 res=1 errno=0 19:16:38 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080), 0x0) 19:16:38 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(0xffffffffffffffff, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r1, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:38 executing program 1: socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r0 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r0, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) [ 924.563543][ T28] audit: type=1800 audit(1601752598.009:458): pid=31651 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16365 res=0 errno=0 [ 924.673369][ T28] audit: type=1804 audit(1601752598.039:459): pid=31651 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/688/memory.events" dev="sda1" ino=16365 res=1 errno=0 [ 924.745945][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 924.771877][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 924.826947][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 924.838722][ T28] audit: type=1804 audit(1601752598.069:460): pid=31651 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/688/memory.events" dev="sda1" ino=16365 res=1 errno=0 [ 924.965795][ T28] audit: type=1804 audit(1601752598.359:461): pid=31670 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/689/memory.events" dev="sda1" ino=16384 res=1 errno=0 [ 925.013191][ T28] audit: type=1800 audit(1601752598.369:462): pid=31670 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16384 res=0 errno=0 [ 925.047217][ T28] audit: type=1804 audit(1601752598.369:463): pid=31670 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/689/memory.events" dev="sda1" ino=16384 res=1 errno=0 [ 925.115234][ T28] audit: type=1804 audit(1601752598.439:464): pid=31670 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/689/memory.events" dev="sda1" ino=16384 res=1 errno=0 19:16:38 executing program 3: socket(0x10, 0x3, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.events\x00', 0x7a05, 0x1700) sendfile(r0, 0xffffffffffffffff, 0x0, 0x800000000000c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, 0xffffffffffffffff, 0x0, 0xf03b0000) sendfile(r2, r1, 0x0, 0x800000000000c) close(0xffffffffffffffff) ioctl(0xffffffffffffffff, 0x2, 0x0) r3 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$sock_int(r3, 0x1, 0x3e, &(0x7f00000000c0)=0x7, 0x4) bind$llc(r3, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x10) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) r4 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x64}}, 0x0) setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000100)={0x1, 0x7}, 0x8) 19:16:38 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080), 0x0) 19:16:38 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:38 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(0xffffffffffffffff, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r1, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:38 executing program 4: socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380), 0x10000023, &(0x7f00000002c0)=""/77, 0x42e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0xfe76, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x6129d00b}], 0x1, &(0x7f00000001c0)=""/4, 0x10036, 0x7301}, 0x3f00) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x3a, &(0x7f0000000000)}, 0x0) 19:16:38 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e23", 0x3f}], 0x1) 19:16:38 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32", 0x8) [ 925.362225][ T28] audit: type=1804 audit(1601752598.919:465): pid=31689 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/690/memory.events" dev="sda1" ino=16381 res=1 errno=0 19:16:39 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:39 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 925.513331][ T28] audit: type=1800 audit(1601752598.919:466): pid=31689 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16381 res=0 errno=0 19:16:39 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32", 0x8) 19:16:39 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:39 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 925.865581][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:40 executing program 3: pipe(0x0) connect$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000040)={0x1f, @fixed, 0x7}, 0xa) bind$rose(0xffffffffffffffff, 0x0, 0x1c00) unshare(0x40000000) r0 = socket(0x4, 0x4, 0x5e3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="08467a9124d35adc215865e66f2677d9bf2addf22b2fa702a2804a44fb2f88872295238a71398ea95b210c7a2356835682f608724aeaa3f63da66c4d512f91148a96175894f2d2f354d0dc98d57889f6a09b3a4cd15b731133bd39ea021cb28991f859b3fb2ccb45c6a57ccd95b237f922debd2e64c62ef281cb60ccfe07d45f722acdf0", @ANYBLOB="000226bd7000fedbdf25070000001400060076657468315f746f5f68737200000000140002002001000000000000000000000300000014040600697036746e6c300000000000000000000500010001000fdefaeebffcdd9f7374656d5f753a6f626a6563745f723a7070705f6465766963655f743a73300000008db8e1c08a6053eb7297c57f6b0d87d7be5e9f7ceb65314cc6a822c9a7"], 0x80}}, 0x0) 19:16:40 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32", 0x8) 19:16:40 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000080)=0x6902, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x34) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x89e1, &(0x7f0000000040)) r2 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x14, &(0x7f0000000080), 0x4) sendmsg$kcm(r2, 0x0, 0x0) getpeername(r2, &(0x7f0000000880)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, &(0x7f0000000900)=0x80) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)=ANY=[@ANYBLOB="1c000000020601010000000000000000050000060500f7ff0b008000"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x800) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x1}, 0x10) listen(r4, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl(r5, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") poll(&(0x7f0000000000)=[{r4}], 0x1, 0x7) connect$rxrpc(0xffffffffffffffff, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @multicast2}}, 0x24) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 19:16:40 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080), 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:40 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r2, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:40 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c9", 0x44}], 0x1) 19:16:40 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d0400", 0xc) 19:16:40 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080), 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:40 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 926.741104][T31728] IPVS: ftp: loaded support on port[0] = 21 [ 926.853064][T31728] virt_wifi0 speed is unknown, defaulting to 1000 19:16:40 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d0400", 0xc) [ 926.905443][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 926.920241][ T38] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 926.930346][ T2546] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:40 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080), 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) [ 926.949508][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:40 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 927.470675][T31729] IPVS: ftp: loaded support on port[0] = 21 [ 927.588156][T31728] virt_wifi0 speed is unknown, defaulting to 1000 [ 927.588213][T31729] virt_wifi0 speed is unknown, defaulting to 1000 [ 928.001772][ T38] tipc: TX() has been purged, node left! [ 928.027792][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 928.028391][T31729] virt_wifi0 speed is unknown, defaulting to 1000 [ 929.076161][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 930.105143][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 930.507793][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 930.518185][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:44 executing program 3: bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000002c0)={0x0, 0x0, 0x8}, 0xc) 19:16:44 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d0400", 0xc) 19:16:44 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x0, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:44 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:44 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) socket(0x10, 0x80002, 0x0) sendfile(r1, r2, 0x0, 0xf03b0000) ioctl$FITRIM(r0, 0x40305839, &(0x7f0000000000)={0x0, 0x8001, 0x800f4d2}) 19:16:44 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c9", 0x44}], 0x1) 19:16:44 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000", 0xe) 19:16:44 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x0, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:44 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:44 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000300)=@raw={'raw\x00', 0x3c1, 0x3, 0x280, 0x0, 0x0, 0x0, 0x0, 0x178, 0x1b0, 0x258, 0x258, 0x1b0, 0x258, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff}, {0xffffffffffffffff, 0xfc}, {0xffffffffffffffff}}}}, {{@ipv6={@mcast2, @remote, [], [], 'rose0\x00', 'macsec0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@MARK={0x28, 'MARK\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2e0) 19:16:44 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000", 0xe) [ 931.149588][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:44 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:44 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x0, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) [ 931.230292][T31832] SET target dimension over the limit! 19:16:44 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0xf000) sendfile(r2, r1, 0x0, 0x8000000000004) syz_emit_ethernet(0x42, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a0000000600010020"], 0x1c}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x7a05, 0x1700) read(r0, &(0x7f0000002140)=""/4097, 0x3b0) 19:16:45 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000", 0xe) 19:16:45 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) socket$packet(0x11, 0x3, 0x300) sendmmsg(0xffffffffffffffff, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:45 executing program 4: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bind$rose(r0, &(0x7f0000000000)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x1, @null}, 0x1c) getsockname(r0, 0x0, &(0x7f00000000c0)) 19:16:45 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:45 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d0400000028", 0xf) 19:16:45 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c9", 0x44}], 0x1) 19:16:45 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) socket$packet(0x11, 0x3, 0x300) sendmmsg(0xffffffffffffffff, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:45 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x6db6e559) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x9, 0x0, &(0x7f0000000040)) 19:16:45 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:45 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d0400000028", 0xf) 19:16:45 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) socket$packet(0x11, 0x3, 0x300) sendmmsg(0xffffffffffffffff, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:45 executing program 4: r0 = socket$inet(0xa, 0x801, 0x84) sendmsg$inet_sctp(r0, &(0x7f0000000040)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c, &(0x7f0000000140)=[{&(0x7f0000000180)='#', 0x1}], 0x1, &(0x7f0000000100)=[@init={0x18, 0x84, 0x5}, @dstaddrv6={0x20, 0x84, 0x2, @loopback}], 0x38}, 0x0) [ 932.187282][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:45 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d0400000028", 0xf) 19:16:45 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, 0x0, 0x0, 0x0) 19:16:45 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:46 executing program 4: r0 = socket(0x2, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x22, &(0x7f0000000000)=0x5, 0x4) 19:16:46 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, 0x0, 0x0, 0x0) [ 932.436481][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 932.447254][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 932.464042][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:46 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b91", 0x46}], 0x1) 19:16:46 executing program 4: r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x0, 0x7c7}, 0x10) recvmmsg(r0, &(0x7f00000024c0)=[{{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000040)=""/50, 0x32}], 0x1}}], 0x1, 0x0, 0x0) 19:16:46 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000300)='westwood\x00', 0x9) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0xffffff6a) r2 = socket$kcm(0x29, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x208e24b) readv(r2, &(0x7f0000000240)=[{&(0x7f0000000380)=""/137, 0x89}], 0x1) sendto$inet6(r0, &(0x7f0000000200)="13", 0x1, 0x0, 0x0, 0x0) 19:16:46 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:46 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, 0x0, 0x0, 0x0) 19:16:46 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f00000051c0)={0x0, 0x0, &(0x7f0000005180)={&(0x7f00000050c0)={0x4c, 0x12, 0x1, 0x0, 0x0, {0x2b}}, 0x4c}}, 0x0) 19:16:46 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400), 0x0, 0x0) 19:16:46 executing program 4: unshare(0x400) r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, 0x0, 0x0) 19:16:46 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:46 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400), 0x0, 0x0) 19:16:46 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001b80)=[{&(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e, 0x0}], 0x1, 0x0) sendmmsg$unix(r0, &(0x7f0000000380)=[{0x0, 0x0, &(0x7f0000003ec0), 0x2}], 0x1001, 0x0) [ 933.263269][ T28] kauditd_printk_skb: 2 callbacks suppressed [ 933.263286][ T28] audit: type=1804 audit(1601752606.819:469): pid=31913 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/703/memory.events" dev="sda1" ino=15797 res=1 errno=0 [ 933.310474][T31915] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.3'. 19:16:47 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400), 0x0, 0x0) [ 933.389200][ T28] audit: type=1800 audit(1601752606.859:470): pid=31913 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=15797 res=0 errno=0 [ 933.496340][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 933.543058][ T28] audit: type=1804 audit(1601752606.869:471): pid=31913 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/703/memory.events" dev="sda1" ino=15797 res=1 errno=0 [ 933.648312][ T28] audit: type=1804 audit(1601752606.919:472): pid=31913 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/703/memory.events" dev="sda1" ino=15797 res=1 errno=0 19:16:47 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b91", 0x46}], 0x1) 19:16:47 executing program 3: sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0xfffffffffffffd90, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c00000010000507000000000000000072030000", @ANYRES32=0x0, @ANYBLOB="00010000000000002c0012000c000100626f6e64000000001c00020008000100040100000a001a"], 0x4c}}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x2, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) [ 933.858783][T31931] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 933.882826][T31931] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'. [ 933.894781][T31931] (unnamed net_device) (uninitialized): Invalid ad_actor_system MAC address. [ 933.913886][T31931] (unnamed net_device) (uninitialized): option ad_actor_system: invalid value (0) 19:16:47 executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000340)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @multicast2}, 0x2}}, 0x2e) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) sendmmsg(r0, &(0x7f00000038c0)=[{{0x0, 0xb80b, &(0x7f0000001500)=[{&(0x7f0000000180)="e1e06b7e8a1eb013cdf1be03e940099a4058554642325fa2d62cbd33121d1dda1c2cba2ab5ddf84c9a99332a02a1b88862081812e1b779370bda0e9169bcabd4e5044fbe61e0d1d96fda94cc50ecf6a6b0c703f5d91a0c02bfa16234b30c26bf7bfee3c68682095f32ff2776d2985a81703f634fe3abaa9ac0aeed3b3148b1aef0ec1efb871a8500338e9de6b4ee1e17eb5847937a83b0358ef8ab6692d2b1538741dab7a9f609e75b6e55a120da346312cab143f90ebb6da62d0fc550b733200c75f715ce01bb70bc23e70dd262ef91215822298fee9709e2d1ea327aa8a6a4314e9b91dbf58300a7917cc3e4f26283937694d3a4c146", 0x8056a}, {&(0x7f0000000780)="c18af54e7facd931e259615d3a072b165331b3657a111037325376ecdcd7cdb565e908e3f8ed1619f36e1d9542c99c64220b90530a9af19cdb598be1b47a3270b2a1164ebd669a64db6fe8c93739fd45325fe94f075eb0f9b0e9f93dfe77af28d06043eb76c521af1f865c2d52eae2c88f2a33646df1d8d300ccdb466c2071b66192d92f3b8c1623c6c46f8baa6b50ee5cfc242f73de00027945540700000000fecb1e7b312558b81c0e6f8c1a0d7dc3000000d4c5afbba32d91fab46da4b75f73", 0xce}, {&(0x7f0000000040)="c39a00bb15b4d145723f765d602ef1e9ee36", 0x7ffff}, {&(0x7f00000003c0)="5683eb186eaf89d39dcfafa4e796554c67e389d4526f1202ce7e4b2da420d47a58d28c3a80a467f347ab84023a82b4a6d86659d01f5caf15e20c5d8986f18ef00cafe40e866419b00a2dceff7623c1aa9cb838fa3608f48974b4d78fe37fae1e577235d7af3d3b105f0b77a5da237b80615ed4a95fae798adfb3aa15119146bcda665356e91113231ded3948684b39093f3f8031d652fefc1d77fe94e3fccb4c4086e22fe32f63285d5d6f0faa603609e5ed282499a9c13ba06b99f837eb09ca142dec8b3c2a5e3791f0a7e1ac323f8f9dc521b145ad811a6d4fe37f04497d78281a1dcf220fe0526d52a75e0a3c13", 0x86}, {&(0x7f0000000880)="cccd8dc47691eecbd79ddc547a148d45eafe6ec8a33e827f046282553b1e97271e8d7fdd39ca80586f9f266107329f2c9bcb9af5ed4b95030cfb3b365b8e2a9dee355a8c8f19d3fcf0debf791812e612353ed2a58f46ea9b3ca877a61b540f452e942e7d36af86053898caf2661225b22b16f61dbbf509d1e900c62586fdad62bac031e362d98fdd1067108f22a17eef2edd4033c0dec88920001d41556153fcad5c15739fef634e99ff94168bbb5e6a94908760a48c3d586af761ab86bac1ea9a675a954c4ad88a5dd2335c135af1934c67ead06f894787994f57db5d1b38cd9c3cd1d9150dc506e415052f24cfd9a57a050098b13913b6da437f310b09eeb3626a09cfb0e3fa510a955c3012731b99d1371d7c2073b545c08d296b1d15e3d6dd22a93041ae58b1f2e2ec84cf80722e74373d2c2f7ea6551d1e5ac98e992d54994082fa69ce18a8c7a7fcf74c105f6f102dabb8edbd0bbcea2641e9af16696afe4eac822f62e4ba4ae18f0efb67bbf2ce02e69d90397d0551663debc7e16af73f65964e9b85af3cb456ec3b48d92dd513bc8bdf8e9377bc9b3b9aee011e12ae2dd43c63a44c71e8f558066d4002fffe0b34a7921d682964172629e214c4a912d09f6b40c49bb5eb48d00fd28427061b20be43c7090ed6298c3573e3c5a3cf3558e7a250fbe393a734c0e2b7a314665b774ece1224d8122b3c0478f801fa71105f88aae92ffbda977126e9eedf6814eedcdb8603b291ec8465ea02cc4739dc8749865d7448da5805a5eda23a5caaadb3a8f78e6856b25c1ba89572e7360148a88d4b435a4c0d81ebf8fc7b2897ddfb8e77ecb38fd41b8b9d21eed4f4aba45a362c3d9ef12149dc89e25ac77bbbfd3d5c53686d164fc0b1e1e81dcc36ca2c938fda7f4ddf20681191eca478c7451d660d06c3da5b83e71ab249b0912297d603cbc34816186ea76673ad7afb1406140525e46ba7e2f3eb370d", 0x2b7}], 0x5}}, {{0x0, 0x6000, 0x0}}], 0x1a000, 0x0) 19:16:47 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:47 executing program 4: syz_emit_ethernet(0x3e, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb86dd606da187000800000000000000000000000000fe8000000000000000000000000000aa00000000000890780000000000"], 0x0) r0 = socket(0x10, 0x3, 0x800) write(r0, &(0x7f0000000200)="1b0000001a005f3814ecf407000903018000200000000000000000", 0x1b) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz0\x00', 0x1ff) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000000)=0x6, 0x4) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000200)="1b0000001a005f3814ecf40700090301800020000000a20f0ac100", 0x1b) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x80001, 0x84) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=ANY=[@ANYBLOB="90f8ffff2b00270d00000000e883bf3d0000000046cedc430231974982dba7abb91fc7a0431dc4d94fca1a9f59ea91688fbdb313f5cc012f0c9b80", @ANYRES32=0x0, @ANYBLOB="0000000000000000040000000a0001006261736963000000600002005c000300580001000b00010073616d706c6500002c00028008000500000000000800030000000000180002000000000000000000040000200000000000000000040006000c00070000000000000000000c0008000000000000000000"], 0x90}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r4, 0x401c5820, &(0x7f0000000140)={0x20}) write$cgroup_int(r4, &(0x7f0000000000), 0xffffff6a) pwritev(r4, &(0x7f0000000500)=[{&(0x7f0000001340)='+', 0x1}], 0x1, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0x12, 0xffffffff, 0x4, 0x21, 0x0, 0x1, 0x0, [], 0x0, r4, 0x5, 0x3, 0x2}, 0x40) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000380)={r5, &(0x7f0000000300)="11d0485700325665d696811fb9a9b432ab7260811fb1eda6402bdf6f587882e401b87f2a2be48c711d4f45458535b49f137e9389448c9aa118ba37f606e156e16fb0b1f7aacb87d2ee3ea713393aa5282bbde93138a6061c130ea5e530bb45fbc4c831ddcd4079f1b1e78ac5706d", &(0x7f0000000180)=@tcp6=r1}, 0x20) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000240)={r6, @in={{0x2, 0x0, @private=0xa010102}}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2}, 0x9c) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000080)={r6}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000100)={r7, 0x3}, 0x8) 19:16:47 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) 19:16:47 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 19:16:47 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 934.126421][ T28] audit: type=1804 audit(1601752607.689:473): pid=31943 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/704/memory.events" dev="sda1" ino=16017 res=1 errno=0 19:16:47 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 934.266044][ T28] audit: type=1800 audit(1601752607.719:474): pid=31943 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16017 res=0 errno=0 [ 934.267481][ T28] audit: type=1804 audit(1601752607.719:475): pid=31943 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/704/memory.events" dev="sda1" ino=16017 res=1 errno=0 19:16:48 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 934.513736][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:48 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) [ 934.561023][ T28] audit: type=1804 audit(1601752607.769:476): pid=31943 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/704/memory.events" dev="sda1" ino=16017 res=1 errno=0 19:16:48 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:48 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b91", 0x46}], 0x1) 19:16:48 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x0, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) [ 934.733876][ T28] audit: type=1804 audit(1601752608.119:477): pid=31955 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/705/memory.events" dev="sda1" ino=16065 res=1 errno=0 [ 934.925669][ T28] audit: type=1800 audit(1601752608.119:478): pid=31955 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16065 res=0 errno=0 19:16:48 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0x0, 0xee01}}}, @cred={{0x1c}}], 0x40}, 0x0) 19:16:48 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:48 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x0, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:48 executing program 4: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=r4, @ANYBLOB="f1ffffff1700000008001c00ef00000002"], 0x28}}, 0x0) 19:16:48 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) [ 935.335801][T31981] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 19:16:49 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:49 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x0, 0x0, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:49 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:49 executing program 0: socketpair$unix(0x1, 0x4000000000002, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000fe4719e781f4fd8964c8268a58cda3b485975da3f05fbd6e96ee00", @ANYRES16=0x0, @ANYBLOB="000000000000000000000a00000004000380"], 0x18}}, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.net/syz1\x00', 0x200002, 0x0) ppoll(&(0x7f0000000180)=[{0xffffffffffffffff, 0x4200}, {0xffffffffffffffff, 0x18540}, {0xffffffffffffffff, 0x1002}, {r0, 0x2200}, {}, {0xffffffffffffffff, 0x6601}], 0x6, &(0x7f0000000200)={0x77359400}, &(0x7f0000000240), 0x8) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r3, &(0x7f0000000380)={0x28, 0x0, 0x0, @host}, 0x10) listen(r3, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, &(0x7f0000000040), 0x10) writev(r4, &(0x7f0000000840)=[{&(0x7f0000000080)="d730", 0xfffffee6}], 0xe3) poll(&(0x7f0000000000), 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x0, 0x64}, {r1, 0x8124}, {r4, 0x204}], 0x3, &(0x7f00000002c0)={0x0, r2+10000000}, 0x0, 0x0) [ 935.554169][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:49 executing program 4: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000001c0)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000040)={r1}, &(0x7f0000000140)=0x8) 19:16:49 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b9100", 0x47}], 0x1) 19:16:49 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:49 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 935.832774][T32015] IPVS: ftp: loaded support on port[0] = 21 19:16:49 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) [ 935.984209][T32015] virt_wifi0 speed is unknown, defaulting to 1000 19:16:49 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r1, &(0x7f0000003400)=[{{&(0x7f0000000040)=@isdn={0x22, 0x8}, 0x80, 0x0}}], 0x1, 0x0) 19:16:49 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 936.266489][ T776] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 936.274933][ T2546] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 936.284646][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:50 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000003c0)={0x14, r1, 0x1, 0x0, 0x0, {0x16}}, 0x14}}, 0x0) [ 936.643649][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:50 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b9100", 0x47}], 0x1) 19:16:50 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:50 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xb, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="8500000023000000350000008000000085000000070000009500001d000000007107f00ae6fdc04a"], &(0x7f0000000040)='GPL\x00', 0x4, 0xfeff, &(0x7f0000000180)=""/153, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffe60, 0x10, 0x0, 0xffffff8b}, 0x2b) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r0, 0x0, 0xe, 0x0, &(0x7f00000000c0)="61df712bc884fed5722780b6c2a7", 0x0, 0x1d8}, 0x28) [ 937.172169][T32015] virt_wifi0 speed is unknown, defaulting to 1000 [ 937.204233][T32017] IPVS: ftp: loaded support on port[0] = 21 [ 937.305758][T32017] virt_wifi0 speed is unknown, defaulting to 1000 [ 937.714161][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 937.912153][T32017] virt_wifi0 speed is unknown, defaulting to 1000 [ 938.008586][ T776] tipc: TX() has been purged, node left! 19:16:51 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)={0x38, 0x1, 0x2, 0x3, 0x0, 0x0, {}, [@CTA_EXPECT_TUPLE={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private}, {0x8, 0x2, @remote}}}]}]}, 0x38}}, 0x0) [ 938.186835][ T25] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 938.198020][T11211] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 938.208738][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:52 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:52 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) 19:16:52 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = socket(0x1e, 0x5, 0x0) r2 = socket(0x1e, 0x2, 0x0) setsockopt$TIPC_CONN_TIMEOUT(r1, 0x10f, 0x82, &(0x7f0000000040), 0x4) bind(r2, &(0x7f0000d80f80)=@generic={0x1e, "0103000000000000000000000000000009a979f321b30c7bc8790405c7bad62e0a43a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb31f1314a8ef151622ca5bdb9c8ead2000077aeb81c90001d6d7c980ee590c8b9f70dc136cb184a"}, 0x80) connect$tipc(r1, &(0x7f0000000000)=@name, 0x10) close(r1) close(r2) 19:16:52 executing program 5: r0 = socket$inet_sctp(0x2, 0x800000000001, 0x84) connect$inet(r0, &(0x7f0000f6fff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000600309ff5bffff00c7e5ed5e232e725839c97b9100", 0x47}], 0x1) 19:16:52 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000300)=@raw={'raw\x00', 0x2, 0x3, 0x298, 0x0, 0xc8, 0x0, 0x0, 0x0, 0x200, 0x200, 0x200, 0x200, 0x200, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@inet=@tcp={{0x30, 'tcp\x00'}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00'}}, {{@ip={@loopback, @rand_addr, 0x0, 0x0, 'vxcan1\x00', 'caif0\x00'}, 0x0, 0xd8, 0x138, 0x0, {}, [@common=@unspec=@physdev={{0x68, 'physdev\x00'}, {'ip6_vti0\x00', {}, 'bridge_slave_0\x00'}}]}, @common=@SET={0x60, 'SET\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2f8) 19:16:52 executing program 4: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f00000001c0)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000040)={r1}, &(0x7f0000000140)=0x8) [ 938.719543][T32132] xt_TCPMSS: Only works on TCP SYN packets [ 938.737428][ T28] kauditd_printk_skb: 26 callbacks suppressed [ 938.737445][ T28] audit: type=1804 audit(1601752612.299:505): pid=32133 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/712/memory.events" dev="sda1" ino=16377 res=1 errno=0 19:16:52 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$sock(r0, &(0x7f0000000300)=[{{&(0x7f0000000040)=@in6={0xa, 0x4e22, 0x0, @mcast1, 0x3}, 0x80, 0x0}}], 0x1, 0x0) 19:16:52 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x80000000000e, 0x4, 0x2000000000004, 0x830, 0x0, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffffff, 0x0, 0xfffffffe}, 0x40) [ 938.832102][T32137] IPVS: ftp: loaded support on port[0] = 21 19:16:52 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 938.954077][ T28] audit: type=1800 audit(1601752612.339:506): pid=32133 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16377 res=0 errno=0 [ 938.997624][T32137] virt_wifi0 speed is unknown, defaulting to 1000 19:16:52 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) 19:16:52 executing program 1: r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000080)={{{@in=@local, @in6=@empty}}, {{@in=@private}, 0x0, @in6}}, &(0x7f00000001c0)=0xe8) write$binfmt_misc(r0, &(0x7f0000000040)={'syz0'}, 0x4) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, 0x0, 0x208e24b) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'syz_tun\x00'}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) write(r0, &(0x7f0000000000)="05", 0x3f9b4) [ 939.118292][ T28] audit: type=1804 audit(1601752612.359:507): pid=32133 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/712/memory.events" dev="sda1" ino=16377 res=1 errno=0 19:16:52 executing program 0: r0 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) ioctl$sock_proto_private(r0, 0x89e1, &(0x7f0000000000)="fe251b58aa1cba1e10f4495fd4") ioctl$sock_proto_private(r0, 0x89e2, &(0x7f0000000000)) [ 939.244178][ T28] audit: type=1804 audit(1601752612.389:508): pid=32133 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/712/memory.events" dev="sda1" ino=16377 res=1 errno=0 19:16:53 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 939.440842][ T28] audit: type=1804 audit(1601752612.789:509): pid=32150 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/713/memory.events" dev="sda1" ino=15726 res=1 errno=0 19:16:53 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@flushpolicy={0x18, 0x12, 0x4e326d0846e0c13d, 0x0, 0x0, "", [@proto={0x5}]}, 0x18}, 0x8}, 0x0) 19:16:53 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x2e, &(0x7f0000000040)={0x2}, 0x4) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r2 = socket$can_j1939(0x1d, 0x2, 0x7) socket$inet(0x2, 0x2, 0x0) ppoll(&(0x7f0000000640)=[{r0}, {r2, 0x9120}], 0x2, 0x0, 0x0, 0x0) [ 939.688417][ T28] audit: type=1800 audit(1601752612.799:510): pid=32150 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=15726 res=0 errno=0 [ 939.898026][ T28] audit: type=1804 audit(1601752612.799:511): pid=32150 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/713/memory.events" dev="sda1" ino=15726 res=1 errno=0 19:16:53 executing program 5: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0x3, &(0x7f0000000300)=@framed={{0x39}}, &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [0x4c], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 19:16:53 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080), 0x0) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 940.186946][ T28] audit: type=1804 audit(1601752612.879:512): pid=32150 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/713/memory.events" dev="sda1" ino=15726 res=1 errno=0 [ 940.265485][T10403] net_ratelimit: 1 callbacks suppressed [ 940.265495][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 940.335119][ T28] audit: type=1804 audit(1601752612.929:513): pid=32153 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir622004404/syzkaller.AYM2aV/676/cgroup.controllers" dev="sda1" ino=16379 res=1 errno=0 [ 940.440732][T32137] virt_wifi0 speed is unknown, defaulting to 1000 [ 940.469571][ T28] audit: type=1804 audit(1601752613.369:514): pid=32164 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/714/memory.events" dev="sda1" ino=15726 res=1 errno=0 19:16:54 executing program 4: r0 = socket$inet(0x2, 0x2000080001, 0x84) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x0, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1a000}], 0x1}, 0x0) shutdown(r0, 0x1) 19:16:54 executing program 0: r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @loopback}}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000ac0)="eea6baabe31ea200e532f3b17d3671105a3081096fa650f0c34f11d795e548ecdce1c8fd8cb3041a9aeb4a312e5298a5e01d6a06dd8bafc252766915072c6dd7cfdb7594aef49066ff485033ba6338f15713d28457ab52fd572fb40cf8f69a62b48de50ace3ee6d4951b8be26d5f43eb5d5db19de8a1d3caa686903b50cd3741f2af2378ddf48a2c4d3165df5652921d278275e18dd4ef649efc47ade3f1f236f60aabb608e38082e378e084b58fd9fe2d85dc072f325fddb7f05d29ec168cb95be5f62ce199be616bf0cd7382b403f2f8863a84d9040e2c80d9c951c210eefdfa4404b3ddd9722684c3f0601bc7cf1d72734f3fbdca2ad9b6f981a269cfdf0467feda9c631e1cd690a6543bc6d185ea41180e0549762465c45f3dc090d825221255082a7cbdc9b0dd99397c19c42b0e946924224c5e86b24090c8eb280fe68d3b948f739b33ec28567c821606a2a40226cd5694aefde23dd3c5ab4ca980f93951ab3d8257408ea8257095368a8ce875f474eebf601e7872d0a9ea2e2b511b056915836c0f0192bfda378a494e1da2e9209af0ced572bb3dc4b292cbb70de78a12404367f9cb9f36272a23f3233f9cfe973f031b959809613014ab2254ffc1e1cc31e99d749fc35851d1451b56bcd2a25b6777d62e18be163c83e040722c8e57b8b5f635fd29f6d700101ff5a72c54bebf49a884e6c683382a0c19ace6c06937c32802e9229c18aa5564de27a1bb44eb7f651729d06395d4a5ef130c535d9163d51428aa7ca00d04fe25546adce114b4716949d97343edb917209ad5948e2af141fcf5b9aa44796a12efa1dad75f4ebc65b9c868dc855a6b1e422ee834f98fe5f70862587ac19746b03553b549460f6827f766e96575e38f8d576347b4c0fef8cf24f5f82f076e683520bac2c3109908e14ade80f9c205ad5ac582bb77a1b648ca3d04f7ab60227d903a1ca8d3e47abe59eed1a967421cd3f08b63154a3711205642910172c54c165a26ae0ed7e28dccb00b18be32902ba6c6b1153078b36e6f8ffc3b417db4a9f9660aba223222500634ac4022822e8fd62d53a33c1d2aa1364c94390c22e20e311b1cff50a2f06b203fa6a884cd9a7d9c60e53edd5426984b1bb1c5f5e1c1c1bfc1bb7bcc683853be456ed28a156c6e8186b2294662631c988e7577765a4c0d3e7c280e98d0d992decf1b6e1c3d6e35da856e98d0c64aae8e7a30e3a21ed507fcd5ed22334f32d32b49162538e82016d20c82ba3df6615514b29e1ccbadc4b3a31f667d86590ac89262f4474156b5b9aff9fe0ce3d1aa9ed59d71be7a34e6ea5c2adcdc885e1ba3dd1520d1b3f48e9df5433b87c628cc1dcc69977028eaf5eb424386c2eda237ac06954402f120ea371dbf4454da60f3e7f7e1337827bfc54f05de51fb644e1b9d8e097fca10b438f16dacf9d6722f19ac6247781439ee2265b7015147c77cffff0000000000002c443e45c73e53f864d1385129441d2491f3cf6ea500949a27c8f3b29288f30e9fd7fe42a1fcedf9f7900c743ba3d0b40b436f92a5a8d172b721dce236fa5d3cde85384b95d4f55839105607d10590b956198b3f6496398c0a362ef49259b406b4aaadece8fa7590e096a83f71c0a1d9f62414f860ec971f0a16c67dfc788f0e9a7ecbc4ba3c121483fc0a8e57adf186d01f6178ad52e3422066038f66d99aff0f52099f58c51081ed019be577794c758bd44e2b96f1d10d373545c3cf80d69ecd857999a7cd76aea02c7b2a8a3c31f98f536d3d7a0618eafafcc941bfb471e9c572aacb600c7205056356aad7065019217b7c0af65543646691fe8eda7f7b06512195f2429e64f4d616368530814469e776ad5038b98083d67948089657f0eed305a7b7993e08fdc42e0f49fec5b8b45d26ff43e271c235e2c5fb14ed6e701c421d404b0fa1544ae577e5c4594ffdaf56d32b37f379707d41eb60245652dfb9883a76c8736b68", 0x57c}, {&(0x7f0000001680)="e7a5d011ff676b12", 0x8}], 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040000002b24ec10064b6fb14bccedfb718aef932f3889d1fdda5b9134015a860f5878c37ffe36e1165d14d435be5b317c6c8189767d2f97879f07a715bb7c169f46933d9338f4ab0483696f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x0) 19:16:54 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) 19:16:54 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:16:54 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080), 0x0) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:54 executing program 5: unshare(0x6c060000) socket(0x10, 0x803, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, 0x0) [ 941.315137][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:55 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum={0x0, 0x0, 0x0, 0x6, 0x3}]}}, &(0x7f0000000200)=""/4092, 0x26, 0xffc, 0x8}, 0x20) [ 941.454024][T32212] IPVS: ftp: loaded support on port[0] = 21 19:16:55 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:16:55 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080), 0x0) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:55 executing program 4: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @remote}, 0x1c) sendmmsg(r0, &(0x7f0000004d80)=[{{0x0, 0x2000bb8, &(0x7f0000001500)=[{&(0x7f0000000040)="d3622fe131479cee20fb607a9585dc0b411519fd3b65066522d73df58b9257b566c6fc626776defc3a2e249c9120cab00220bc31d41e44f96f67971b8ed8a3dc9eb4123a903d58da02dd1eca653150422bc91e9585fb38", 0x57}, {&(0x7f00000011c0)="7cc3be44ec866303c11f9ec49c2fe80d4ccef580f3bf717b5e129f1dc7766fdf864b7bc35924f34bb5fd1dd89172a4b0db90eea51bdfec78bb53e8d41773cba7f1305a8a40b7368445a71ef7870273f1544930baf73a8bfa6ece09d54376b821b65fdf1e0704f1f3c5a823fa67f635159af010053f5b909f8e944c43d6fb1c4fca639b470d3e6ad140d0838958ecf0fc98a780205474fdeb93a97d27b4f3314a9585129aaec893d7fe36d87fd746841ac5c60b31e1732a1a3ca0afcc4068cdde63b142700c563c1ab59dc0b7200723bf21c694583ed8fed1b2bc5c204df3812c223ce0de2f40b69e7f4e8ba1c3ebc31de2f4190e3f1ceb", 0xf7}, {&(0x7f00000012c0), 0x80fe}, {&(0x7f0000000280)="0c22fcc306e8a4d628dc3f33cd1758b784d34ef62ecd943b96c5573b05e34886b55503a08eeac42aafc204e9fec654b4b0853f4c32d8d6f8968a96b81710a9ed49ae96ea22eb07accdc99ed31fb48b921b4c9af7278829eb32247169da3593e5e73371e82e3558cd87b9c876b91e091e933496ae3a6b5a00a79f50110980c83af2fd44e0f08908f806be4146080def894a3ac87c3d214e32b0e031c8873b6ed3cdb9c160ee236576cb5a749ee356d4f5df961b35ec3667bcfa641e2c812a5eefbd78546783b6bd280dc4ec1cd015bee7d07f0993d6", 0xd5}, {&(0x7f0000001440)="7b18908bcd34b2f4eef2193c5f89bb79551b5d7000ccc31628374b03e7f0b8bbfe45", 0x22}], 0x5, 0x0, 0x0, 0xffffffe0}, 0x631b0000}], 0x400000000000132, 0x4000000) [ 941.594408][T32212] virt_wifi0 speed is unknown, defaulting to 1000 [ 941.702149][T32226] BPF:[1] ENUM (anon) [ 941.724010][T32226] BPF:size=3 vlen=0 [ 941.744605][T32226] BPF: [ 941.761058][T32226] BPF:Unexpected size 19:16:55 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) [ 941.788533][T32226] BPF: [ 941.788533][T32226] [ 941.876462][T32233] BPF:[1] ENUM (anon) [ 941.896106][T32233] BPF:size=3 vlen=0 19:16:55 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) [ 941.920850][T32233] BPF: [ 941.934267][T32233] BPF:Unexpected size [ 941.953632][T32233] BPF: [ 941.953632][T32233] 19:16:55 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32", 0x8) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:55 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x189002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00'}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r2 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x5}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000340)={{{@in=@multicast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@remote, 0x0, 0x33}, 0x0, @in=@broadcast, 0x0, 0x0, 0x0, 0x6, 0xfdc}}, 0xe8) sendmmsg(r2, &(0x7f0000000480), 0x2e9, 0x0) write$tun(r0, &(0x7f0000001a80)=ANY=[@ANYBLOB, @ANYBLOB, @ANYBLOB, @ANYBLOB="50800d451dc07789000090a187e5de3bda79685eef97b76463b2758a4213f7b98d31ac00000800000000000000"], 0x4) [ 942.026485][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 942.036872][ T38] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:55 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) [ 942.212571][T32216] IPVS: ftp: loaded support on port[0] = 21 [ 942.355402][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:56 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:16:56 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32", 0x8) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 942.709799][T32216] virt_wifi0 speed is unknown, defaulting to 1000 [ 942.718515][T32212] virt_wifi0 speed is unknown, defaulting to 1000 [ 943.375425][T32216] virt_wifi0 speed is unknown, defaulting to 1000 [ 943.397197][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:57 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000900)=@newtaction={0x44, 0x30, 0xffff, 0x0, 0x0, {}, [{0x30, 0x1, [@m_nat={0x2c, 0x1, 0x0, 0x0, {{0x8, 0x1, 'nat\x00'}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x6000000}}}}]}]}, 0x44}}, 0x0) 19:16:57 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001700)={'batadv_slave_0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000017c0)={0x0, 0x3, &(0x7f00000000c0)=@framed, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], r1, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 19:16:57 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=@newlink={0x50, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x3}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0x24, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LINK={0x8, 0x1, r6}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @local}, @IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x1}, @IFLA_IPTUN_ENCAP_SPORT={0x6, 0x11, 0x4e22}]}}}]}, 0x50}}, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 19:16:57 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) 19:16:57 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:16:57 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32", 0x8) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:57 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='vegas\x00', 0x6) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0xd, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008011, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback=0xac14140d}, 0x10) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000000)={@dev={0xac, 0x14, 0x14, 0x11}, @multicast1, 0x0, 0x1, [@initdev={0xac, 0x1e, 0x0, 0x0}]}, 0x14) socket$inet_icmp(0x2, 0x2, 0x1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000900)=@raw={'raw\x00', 0x3c1, 0x3, 0x480200, 0x330, 0x0, 0x0, 0x0, 0x220, 0x330, 0x330, 0x330, 0x330, 0x330, 0x3, 0x0, {[{{@ipv6={@remote, @dev, [], [], 'ip6gretap0\x00', 'vxcan1\x00'}, 0x0, 0x1f0, 0x220, 0x0, {}, [@common=@unspec=@conntrack1={{0xb8, 'conntrack\x00'}, {{@ipv4=@multicast1, [], @ipv4=@broadcast, [], @ipv4=@broadcast, [], @ipv6=@initdev={0xfe, 0x88, [], 0x0, 0x0}}}}, @common=@srh1={{0x90, 'srh\x00'}, {0x0, 0x0, 0x0, 0x0, 0x0, @mcast2, @loopback, @ipv4={[], [], @local}}}]}, @common=@inet=@SET2={0x30, 'SET\x00'}}, {{@uncond, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x460) socket$inet(0x2, 0x0, 0x0) recvfrom(r0, &(0x7f0000000100)=""/94, 0xffffffffffffff5e, 0x10100, 0x0, 0x3e8) [ 943.916174][ T28] kauditd_printk_skb: 24 callbacks suppressed [ 943.916199][ T28] audit: type=1804 audit(1601752617.479:539): pid=32318 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/720/memory.events" dev="sda1" ino=16366 res=1 errno=0 [ 943.946662][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:57 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) [ 943.959434][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 943.969902][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:57 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d0400", 0xc) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 944.139859][ T28] audit: type=1800 audit(1601752617.479:540): pid=32318 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16366 res=0 errno=0 19:16:57 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x2, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="4800000024000705000000000000000000001f00", @ANYRES32=r4, @ANYBLOB="00000400f1ffffff0000000008000100687462001c0002001800020003"], 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=@delchain={0x24, 0x2c, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xc, 0xffff}}}, 0x24}}, 0x0) 19:16:57 executing program 0: r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x8915, &(0x7f0000003b00)) 19:16:57 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) [ 944.330527][ T28] audit: type=1804 audit(1601752617.489:541): pid=32318 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/720/memory.events" dev="sda1" ino=16366 res=1 errno=0 19:16:58 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d0400", 0xc) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 944.482941][T32343] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 944.537788][ T28] audit: type=1804 audit(1601752617.559:542): pid=32318 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/720/memory.events" dev="sda1" ino=16366 res=1 errno=0 19:16:58 executing program 0: recvmsg$can_j1939(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000002700)=[{0x0}, {&(0x7f0000000180)=""/97, 0x61}], 0x2}, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = getpid() sendmmsg$unix(r0, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000300)='|', 0x9701}], 0xa, &(0x7f0000000140)=[@cred={{0x1c, 0x1, 0x2, {r1}}}], 0x20}], 0x198, 0x0) [ 944.598326][T32346] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 19:16:58 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) bind$inet(r0, &(0x7f00000003c0)={0x2, 0x200000000004e23, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='hybla\x00', 0x6) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) write$binfmt_elf64(r0, &(0x7f0000000340)=ANY=[], 0x100000530) 19:16:58 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) close(r2) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) 19:16:58 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) [ 944.713262][ T28] audit: type=1804 audit(1601752617.889:543): pid=32339 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/721/memory.events" dev="sda1" ino=15688 res=1 errno=0 19:16:58 executing program 0: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [0x48], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000240)='k'}, 0x40) [ 944.912462][ T28] audit: type=1800 audit(1601752617.889:544): pid=32339 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=15688 res=0 errno=0 [ 944.964871][T32365] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 945.087951][ T28] audit: type=1804 audit(1601752617.889:545): pid=32339 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/721/memory.events" dev="sda1" ino=15688 res=1 errno=0 19:16:58 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x14, r1, 0x703, 0x0, 0x0, {0x1c}}, 0x14}}, 0x0) 19:16:58 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d0400", 0xc) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:58 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:16:58 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000100)=0x7, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 945.186250][ T28] audit: type=1804 audit(1601752617.929:546): pid=32339 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/721/memory.events" dev="sda1" ino=15688 res=1 errno=0 [ 945.340131][ T28] audit: type=1804 audit(1601752618.309:547): pid=32356 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/722/memory.events" dev="sda1" ino=16380 res=1 errno=0 [ 945.345145][ C0] net_ratelimit: 58 callbacks suppressed [ 945.345181][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:59 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:16:59 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000", 0xe) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:59 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000200)=@expire={0x104, 0x18, 0x1, 0x0, 0x0, {{{@in=@broadcast, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee01}, {@in6=@local}, @in6=@private1}}, [@mark={0xc}]}, 0x104}}, 0x0) [ 945.553027][ T28] audit: type=1800 audit(1601752618.319:548): pid=32356 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16380 res=0 errno=0 19:16:59 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) bind$unix(0xffffffffffffffff, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(0xffffffffffffffff, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) [ 945.731101][T32368] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:16:59 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000040)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x34, r1, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'rose0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000040)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x34, r4, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'dummy0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x0) sendmsg$SMC_PNETID_FLUSH(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r4, 0x1}, 0x14}}, 0x0) 19:16:59 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) close(r2) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) 19:16:59 executing program 4: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb, 0x1, 'bridge\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_PROTOCOL={0x6}]}}}]}, 0x3c}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl(r3, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 19:16:59 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000", 0xe) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:16:59 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) bind$unix(0xffffffffffffffff, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(0xffffffffffffffff, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) [ 946.015649][T32403] smc: net device dummy0 applied user defined pnetid SYZ2 [ 946.035290][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 946.057670][T32403] smc: net device dummy0 erased user defined pnetid SYZ2 [ 946.140599][T32411] smc: net device dummy0 applied user defined pnetid SYZ2 [ 946.192563][T32403] smc: net device dummy0 erased user defined pnetid SYZ2 19:16:59 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) bind$unix(0xffffffffffffffff, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(0xffffffffffffffff, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(0xffffffffffffffff, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:16:59 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000", 0xe) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:17:00 executing program 0: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r1, 0x0) setsockopt$X25_QBITINCL(r0, 0x106, 0x1, &(0x7f0000000000), 0x4) 19:17:00 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xe, 0x4, &(0x7f0000000000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x8, 0x64}, [@call={0x5c}]}, &(0x7f0000000140)='GPL\x00', 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x1e}, 0x64) 19:17:00 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) close(r2) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) [ 946.462664][ T776] tipc: TX() has been purged, node left! [ 946.498949][ T776] tipc: TX() has been purged, node left! 19:17:00 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r0, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) [ 946.528255][ T776] tipc: TX() has been purged, node left! [ 946.553928][ T776] tipc: TX() has been purged, node left! 19:17:00 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d0400000028", 0xf) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:17:00 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newtaction={0x64, 0x30, 0x1, 0x0, 0x0, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9, 0x1, 'mpls\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) 19:17:00 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) ioctl$TUNSETFILTEREBPF(r0, 0xc080661a, 0x0) 19:17:00 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) setsockopt$RDS_GET_MR(0xffffffffffffffff, 0x114, 0x2, 0x0, 0x0) ioctl$FITRIM(r1, 0x40305839, &(0x7f0000000100)={0x0, 0x0, 0x2be20000}) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) 19:17:00 executing program 5: r0 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r0, &(0x7f0000000040)={{0x3, @null, 0x1}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @bcast]}, 0x48) 19:17:00 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) 19:17:00 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d0400000028", 0xf) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:17:00 executing program 0: r0 = socket$kcm(0x29, 0x1000000000002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_user\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuacct.usage_user\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000040)=ANY=[@ANYRESOCT], 0x17) sendfile(r0, r1, 0x0, 0x7fffffff) sendmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000100)="dd", 0x1}], 0x1}, 0x0) [ 947.076066][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:17:00 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x14, 0x0, 0x3, 0x11}, 0x14}}, 0x0) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfd53) splice(r1, 0x0, r0, 0x0, 0x400000, 0x0) [ 947.145872][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 947.154031][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:17:00 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mmap(&(0x7f0000000000/0xfda000)=nil, 0xfda000, 0x6, 0x8000031, 0xffffffffffffffff, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x10, 0xffffffffffffffff, 0x0) getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f00000022c0)=""/4086, &(0x7f0000000000)=0xff6) 19:17:00 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d0400000028", 0xf) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:17:01 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r0, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:17:01 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000001d40)={0x0, 0x0, &(0x7f0000001d00)={&(0x7f0000001740)={0x20, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8}]}]}, 0x20}}, 0x0) 19:17:01 executing program 5: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="d651311e022196b0558901008000000000003a918faff6917dc62a790df1c3b934f1275e5d1445295b1b2b615924fd44132f6832485b7529e212e4f7c87b9d4cae687a52ec6e9e0443"], 0xa) close(r2) r3 = socket(0x10, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) write(0xffffffffffffffff, &(0x7f0000000180)="2000008012005f", 0x7) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000380)="f98ac693ce6908", 0x7}], 0x1) accept4$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000180)=0x2cd, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) 19:17:01 executing program 4: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x7f}, 0x10) ioctl$int_in(r0, 0x5421, &(0x7f00000000c0)=0x7fc) connect$llc(r0, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:17:01 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) 19:17:01 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x44, 0x31, 0x501, 0x0, 0x0, {}, [{0x30, 0x1, [@m_bpf={0x2c, 0x1, 0x0, 0x0, {{0x8, 0x1, 'bpf\x00'}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x44}}, 0x0) 19:17:01 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(0xffffffffffffffff, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:17:01 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61124c000000000061138c0000000000bf200000000000001703000040420f002d0301000000000095000000000000006916000000000000bf67000000000000560700000fff06006706000002000000070600000ee60000bf050000000000000f650000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad43010000000000950000000000000005000000000000009500000000000000022a4f0432631c31f660fff44c5c702520eca2fea093d9adcc1be5441b59b3e4ec2cababdfa556910ab5e7a182c3658d0e4a4857cb0311beac15a2aca70ec8d472d25654526c003a23b5099953c6959cf7048c184ab35338bd251c8d7027bc969b8b91a819a38a0ab4567228574822035259b0ffd625e0c760e749bcdc34ffe19b72cabaccdee1da4e3fac3e283bcbe096ebc9fda15a2ff0ad598207f1a0f6a16305f61ae517f1e23e646c64ae0d2d3d5a2c2c5e2e5a2162fa49d34708d057622a4b7f7967990847eb17dd5995c83b"], &(0x7f0000000100)='GPL\x00'}, 0x48) 19:17:01 executing program 5: sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="c00000000001190500000300480000000a0000003c0001002c0001001400030016f8bad33edad6b8000000000000000014000400fe8000000000000000000000000000bb0c00020005000100000000003c0002000c00020005000100000000002c00010014000300fe88000000000000000000000000000114000400ff01000000000000000000000000000108000700000000002c000d001400"], 0xc0}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETCHAIN(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x8}, 0x0) 19:17:01 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000100)={0x0, {0x2, 0x0, @dev={0xac, 0x14, 0x63}}, {0x2, 0x0, @remote}, {0x2, 0x0, @remote}, 0x1b6}) 19:17:01 executing program 4: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f0000000040)=0xffffffff, 0x4) 19:17:01 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(0xffffffffffffffff, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 948.105958][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 948.131577][T32494] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. [ 948.218854][T32497] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. [ 948.291719][T32499] tipc: Trying to set illegal importance in message 19:17:02 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r0, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:17:02 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) listen(r2, 0x0) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) 19:17:02 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) poll(&(0x7f0000000180)=[{}], 0x1, 0x80) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) 19:17:02 executing program 5: ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x6}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000140), &(0x7f0000000180)={0x8, 0x0, 0x0, 0x0, 0x7, 0x8}, 0x0, &(0x7f0000000240)={0x0, r0+10000000}, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000a80)='mptcp_pm\x00') 19:17:02 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=@newsa={0x154, 0x10, 0x713, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in6=@mcast2, 0x0, 0x32}, @in=@multicast2, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @encap={0x1c, 0x4, {0x0, 0x0, 0x0, @in=@local}}]}, 0x154}}, 0x0) 19:17:02 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(0xffffffffffffffff, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:17:02 executing program 5: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001540)={r0, 0xc0, &(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) 19:17:02 executing program 4: setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000001e80)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x7c774aac) mmap(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0xc, 0x2011, r0, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x161ef000) 19:17:02 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x32, 0xfdca) connect$inet(r0, &(0x7f0000000440)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x400000000000695, 0x0) sendmmsg(r0, &(0x7f0000000540), 0x187, 0x0) 19:17:02 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:17:02 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r0, &(0x7f00000031c0)=[{{&(0x7f00000008c0)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, 0x0}}], 0x1, 0x10040, 0x0) 19:17:02 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) [ 949.139459][ T28] kauditd_printk_skb: 42 callbacks suppressed [ 949.139476][ T28] audit: type=1804 audit(1601752622.699:591): pid=32534 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/733/memory.events" dev="sda1" ino=16368 res=1 errno=0 [ 949.155150][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 949.329983][ T28] audit: type=1800 audit(1601752622.699:592): pid=32534 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16368 res=0 errno=0 [ 949.477853][ T28] audit: type=1804 audit(1601752622.749:593): pid=32534 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/733/memory.events" dev="sda1" ino=16368 res=1 errno=0 19:17:03 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$rds(0x15, 0x5, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:17:03 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:17:03 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x20200, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0xd, r2}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) 19:17:03 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000100)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = socket(0x0, 0x2, 0x0) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, 0x0) socket(0x40000000015, 0x5, 0x0) close(0xffffffffffffffff) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x4000000000000, 0x60, &(0x7f0000000540)=@raw={'raw\x00', 0x2, 0x3, 0x1f8, 0xd0, 0x0, 0xd0, 0x0, 0x0, 0x188, 0x188, 0x188, 0x188, 0x188, 0x3, 0x0, {[{{@ip={@local, @multicast1, 0x0, 0x0, 'veth1_to_team\x00', 'veth1_to_bond\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @dev}}}, {{@uncond, 0x0, 0x70, 0x90}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x258) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000000706010341d43a87587cff000100e9000500010047"], 0x1}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r4, r1, 0x0, 0x100000001) [ 949.706779][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 949.717719][ T2546] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 949.834097][ T28] audit: type=1804 audit(1601752623.389:594): pid=32556 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/734/memory.events" dev="sda1" ino=16379 res=1 errno=0 19:17:03 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) 19:17:03 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 950.031091][T32555] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 950.066637][ T28] audit: type=1800 audit(1601752623.429:595): pid=32556 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16379 res=0 errno=0 19:17:03 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) [ 950.194235][T32555] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 950.267646][ T28] audit: type=1804 audit(1601752623.429:596): pid=32553 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/734/memory.events" dev="sda1" ino=16379 res=1 errno=0 [ 950.293843][T32555] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 950.451017][ T28] audit: type=1804 audit(1601752623.429:597): pid=32557 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir158342096/syzkaller.sp5NJA/504/cgroup.controllers" dev="sda1" ino=16381 res=1 errno=0 19:17:04 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000380)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) r1 = socket$inet6(0xa, 0x3, 0x6) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80}, {0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0x1}, {{@in=@remote, 0x0, 0x33}, 0x0, @in=@broadcast, 0x0, 0x0, 0x0, 0x6}}, 0xe8) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0xe808) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f00000000c0)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, {0x0, @in6={{0xa, 0x0, 0x0, @loopback}}}}, &(0x7f0000000180)=0xb0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_STATUS(r5, 0x84, 0xe, &(0x7f00000000c0)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in6={{0xa, 0x0, 0x0, @loopback}}}}, &(0x7f0000000180)=0xb0) getsockopt$inet_sctp6_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f00000000c0)={r4, 0xbe, 0x49, 0x3ff, 0x2, 0x4, 0x0, 0x806, {r4, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x7, 0x0}}}, 0xfffffff8, 0x10001, 0x0, 0xffffffff, 0x3}}, &(0x7f0000000180)=0xb0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000000)={r4, 0x5, "21cc25da2f"}, &(0x7f0000000040)=0xd) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000080)={r8, 0x465}, &(0x7f00000000c0)=0x8) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 950.511677][T32555] rdma_rxe: ignoring netdev event = 30 for virt_wifi0 [ 950.665392][ C0] net_ratelimit: 1 callbacks suppressed [ 950.665431][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 950.695640][ T28] audit: type=1804 audit(1601752623.939:598): pid=32568 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/735/memory.events" dev="sda1" ino=16379 res=1 errno=0 [ 950.748833][T10403] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 950.788053][T32575] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 950.860828][T32575] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 950.928297][ T28] audit: type=1800 audit(1601752623.939:599): pid=32568 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16379 res=0 errno=0 [ 950.932264][T32575] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 19:17:04 executing program 0: r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8, 0x1, 'cbs\x00'}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x7}}}}]}, 0x48}}, 0x0) 19:17:04 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(0xffffffffffffffff, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:17:04 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:17:04 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) [ 951.043810][ T28] audit: type=1804 audit(1601752623.949:600): pid=32568 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/735/memory.events" dev="sda1" ino=16379 res=1 errno=0 [ 951.195086][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:17:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x0, 0x0, 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x24, r1, 0xc15, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) sendmsg$alg(0xffffffffffffffff, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xd86dac9, 0x0) getsockname$tipc(0xffffffffffffffff, &(0x7f0000000000)=@id, &(0x7f0000000080)=0x10) 19:17:04 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [r0]}}], 0x18}], 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:17:04 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(0xffffffffffffffff, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:17:05 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000640)=ANY=[@ANYBLOB="2000000011000d040000000a0000000000000000", @ANYRES32=r3], 0x20}}, 0x0) 19:17:05 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000140)="390000001100090468fe0700000000000700ff3f0800000045000e070000001419001a00", 0x24}], 0x1) write$binfmt_misc(r1, &(0x7f0000000080)=ANY=[@ANYRES16=r2, @ANYBLOB="0219f6db"], 0x15) splice(r0, 0x0, r2, 0x0, 0x19404, 0x0) [ 951.465261][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:17:05 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) listen(r2, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) 19:17:05 executing program 1: sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}], 0x1, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r0, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:17:05 executing program 5: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b80)={0x18, 0x6, &(0x7f0000000980)=@framed={{}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @func, @func]}, &(0x7f0000000a00)='GPL\x00', 0x7, 0xba, &(0x7f0000000a40)=""/186, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 951.660616][T32607] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 19:17:05 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(0xffffffffffffffff, &(0x7f00000004c0)=[{0x0}, {0x0}, {&(0x7f0000000200)="db", 0xfffff000}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 951.785361][ T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 951.870615][T32610] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 19:17:05 executing program 0: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000000340)=[{{&(0x7f00000000c0)={0xa, 0x4e21, 0x0, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000000500)=[@dstopts={{0x18}}], 0x18}}], 0x1, 0x0) 19:17:05 executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x18, 0x0, 0x0) 19:17:05 executing program 1: sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}], 0x1, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r0, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:17:05 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0xffffffbc, 0x10}, [@ldst={0x7, 0xff05, 0x0, 0x0, 0xa}]}, &(0x7f0000003ff6)='GPL\x00', 0x1, 0xff06, &(0x7f000000cf3d)=""/195, 0x0, 0xa}, 0x48) 19:17:05 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) listen(r2, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) 19:17:05 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, 0x0, 0x0, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:17:05 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}]}, 0x34}}, 0x0) 19:17:05 executing program 5: sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000001600ff21"], 0x2c}}, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000000c0)={0x7ff}, 0x10) sendmmsg$alg(r0, &(0x7f0000000140), 0x4924b68, 0x0) [ 952.266015][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 952.293051][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:17:06 executing program 1: sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003f40)=[{&(0x7f0000000040)=@abs, 0x6e, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}], 0x1, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r0, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:17:06 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, 0x0, 0x0, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:17:06 executing program 4: r0 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) connect$ax25(r0, &(0x7f0000000040)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}}, [@null, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) 19:17:06 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket(0xa, 0x6, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gtp={{0x8, 0x1, 'gtp\x00'}, {0x1c, 0x2, 0x0, 0x1, {{0x8}, {0x8}, [@IFLA_GTP_FD1={0x8, 0x2, r1}]}}}}]}, 0x48}}, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)={0x60, r2, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @dev}}}}]}]}, 0x60}}, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='wg0\x00', 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x400000000000075, 0x0) [ 952.537939][T32654] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. 19:17:06 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) r2 = socket(0x1e, 0x5, 0x0) listen(r2, 0x0) close(r2) getsockname$packet(r2, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) 19:17:06 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f00000006c0)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r0, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) 19:17:06 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, 0x0, 0x0, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 952.835497][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 19:17:06 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}], 0x2, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:17:06 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) close(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) 19:17:07 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}], 0x2, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) 19:17:07 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}], 0x2, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 953.963837][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 953.979766][T32666] tipc: Enabling of bearer rejected, failed to enable media [ 954.017446][T32676] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. 19:17:07 executing program 5: r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f00000000c0)={0x12, 0xc, 0x8, 0x4, 0x0, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x40) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000480)={r0, &(0x7f0000000100), &(0x7f00000004c0)=@udp6=r1}, 0x20) 19:17:07 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000040), 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xc7) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x61bd, 0x1c2dc0000}) pwritev(r0, &(0x7f0000000280)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0, 0x0) write$cgroup_int(r0, &(0x7f0000000300), 0xfffffe8c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x24ba1dc0, 0x47ff}) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) close(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$PNPIPE_ENCAP(0xffffffffffffffff, 0x113, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$BTRFS_IOC_SCRUB(0xffffffffffffffff, 0xc400941b, &(0x7f0000000500)={0x0, 0x3, 0x5, 0x1}) 19:17:07 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r2 = accept$alg(r1, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r3, &(0x7f00000004c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x8040000, 0x0) sendfile(r2, r0, 0x0, 0x8000f800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 954.452317][ T28] kauditd_printk_skb: 36 callbacks suppressed [ 954.452334][ T28] audit: type=1804 audit(1601752628.009:637): pid=32704 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/745/memory.events" dev="sda1" ino=16374 res=1 errno=0 [ 954.599952][ T28] audit: type=1800 audit(1601752628.059:638): pid=32704 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16374 res=0 errno=0 [ 954.745149][ T28] audit: type=1804 audit(1601752628.069:639): pid=32704 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/745/memory.events" dev="sda1" ino=16374 res=1 errno=0 [ 954.830080][ T311] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 954.895962][ T28] audit: type=1804 audit(1601752628.079:640): pid=32704 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir961098157/syzkaller.rhFnHZ/745/memory.events" dev="sda1" ino=16374 res=1 errno=0 [ 955.865918][ T2473] net_ratelimit: 3 callbacks suppressed [ 955.865928][ T2473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 956.671699][ T776] tipc: TX() has been purged, node left! [ 956.905334][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 957.965774][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 958.025817][ T21] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 958.034799][ T21] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 958.053653][T32718] IPVS: ftp: loaded support on port[0] = 21 [ 958.231501][T32718] virt_wifi0 speed is unknown, defaulting to 1000 [ 958.474971][T32718] virt_wifi0 speed is unknown, defaulting to 1000 [ 958.872016][T32718] chnl_net:caif_netlink_parms(): no params data found [ 958.985139][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 959.020709][T32718] bridge0: port 1(bridge_slave_0) entered blocking state [ 959.045016][T32718] bridge0: port 1(bridge_slave_0) entered disabled state [ 959.054041][T32718] device bridge_slave_0 entered promiscuous mode [ 959.067866][T32718] bridge0: port 2(bridge_slave_1) entered blocking state [ 959.084935][T32718] bridge0: port 2(bridge_slave_1) entered disabled state [ 959.095543][T32718] device bridge_slave_1 entered promiscuous mode [ 959.130544][T32718] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 959.143241][ T776] device bridge_slave_0 left promiscuous mode [ 959.179869][ T776] bridge242: port 1(bridge_slave_0) entered disabled state [ 959.371900][ T776] device hsr_slave_0 left promiscuous mode [ 959.378755][ T776] device hsr_slave_1 left promiscuous mode [ 959.387823][ T776] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 959.397011][ T776] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 959.407623][ T776] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 959.415644][ T776] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 959.428994][ T776] device bridge_slave_1 left promiscuous mode [ 959.437359][ T776] bridge0: port 2(bridge_slave_1) entered disabled state [ 959.466154][ T776] device bridge4 left promiscuous mode [ 959.474423][ T776] device veth1_macvtap left promiscuous mode [ 959.481589][ T776] device veth0_macvtap left promiscuous mode [ 959.502017][ T776] device veth1_vlan left promiscuous mode [ 959.509071][ T776] device veth0_vlan left promiscuous mode [ 959.949195][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 959.959265][T11033] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 959.968801][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 960.025366][T11033] Bluetooth: hci4: command 0x0409 tx timeout [ 960.985430][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 962.025477][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 962.105120][T10401] Bluetooth: hci4: command 0x041b tx timeout [ 963.065422][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 963.075168][ T311] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 963.785718][ T38] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 964.105316][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 964.185119][T10401] Bluetooth: hci4: command 0x040f tx timeout [ 965.146888][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 965.706985][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 965.727562][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 965.739596][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 966.265099][ T2642] Bluetooth: hci4: command 0x0419 tx timeout [ 966.745454][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 967.785118][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 968.273409][ T38] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 968.825347][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 969.555954][ T21] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 969.865978][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 970.905724][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 971.466920][ T311] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 971.476499][T11211] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 971.489033][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 972.505462][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 973.385970][ T38] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 973.545487][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 974.585201][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 974.665553][T11033] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 975.316157][ T6840] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 975.625657][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 976.665522][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 977.710166][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 978.745153][ T2642] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 979.146031][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 979.785262][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 980.346031][ T117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 980.512982][ T776] bond5 (unregistering): Released all slaves [ 980.569355][ T776] bond4 (unregistering): (slave veth5): Releasing backup interface [ 980.582463][ T776] bond4 (unregistering): (slave vlan2): Releasing backup interface [ 980.649546][ T776] bond4 (unregistering): (slave veth3): Releasing backup interface [ 980.667842][ T776] bond4 (unregistering): Released all slaves [ 980.680933][ T776] bond3 (unregistering): (slave bridge3): Releasing backup interface [ 980.689194][ T776] device bridge3 left promiscuous mode [ 980.727640][ T776] bond3 (unregistering): Released all slaves [ 980.745120][ T776] bond2 (unregistering): (slave bridge2): Releasing backup interface [ 980.753306][ T776] device bridge2 left promiscuous mode [ 980.788900][ T776] bond2 (unregistering): Released all slaves [ 980.798727][ T776] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 980.807761][ T776] device bridge1 left promiscuous mode [ 980.825143][T10401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 980.849494][ T776] bond1 (unregistering): Released all slaves [ 980.907685][ T6840] smc: removing ib device syz1 [ 980.952217][ T6840] ------------[ cut here ]------------ [ 980.983557][ T6840] sysfs group 'power' not found for kobject 'uverbs0' [ 981.001023][ T6840] WARNING: CPU: 1 PID: 6840 at fs/sysfs/group.c:279 sysfs_remove_group+0x126/0x170 [ 981.014067][ T6840] Kernel panic - not syncing: panic_on_warn set ... [ 981.020674][ T6840] CPU: 1 PID: 6840 Comm: kworker/u4:7 Not tainted 5.9.0-rc7-syzkaller #0 [ 981.029088][ T6840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 981.039233][ T6840] Workqueue: events_unbound ib_unregister_work [ 981.045442][ T6840] Call Trace: [ 981.048772][ T6840] dump_stack+0x198/0x1fd [ 981.053110][ T6840] panic+0x382/0x7fb [ 981.057009][ T6840] ? __warn_printk+0xf3/0xf3 [ 981.061615][ T6840] ? __warn.cold+0x5/0x4b [ 981.065954][ T6840] ? __warn+0xd6/0x1f2 [ 981.070028][ T6840] ? sysfs_remove_group+0x126/0x170 [ 981.075229][ T6840] __warn.cold+0x20/0x4b [ 981.079481][ T6840] ? sysfs_remove_group+0x126/0x170 [ 981.084698][ T6840] report_bug+0x1bd/0x210 [ 981.089116][ T6840] handle_bug+0x38/0x90 [ 981.093280][ T6840] ? __warn_printk+0xc6/0xf3 [ 981.097873][ T6840] exc_invalid_op+0x14/0x40 [ 981.102452][ T6840] asm_exc_invalid_op+0x12/0x20 [ 981.107314][ T6840] RIP: 0010:sysfs_remove_group+0x126/0x170 [ 981.113122][ T6840] Code: 48 89 d9 49 8b 14 24 48 b8 00 00 00 00 00 fc ff df 48 c1 e9 03 80 3c 01 00 75 37 48 8b 33 48 c7 c7 00 fa 9a 88 e8 dc c0 59 ff <0f> 0b eb 98 e8 41 5a ca ff e9 01 ff ff ff 48 89 df e8 34 5a ca ff [ 981.132735][ T6840] RSP: 0018:ffffc900055d7a90 EFLAGS: 00010282 [ 981.138805][ T6840] RAX: 0000000000000000 RBX: ffffffff88f9bac0 RCX: 0000000000000000 [ 981.146783][ T6840] RDX: ffff8880a51965c0 RSI: ffffffff815f59d5 RDI: fffff52000abaf44 [ 981.154762][ T6840] RBP: 0000000000000000 R08: 0000000000000001 R09: ffff8880ae5318e7 [ 981.162741][ T6840] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888054452060 [ 981.170716][ T6840] R13: ffffffff88f9c060 R14: ffff88804b2ac5a8 R15: ffffffff8af43bc0 [ 981.178717][ T6840] ? vprintk_func+0x95/0x1d4 [ 981.183431][ T6840] ? ib_uverbs_close+0x2a0/0x2a0 [ 981.188414][ T6840] dpm_sysfs_remove+0x97/0xb0 [ 981.193147][ T6840] device_del+0x18b/0xd90 [ 981.197492][ T6840] ? device_link_add_missing_supplier_links+0x370/0x370 [ 981.204795][ T6840] ? ib_uverbs_close+0x2a0/0x2a0 [ 981.209738][ T6840] cdev_device_del+0x19/0x100 [ 981.214419][ T6840] ib_uverbs_remove_one+0x33/0x4f0 [ 981.219534][ T6840] ? remove_client_context+0xbe/0x110 [ 981.224969][ T6840] ? lockdep_hardirqs_on+0x53/0x100 [ 981.230173][ T6840] ? ib_uverbs_close+0x2a0/0x2a0 [ 981.235113][ T6840] remove_client_context+0xbe/0x110 [ 981.240317][ T6840] disable_device+0x13b/0x270 [ 981.245002][ T6840] ? add_client_context+0x5e0/0x5e0 [ 981.250205][ T6840] ? do_raw_spin_lock+0x120/0x2b0 [ 981.255243][ T6840] __ib_unregister_device+0x91/0x1a0 [ 981.260532][ T6840] ib_unregister_work+0x15/0x30 [ 981.265412][ T6840] process_one_work+0x94c/0x1670 [ 981.270363][ T6840] ? lock_release+0x8f0/0x8f0 [ 981.275061][ T6840] ? pwq_dec_nr_in_flight+0x320/0x320 [ 981.280439][ T6840] ? rwlock_bug.part.0+0x90/0x90 [ 981.285384][ T6840] ? lockdep_hardirqs_off+0x96/0xd0 [ 981.290595][ T6840] worker_thread+0x64c/0x1120 [ 981.295286][ T6840] ? __kthread_parkme+0x13f/0x1e0 [ 981.300314][ T6840] ? process_one_work+0x1670/0x1670 [ 981.306649][ T6840] kthread+0x3b5/0x4a0 [ 981.310734][ T6840] ? __kthread_bind_mask+0xc0/0xc0 [ 981.315852][ T6840] ret_from_fork+0x1f/0x30 [ 981.321851][ T6840] Kernel Offset: disabled [ 981.326365][ T6840] Rebooting in 86400 seconds..