[ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty1. [ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.10.32' (ECDSA) to the list of known hosts. 2020/05/22 16:03:25 fuzzer started 2020/05/22 16:03:25 dialing manager at 10.128.0.26:38661 2020/05/22 16:03:25 syscalls: 3055 2020/05/22 16:03:25 code coverage: enabled 2020/05/22 16:03:25 comparison tracing: enabled 2020/05/22 16:03:25 extra coverage: enabled 2020/05/22 16:03:25 setuid sandbox: enabled 2020/05/22 16:03:25 namespace sandbox: enabled 2020/05/22 16:03:25 Android sandbox: /sys/fs/selinux/policy does not exist 2020/05/22 16:03:25 fault injection: enabled 2020/05/22 16:03:25 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2020/05/22 16:03:25 net packet injection: enabled 2020/05/22 16:03:25 net device setup: enabled 2020/05/22 16:03:25 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2020/05/22 16:03:25 devlink PCI setup: PCI device 0000:00:10.0 is not available 2020/05/22 16:03:25 USB emulation: enabled 16:03:52 executing program 0: mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}]}, @IFLA_GROUP={0x8}, @IFLA_GSO_MAX_SIZE={0x8}, @IFLA_IFALIAS={0x14, 0x14, 'bond_slave_0\x00'}]}, 0x50}}, 0x84) syzkaller login: [ 82.610463][ T6828] IPVS: ftp: loaded support on port[0] = 21 16:03:52 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'wp256\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00') sendfile(r1, r2, 0x0, 0x1000007ffff000) [ 82.782120][ T6828] chnl_net:caif_netlink_parms(): no params data found [ 82.939153][ T6828] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.949029][ T6828] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.960304][ T6828] device bridge_slave_0 entered promiscuous mode [ 82.980720][ T6828] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.991419][ T6948] IPVS: ftp: loaded support on port[0] = 21 [ 82.999103][ T6828] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.017132][ T6828] device bridge_slave_1 entered promiscuous mode [ 83.077220][ T6828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.093206][ T6828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 16:03:52 executing program 2: socket(0x40000000002, 0x3, 0x2) recvmmsg(0xffffffffffffffff, &(0x7f0000007d80)=[{{0x0, 0x0, &(0x7f0000003340)=[{&(0x7f00000011c0)=""/34, 0x22}], 0x1}}], 0x1, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/raw\x00') preadv(r2, &(0x7f00000017c0), 0x3da, 0x600) [ 83.152032][ T6828] team0: Port device team_slave_0 added [ 83.164644][ T6828] team0: Port device team_slave_1 added [ 83.229813][ T6828] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.245516][ T6828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.305337][ T6828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.389478][ T6828] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.400396][ T6828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.430339][ T6828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.457912][ T6948] chnl_net:caif_netlink_parms(): no params data found [ 83.490162][ T7010] IPVS: ftp: loaded support on port[0] = 21 16:03:53 executing program 3: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x0, 0x0, 0x0, 0x0, 0x0) keyctl$get_security(0x11, r0, &(0x7f0000000000)=""/98, 0x62) [ 83.530373][ T6828] device hsr_slave_0 entered promiscuous mode [ 83.576861][ T6828] device hsr_slave_1 entered promiscuous mode [ 83.829864][ T6948] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.856013][ T6948] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.863644][ T6948] device bridge_slave_0 entered promiscuous mode 16:03:53 executing program 4: r0 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r0) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000200)="0f34", 0x2}], 0x1, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000000c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x2a}) ptrace$setopts(0x4206, r1, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000140)=""/71, 0x47}], 0x3, 0x0, 0x0, 0x0) tkill(r1, 0x3c) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) [ 83.901499][ T7140] IPVS: ftp: loaded support on port[0] = 21 [ 83.911523][ T6948] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.935874][ T6948] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.943565][ T6948] device bridge_slave_1 entered promiscuous mode [ 84.122178][ T6948] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.197161][ T6948] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.316033][ T7010] chnl_net:caif_netlink_parms(): no params data found 16:03:54 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000040)={0x20, r3, 0x703, 0x0, 0x0, {}, [@ETHTOOL_A_STRSET_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x20}}, 0x0) [ 84.370488][ T6948] team0: Port device team_slave_0 added [ 84.414964][ T6948] team0: Port device team_slave_1 added [ 84.494607][ T6948] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.503177][ T6948] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.532871][ T6948] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.596099][ T6948] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.599500][ T7327] IPVS: ftp: loaded support on port[0] = 21 [ 84.603060][ T6948] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.635089][ T6948] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.649666][ T6828] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 84.654684][ T7297] IPVS: ftp: loaded support on port[0] = 21 [ 84.732693][ T6828] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 84.831143][ T6828] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 84.861460][ T6828] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 84.939806][ T7010] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.948328][ T7010] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.959188][ T7010] device bridge_slave_0 entered promiscuous mode [ 84.971395][ T7010] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.979102][ T7010] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.988324][ T7010] device bridge_slave_1 entered promiscuous mode [ 85.009485][ T7140] chnl_net:caif_netlink_parms(): no params data found [ 85.070603][ T6948] device hsr_slave_0 entered promiscuous mode [ 85.125844][ T6948] device hsr_slave_1 entered promiscuous mode [ 85.185634][ T6948] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 85.193369][ T6948] Cannot create hsr debugfs directory [ 85.250866][ T7010] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.301736][ T7010] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.383842][ T7010] team0: Port device team_slave_0 added [ 85.486941][ T7010] team0: Port device team_slave_1 added [ 85.543521][ T7010] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.551189][ T7010] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.579152][ T7010] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.592189][ T7010] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.600068][ T7010] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.627585][ T7010] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.643065][ T7327] chnl_net:caif_netlink_parms(): no params data found [ 85.652581][ T7140] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.660174][ T7140] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.668298][ T7140] device bridge_slave_0 entered promiscuous mode [ 85.748441][ T7010] device hsr_slave_0 entered promiscuous mode [ 85.765630][ T7010] device hsr_slave_1 entered promiscuous mode [ 85.825529][ T7010] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 85.833116][ T7010] Cannot create hsr debugfs directory [ 85.839969][ T7140] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.847290][ T7140] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.855423][ T7140] device bridge_slave_1 entered promiscuous mode [ 86.030513][ T7140] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.097231][ T7140] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.122793][ T7297] chnl_net:caif_netlink_parms(): no params data found [ 86.140187][ T7327] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.153303][ T7327] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.162282][ T7327] device bridge_slave_0 entered promiscuous mode [ 86.211316][ T7327] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.218705][ T7327] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.227599][ T7327] device bridge_slave_1 entered promiscuous mode [ 86.284068][ T7140] team0: Port device team_slave_0 added [ 86.314101][ T6948] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 86.390227][ T7327] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.401772][ T7140] team0: Port device team_slave_1 added [ 86.417328][ T6948] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 86.479004][ T7327] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.504628][ T7140] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.512751][ T7140] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.538709][ T7140] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.560212][ T6948] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 86.631703][ T6828] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.640327][ T7140] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.647561][ T7140] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.673535][ T7140] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.710424][ T6948] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 86.817977][ T7140] device hsr_slave_0 entered promiscuous mode [ 86.865693][ T7140] device hsr_slave_1 entered promiscuous mode [ 86.905278][ T7140] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.912931][ T7140] Cannot create hsr debugfs directory [ 86.928349][ T7297] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.936233][ T7297] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.943929][ T7297] device bridge_slave_0 entered promiscuous mode [ 86.954483][ T7297] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.962711][ T7297] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.971668][ T7297] device bridge_slave_1 entered promiscuous mode [ 86.981787][ T7327] team0: Port device team_slave_0 added [ 87.020004][ T6828] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.031129][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 87.041035][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.074813][ T7327] team0: Port device team_slave_1 added [ 87.093091][ T7297] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.136603][ T7327] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.143559][ T7327] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.171442][ T7327] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.185856][ T7297] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.194983][ T7010] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 87.239734][ T7010] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 87.300809][ T7010] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 87.361469][ T7010] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 87.410998][ T7327] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.418404][ T7327] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.444520][ T7327] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.484765][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 87.495988][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 87.504467][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.511661][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.520736][ T2489] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 87.609256][ T7327] device hsr_slave_0 entered promiscuous mode [ 87.676242][ T7327] device hsr_slave_1 entered promiscuous mode [ 87.715321][ T7327] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 87.722901][ T7327] Cannot create hsr debugfs directory [ 87.791515][ T7297] team0: Port device team_slave_0 added [ 87.799646][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 87.812135][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 87.821347][ T2519] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.828474][ T2519] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.842724][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 87.881967][ T7297] team0: Port device team_slave_1 added [ 87.914767][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 87.991532][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 88.008310][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 88.021230][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 88.030726][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 88.039483][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 88.048083][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 88.056344][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 88.064720][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 88.076967][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 88.113458][ T7297] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.121845][ T7297] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.148909][ T7297] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.163457][ T7297] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.171675][ T7297] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.200392][ T7297] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.349250][ T7297] device hsr_slave_0 entered promiscuous mode [ 88.425625][ T7297] device hsr_slave_1 entered promiscuous mode [ 88.465275][ T7297] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 88.472833][ T7297] Cannot create hsr debugfs directory [ 88.497964][ T7140] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 88.537531][ T7140] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 88.652177][ T7140] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 88.689600][ T7140] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 88.812815][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 88.820783][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 88.834366][ T6948] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.853070][ T7010] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.877830][ T6828] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.934996][ T6948] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.961384][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 88.970686][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 88.996707][ T7327] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 89.041876][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 89.050682][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 89.060017][ T2843] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.067178][ T2843] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.074712][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 89.083571][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 89.103567][ T7010] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.117443][ T7327] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 89.173402][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 89.182073][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 89.194389][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 89.204019][ T2843] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.211212][ T2843] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.219619][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 89.228533][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 89.248354][ T7327] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 89.307782][ T7327] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 89.367556][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 89.377102][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 89.401318][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 89.410896][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 89.419805][ T2526] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.426927][ T2526] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.447436][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 89.487497][ T7140] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.525708][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 89.534542][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 89.544593][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 89.553765][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 89.562700][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 89.572014][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 89.581108][ T2519] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.588263][ T2519] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.596291][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 89.604543][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 89.613060][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 89.621522][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 89.669593][ T6948] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 89.684258][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 89.692485][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 89.702417][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 89.710812][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 89.719248][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 89.728331][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 89.737728][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 89.748889][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 89.758290][ T7140] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.766848][ T6828] device veth0_vlan entered promiscuous mode [ 89.824902][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 89.833983][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 89.841968][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 89.851509][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 89.860742][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 89.869516][ T3843] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.876644][ T3843] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.884203][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 89.893066][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 89.902499][ T7297] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 89.938431][ T7297] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 90.006939][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 90.015019][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 90.030214][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 90.039886][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 90.048789][ T2519] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.055911][ T2519] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.069429][ T6828] device veth1_vlan entered promiscuous mode [ 90.081140][ T7297] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 90.144947][ T6948] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.163848][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 90.174119][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 90.183036][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 90.191891][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 90.200928][ T7297] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 90.276057][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 90.284114][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 90.293539][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 90.302979][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 90.311861][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 90.320915][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 90.337009][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 90.357952][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 90.366874][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 90.408706][ T7010] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 90.431499][ T7327] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.443404][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 90.452348][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 90.461434][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 90.470330][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 90.498995][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 90.509425][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 90.519997][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 90.530683][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 90.573208][ T7140] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 90.591485][ T7140] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 90.614612][ T7327] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.641566][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 90.650404][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 90.660605][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 90.669024][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 90.678877][ T6828] device veth0_macvtap entered promiscuous mode [ 90.707239][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 90.717181][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 90.725038][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 90.753972][ T6828] device veth1_macvtap entered promiscuous mode [ 90.779690][ T7010] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.790336][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 90.799813][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 90.809152][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 90.819163][ T2526] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.826315][ T2526] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.834006][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 90.843554][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 90.852326][ T2526] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.859568][ T2526] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.867591][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 90.876311][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 90.884797][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 90.892627][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 90.914849][ T7140] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.943955][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 90.952434][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 90.962030][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 90.971730][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 90.981475][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 90.997924][ T6948] device veth0_vlan entered promiscuous mode [ 91.046500][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 91.060225][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 91.068827][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 91.081858][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 91.090686][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 91.103121][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 91.133131][ T6948] device veth1_vlan entered promiscuous mode [ 91.160033][ T6828] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.170631][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 91.180017][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 91.191146][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 91.201405][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 91.212754][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 91.222427][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 91.241834][ T7327] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 91.255858][ T7327] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 91.265829][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 91.274306][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 91.289809][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 91.301382][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 91.319713][ T6828] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.340268][ T7297] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.348381][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 91.364222][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 91.373105][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 91.386472][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 91.398413][ T7010] device veth0_vlan entered promiscuous mode [ 91.453912][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 91.466172][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 91.474054][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 91.486382][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 91.544304][ T7327] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.564422][ T7140] device veth0_vlan entered promiscuous mode [ 91.573180][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 91.583316][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 91.593175][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 91.602117][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 91.613386][ T7297] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.627636][ T7010] device veth1_vlan entered promiscuous mode [ 91.732895][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 91.744958][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 91.769045][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 91.796013][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 91.817422][ C1] hrtimer: interrupt took 37750 ns [ 91.834432][ T6948] device veth0_macvtap entered promiscuous mode [ 91.856820][ T7140] device veth1_vlan entered promiscuous mode [ 91.885934][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 91.894484][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 91.905826][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 91.914462][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 91.924592][ T2843] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.931751][ T2843] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.940374][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 92.026524][ T8084] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 92.130120][ T8084] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 92.148787][ T8084] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 16:04:02 executing program 0: mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}]}, @IFLA_GROUP={0x8}, @IFLA_GSO_MAX_SIZE={0x8}, @IFLA_IFALIAS={0x14, 0x14, 'bond_slave_0\x00'}]}, 0x50}}, 0x84) [ 92.582760][ T6948] device veth1_macvtap entered promiscuous mode [ 92.611060][ T2489] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 92.624205][ T2489] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 92.643130][ T2489] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 92.668335][ T2489] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 92.684274][ T2489] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.691490][ T2489] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.700065][ T2489] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 92.728446][ T7010] device veth0_macvtap entered promiscuous mode [ 92.844907][ T8094] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 92.942195][ T8094] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 92.966246][ T8094] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 93.429604][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 93.439920][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 93.449282][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 93.459268][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready 16:04:03 executing program 0: mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}]}, @IFLA_GROUP={0x8}, @IFLA_GSO_MAX_SIZE={0x8}, @IFLA_IFALIAS={0x14, 0x14, 'bond_slave_0\x00'}]}, 0x50}}, 0x84) [ 93.480620][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 93.490148][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 93.498639][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 93.510195][ T7010] device veth1_macvtap entered promiscuous mode [ 93.532961][ T6948] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 93.552862][ T6948] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.575736][ T6948] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.714327][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 93.847971][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 93.866800][ T8098] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 94.283579][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 94.292743][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 94.303091][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 94.312646][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 94.323107][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready 16:04:04 executing program 0: mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}]}, @IFLA_GROUP={0x8}, @IFLA_GSO_MAX_SIZE={0x8}, @IFLA_IFALIAS={0x14, 0x14, 'bond_slave_0\x00'}]}, 0x50}}, 0x84) [ 94.395375][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 94.407674][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 94.429192][ T6948] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 94.452905][ T6948] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 94.467635][ T6948] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.584592][ T8102] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 94.643356][ T8102] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 94.685637][ T8102] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 95.118308][ T7297] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 95.132642][ T7297] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 95.152578][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready 16:04:04 executing program 0: unshare(0x40000000) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xfe30) ioctl$RTC_PIE_ON(r1, 0x7005) r2 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000000)={0x0, r1}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETTXFILTER(r4, 0x400454d1, &(0x7f0000000040)={0x0, 0x1, [@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = fcntl$dupfd(r6, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$SNDCTL_DSP_GETFMTS(r7, 0x8004500b, &(0x7f0000000080)=0x8) setsockopt$inet6_MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000180)={0x2, 0x1, 0x0, 0x3, 0x2}, 0xc) [ 95.161743][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 95.182869][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 95.210155][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 95.221484][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 95.232743][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 95.248635][ T8106] IPVS: ftp: loaded support on port[0] = 21 [ 95.255467][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 95.271051][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 95.291451][ T7010] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 95.313806][ T7010] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.342480][ T7010] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 95.353197][ T7010] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.367282][ T7010] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.391494][ T7140] device veth0_macvtap entered promiscuous mode [ 95.467475][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 95.475925][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 95.484578][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 95.503230][ T7010] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 95.513919][ T7010] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.526930][ T7010] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 95.537427][ T7010] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 95.548691][ T7010] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.628406][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 95.637478][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 95.646976][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 95.658984][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 95.687682][ T7140] device veth1_macvtap entered promiscuous mode [ 95.700727][ T7327] device veth0_vlan entered promiscuous mode [ 95.710272][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 95.720540][ T2843] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 95.763117][ T7327] device veth1_vlan entered promiscuous mode [ 95.880181][ T7297] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.892425][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 95.905840][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 95.922616][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 95.938717][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 16:04:05 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'wp256\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00') sendfile(r1, r2, 0x0, 0x1000007ffff000) [ 96.023015][ T7140] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 96.056549][ T7140] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 96.069598][ T7140] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 96.106396][ T7140] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 96.127653][ T7140] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 96.150687][ T7140] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! 16:04:05 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'wp256\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00') sendfile(r1, r2, 0x0, 0x1000007ffff000) [ 96.176883][ T7140] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.223339][ T8106] IPVS: ftp: loaded support on port[0] = 21 [ 96.233518][ T7327] device veth0_macvtap entered promiscuous mode [ 96.262393][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready 16:04:06 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'wp256\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00') sendfile(r1, r2, 0x0, 0x1000007ffff000) [ 96.272480][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 96.292418][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 96.311045][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 96.369363][ T7140] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 96.406418][ T7140] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! 16:04:06 executing program 1: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0xffffffffffffffff, r1) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f00000003c0)={'syz', 0x3}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x4, r2, 0xffffffffffffffff, 0x0, 0x0) [ 96.438972][ T7140] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 96.455324][ T7140] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 96.465842][ T7140] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 96.535483][ T7140] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 96.574269][ T7140] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.602800][ T7327] device veth1_macvtap entered promiscuous mode [ 96.617720][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 96.637018][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 96.655226][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 96.664003][ T2526] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 16:04:06 executing program 2: socket(0x40000000002, 0x3, 0x2) recvmmsg(0xffffffffffffffff, &(0x7f0000007d80)=[{{0x0, 0x0, &(0x7f0000003340)=[{&(0x7f00000011c0)=""/34, 0x22}], 0x1}}], 0x1, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/raw\x00') preadv(r2, &(0x7f00000017c0), 0x3da, 0x600) [ 96.882816][ T2489] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 96.893209][ T2489] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 96.991306][ T7327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 97.010420][ T7327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 97.023477][ T7327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 97.041757][ T7327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 97.052072][ T7327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 97.063277][ T7327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 97.073250][ T7327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 97.083832][ T7327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 97.096255][ T7327] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 97.179068][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 97.193799][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 97.206883][ T7327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 97.260372][ T7327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 97.270887][ T7327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 97.289642][ T7327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 97.313103][ T7327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 97.325959][ T7327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 97.337251][ T7327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 97.356201][ T7327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 97.374720][ T7327] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 97.401825][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 97.411020][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 97.424817][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 97.433348][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 97.447681][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready 16:04:07 executing program 3: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x0, 0x0, 0x0, 0x0, 0x0) keyctl$get_security(0x11, r0, &(0x7f0000000000)=""/98, 0x62) [ 97.461873][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 97.510662][ T7297] device veth0_vlan entered promiscuous mode [ 97.548065][ T7297] device veth1_vlan entered promiscuous mode [ 97.684658][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 97.706048][ T41] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 97.802226][ T7297] device veth0_macvtap entered promiscuous mode [ 97.812801][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 97.838222][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 97.858307][ T7297] device veth1_macvtap entered promiscuous mode [ 97.882305][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 97.898568][ T2519] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 97.946705][ T7297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 97.964397][ T7297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 97.983182][ T7297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 97.994585][ T7297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 98.016452][ T7297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 98.035573][ T7297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 98.047568][ T7297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 98.059709][ T7297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 98.070541][ T7297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 98.081705][ T7297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 98.094169][ T7297] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 98.104158][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 98.113725][ T3843] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 98.134687][ T7297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 98.145389][ T7297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 98.157506][ T7297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 98.170530][ T7297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 98.180454][ T7297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 98.190961][ T7297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 98.200843][ T7297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 98.211352][ T7297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 98.221813][ T7297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 98.232313][ T7297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 98.243963][ T7297] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 98.256330][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 98.266615][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 16:04:08 executing program 4: r0 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r0) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000200)="0f34", 0x2}], 0x1, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000000c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x2a}) ptrace$setopts(0x4206, r1, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000140)=""/71, 0x47}], 0x3, 0x0, 0x0, 0x0) tkill(r1, 0x3c) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) 16:04:08 executing program 1: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0xffffffffffffffff, r1) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f00000003c0)={'syz', 0x3}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x4, r2, 0xffffffffffffffff, 0x0, 0x0) 16:04:08 executing program 2: socket(0x40000000002, 0x3, 0x2) recvmmsg(0xffffffffffffffff, &(0x7f0000007d80)=[{{0x0, 0x0, &(0x7f0000003340)=[{&(0x7f00000011c0)=""/34, 0x22}], 0x1}}], 0x1, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/raw\x00') preadv(r2, &(0x7f00000017c0), 0x3da, 0x600) 16:04:08 executing program 3: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x0, 0x0, 0x0, 0x0, 0x0) keyctl$get_security(0x11, r0, &(0x7f0000000000)=""/98, 0x62) 16:04:08 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000040)={0x20, r3, 0x703, 0x0, 0x0, {}, [@ETHTOOL_A_STRSET_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x20}}, 0x0) [ 98.596188][ T8220] ptrace attach of "/root/syz-executor.4"[8218] was attempted by "/root/syz-executor.4"[8220] 16:04:09 executing program 0: unshare(0x40000000) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xfe30) ioctl$RTC_PIE_ON(r1, 0x7005) r2 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000000)={0x0, r1}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETTXFILTER(r4, 0x400454d1, &(0x7f0000000040)={0x0, 0x1, [@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = fcntl$dupfd(r6, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$SNDCTL_DSP_GETFMTS(r7, 0x8004500b, &(0x7f0000000080)=0x8) setsockopt$inet6_MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000180)={0x2, 0x1, 0x0, 0x3, 0x2}, 0xc) 16:04:09 executing program 3: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x0, 0x0, 0x0, 0x0, 0x0) keyctl$get_security(0x11, r0, &(0x7f0000000000)=""/98, 0x62) 16:04:09 executing program 1: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0xffffffffffffffff, r1) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f00000003c0)={'syz', 0x3}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x4, r2, 0xffffffffffffffff, 0x0, 0x0) 16:04:09 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000040)={0x20, r3, 0x703, 0x0, 0x0, {}, [@ETHTOOL_A_STRSET_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x20}}, 0x0) 16:04:09 executing program 2: socket(0x40000000002, 0x3, 0x2) recvmmsg(0xffffffffffffffff, &(0x7f0000007d80)=[{{0x0, 0x0, &(0x7f0000003340)=[{&(0x7f00000011c0)=""/34, 0x22}], 0x1}}], 0x1, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/raw\x00') preadv(r2, &(0x7f00000017c0), 0x3da, 0x600) 16:04:09 executing program 1: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0xffffffffffffffff, r1) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f00000003c0)={'syz', 0x3}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x4, r2, 0xffffffffffffffff, 0x0, 0x0) 16:04:09 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440)='ethtool\x00') sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000040)={0x20, r3, 0x703, 0x0, 0x0, {}, [@ETHTOOL_A_STRSET_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x20}}, 0x0) [ 100.151489][ T8255] IPVS: ftp: loaded support on port[0] = 21 [ 100.225535][ T255] tipc: TX() has been purged, node left! 16:04:11 executing program 4: r0 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r0) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000200)="0f34", 0x2}], 0x1, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000000c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x2a}) ptrace$setopts(0x4206, r1, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000140)=""/71, 0x47}], 0x3, 0x0, 0x0, 0x0) tkill(r1, 0x3c) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) 16:04:11 executing program 3: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x0, 0x0, 0x0, 0x0, 0x0) keyctl$get_security(0x11, r0, &(0x7f0000000000)=""/98, 0x62) 16:04:11 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0xffffffffffffffff, r1) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f00000003c0)={'syz', 0x3}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x4, r2, 0xffffffffffffffff, 0x0, 0x0) 16:04:11 executing program 1: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0xffffffffffffffff, r1) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f00000003c0)={'syz', 0x3}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x4, r2, 0xffffffffffffffff, 0x0, 0x0) 16:04:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="18000000120035c20000080000000000050019"], 0x18}, 0x8}, 0x0) 16:04:11 executing program 0: unshare(0x40000000) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xfe30) ioctl$RTC_PIE_ON(r1, 0x7005) r2 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000000)={0x0, r1}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETTXFILTER(r4, 0x400454d1, &(0x7f0000000040)={0x0, 0x1, [@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = fcntl$dupfd(r6, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$SNDCTL_DSP_GETFMTS(r7, 0x8004500b, &(0x7f0000000080)=0x8) setsockopt$inet6_MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000180)={0x2, 0x1, 0x0, 0x3, 0x2}, 0xc) [ 101.811808][ T8298] IPVS: ftp: loaded support on port[0] = 21 16:04:11 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0xffffffffffffffff, r1) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f00000003c0)={'syz', 0x3}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x4, r2, 0xffffffffffffffff, 0x0, 0x0) 16:04:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="18000000120035c20000080000000000050019"], 0x18}, 0x8}, 0x0) 16:04:11 executing program 1: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0xffffffffffffffff, r1) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f00000003c0)={'syz', 0x3}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x4, r2, 0xffffffffffffffff, 0x0, 0x0) 16:04:11 executing program 3: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x0, 0x0, 0x0, 0x0, 0x0) keyctl$get_security(0x11, r0, &(0x7f0000000000)=""/98, 0x62) 16:04:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="18000000120035c20000080000000000050019"], 0x18}, 0x8}, 0x0) 16:04:11 executing program 2: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0xffffffffffffffff, r1) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f00000003c0)={'syz', 0x3}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x4, r2, 0xffffffffffffffff, 0x0, 0x0) [ 103.425289][ T255] tipc: TX() has been purged, node left! [ 103.585324][ T255] tipc: TX() has been purged, node left! 16:04:14 executing program 4: r0 = gettid() prctl$PR_SET_PTRACER(0x59616d61, r0) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000200)="0f34", 0x2}], 0x1, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000000c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x2a}) ptrace$setopts(0x4206, r1, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000140)=""/71, 0x47}], 0x3, 0x0, 0x0, 0x0) tkill(r1, 0x3c) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r1, 0x0, 0x0) 16:04:14 executing program 1: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0xffffffffffffffff, r1) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f00000003c0)={'syz', 0x3}, &(0x7f00000000c0)="ff", 0x1, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x4, r2, 0xffffffffffffffff, 0x0, 0x0) 16:04:14 executing program 3: r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x0, 0x0, 0x0, 0x0, 0x0) keyctl$get_security(0x11, r0, &(0x7f0000000000)=""/98, 0x62) 16:04:14 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="18000000120035c20000080000000000050019"], 0x18}, 0x8}, 0x0) 16:04:14 executing program 0: unshare(0x40000000) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xfe30) ioctl$RTC_PIE_ON(r1, 0x7005) r2 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$TIPC_MCAST_REPLICAST(r0, 0x10f, 0x86) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000000)={0x0, r1}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$TUNSETTXFILTER(r4, 0x400454d1, &(0x7f0000000040)={0x0, 0x1, [@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}]}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = fcntl$dupfd(r6, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$SNDCTL_DSP_GETFMTS(r7, 0x8004500b, &(0x7f0000000080)=0x8) setsockopt$inet6_MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000180)={0x2, 0x1, 0x0, 0x3, 0x2}, 0xc) 16:04:14 executing program 2: sched_setscheduler(0x0, 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x9, 0x100000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000180)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000100)) [ 104.841936][ T8359] IPVS: ftp: loaded support on port[0] = 21 16:04:14 executing program 3: r0 = gettid() r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1) prctl$PR_SET_PTRACER(0x59616d61, r0) write$binfmt_script(r1, &(0x7f0000000380)=ANY=[@ANYBLOB='#! .'], 0x191) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) 16:04:14 executing program 2: sched_setscheduler(0x0, 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x9, 0x100000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000180)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000100)) 16:04:14 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{}, {}, 0x8, {0x2, 0x0, @broadcast}, 'veth0_to_bond\x00'}) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000100)={{}, {0x0, @local}, 0x8, {0x2, 0x0, @local}, 'veth0_to_bond\x00'}) 16:04:14 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) 16:04:14 executing program 2: sched_setscheduler(0x0, 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x9, 0x100000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000180)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000100)) [ 105.126189][ T27] audit: type=1804 audit(1590163454.875:2): pid=8385 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir132280787/syzkaller.4GVcEg/11/cgroup.controllers" dev="sda1" ino=15823 res=1 16:04:15 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{}, {}, 0x8, {0x2, 0x0, @broadcast}, 'veth0_to_bond\x00'}) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000100)={{}, {0x0, @local}, 0x8, {0x2, 0x0, @local}, 'veth0_to_bond\x00'}) [ 105.815286][ T27] audit: type=1804 audit(1590163455.555:3): pid=8414 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir132280787/syzkaller.4GVcEg/11/cgroup.controllers" dev="sda1" ino=15823 res=1 [ 105.907048][ T8385] syz-executor.1 (8385) used greatest stack depth: 22816 bytes left [ 107.425355][ T255] tipc: TX() has been purged, node left! 16:04:17 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) 16:04:17 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) 16:04:17 executing program 2: sched_setscheduler(0x0, 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x9, 0x100000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000180)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000100)) 16:04:17 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{}, {}, 0x8, {0x2, 0x0, @broadcast}, 'veth0_to_bond\x00'}) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000100)={{}, {0x0, @local}, 0x8, {0x2, 0x0, @local}, 'veth0_to_bond\x00'}) 16:04:17 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{}, {}, 0x8, {0x2, 0x0, @broadcast}, 'veth0_to_bond\x00'}) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000100)={{}, {0x0, @local}, 0x8, {0x2, 0x0, @local}, 'veth0_to_bond\x00'}) 16:04:17 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{}, {}, 0x8, {0x2, 0x0, @broadcast}, 'veth0_to_bond\x00'}) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000100)={{}, {0x0, @local}, 0x8, {0x2, 0x0, @local}, 'veth0_to_bond\x00'}) 16:04:17 executing program 3: r0 = gettid() r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1) prctl$PR_SET_PTRACER(0x59616d61, r0) write$binfmt_script(r1, &(0x7f0000000380)=ANY=[@ANYBLOB='#! .'], 0x191) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) 16:04:17 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) 16:04:17 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{}, {}, 0x8, {0x2, 0x0, @broadcast}, 'veth0_to_bond\x00'}) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000100)={{}, {0x0, @local}, 0x8, {0x2, 0x0, @local}, 'veth0_to_bond\x00'}) [ 108.099646][ T27] audit: type=1804 audit(1590163457.845:4): pid=8433 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir129183102/syzkaller.1uzj2y/4/cgroup.controllers" dev="sda1" ino=15837 res=1 [ 108.237439][ T27] audit: type=1804 audit(1590163457.875:5): pid=8432 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir132280787/syzkaller.4GVcEg/12/cgroup.controllers" dev="sda1" ino=15836 res=1 16:04:18 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{}, {}, 0x8, {0x2, 0x0, @broadcast}, 'veth0_to_bond\x00'}) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000100)={{}, {0x0, @local}, 0x8, {0x2, 0x0, @local}, 'veth0_to_bond\x00'}) 16:04:18 executing program 5: r0 = gettid() r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1) prctl$PR_SET_PTRACER(0x59616d61, r0) write$binfmt_script(r1, &(0x7f0000000380)=ANY=[@ANYBLOB='#! .'], 0x191) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) [ 108.469132][ T27] audit: type=1804 audit(1590163457.985:6): pid=8448 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir163447480/syzkaller.DmxQSG/11/cgroup.controllers" dev="sda1" ino=15826 res=1 16:04:18 executing program 0: r0 = gettid() r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1) prctl$PR_SET_PTRACER(0x59616d61, r0) write$binfmt_script(r1, &(0x7f0000000380)=ANY=[@ANYBLOB='#! .'], 0x191) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) 16:04:19 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) 16:04:19 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) [ 109.651418][ T27] audit: type=1804 audit(1590163459.395:7): pid=8475 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir132280787/syzkaller.4GVcEg/13/cgroup.controllers" dev="sda1" ino=15836 res=1 16:04:19 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) [ 109.771147][ T27] audit: type=1804 audit(1590163459.395:8): pid=8476 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir129183102/syzkaller.1uzj2y/5/cgroup.controllers" dev="sda1" ino=15837 res=1 [ 110.091019][ T27] audit: type=1804 audit(1590163459.835:9): pid=8481 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir163447480/syzkaller.DmxQSG/12/cgroup.controllers" dev="sda1" ino=15826 res=1 16:04:20 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) 16:04:20 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) 16:04:20 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) [ 111.018735][ T27] audit: type=1804 audit(1590163460.765:10): pid=8494 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir132280787/syzkaller.4GVcEg/14/cgroup.controllers" dev="sda1" ino=15826 res=1 16:04:20 executing program 3: r0 = gettid() r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1) prctl$PR_SET_PTRACER(0x59616d61, r0) write$binfmt_script(r1, &(0x7f0000000380)=ANY=[@ANYBLOB='#! .'], 0x191) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) [ 111.148440][ T27] audit: type=1804 audit(1590163460.795:11): pid=8492 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir129183102/syzkaller.1uzj2y/6/cgroup.controllers" dev="sda1" ino=15833 res=1 [ 111.329699][ T27] audit: type=1804 audit(1590163460.885:12): pid=8500 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir163447480/syzkaller.DmxQSG/13/cgroup.controllers" dev="sda1" ino=15837 res=1 16:04:21 executing program 5: r0 = gettid() r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1) prctl$PR_SET_PTRACER(0x59616d61, r0) write$binfmt_script(r1, &(0x7f0000000380)=ANY=[@ANYBLOB='#! .'], 0x191) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) 16:04:21 executing program 0: r0 = gettid() r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1) prctl$PR_SET_PTRACER(0x59616d61, r0) write$binfmt_script(r1, &(0x7f0000000380)=ANY=[@ANYBLOB='#! .'], 0x191) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) 16:04:22 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) 16:04:22 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) 16:04:22 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) [ 112.598563][ T27] audit: type=1804 audit(1590163462.345:13): pid=8525 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir132280787/syzkaller.4GVcEg/15/cgroup.controllers" dev="sda1" ino=15826 res=1 [ 112.740446][ T27] audit: type=1804 audit(1590163462.465:14): pid=8528 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir129183102/syzkaller.1uzj2y/7/cgroup.controllers" dev="sda1" ino=15833 res=1 [ 112.877227][ T27] audit: type=1804 audit(1590163462.575:15): pid=8532 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir163447480/syzkaller.DmxQSG/14/cgroup.controllers" dev="sda1" ino=15837 res=1 16:04:23 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) 16:04:23 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) 16:04:23 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) [ 113.834739][ T27] audit: type=1804 audit(1590163463.575:16): pid=8543 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir132280787/syzkaller.4GVcEg/16/cgroup.controllers" dev="sda1" ino=15826 res=1 [ 113.941077][ T27] audit: type=1804 audit(1590163463.685:17): pid=8545 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir129183102/syzkaller.1uzj2y/8/cgroup.controllers" dev="sda1" ino=15833 res=1 [ 114.080167][ T27] audit: type=1804 audit(1590163463.825:18): pid=8551 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir163447480/syzkaller.DmxQSG/15/cgroup.controllers" dev="sda1" ino=15837 res=1 16:04:24 executing program 3: r0 = gettid() r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1) prctl$PR_SET_PTRACER(0x59616d61, r0) write$binfmt_script(r1, &(0x7f0000000380)=ANY=[@ANYBLOB='#! .'], 0x191) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) 16:04:24 executing program 5: r0 = gettid() r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1) prctl$PR_SET_PTRACER(0x59616d61, r0) write$binfmt_script(r1, &(0x7f0000000380)=ANY=[@ANYBLOB='#! .'], 0x191) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) 16:04:24 executing program 0: r0 = gettid() r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1) prctl$PR_SET_PTRACER(0x59616d61, r0) write$binfmt_script(r1, &(0x7f0000000380)=ANY=[@ANYBLOB='#! .'], 0x191) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) 16:04:24 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) 16:04:24 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) 16:04:24 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000280)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r3, r2, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200), 0x8) [ 115.285349][ T27] audit: type=1804 audit(1590163465.025:19): pid=8578 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir132280787/syzkaller.4GVcEg/17/cgroup.controllers" dev="sda1" ino=15831 res=1 16:04:25 executing program 1: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) 16:04:26 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x200000000000011, 0x3, 0x0) getsockopt$packet_buf(r2, 0x107, 0x13, &(0x7f0000651000)=""/234, &(0x7f0000000100)=0xea) 16:04:26 executing program 2: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000340)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="1020f5f29008070009000000030000000c0000000900000001000000020000000000000000300000000000000e00000018000000020000000200000002000000020000000e000000000400000004000000080000000c00000010000000140000030000000100000002", 0x69, 0x1400}], 0x0, 0x0) pipe(&(0x7f0000000280)) socket$inet_udp(0x2, 0x2, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x400000, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) splice(r0, 0x0, r1, 0x0, 0x400000, 0x0) [ 116.335954][ T8593] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 116.344172][ T8593] ref_ctr decrement failed for inode: 0x3dd7 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000009bf3b11 16:04:26 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x200000000000011, 0x3, 0x0) getsockopt$packet_buf(r2, 0x107, 0x13, &(0x7f0000651000)=""/234, &(0x7f0000000100)=0xea) [ 116.387329][ T8593] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 116.410044][ T8593] ref_ctr decrement failed for inode: 0x3dd7 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000009bf3b11 16:04:26 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x200000000000011, 0x3, 0x0) getsockopt$packet_buf(r2, 0x107, 0x13, &(0x7f0000651000)=""/234, &(0x7f0000000100)=0xea) 16:04:26 executing program 1: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) [ 116.707523][ T8604] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 116.718455][ T8604] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 116.735829][ T8604] F2FS-fs (loop2): Fix alignment : done, start(5120) end(13312) block(7168) [ 116.765794][ T8604] attempt to access beyond end of device [ 116.775017][ T8604] loop2: rw=12288, want=8200, limit=20 [ 116.783372][ T8604] attempt to access beyond end of device [ 116.790281][ T8604] loop2: rw=12288, want=12296, limit=20 [ 116.800892][ T8604] F2FS-fs (loop2): Failed to get valid F2FS checkpoint [ 116.960719][ T8613] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 116.986119][ T8613] ref_ctr decrement failed for inode: 0x3de5 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000035f3fd42 [ 117.012440][ T8613] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 117.035327][ T8613] ref_ctr decrement failed for inode: 0x3de5 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000035f3fd42 16:04:27 executing program 2: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000340)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="1020f5f29008070009000000030000000c0000000900000001000000020000000000000000300000000000000e00000018000000020000000200000002000000020000000e000000000400000004000000080000000c00000010000000140000030000000100000002", 0x69, 0x1400}], 0x0, 0x0) pipe(&(0x7f0000000280)) socket$inet_udp(0x2, 0x2, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x400000, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) splice(r0, 0x0, r1, 0x0, 0x400000, 0x0) [ 117.534169][ T8627] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 117.542514][ T8627] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 117.556434][ T8627] F2FS-fs (loop2): Fix alignment : done, start(5120) end(13312) block(7168) [ 117.579262][ T8627] attempt to access beyond end of device [ 117.585371][ T8627] loop2: rw=12288, want=8200, limit=20 [ 117.591749][ T8627] attempt to access beyond end of device [ 117.598131][ T8627] loop2: rw=12288, want=12296, limit=20 [ 117.603856][ T8627] F2FS-fs (loop2): Failed to get valid F2FS checkpoint 16:04:27 executing program 3: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) [ 117.826158][ T8635] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 117.834369][ T8635] ref_ctr decrement failed for inode: 0x3ddf offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000008439d53 [ 117.860945][ T8635] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 117.877378][ T8635] ref_ctr decrement failed for inode: 0x3ddf offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000008439d53 16:04:27 executing program 3: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) 16:04:27 executing program 1: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) 16:04:27 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x200000000000011, 0x3, 0x0) getsockopt$packet_buf(r2, 0x107, 0x13, &(0x7f0000651000)=""/234, &(0x7f0000000100)=0xea) 16:04:27 executing program 5: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) 16:04:27 executing program 0: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) 16:04:27 executing program 4: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) 16:04:28 executing program 2: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000340)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="1020f5f29008070009000000030000000c0000000900000001000000020000000000000000300000000000000e00000018000000020000000200000002000000020000000e000000000400000004000000080000000c00000010000000140000030000000100000002", 0x69, 0x1400}], 0x0, 0x0) pipe(&(0x7f0000000280)) socket$inet_udp(0x2, 0x2, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x400000, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) splice(r0, 0x0, r1, 0x0, 0x400000, 0x0) [ 118.277005][ T8647] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 118.294596][ T8647] ref_ctr decrement failed for inode: 0x3ded offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x00000000e1714df1 [ 118.317227][ T8647] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 118.338518][ T8647] ref_ctr decrement failed for inode: 0x3ded offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x00000000e1714df1 16:04:28 executing program 0: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) [ 118.507304][ T8648] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 118.521633][ T8648] ref_ctr decrement failed for inode: 0x3dee offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000034a3a6c4 16:04:28 executing program 1: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) [ 118.574986][ T8660] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 118.584108][ T8660] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 118.607066][ T8660] F2FS-fs (loop2): Fix alignment : done, start(5120) end(13312) block(7168) [ 118.609145][ T8648] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 118.646433][ T8660] attempt to access beyond end of device [ 118.652443][ T8660] loop2: rw=12288, want=8200, limit=20 [ 118.654861][ T8648] ref_ctr decrement failed for inode: 0x3dee offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000034a3a6c4 [ 118.659413][ T8660] attempt to access beyond end of device [ 118.682261][ T8660] loop2: rw=12288, want=12296, limit=20 [ 118.689121][ T8660] F2FS-fs (loop2): Failed to get valid F2FS checkpoint 16:04:28 executing program 5: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) [ 118.869374][ T8643] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 118.906497][ T8643] ref_ctr decrement failed for inode: 0x3df0 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x000000005db8926c [ 118.949247][ T8643] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 118.995302][ T8643] ref_ctr decrement failed for inode: 0x3df0 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x000000005db8926c 16:04:28 executing program 3: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) [ 119.127591][ T8654] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 119.143884][ T8654] ref_ctr decrement failed for inode: 0x3df2 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x000000008f2de0e9 16:04:28 executing program 2: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000340)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000040)="1020f5f29008070009000000030000000c0000000900000001000000020000000000000000300000000000000e00000018000000020000000200000002000000020000000e000000000400000004000000080000000c00000010000000140000030000000100000002", 0x69, 0x1400}], 0x0, 0x0) pipe(&(0x7f0000000280)) socket$inet_udp(0x2, 0x2, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x400000, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) splice(r0, 0x0, r1, 0x0, 0x400000, 0x0) [ 119.215062][ T8654] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 119.231040][ T8654] ref_ctr decrement failed for inode: 0x3df2 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x000000008f2de0e9 16:04:29 executing program 4: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) [ 119.375900][ T8667] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 119.408913][ T8667] ref_ctr decrement failed for inode: 0x3def offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x000000009d5e64de [ 119.428718][ T8667] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 119.442262][ T8667] ref_ctr decrement failed for inode: 0x3def offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x000000009d5e64de [ 119.531018][ T8683] F2FS-fs (loop2): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 119.556506][ T8665] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 119.564390][ T8683] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 119.603694][ T8665] ref_ctr decrement failed for inode: 0x3de4 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000048b59f63 [ 119.630275][ T8665] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 119.630531][ T8683] F2FS-fs (loop2): Fix alignment : done, start(5120) end(13312) block(7168) 16:04:29 executing program 1: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x71, &(0x7f0000000340)={r2}, 0x8) [ 119.653228][ T8665] ref_ctr decrement failed for inode: 0x3de4 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000048b59f63 [ 119.728856][ T8683] attempt to access beyond end of device [ 119.737418][ T8683] loop2: rw=12288, want=8200, limit=20 [ 119.744945][ T8683] attempt to access beyond end of device [ 119.756101][ T8683] loop2: rw=12288, want=12296, limit=20 [ 119.762558][ T8683] F2FS-fs (loop2): Failed to get valid F2FS checkpoint 16:04:29 executing program 0: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) [ 119.806332][ T8675] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 119.814346][ T8675] ref_ctr decrement failed for inode: 0x3dee offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000051f72ae4 [ 119.845375][ T8675] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 119.853389][ T8675] ref_ctr decrement failed for inode: 0x3dee offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000051f72ae4 16:04:29 executing program 1: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x71, &(0x7f0000000340)={r2}, 0x8) 16:04:29 executing program 5: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) 16:04:29 executing program 1: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x71, &(0x7f0000000340)={r2}, 0x8) [ 120.003568][ T8687] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 120.028565][ T8687] ref_ctr decrement failed for inode: 0x3df2 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x00000000b695f799 [ 120.040554][ T8687] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 16:04:29 executing program 1: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x71, &(0x7f0000000340)={r2}, 0x8) [ 120.050327][ T8687] ref_ctr decrement failed for inode: 0x3df2 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x00000000b695f799 16:04:29 executing program 4: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x2, 0x2812, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x0, 0x2812, r1, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xfd30) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x140}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x3) close(r2) [ 120.155500][ T8680] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 120.191760][ T8680] ref_ctr decrement failed for inode: 0x3df3 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x000000008e1c250a 16:04:29 executing program 2: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x71, &(0x7f0000000340)={r2}, 0x8) 16:04:30 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x156, &(0x7f00000002c0)="94a4b04e04000000000000002b615ac5ee9a8f8cbeaf99cfc4dedd20494d4b895b5804ef58d7cee1761cd167fd6e40d0b1eb346f19367f420083cff2dc39f3cc1e564cd165167d6872a0cdd716000000e1d60bef63eaef5d00001c5449c865576d0cfefa36566d4c68b24ec011e163f2975244707780d868116111aeed76c195ae235abe61f83eb11f66b75e0ac88835a0846e7ca26973c47f1a5545c3b153470a3452f072db58a754cb474a2ae91cc4f81b809362b35b1c9f5160a11e99dc5124129d069c182255545139ff639bd6762d26b5d5a0b5d5e3788abfc4480d1b876757255a29f33019de57449f184fc79330d4c42a8d80732b4744aa59b92dafe7dacf4173699f2d3681d18f716185eca90eae300ca24c486bfea87fa2c90f59fcd1c9b226ca1aa1702d8b2e29400300dcea938e6d4ff7840162ab32a0d0a72fb1bd9f82c34ed797a2d55dc14f6c9eac4f70c576eb335b"}}], 0x1c) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0xf) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 120.261319][ T8680] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 120.294506][ T8680] ref_ctr decrement failed for inode: 0x3df3 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x000000008e1c250a 16:04:30 executing program 2: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x71, &(0x7f0000000340)={r2}, 0x8) [ 120.440296][ T8698] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 120.454046][ T8698] ref_ctr decrement failed for inode: 0x3de4 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000038e1e7fb [ 120.497382][ T8698] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 120.525432][ T8698] ref_ctr decrement failed for inode: 0x3de4 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x0000000038e1e7fb 16:04:30 executing program 3: setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040), 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket(0x840000000002, 0x3, 0xff) connect$inet(r1, &(0x7f0000593000)={0x2, 0x0, @remote}, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = fcntl$dupfd(r2, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) io_setup(0x2, &(0x7f0000000140)=0x0) io_submit(r5, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x2, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x12f}]) 16:04:30 executing program 2: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x71, &(0x7f0000000340)={r2}, 0x8) 16:04:30 executing program 0: clone(0x2000000000200500, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x20000080000000, 0x0) r0 = gettid() syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') tkill(r0, 0x34) [ 120.669232][ T8704] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 16:04:30 executing program 2: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000500)={0x2, &(0x7f00000004c0)=[{0x80}, {0x6, 0x0, 0x0, 0x50000}]}) 16:04:30 executing program 3: setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040), 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket(0x840000000002, 0x3, 0xff) connect$inet(r1, &(0x7f0000593000)={0x2, 0x0, @remote}, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = fcntl$dupfd(r2, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) io_setup(0x2, &(0x7f0000000140)=0x0) io_submit(r5, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x2, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x12f}]) [ 120.721037][ T8704] ref_ctr decrement failed for inode: 0x3ddf offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x000000002b0a7167 [ 120.780790][ T8704] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 120.797848][ T8704] ref_ctr decrement failed for inode: 0x3ddf offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x000000002b0a7167 16:04:30 executing program 0: clone(0x2000000000200500, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x20000080000000, 0x0) r0 = gettid() syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') tkill(r0, 0x34) 16:04:30 executing program 5: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180)='/dev/uinput\x00', 0x400000000000002, 0x0) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) r1 = dup(r0) write$uinput_user_dev(r1, &(0x7f0000000980)={'syz0\x00', {}, 0x0, [0x4000]}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) [ 120.906483][ T8713] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 120.914499][ T8713] ref_ctr decrement failed for inode: 0x3df8 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x00000000defb8de9 16:04:30 executing program 3: setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040), 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) close(r0) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket(0x840000000002, 0x3, 0xff) connect$inet(r1, &(0x7f0000593000)={0x2, 0x0, @remote}, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = fcntl$dupfd(r2, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) io_setup(0x2, &(0x7f0000000140)=0x0) io_submit(r5, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x2, 0x0, 0x0, 0x1000800000000001, 0x0, r0, 0x0, 0x12f}]) [ 120.972431][ T8713] ref_ctr going negative. vaddr: 0x20004004, curr val: 0, delta: -1 [ 120.998987][ T8713] ref_ctr decrement failed for inode: 0x3df8 offset: 0x0 ref_ctr_offset: 0x4 of mm: 0x00000000defb8de9 [ 121.059881][ T8748] input: syz0 as /devices/virtual/input/input5 16:04:30 executing program 2: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000500)={0x2, &(0x7f00000004c0)=[{0x80}, {0x6, 0x0, 0x0, 0x50000}]}) 16:04:30 executing program 4: clone(0x200022041fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() pause() ptrace(0x10, r0) ptrace$getsig(0x2, r0, 0xffffffffff600047, &(0x7f0000000100)) [ 121.164611][ T8744] ================================================================== [ 121.172902][ T8744] BUG: KASAN: use-after-free in __mutex_lock+0x1033/0x13c0 [ 121.180098][ T8744] Read of size 8 at addr ffff8880630e4150 by task syz-executor.5/8744 [ 121.188234][ T8744] [ 121.190560][ T8744] CPU: 1 PID: 8744 Comm: syz-executor.5 Not tainted 5.7.0-rc6-next-20200522-syzkaller #0 [ 121.200341][ T8744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 121.210382][ T8744] Call Trace: [ 121.213667][ T8744] dump_stack+0x18f/0x20d [ 121.217989][ T8744] ? __mutex_lock+0x1033/0x13c0 [ 121.222895][ T8744] ? __mutex_lock+0x1033/0x13c0 [ 121.227752][ T8744] print_address_description.constprop.0.cold+0xd3/0x413 [ 121.234769][ T8744] ? cdev_device_del+0x69/0x80 [ 121.239530][ T8744] ? joydev_disconnect+0x3d/0xb0 [ 121.244476][ T8744] ? __input_unregister_device+0x1b0/0x430 [ 121.250696][ T8744] ? input_unregister_device+0xb4/0xf0 [ 121.256150][ T8744] ? uinput_destroy_device+0x1e2/0x240 [ 121.261623][ T8744] ? vprintk_func+0x97/0x1a6 [ 121.266230][ T8744] ? __mutex_lock+0x1033/0x13c0 [ 121.271077][ T8744] kasan_report.cold+0x1f/0x37 [ 121.275859][ T8744] ? __mutex_lock+0x1033/0x13c0 [ 121.280706][ T8744] __mutex_lock+0x1033/0x13c0 [ 121.285400][ T8744] ? joydev_cleanup+0x21/0x190 [ 121.290177][ T8744] ? print_usage_bug+0x240/0x240 [ 121.295111][ T8744] ? trace_hardirqs_off+0x50/0x220 [ 121.300217][ T8744] ? mutex_trylock+0x2c0/0x2c0 [ 121.304987][ T8744] ? mark_held_locks+0x9f/0xe0 [ 121.309745][ T8744] ? kfree+0x1eb/0x2b0 [ 121.313824][ T8744] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 121.319810][ T8744] ? kfree_const+0x51/0x60 [ 121.324239][ T8744] ? joydev_cleanup+0x21/0x190 [ 121.328994][ T8744] joydev_cleanup+0x21/0x190 [ 121.333581][ T8744] joydev_disconnect+0x45/0xb0 [ 121.338341][ T8744] __input_unregister_device+0x1b0/0x430 [ 121.343968][ T8744] input_unregister_device+0xb4/0xf0 [ 121.349246][ T8744] uinput_destroy_device+0x1e2/0x240 [ 121.354527][ T8744] ? uinput_destroy_device+0x240/0x240 [ 121.359975][ T8744] uinput_release+0x37/0x50 [ 121.364471][ T8744] __fput+0x33e/0x880 [ 121.368466][ T8744] task_work_run+0xf4/0x1b0 [ 121.372967][ T8744] exit_to_usermode_loop+0x2fa/0x360 [ 121.378247][ T8744] do_syscall_64+0x6b1/0x7d0 [ 121.382920][ T8744] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 121.388800][ T8744] RIP: 0033:0x416621 [ 121.392683][ T8744] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 121.412289][ T8744] RSP: 002b:00007ffefde1fcc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 121.420687][ T8744] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000416621 [ 121.428659][ T8744] RDX: 0000000000000000 RSI: 00000000000000d0 RDI: 0000000000000004 [ 121.436617][ T8744] RBP: 0000000000000001 R08: 00000000551800d0 R09: 00000000551800d4 [ 121.444575][ T8744] R10: 00007ffefde1fdb0 R11: 0000000000000293 R12: 000000000078c900 [ 121.452534][ T8744] R13: 000000000078c900 R14: ffffffffffffffff R15: 000000000078bf0c [ 121.460519][ T8744] [ 121.462837][ T8744] Allocated by task 8748: [ 121.467161][ T8744] save_stack+0x1b/0x40 [ 121.471305][ T8744] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 121.476923][ T8744] kmem_cache_alloc_trace+0x153/0x7d0 [ 121.482281][ T8744] joydev_connect+0x83/0xd2f [ 121.486861][ T8744] input_attach_handler+0x194/0x200 [ 121.492043][ T8744] input_register_device.cold+0xf5/0x246 [ 121.497664][ T8744] uinput_ioctl_handler.isra.0+0x1210/0x1d80 [ 121.503658][ T8744] ksys_ioctl+0x11a/0x180 [ 121.507978][ T8744] __x64_sys_ioctl+0x6f/0xb0 [ 121.512556][ T8744] do_syscall_64+0xf6/0x7d0 [ 121.517046][ T8744] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 121.522921][ T8744] [ 121.525236][ T8744] Freed by task 8744: [ 121.529208][ T8744] save_stack+0x1b/0x40 [ 121.533349][ T8744] __kasan_slab_free+0xf7/0x140 [ 121.538187][ T8744] kfree+0x109/0x2b0 [ 121.542067][ T8744] device_release+0x71/0x200 [ 121.546652][ T8744] kobject_put+0x1c8/0x2f0 [ 121.551056][ T8744] cdev_device_del+0x69/0x80 [ 121.555638][ T8744] joydev_disconnect+0x3d/0xb0 [ 121.560393][ T8744] __input_unregister_device+0x1b0/0x430 [ 121.566026][ T8744] input_unregister_device+0xb4/0xf0 [ 121.571299][ T8744] uinput_destroy_device+0x1e2/0x240 [ 121.576570][ T8744] uinput_release+0x37/0x50 [ 121.581059][ T8744] __fput+0x33e/0x880 [ 121.585043][ T8744] task_work_run+0xf4/0x1b0 [ 121.589550][ T8744] exit_to_usermode_loop+0x2fa/0x360 [ 121.594825][ T8744] do_syscall_64+0x6b1/0x7d0 [ 121.599408][ T8744] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 121.605282][ T8744] [ 121.607621][ T8744] The buggy address belongs to the object at ffff8880630e4000 [ 121.607621][ T8744] which belongs to the cache kmalloc-8k of size 8192 [ 121.621663][ T8744] The buggy address is located 336 bytes inside of [ 121.621663][ T8744] 8192-byte region [ffff8880630e4000, ffff8880630e6000) [ 121.635005][ T8744] The buggy address belongs to the page: [ 121.640640][ T8744] page:ffffea00018c3900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 head:ffffea00018c3900 order:2 compound_mapcount:0 compound_pincount:0 [ 121.655806][ T8744] flags: 0xfffe0000010200(slab|head) [ 121.661086][ T8744] raw: 00fffe0000010200 ffffea000180fa08 ffffea00017bd408 ffff8880aa0021c0 [ 121.669659][ T8744] raw: 0000000000000000 ffff8880630e4000 0000000100000001 0000000000000000 [ 121.678241][ T8744] page dumped because: kasan: bad access detected [ 121.684633][ T8744] [ 121.686944][ T8744] Memory state around the buggy address: [ 121.692564][ T8744] ffff8880630e4000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 121.700611][ T8744] ffff8880630e4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 121.708659][ T8744] >ffff8880630e4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 121.716701][ T8744] ^ [ 121.723362][ T8744] ffff8880630e4180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 121.731409][ T8744] ffff8880630e4200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 121.739450][ T8744] ================================================================== [ 121.747490][ T8744] Disabling lock debugging due to kernel taint [ 121.823790][ T8744] Kernel panic - not syncing: panic_on_warn set ... [ 121.830415][ T8744] CPU: 1 PID: 8744 Comm: syz-executor.5 Tainted: G B 5.7.0-rc6-next-20200522-syzkaller #0 [ 121.841600][ T8744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 121.851642][ T8744] Call Trace: [ 121.854929][ T8744] dump_stack+0x18f/0x20d [ 121.859260][ T8744] ? __mutex_lock+0xf50/0x13c0 [ 121.864026][ T8744] panic+0x2e3/0x75c [ 121.867920][ T8744] ? __warn_printk+0xf3/0xf3 [ 121.872507][ T8744] ? preempt_schedule_common+0x5e/0xc0 [ 121.877958][ T8744] ? __mutex_lock+0x1033/0x13c0 [ 121.882799][ T8744] ? __mutex_lock+0x1033/0x13c0 [ 121.887649][ T8744] ? preempt_schedule_thunk+0x16/0x18 [ 121.893108][ T8744] ? trace_hardirqs_on+0x55/0x230 [ 121.898126][ T8744] ? __mutex_lock+0x1033/0x13c0 [ 121.902969][ T8744] ? __mutex_lock+0x1033/0x13c0 [ 121.907812][ T8744] end_report+0x4d/0x53 [ 121.911962][ T8744] kasan_report.cold+0xd/0x37 [ 121.916631][ T8744] ? __mutex_lock+0x1033/0x13c0 [ 121.921473][ T8744] __mutex_lock+0x1033/0x13c0 [ 121.926152][ T8744] ? joydev_cleanup+0x21/0x190 [ 121.930911][ T8744] ? print_usage_bug+0x240/0x240 [ 121.935842][ T8744] ? trace_hardirqs_off+0x50/0x220 [ 121.940955][ T8744] ? mutex_trylock+0x2c0/0x2c0 [ 121.945713][ T8744] ? mark_held_locks+0x9f/0xe0 [ 121.950477][ T8744] ? kfree+0x1eb/0x2b0 [ 121.954540][ T8744] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 121.960515][ T8744] ? kfree_const+0x51/0x60 [ 121.964933][ T8744] ? joydev_cleanup+0x21/0x190 [ 121.969690][ T8744] joydev_cleanup+0x21/0x190 [ 121.974293][ T8744] joydev_disconnect+0x45/0xb0 [ 121.979055][ T8744] __input_unregister_device+0x1b0/0x430 [ 121.984693][ T8744] input_unregister_device+0xb4/0xf0 [ 121.989975][ T8744] uinput_destroy_device+0x1e2/0x240 [ 121.995257][ T8744] ? uinput_destroy_device+0x240/0x240 [ 122.000708][ T8744] uinput_release+0x37/0x50 [ 122.005209][ T8744] __fput+0x33e/0x880 [ 122.009189][ T8744] task_work_run+0xf4/0x1b0 [ 122.013695][ T8744] exit_to_usermode_loop+0x2fa/0x360 [ 122.018983][ T8744] do_syscall_64+0x6b1/0x7d0 [ 122.023572][ T8744] entry_SYSCALL_64_after_hwframe+0x49/0xb3 [ 122.029456][ T8744] RIP: 0033:0x416621 [ 122.033344][ T8744] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 122.052947][ T8744] RSP: 002b:00007ffefde1fcc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 122.061354][ T8744] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000416621 [ 122.069319][ T8744] RDX: 0000000000000000 RSI: 00000000000000d0 RDI: 0000000000000004 [ 122.077285][ T8744] RBP: 0000000000000001 R08: 00000000551800d0 R09: 00000000551800d4 [ 122.085253][ T8744] R10: 00007ffefde1fdb0 R11: 0000000000000293 R12: 000000000078c900 [ 122.093222][ T8744] R13: 000000000078c900 R14: ffffffffffffffff R15: 000000000078bf0c [ 122.102250][ T8744] Kernel Offset: disabled [ 122.106562][ T8744] Rebooting in 86400 seconds..