[ 55.293970][ T26] audit: type=1800 audit(1572245641.295:25): pid=8616 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 55.321716][ T26] audit: type=1800 audit(1572245641.295:26): pid=8616 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 55.380239][ T26] audit: type=1800 audit(1572245641.305:27): pid=8616 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 55.893042][ T8680] sshd (8680) used greatest stack depth: 22888 bytes left [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.0' (ECDSA) to the list of known hosts. 2019/10/28 06:54:12 fuzzer started 2019/10/28 06:54:14 dialing manager at 10.128.0.26:34793 2019/10/28 06:54:15 syscalls: 2534 2019/10/28 06:54:15 code coverage: enabled 2019/10/28 06:54:15 comparison tracing: enabled 2019/10/28 06:54:15 extra coverage: extra coverage is not supported by the kernel 2019/10/28 06:54:15 setuid sandbox: enabled 2019/10/28 06:54:15 namespace sandbox: enabled 2019/10/28 06:54:15 Android sandbox: /sys/fs/selinux/policy does not exist 2019/10/28 06:54:15 fault injection: enabled 2019/10/28 06:54:15 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/10/28 06:54:15 net packet injection: enabled 2019/10/28 06:54:15 net device setup: enabled 2019/10/28 06:54:15 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 06:56:27 executing program 0: 06:56:27 executing program 1: syzkaller login: [ 201.320074][ T8780] IPVS: ftp: loaded support on port[0] = 21 [ 201.488522][ T8780] chnl_net:caif_netlink_parms(): no params data found [ 201.522670][ T8783] IPVS: ftp: loaded support on port[0] = 21 [ 201.584500][ T8780] bridge0: port 1(bridge_slave_0) entered blocking state [ 201.593556][ T8780] bridge0: port 1(bridge_slave_0) entered disabled state [ 201.602045][ T8780] device bridge_slave_0 entered promiscuous mode 06:56:27 executing program 2: [ 201.627210][ T8780] bridge0: port 2(bridge_slave_1) entered blocking state [ 201.635422][ T8780] bridge0: port 2(bridge_slave_1) entered disabled state [ 201.645301][ T8780] device bridge_slave_1 entered promiscuous mode [ 201.730897][ T8780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 201.768812][ T8780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 201.797478][ T8780] team0: Port device team_slave_0 added [ 201.817702][ T8783] chnl_net:caif_netlink_parms(): no params data found [ 201.847427][ T8780] team0: Port device team_slave_1 added 06:56:27 executing program 3: [ 201.886316][ T8786] IPVS: ftp: loaded support on port[0] = 21 [ 201.941169][ T8780] device hsr_slave_0 entered promiscuous mode [ 201.991966][ T8780] device hsr_slave_1 entered promiscuous mode [ 202.084419][ T8783] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.095518][ T8788] IPVS: ftp: loaded support on port[0] = 21 [ 202.101445][ T8783] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.113059][ T8783] device bridge_slave_0 entered promiscuous mode [ 202.132414][ T8783] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.139471][ T8783] bridge0: port 2(bridge_slave_1) entered disabled state [ 202.162354][ T8783] device bridge_slave_1 entered promiscuous mode 06:56:28 executing program 4: syz_mount_image$iso9660(&(0x7f00000002c0)='iso9660\x00', &(0x7f0000000380)='./file1\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)={[{@map_off='map=off'}]}) [ 202.227041][ T8783] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 202.247937][ T8783] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 202.293598][ T8783] team0: Port device team_slave_0 added [ 202.312406][ T8783] team0: Port device team_slave_1 added [ 202.352104][ T8780] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.359250][ T8780] bridge0: port 2(bridge_slave_1) entered forwarding state [ 202.367052][ T8780] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.374136][ T8780] bridge0: port 1(bridge_slave_0) entered forwarding state 06:56:28 executing program 5: syz_open_dev$video(&(0x7f0000000040)='/dev/video#\x00', 0x7, 0x9c5600) [ 202.523745][ T8783] device hsr_slave_0 entered promiscuous mode [ 202.572207][ T8783] device hsr_slave_1 entered promiscuous mode [ 202.611479][ T8783] debugfs: Directory 'hsr0' with parent '/' already present! [ 202.629343][ T8793] IPVS: ftp: loaded support on port[0] = 21 [ 202.647716][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.656116][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 202.682634][ T8791] IPVS: ftp: loaded support on port[0] = 21 [ 202.726274][ T8788] chnl_net:caif_netlink_parms(): no params data found [ 202.767144][ T8786] chnl_net:caif_netlink_parms(): no params data found [ 202.858247][ T8788] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.865546][ T8788] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.873283][ T8788] device bridge_slave_0 entered promiscuous mode [ 202.880812][ T8786] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.888430][ T8786] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.896276][ T8786] device bridge_slave_0 entered promiscuous mode [ 202.905340][ T8786] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.912442][ T8786] bridge0: port 2(bridge_slave_1) entered disabled state [ 202.920128][ T8786] device bridge_slave_1 entered promiscuous mode [ 202.930680][ T8788] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.941550][ T8788] bridge0: port 2(bridge_slave_1) entered disabled state [ 202.949195][ T8788] device bridge_slave_1 entered promiscuous mode [ 202.974676][ T8786] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 202.986944][ T8786] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 203.024599][ T8786] team0: Port device team_slave_0 added [ 203.033384][ T8788] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 203.045682][ T8788] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 203.082574][ T8786] team0: Port device team_slave_1 added [ 203.104121][ T8780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 203.167453][ T8780] 8021q: adding VLAN 0 to HW filter on device team0 [ 203.176000][ T8788] team0: Port device team_slave_0 added [ 203.189822][ T8788] team0: Port device team_slave_1 added [ 203.199681][ T8793] chnl_net:caif_netlink_parms(): no params data found [ 203.243053][ T8786] device hsr_slave_0 entered promiscuous mode [ 203.291888][ T8786] device hsr_slave_1 entered promiscuous mode [ 203.361436][ T8786] debugfs: Directory 'hsr0' with parent '/' already present! [ 203.371533][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 203.379702][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 203.428859][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 203.438581][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 203.447261][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.454376][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 203.481825][ T8791] chnl_net:caif_netlink_parms(): no params data found [ 203.523426][ T8788] device hsr_slave_0 entered promiscuous mode [ 203.611858][ T8788] device hsr_slave_1 entered promiscuous mode [ 203.661486][ T8788] debugfs: Directory 'hsr0' with parent '/' already present! [ 203.670074][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 203.678849][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 203.687272][ T8796] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.694358][ T8796] bridge0: port 2(bridge_slave_1) entered forwarding state [ 203.708754][ T8793] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.716316][ T8793] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.724815][ T8793] device bridge_slave_0 entered promiscuous mode [ 203.733664][ T8793] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.740708][ T8793] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.748729][ T8793] device bridge_slave_1 entered promiscuous mode [ 203.767455][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 203.776148][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 203.788157][ T8783] 8021q: adding VLAN 0 to HW filter on device bond0 [ 203.824855][ T8793] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 203.847974][ T8793] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 203.860879][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 203.870325][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 203.879026][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 203.887573][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 203.899198][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 203.916486][ T8783] 8021q: adding VLAN 0 to HW filter on device team0 [ 203.957455][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 203.967694][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 203.975469][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 203.984690][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 203.993767][ T2836] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.000805][ T2836] bridge0: port 1(bridge_slave_0) entered forwarding state [ 204.009014][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 204.026083][ T8793] team0: Port device team_slave_0 added [ 204.045491][ T8791] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.053260][ T8791] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.062404][ T8791] device bridge_slave_0 entered promiscuous mode [ 204.076058][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 204.084905][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 204.093341][ T8796] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.100372][ T8796] bridge0: port 2(bridge_slave_1) entered forwarding state [ 204.108021][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 204.116506][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 204.125178][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 204.133449][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 204.141967][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 204.150136][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 204.160469][ T8793] team0: Port device team_slave_1 added [ 204.178754][ T8791] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.187039][ T8791] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.194946][ T8791] device bridge_slave_1 entered promiscuous mode [ 204.203644][ T8780] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 204.264772][ T8793] device hsr_slave_0 entered promiscuous mode [ 204.301847][ T8793] device hsr_slave_1 entered promiscuous mode [ 204.361570][ T8793] debugfs: Directory 'hsr0' with parent '/' already present! [ 204.369805][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 204.378303][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 204.387408][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 204.407089][ T8783] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 204.417725][ T8783] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 204.430964][ T8791] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 204.443590][ T8791] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 204.462609][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 204.471162][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 204.483391][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 204.491791][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 204.500171][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 204.510319][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 204.519246][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 204.546341][ T8791] team0: Port device team_slave_0 added [ 204.569522][ T8783] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 204.594155][ T8791] team0: Port device team_slave_1 added [ 204.608265][ T8780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 204.703498][ T8791] device hsr_slave_0 entered promiscuous mode [ 204.741872][ T8791] device hsr_slave_1 entered promiscuous mode [ 204.791554][ T8791] debugfs: Directory 'hsr0' with parent '/' already present! [ 204.816426][ T8786] 8021q: adding VLAN 0 to HW filter on device bond0 [ 204.872330][ T8788] 8021q: adding VLAN 0 to HW filter on device bond0 [ 204.880833][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 204.889086][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 204.908902][ T8786] 8021q: adding VLAN 0 to HW filter on device team0 [ 204.936433][ T8788] 8021q: adding VLAN 0 to HW filter on device team0 [ 204.945934][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 204.963604][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 204.971207][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 204.980750][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 204.989286][ T3778] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.996373][ T3778] bridge0: port 1(bridge_slave_0) entered forwarding state [ 205.005459][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 06:56:31 executing program 1: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xd7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r1 = dup(r0) setsockopt$bt_rfcomm_RFCOMM_LM(r1, 0x12, 0x3, 0x0, 0x0) [ 205.059644][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 205.072650][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 205.081030][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 205.088157][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state 06:56:31 executing program 0: [ 205.149216][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 205.169813][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 205.191171][ T46] bridge0: port 2(bridge_slave_1) entered blocking state 06:56:31 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) bind$rxrpc(r3, &(0x7f0000000080)=@in4={0x21, 0x0, 0x2, 0x1c, {0x2, 0x0, @local}}, 0x24) r4 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r4, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10}, 0x24) sendmmsg(r4, &(0x7f0000005c00)=[{{0x0, 0xfffffffffffffd95, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0x1, "ec"}], 0x18}}], 0x1, 0x0) [ 205.198321][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 205.216684][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 205.225571][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 205.234235][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 205.241289][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 205.249067][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 205.269482][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 205.278382][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 205.289701][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 205.300971][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 205.309137][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 205.317252][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 205.350054][ T8790] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 205.359326][ T8790] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 205.370028][ T8790] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 205.379019][ T8790] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 205.387415][ T8790] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 205.396009][ T8790] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 205.407296][ T8786] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 205.436926][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 06:56:31 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) bind$rxrpc(r3, &(0x7f0000000080)=@in4={0x21, 0x0, 0x2, 0x1c, {0x2, 0x0, @local}}, 0x24) r4 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r4, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10}, 0x24) sendmmsg(r4, &(0x7f0000005c00)=[{{0x0, 0xfffffffffffffd95, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0x1, "ec"}], 0x18}}], 0x1, 0x0) 06:56:31 executing program 1: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xd7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x200000000000004) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000080)="480000001400190d09004beafd0d8c560a8447000bffe0064e230f00000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1) [ 205.446078][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 205.459418][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 205.499880][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 205.528630][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 205.537383][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 205.546124][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 205.555731][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 205.565957][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 205.589025][ T8788] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 205.597519][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready 06:56:31 executing program 0: syz_open_dev$sndseq(&(0x7f0000000240)='/dev/snd/seq\x00', 0x0, 0x0) [ 205.624829][ T8793] 8021q: adding VLAN 0 to HW filter on device bond0 06:56:31 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20010001, &(0x7f0000000280)={0xa, 0x0, 0x0, @remote, 0x2}, 0x1c) clone(0x1ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = dup2(r1, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x131f64) getsockopt$EBT_SO_GET_INIT_INFO(r2, 0x0, 0x82, 0x0, &(0x7f00000004c0)) sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r3, 0x1000000000015) [ 205.684370][ T8788] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 205.709888][ T8786] 8021q: adding VLAN 0 to HW filter on device batadv0 06:56:31 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@local, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x2c}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@remote, 0x0, 0x2b}, 0x0, @in=@empty}}, 0xe8) sendmmsg(r1, &(0x7f0000005fc0), 0x400023a, 0x0) [ 205.766220][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 205.782766][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 205.815827][ T8793] 8021q: adding VLAN 0 to HW filter on device team0 [ 205.854395][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 205.874817][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 205.905234][ T8796] bridge0: port 1(bridge_slave_0) entered blocking state [ 205.912415][ T8796] bridge0: port 1(bridge_slave_0) entered forwarding state [ 205.937373][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 205.964069][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 205.990271][ T8796] bridge0: port 2(bridge_slave_1) entered blocking state [ 205.997443][ T8796] bridge0: port 2(bridge_slave_1) entered forwarding state [ 206.022360][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 206.070034][ T8791] 8021q: adding VLAN 0 to HW filter on device bond0 [ 206.121776][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 206.130750][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 206.152871][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 206.172257][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 206.180846][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 206.212723][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 206.221224][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 206.233600][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 206.259493][ T8791] 8021q: adding VLAN 0 to HW filter on device team0 [ 206.269951][ T8793] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 206.284537][ T8793] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 206.313210][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 206.321171][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 206.344793][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 206.361141][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 206.369867][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 206.411759][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 206.420645][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready 06:56:32 executing program 2: 06:56:32 executing program 1: [ 206.452264][ T8796] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.459889][ T8796] bridge0: port 1(bridge_slave_0) entered forwarding state [ 206.480306][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 206.489115][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 206.510243][ T8796] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.517383][ T8796] bridge0: port 2(bridge_slave_1) entered forwarding state [ 206.558409][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 206.567679][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 206.577709][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 206.586891][ T8796] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 206.597614][ T8793] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 206.627439][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 206.636094][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 206.651157][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 206.659901][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 206.669187][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 206.679348][ T2836] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 206.692049][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 206.700337][ T3778] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 206.725814][ T8791] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 206.751098][ T8791] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 206.983984][ T8879] ISOFS: Unable to identify CD-ROM format. [ 207.073732][ T8879] ISOFS: Unable to identify CD-ROM format. 06:56:33 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e24, 0x0, @ipv4={[], [], @local}}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) sendmsg$inet6(0xffffffffffffffff, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x100800000000002, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000500)=ANY=[@ANYBLOB="01000000d5aeed0e6f9a903081b82fc9fc7f812ffe0ae0763c896d0c5683f5f608be2e7e614c3aa87e75"], 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000040), &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000380)={0x0, 0x7fffffff, 0xd4b, 0x1, 0x0, 0x0, 0x0, 0x37e9, {0x0, @in={{0x2, 0x4e24, @multicast2}}, 0x4, 0x7fffffff, 0xd7b, 0x1, 0x8}}, &(0x7f0000000440)=0xb0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000680)={r2, @in6={{0xa, 0x4e22, 0x0, @mcast2}}}, &(0x7f00000004c0)=0x84) r3 = syz_open_procfs(0x0, 0x0) read$FUSE(r3, 0x0, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000000100)) socket$inet6(0xa, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') sendfile(0xffffffffffffffff, r4, 0x0, 0x8607) r5 = socket$inet6(0xa, 0x100800000000002, 0x0) sendmsg$inet6(r5, 0x0, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000000)=0xd) write(r6, &(0x7f0000000040)="e0", 0xfffffe00) ioctl$TIOCSETD(r6, 0x5437, 0x0) 06:56:33 executing program 3: 06:56:33 executing program 0: 06:56:33 executing program 1: 06:56:33 executing program 2: 06:56:33 executing program 5: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x0, 0x0) close(r0) 06:56:33 executing program 0: [ 207.207284][ C1] hrtimer: interrupt took 30838 ns 06:56:33 executing program 1: 06:56:33 executing program 3: 06:56:33 executing program 2: 06:56:33 executing program 5: 06:56:33 executing program 0: 06:56:33 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x20310, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) accept$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x0) memfd_create(&(0x7f0000000540)='\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00v\x8e\x05\xf7\xc1U\xad}\xc6\x94|W>Zi$Nv8,\n\xa6=W^\xa3Y\x7f\x8b\x17(\'~\xf7k0TM{\xa9-\xcf\x97\x8f\x1f\x81\xdc\x1b\x7f\x8f{4Q\xda\xda\x02\xec\xb4\xf1\xdd\xcc\x8bRA\xda\x89Efn\x00s\xc2Zb\x01\x00M\xbe\xa3z\xab\xd3\xeb\x98\x88\xc4\xc6)A\x9fP\x93zhH\xe0\xd2\x81\xdb\xeeV\x8cM\xe9\xa06\xc2o\x19\"\xf6Iq\xd4\xdf\x97\xfb\xab\x04\xe8\xceI8\xb3\x1d\xcf%\x9bK\xc6\t\x01\xe1\x86a\xfa\xb8\xfb)\x88\xcd+\xc2`\xc2\xf5r5>k\xb0\xa0\x02\xfc\x16MO\x18\x9b\x06\x80b\xd1\x01\x00\x00\x00\x00\x00\x00\x00@\f\fL\xa5{Tk\x940\x17.\xa56.\xe0\x14\x1b=\xf0j\xd25\xe8\x15\xd8\x9e\xea\xd3\xd9G4\t\xc0\x9c.\'\xa9R3z$\xf2\x01\x88\xc0\x13\x12<\xc01j3\xd8\xb4CE7s\xe4\xa0\x9e\xdd\x801\x12M\xee\x13\xce\x9cu(\x8f.\xc83\xc7\xe6j\xf5\xb1\x9a\x00\x00\x00\x00\x00\x00\x00', 0x0) r1 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000440)='/proc/self//exe\x00', 0x3, 0x0) fadvise64(r1, 0x0, 0x0, 0x4) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000140)={0x8, 0x0, 0x3ff, 0x6, 0x6}) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, 0x0) creat(0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000008600), 0x0, 0x0) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000040)={'HL\x00'}, 0x0) r2 = openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40042409, 0x0) r3 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r3, &(0x7f0000000340)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) r4 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) sendto$rxrpc(0xffffffffffffffff, 0x0, 0x0, 0x4048004, 0x0, 0x0) sendmmsg(r4, &(0x7f0000000c00), 0x4000000000001e6, 0x0) 06:56:33 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_int(r0, 0x0, 0x1f, &(0x7f0000000000)=0x9, 0x4) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000280)='batadv0\x00', 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x400000000000288, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 06:56:33 executing program 2: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000000600)=""/164, 0xa4}], 0x1, 0x0) setxattr$trusted_overlay_upper(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0) mount$fuseblk(0x0, &(0x7f0000000200)='./file0/file0\x00', 0x0, 0x0, 0x0) read$FUSE(r0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000000780), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000140)={0x50, 0x0, 0x1}, 0x50) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) creat(&(0x7f00000000c0)='./file0/file0\x00', 0x0) write$FUSE_ENTRY(r0, &(0x7f0000000540)={0x90, 0x0, 0x3, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x85eb}}}, 0x90) 06:56:33 executing program 1: ioctl$sock_inet_SIOCRTMSG(0xffffffffffffffff, 0x890d, &(0x7f0000000100)={0x0, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x0, @dev}}) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0xaaaaaaaaaaaab31, &(0x7f0000000100)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0x17e, 0x400}], 0x2, 0x0) 06:56:33 executing program 5: 06:56:33 executing program 0: 06:56:33 executing program 5: 06:56:33 executing program 0: 06:56:33 executing program 5: 06:56:33 executing program 4: [ 207.828389][ T8926] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 207.858457][ T8926] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 207.940135][ T8926] EXT4-fs (loop1): group descriptors corrupted! 06:56:34 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0xff) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="0800b5055e0bcfe87b2071") connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) getpid() ioctl$sock_FIOSETOWN(0xffffffffffffffff, 0x8901, 0x0) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @remote}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='lo\x00\x00\x00\x00\xdf\xff\xff\xff\x00', 0x5) sendto$inet(r0, 0x0, 0x0, 0x1000000020000000, &(0x7f0000000080)={0x2, 0x4e20, @remote}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000240), 0x1192aca8268c9077, 0x3, 0x0, 0xffffffffffffff06) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000040)={'lo\x00'}) 06:56:34 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x1, &(0x7f00000000c0)={0x0, 0x1, 0x1}, &(0x7f0000000100)) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f00000002c0)={'rose0\x00', {0x2, 0x4e23, @local}}) dup(0xffffffffffffffff) ioctl$VT_RELDISP(0xffffffffffffffff, 0x5605) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x77359400}}, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r3, 0x227d, &(0x7f00000000c0)) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f00000000c0)) timerfd_settime(0xffffffffffffffff, 0x1, &(0x7f0000000300), &(0x7f0000000340)) pselect6(0x40, &(0x7f0000000280), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000080), 0x0) vmsplice(r0, &(0x7f0000000000), 0x0, 0x0) 06:56:34 executing program 4: 06:56:34 executing program 3: [ 208.173114][ T8952] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 06:56:34 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000580)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha12\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000000c0)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x20) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r2 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x10128) recvmmsg(r2, &(0x7f0000008a00)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000680)=""/120, 0x78}, {&(0x7f0000000300)=""/230, 0xff87}], 0x2}}], 0x1, 0x0, 0x0) 06:56:34 executing program 1: 06:56:34 executing program 4: 06:56:34 executing program 3: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, &(0x7f00000002c0)) ustat(0x7, &(0x7f0000000380)) 06:56:34 executing program 4: mkdir(&(0x7f0000000800)='./file0\x00', 0x0) mount(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000000)='cgroup\x00', 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) umount2(&(0x7f0000000080)='./file0\x00', 0x0) 06:56:34 executing program 1: r0 = socket$inet6(0xa, 0x80003, 0xff) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0800b5055e0bcfe87b2071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x11f) ioctl$int_in(r3, 0x5452, &(0x7f0000000040)=0x5) connect$inet(r4, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) write$binfmt_misc(r2, &(0x7f0000000240)=ANY=[], 0x6f5) splice(r1, 0x0, r4, 0x0, 0x10003, 0x0) 06:56:34 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7a, 0x0, [0x4d0, 0x0, 0xc0010058], [0x3a]}) 06:56:34 executing program 2: connect$inet6(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f000095bffc), 0x4) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(0x0, 0x140, 0x10) r1 = open(&(0x7f0000000100)='./file0\x00', 0x140, 0x0) fcntl$setlease(r1, 0x400, 0x1) write$FUSE_IOCTL(r0, &(0x7f0000000140)={0x4b3a827937f4e4f9, 0x0, 0x0, {0x8, 0x0, 0x80, 0x182}}, 0xfffffd7a) r2 = socket$inet6(0xa, 0x3, 0x6) r3 = syz_open_procfs(0x0, &(0x7f0000000600)='net/ip6_flowlabel\x00n\xc01\x14\x894X\xed\xc1\xc9\xd8\xdcK\r\x8d\xae\x98&@\xd0\xe6\xbbQ\xd7\xffYn\x1c\x92\xde\x0e\xaa1\x91\x98\xe9\x1f\nMCi|+\xcdw\xf0\x176Z\xf1`\xac\xf3;\xd6d2\xeb\xe5\f\x0e\x8b\xda\xf7\xfc9\xfe\xff4\xef\'\xa19q\x93\"\x7fG3\xc1E\xe6e6\xc6\xc2u\x11% \xe7+0\x97\x84;\\\xda\xc4\x80\xc3\xb18N\xbfY%\x05\xf8\x85\x89\xfc\xd2\xd7') sendfile(r2, r3, &(0x7f0000000240)=0x202, 0x4000000000dc) [ 208.733396][ T8982] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. 06:56:34 executing program 5: syz_emit_ethernet(0x8a, &(0x7f0000000600)={@local, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x54, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, {[@exp_smc={0xfe, 0x6}, @exp_fastopen={0xfe, 0x4}, @window={0x3, 0x2}, @md5sig={0x13, 0x12, "d31c8190da8dfe461d135b075be2c1c4"}, @md5sig={0x13, 0x12, "5b3b4bc0ca96fcedefad47a621547516"}, @exp_fastopen={0xfe, 0xc, 0xf989, "908fabfe9a69b583"}]}}}}}}}}, 0x0) 06:56:35 executing program 0: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) timer_create(0x1, &(0x7f00000000c0)={0x0, 0x1, 0x1}, &(0x7f0000000100)) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f00000002c0)={'rose0\x00', {0x2, 0x4e23, @local}}) dup(0xffffffffffffffff) ioctl$VT_RELDISP(0xffffffffffffffff, 0x5605) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x77359400}}, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r3, 0x227d, &(0x7f00000000c0)) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f00000000c0)) timerfd_settime(0xffffffffffffffff, 0x1, &(0x7f0000000300), &(0x7f0000000340)) pselect6(0x40, &(0x7f0000000280), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000080), 0x0) vmsplice(r0, &(0x7f0000000000), 0x0, 0x0) 06:56:35 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f00000000c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000040), r3}}, 0x18) 06:56:35 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000024000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f00000000c0)="b8010000000f01d9c481d5559f36b20000b9f80a00000f3266baf80c5c4e4f8bef66bafc0cb001eef20f1abfc400000066b849000f00d066b8ad000f00d83e67450f01d10ff1df2e0f06", 0x4a}], 0x1, 0x0, 0x0, 0x0) openat$cachefiles(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae67, 0x0) openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/audio\x00', 0x0, 0x0) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f00000002c0)) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000280)={{{@in6=@remote, @in=@empty}}, {{@in6=@remote}, 0x0, @in6=@local}}, 0x0) lstat(0x0, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000380)) sched_setscheduler(0x0, 0x0, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000240), &(0x7f00000002c0), 0x0) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240), 0x0) lstat(0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000280)={'ip6tnl0\x00'}) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) getresuid(0x0, 0x0, &(0x7f0000000300)) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) syz_open_dev$midi(&(0x7f0000003200)='/dev/midi#\x00', 0x0, 0x0) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) getresuid(0x0, 0x0, &(0x7f0000003300)) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x2, 0x13012, r2, 0x0) fstat(0xffffffffffffffff, 0x0) sendmsg$netlink(r1, &(0x7f0000003480)={0x0, 0x0, &(0x7f0000003040)=[{&(0x7f00000003c0)={0x18, 0x0, 0x0, 0x0, 0x0, "", [@typed={0x8, 0x0, @ipv4=@remote}]}, 0x18}], 0x1}, 0x0) 06:56:35 executing program 2: r0 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000180)={0x0, 0xff8, 0x1, {0x5, @vbi={0x0, 0x0, 0xffffffffffffff81, 0x0, [], [0x1]}}}) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r0, 0x0, 0x0) 06:56:35 executing program 3: r0 = perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000001280)='/dev/bus/usb/00#/00#\x00', 0x200, 0x0) syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x0, 0x0) dup2(r0, r1) 06:56:35 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f00000000c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000040), r3}}, 0x18) 06:56:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x4001000008912, &(0x7f00000000c0)="0800b5055e0bcfe87b0071") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x2c, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8}]}]}]}, 0x2c}}, 0x0) 06:56:35 executing program 2: 06:56:35 executing program 3: [ 209.241595][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 209.247626][ C1] protocol 88fb is buggy, dev hsr_slave_1 06:56:35 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f00000000c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000040), r3}}, 0x18) 06:56:35 executing program 3: 06:56:35 executing program 5: 06:56:35 executing program 0: 06:56:35 executing program 2: 06:56:35 executing program 3: 06:56:35 executing program 5: 06:56:35 executing program 1: 06:56:35 executing program 4: 06:56:36 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x5) 06:56:36 executing program 2: connect$inet6(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x8000000000000802, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xd) write(r0, &(0x7f0000000040)="e0", 0xfffffe00) ioctl$TIOCSETD(r0, 0x5437, 0x0) 06:56:36 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x20310, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000440)='/proc/self//exe\x00', 0x3, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x6}) creat(0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000008600), 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) 06:56:36 executing program 3: syz_open_dev$sndseq(&(0x7f0000000240)='/dev/snd/seq\x00', 0x0, 0x6000) 06:56:36 executing program 5: gettid() timer_create(0x0, 0x0, &(0x7f0000000400)) timer_delete(0x0) 06:56:36 executing program 0: setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) mlockall(0x1) write$UHID_DESTROY(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0xfffffffffffffdef, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_pts(0xffffffffffffffff, 0x800) mlock(&(0x7f0000ffc000/0x2000)=nil, 0x2000) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) 06:56:36 executing program 3: r0 = socket$vsock_dgram(0x28, 0x2, 0x0) bind$vsock_dgram(r0, &(0x7f0000000080)={0x28, 0x0, 0x0, @reserved}, 0x10) r1 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video1\x00', 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0205647, &(0x7f0000000100)={0x9d0000, 0x1, 0x3f, [], &(0x7f00000000c0)={0xa20933, 0x2, [], @string=&(0x7f0000000140)=0xa4}}) 06:56:36 executing program 5: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f00000000c0)="f2a60f20e06635002000000f22e0b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0xd}], 0x66f8248efc0ebf9, 0x0, 0x0, 0xfffffe24) r3 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4ce]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) socket(0x0, 0x0, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0xb001d3f613c882aa, 0x0) mq_timedreceive(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, &(0x7f00000004c0)=ANY=[@ANYBLOB="0000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000f4070000000100000000000004000000000006000600000000000000ff030000de6b99d20000000000000000000000000000000000000000000000000400000080000000070000000000000008000000000000000010000000000000030000000000000000000000be59000000000000000000000000000000000000000000000000000000000000000000009800000000000000000000000000009661b0d7dc63a12ec61334abf50000000000000000000089fe00000000006442e27804000000000000000000000000c402dffa41980d919c0292b512171345d560e0d5a818b9ee1a2c0fc04ea0369e6344d1d215c75cb275814647697e0022e17b5d3a8047bb01748233e39337d3d576de7540370db1beeab245b8d82af46e66d994729e6890ee3b9dd7dd8c1b9b7d91ab4594c3ee44a0bddf11ad79de7a1a5c66"]) r5 = openat(r3, &(0x7f0000000000)='./file0\x00', 0x125000, 0x0) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x7f, 0x908bb04675f6e605, 0x2, 0x11, "5ca61de91e27ae575aadcc6adb0edfeae37b5f146070f57a745b246d0af7f37cc79999d846ee4bd873e3f4fd4f26e94bff2d481d7f34fa7a99fda8837de8dda1", "95952104cf9381b4b24958460c182fb1109988a53e011fbf4ebd35dbac9cc647", [0xffffffffffffffff, 0xffff]}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) syz_open_dev$amidi(&(0x7f00000001c0)='/dev/amidi#\x00', 0x9, 0x145002) 06:56:36 executing program 4: timer_create(0x0, &(0x7f0000066000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00009b1ffc)) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400400, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000080)='lp\x00', 0x3) sendto$inet6(r1, &(0x7f0000000080), 0xffffffffffffffde, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x1c9c380}, {0x0, 0x9}}, 0x0) tkill(r2, 0x18) 06:56:36 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000600)={'\x00\xacs\x00\x00\x00\x00\x00\xec\x97?\x82\x0f|@\x00', 0xc201}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x7) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) dup3(r2, r1, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000300)={0x0}, &(0x7f0000000340)=0xc) ptrace$peekuser(0x3, r3, 0xe68) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x80800) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, &(0x7f0000000080)=[@in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e23, 0x80, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0xffffffff}], 0x2c) set_robust_list(&(0x7f00000004c0)={&(0x7f0000000480)={&(0x7f0000000400)}, 0x1, &(0x7f0000000240)={&(0x7f0000000440)}}, 0x18) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f00000000c0)=@add_del={0x2, &(0x7f0000000000)='ip6erspan0\x00'}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = fcntl$dupfd(r6, 0x406, r5) delete_module(&(0x7f0000000380)='ip6erspan0\x00\aH\x00\x00\x02', 0x200) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000140)=@add_del={0x3, &(0x7f0000000100)='ip6erspan0\x00\aH\x00\x00\x02'}) 06:56:36 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) r1 = socket(0x400000000000010, 0x802, 0x0) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x104c0, 0x0) ioctl$DRM_IOCTL_AGP_ACQUIRE(r2, 0x6430) write(r1, &(0x7f00000000c0)="24000000200099f0003be90000ed190e020008160000100000ba1080080002007f196be0", 0x24) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$sock_int(r0, 0x1, 0x22, &(0x7f00000001c0)=0xffffffff, 0x4) 06:56:36 executing program 3: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x510, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(&(0x7f0000000100)=[{r0}, {0xffffffffffffffff, 0x188}, {}, {}], 0x4, 0x1) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='cmdline\x00') preadv(r1, &(0x7f0000001400)=[{&(0x7f0000000040)=""/113, 0x200000b1}], 0x1, 0x0) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f00000002c0)={0x9, 0x8001, 0x8, 0x8, 0x3, 0x7}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000600)={'\x00\xacs\x00\x00\x00\x00\x00\xec\x97?\x82\x0f|@\x00', 0xc201}) ioctl$TUNSETLINK(r2, 0x400454cd, 0x7) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) dup3(r3, r2, 0x0) ioctl$sock_inet_SIOCDARP(r3, 0x8953, &(0x7f0000000340)={{0x2, 0x4e24, @multicast1}, {0x1}, 0x20, {0x2, 0x4e21, @rand_addr=0x1f}, 'ipddp0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x81, &(0x7f0000000a00)=ANY=[@ANYBLOB="8500000007000000250000000000000095000001000000005fa8953cdc5d2cfac6f4dc462ee5a73096bda5de3d00001ac895dbe473653fe3a073148d1b509cfb5f6807894ba37bd7e3005d0a72a8d775950caa6ae42ee7b6916c9573719b1146ef98a91ebf42530460360161522a87a4bd189022e6a6f65bbffaea80ded191191450f0f1c00db5d51ee1adcdf349c6719a81f3a14e05472154aca532b3aa402417e66b177dbf874d8d9bbde17ac93b062a88a818fb4b3ecd08a86fc3bc9ae949a711b4e2ad7c46afb2c044c5fd12718d57e634a584b45309b9f6c8fab32752e399f132985eecdd2a3447a8c8563a6e0d2430d1f56b5736342ca8711fba51a77ef65ff0e212279b020000000000000096ea2475df2ab856a3fc33fa1fb63759b3295b070000853ce053d0538bece30c01d6ed13e6cd8131f1b813cd1ffd6c53d88220aee173e1868e7856c72a40a2146ac1b52176f7ade3da8a773beecb21bb44eb59797da81656f66518786a17139eeec18bd23a17f61f2b931a34b9797fa4ebdf1536cf167e9e59258c2a7f60f73785fa0f750ccf77862e75ddea2bd8e833e72f9a181be65cd14d7225d8c21300000000009ada063389000000000000000021a8013392ec38fabe0f6982df4aa8e53b152795723c81472c438e44c806eddaf3b212cca07a6d73d34afe871bd81bc6b3c0eb38f12bb7d7df9926e5c063306950175fa375d52f3c6cc88f1fe493aa4b6e5e8ef5570d5a778056a6239e943e103676bec97ae677cfd9ef4ae5f4090000000000000062857e40fcaa167900e1f6ecc6a17b070a75ef8c96aa14c90b338a4107843e2fca12509aeb1cf03723865397de3921344ebc0dbc0db5a59bd0f3da92a4d2fdd52c8d0dbf3c7c1096381dca8baacafd1497f5554f8a5a08a99bb25c9218c304811ee4e94cf3a0dfc218128f799f7da20cb3851b52b5556394d42f248f35da79c5000d3dc71c4dcaebd997c94549e82a24b48afa424b57143c95d5dd8d007887d067fd78ca044b524b6990f0a1a8e249720d946c7b0d3a596fce6e646f1e685aeaa0a0b7056afa41e9f3385073019b33437778435cc7af718a6e06d00e69f09a138b98bc0f3d7549df682faa20f0a9d39b24752506831884d82b015499c84ce13e4f5af2ff7f0000322e6ebf3d5c9cbad3ca197140803b3793b8a3b61e37172ca28cccb84ce9cc83dc21c31cf1fa9a430004000009b5021b49828236f41f86ca19724535b1b9131e76f3768c8c381987c3defb72efab24848eead6ffece3be98a04a28fd67fdc98adb34a13920f5df459447e65a532baab89ce3e495bc0db5aa57f92d93ef88dd8d398dea55134a65af221807464b8c79cb7bb5e6b033231f896ddeb5fa5f4bb0a10bc7e92d26c821eca7b9d37fa6728bf0e79f93afc5fa6c1d9f8e6f51fe741fed35cf70ba30583802b14a869863"], &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sysinfo(&(0x7f0000000000)=""/50) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240)={0x0}, &(0x7f0000000280)=0xc) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x1, 0x7, 0x6, 0x1f, 0x0, 0x1000000000000000, 0xc34db6f6101ea925, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x4, @perf_bp={&(0x7f0000000180), 0x2}, 0x1084, 0x8000000000b5c7, 0x80000000, 0x0, 0x4, 0xb0, 0x9}, r4, 0x0, 0xffffffffffffffff, 0x3) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x100000) times(&(0x7f0000000300)) socketpair(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') 06:56:36 executing program 4: r0 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x6, 0x800) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100)='devlink\x00') r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r3 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x161) sendmsg$nl_crypto(r2, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200080}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)=ANY=[@ANYBLOB="f80000001000280225bd7000ffdbdf256a6974746572656e74726f70795f726e670000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3ffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000042000000000000000000000700010008000000080001000900000008000100fc030000"], 0xf8}, 0x1, 0x0, 0x0, 0x50}, 0x80) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r5 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0x3e, &(0x7f00000002c0)=r4, 0x161) ioctl$KVM_DEASSIGN_DEV_IRQ(r4, 0x4040ae75, &(0x7f0000000500)={0x1, 0x7, 0x0, 0x683}) sendmsg$DEVLINK_CMD_PORT_SET(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="64010000", @ANYRES16=r1, @ANYBLOB="000228bd7000fedbdf2506000000150001006e657464657673696d000000100002006e657464657673696d30000008000300020000000800040003000000100001006e657464657673696d000000100002006e657464657673696d30f1d9c32aca1d000008000300030000000800040003000000100001006e657464657673696d000000100002006e50188659105c1f8230000008000300000000000800040001000000100001006e657464657673696d000000100002006e657464657673696d30000008000300030000000800040000000000100001006e657464657673696d000000100002006e657464657673696d30000008000300020000000800040000000000100001006e657464657673696d000000100002006e657464657673696d30000008000300030000000800040000000000100001000000100002006e657464657673696d30000008000300010000000800"/350], 0x164}, 0x1, 0x0, 0x0, 0x4820}, 0xd6d5d40617d262a7) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r6, 0x1000008912, &(0x7f0000000000)="0800b5055e0bcfe87b0071") r7 = socket$inet6(0xa, 0x800000000000002, 0x0) bind$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x14}, 0x1c) connect$inet6(r7, &(0x7f00000000c0)={0xa, 0x0, 0x0, @rand_addr="ff3e6808e92b7abafc47d822996f60e4"}, 0x1c) sendmmsg(r7, &(0x7f0000006d00)=[{{0x0, 0x1000000, 0x0}}], 0xc6, 0x0) 06:56:36 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xd75, 0x80000000}, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(0x0, 0x12) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000005000/0x3000)=nil, 0x3000, 0x0) getegid() r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) r3 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) ioctl$NS_GET_OWNER_UID(r1, 0xb704, &(0x7f00000001c0)=0x0) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x1000000, &(0x7f00000004c0)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@default_permissions='default_permissions'}], [{@obj_role={'obj_role'}}, {@smackfshat={'smackfshat', 0x3d, '[cgroupvboxnet1'}}, {@fsuuid={'fsuuid', 0x3d, {[0x62, 0x66, 0x62], 0x2d, [0x38, 0x32, 0x0, 0x64], 0x2d, [0x0, 0x38, 0x64, 0x37], 0x2d, [0x32, 0x62, 0x32], 0x2d, [0x63, 0x36, 0x31, 0x0, 0x0, 0x0, 0x0, 0x64]}}}, {@seclabel='seclabel'}]}}) keyctl$chown(0x4, r3, r4, r5) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_int(r2, 0x6, 0x19, &(0x7f0000000100)=0x6, 0x4) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r7 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r7, 0x1, 0x3e, &(0x7f00000002c0)=r6, 0x161) r8 = openat$cgroup_ro(r6, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x0, 0x0) getsockopt$inet_int(r8, 0x0, 0x3, &(0x7f00000003c0), &(0x7f0000000400)=0x4) ioctl$INOTIFY_IOC_SETNEXTWD(0xffffffffffffffff, 0x40044900, 0x0) setsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x50) sendto$inet(r2, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) getsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000040)={@mcast2}, &(0x7f00000000c0)=0x14) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) fsync(r0) syz_open_procfs(0x0, &(0x7f0000000080)='oom_adj\x00') 06:56:37 executing program 4: unshare(0x8020000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000600)={'\x00\xacs\x00\x00\x00\x00\x00\xec\x97?\x82\x0f|@\x00', 0xc201}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x7) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) dup3(r2, r1, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000180)={r2, 0x100, 0xcae4, "093bf8058e6c8ededbc23e4e094683e878ab306b218a168cda5a93d47b7186172d9c2009f120a8026ddc8b08095200f4753ece35d87078d35003497d50559e5aeacc570d5ef8fe45140cca7ad398e659ac9bdf249238206360505f4d6c4947098226e6551dfdd22d6774e3e84f3b6691d0d06eeb6081c65943f9d56f889104420f501374878e85a1"}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r0, 0xc08c5335, &(0x7f0000000080)={0xffff, 0x2, 0xdfd, 'queue1\x00', 0x20}) semget$private(0x0, 0x403, 0x0) r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/ipc\x00') pipe2$9p(0x0, 0x0) semtimedop(0x0, &(0x7f0000000040)=[{0x0, 0x0, 0x1800}], 0x1, 0x0) setns(r3, 0x0) eventfd(0xfffffe00) 06:56:37 executing program 5: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000011000/0x18000)=nil, &(0x7f0000000240)=[@textreal={0x8, &(0x7f00000000c0)="f2a60f20e06635002000000f22e0b00fee0f090f3036f30f1a970000660f3806581e0f08bad004b0beeef30f2af8baa100b000ee", 0xd}], 0x66f8248efc0ebf9, 0x0, 0x0, 0xfffffe24) r3 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4ce]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) socket(0x0, 0x0, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0xb001d3f613c882aa, 0x0) mq_timedreceive(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, &(0x7f00000004c0)=ANY=[@ANYBLOB="0000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000f4070000000100000000000004000000000006000600000000000000ff030000de6b99d20000000000000000000000000000000000000000000000000400000080000000070000000000000008000000000000000010000000000000030000000000000000000000be59000000000000000000000000000000000000000000000000000000000000000000009800000000000000000000000000009661b0d7dc63a12ec61334abf50000000000000000000089fe00000000006442e27804000000000000000000000000c402dffa41980d919c0292b512171345d560e0d5a818b9ee1a2c0fc04ea0369e6344d1d215c75cb275814647697e0022e17b5d3a8047bb01748233e39337d3d576de7540370db1beeab245b8d82af46e66d994729e6890ee3b9dd7dd8c1b9b7d91ab4594c3ee44a0bddf11ad79de7a1a5c66"]) r5 = openat(r3, &(0x7f0000000000)='./file0\x00', 0x125000, 0x0) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x7f, 0x908bb04675f6e605, 0x2, 0x11, "5ca61de91e27ae575aadcc6adb0edfeae37b5f146070f57a745b246d0af7f37cc79999d846ee4bd873e3f4fd4f26e94bff2d481d7f34fa7a99fda8837de8dda1", "95952104cf9381b4b24958460c182fb1109988a53e011fbf4ebd35dbac9cc647", [0xffffffffffffffff, 0xffff]}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) syz_open_dev$amidi(&(0x7f00000001c0)='/dev/amidi#\x00', 0x9, 0x145002) 06:56:37 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000000)=0xb4, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x33, &(0x7f0000000300)={0x1, &(0x7f0000000080)=[{0x6}]}, 0x10) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x5, @loopback}, 0x1a2) fsetxattr$trusted_overlay_upper(r0, &(0x7f00000000c0)='trusted.overlay.upper\x00', &(0x7f0000000100)={0x0, 0xfb, 0xdf, 0x9, 0x4, "c08e6e46e900e924b5cd7c24abb1ef47", "63441762c331609178625d99fd9f513392a0c81f2fb98c708575eb42a97d18bb21a4909d14e672865d798e39bdc20f7c5f2a1a07780099d58dabd3ecd7954d1fcc869e2e89025f991dfeb62418bebac5fbfe2ff29d20f47a99ee1299c553c3f3adf6de8f9a7dc2d5d0f2b235069429454ee29b386ca74319696451e88a495e50e8f400647cba5ec80f3b2befb2ffdbfe46f08d2d2bda50d7bb2ac9deff68589b82af2cf3520abb17a6609c39acbea0201c92f7db13bd20ecbd459de4664e4a3f6be40c58c756b68042d2"}, 0xdf, 0x1) 06:56:37 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xd75, 0x80000000}, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(0x0, 0x12) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000005000/0x3000)=nil, 0x3000, 0x0) getegid() r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) r3 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) ioctl$NS_GET_OWNER_UID(r1, 0xb704, &(0x7f00000001c0)=0x0) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x1000000, &(0x7f00000004c0)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@default_permissions='default_permissions'}], [{@obj_role={'obj_role'}}, {@smackfshat={'smackfshat', 0x3d, '[cgroupvboxnet1'}}, {@fsuuid={'fsuuid', 0x3d, {[0x62, 0x66, 0x62], 0x2d, [0x38, 0x32, 0x0, 0x64], 0x2d, [0x0, 0x38, 0x64, 0x37], 0x2d, [0x32, 0x62, 0x32], 0x2d, [0x63, 0x36, 0x31, 0x0, 0x0, 0x0, 0x0, 0x64]}}}, {@seclabel='seclabel'}]}}) keyctl$chown(0x4, r3, r4, r5) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_int(r2, 0x6, 0x19, &(0x7f0000000100)=0x6, 0x4) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r7 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r7, 0x1, 0x3e, &(0x7f00000002c0)=r6, 0x161) r8 = openat$cgroup_ro(r6, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x0, 0x0) getsockopt$inet_int(r8, 0x0, 0x3, &(0x7f00000003c0), &(0x7f0000000400)=0x4) ioctl$INOTIFY_IOC_SETNEXTWD(0xffffffffffffffff, 0x40044900, 0x0) setsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x50) sendto$inet(r2, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) getsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000040)={@mcast2}, &(0x7f00000000c0)=0x14) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) fsync(r0) syz_open_procfs(0x0, &(0x7f0000000080)='oom_adj\x00') 06:56:37 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xd75, 0x80000000}, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(0x0, 0x12) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000005000/0x3000)=nil, 0x3000, 0x0) getegid() r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) r3 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) ioctl$NS_GET_OWNER_UID(r1, 0xb704, &(0x7f00000001c0)=0x0) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x1000000, &(0x7f00000004c0)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@default_permissions='default_permissions'}], [{@obj_role={'obj_role'}}, {@smackfshat={'smackfshat', 0x3d, '[cgroupvboxnet1'}}, {@fsuuid={'fsuuid', 0x3d, {[0x62, 0x66, 0x62], 0x2d, [0x38, 0x32, 0x0, 0x64], 0x2d, [0x0, 0x38, 0x64, 0x37], 0x2d, [0x32, 0x62, 0x32], 0x2d, [0x63, 0x36, 0x31, 0x0, 0x0, 0x0, 0x0, 0x64]}}}, {@seclabel='seclabel'}]}}) keyctl$chown(0x4, r3, r4, r5) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_int(r2, 0x6, 0x19, &(0x7f0000000100)=0x6, 0x4) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r7 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r7, 0x1, 0x3e, &(0x7f00000002c0)=r6, 0x161) r8 = openat$cgroup_ro(r6, &(0x7f0000000240)='cpuset.effective_cpus\x00', 0x0, 0x0) getsockopt$inet_int(r8, 0x0, 0x3, &(0x7f00000003c0), &(0x7f0000000400)=0x4) ioctl$INOTIFY_IOC_SETNEXTWD(0xffffffffffffffff, 0x40044900, 0x0) setsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x50) sendto$inet(r2, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) getsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000040)={@mcast2}, &(0x7f00000000c0)=0x14) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) fsync(r0) syz_open_procfs(0x0, &(0x7f0000000080)='oom_adj\x00') 06:56:37 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000001d80)='./file0\x00', 0x8) acct(0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000440)='proc\x00', 0x0, 0x0) r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) getdents(r0, &(0x7f00000005c0)=""/223, 0xfc61) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x1002) tee(r1, r2, 0x9, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_procfs(0x0, 0x0) 06:56:37 executing program 1: r0 = socket(0x1e, 0x4, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x40001, 0x0) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000000140)) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req={0x80, 0x0, 0x3}, 0xe1) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000040)=@req={0x80, 0x0, 0x3}, 0xe1) sendto$inet6(r2, &(0x7f00000003c0)="84", 0x1, 0x0, 0x0, 0x0) recvmsg$kcm(r0, &(0x7f0000000780)={&(0x7f0000000000)=@sco, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000080)=""/84, 0x54}], 0x1}, 0x0) 06:56:37 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='coredump_filter\x00') ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r1, 0xc0096616, &(0x7f0000000540)=ANY=[@ANYBLOB="e5f9a4000000008aa4faca825d1904e2ca93e5c74e5a7430848a943f32fdf2d33d55efe1b4fa219e58e890bd9a4b31051514cbd7a9f409b77dee"]) sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r2 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000340), 0x41395527) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3, 0x0, 0xfffffffffffffffb}, 0x0) socketpair(0x1b, 0xa, 0xfa, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000380)='/dev/zero\x00', 0x0, 0x0) getsockopt$sock_buf(r6, 0x1, 0x1a, &(0x7f00000003c0)=""/201, &(0x7f0000000500)=0xc9) accept$unix(r5, &(0x7f00000002c0), &(0x7f0000000340)=0x6e) r7 = socket$unix(0x1, 0x5, 0x0) signalfd4(r7, &(0x7f00000000c0)={0x4}, 0x8, 0x1800) socket$inet(0x2, 0x2, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB="280000002200040000000000000000000000000005ff1400fe8000000000000000000000000000aa"], 0x28}, 0x1, 0xfdffffff00000000, 0x0, 0x4040}, 0x0) 06:56:37 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000080), 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x3) ioctl$VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc100565c, &(0x7f0000000240)={0x0, 0x9, 0x0, {0xb, @pix={0x0, 0xffffffff00000001}}}) ioctl$TIOCMBIC(0xffffffffffffffff, 0x5417, &(0x7f0000000200)=0x9) syz_open_dev$vcsa(0x0, 0x0, 0x102) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000000600)=0x1da9, 0x4) r2 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x5, 0x0) ioctl$VIDIOC_G_PRIORITY(r2, 0x80045643, 0x0) r3 = syz_open_dev$swradio(&(0x7f0000000180)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f0000000240)={0x0, 0x9, 0x1}) read(0xffffffffffffffff, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r4 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f00000000c0)={0x0, 0x0, 0x1, 0x3ff, 0x80}, &(0x7f0000000140)=0x14) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x9705}, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r0, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) 06:56:38 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) ioctl$TIOCSSERIAL(r0, 0x541f, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000280)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000000000040000000001000000004000000040010080002e360e59acaa4f37be5a0000ffff53ef", 0x261, 0x400}], 0x1, 0x0) 06:56:38 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x68, 0x10, 0xe3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_MASTER={0x8, 0xa, 0x6}, @IFLA_LINKINFO={0x40, 0x12, @gre={{0x8, 0x1, 'gre\x00'}, {0x34, 0x2, [@gre_common_policy=[@IFLA_GRE_TOS={0x8, 0x9, 0x40}, @IFLA_GRE_ENCAP_TYPE={0x8, 0xe, 0x2}, @IFLA_GRE_OKEY={0x8, 0x5, 0x18e}, @IFLA_GRE_TTL={0x8, 0x8, 0xb5}, @IFLA_GRE_ERSPAN_INDEX={0x8, 0x15, 0xa422f}, @IFLA_GRE_ERSPAN_DIR={0x8, 0x17, 0x1}]]}}}]}, 0x68}, 0x1, 0x0, 0x0, 0x4004008}, 0x28800) [ 212.432031][ T9173] EXT4-fs (loop1): Unrecognized mount option "" or missing value [ 212.439957][ T9173] EXT4-fs (loop1): failed to parse options in superblock:  [ 212.448127][ T9173] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 212.457865][ T9173] EXT4-fs (loop1): unsupported descriptor size 0 [ 212.543744][ T9176] EXT4-fs (loop1): Unrecognized mount option "" or missing value [ 212.563412][ T9179] netlink: 'syz-executor.4': attribute type 9 has an invalid length. [ 212.571698][ T9176] EXT4-fs (loop1): failed to parse options in superblock:  06:56:38 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000001d80)='./file0\x00', 0x8) acct(0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000440)='proc\x00', 0x0, 0x0) r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) getdents(r0, &(0x7f00000005c0)=""/223, 0xfc61) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x1002) tee(r1, r2, 0x9, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_procfs(0x0, 0x0) [ 212.590711][ T9176] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 212.601768][ T9176] EXT4-fs (loop1): unsupported descriptor size 0 [ 212.608281][ T9179] netlink: 'syz-executor.4': attribute type 14 has an invalid length. [ 212.622841][ T9179] netlink: 'syz-executor.4': attribute type 8 has an invalid length. [ 212.636617][ T9179] netlink: 'syz-executor.4': attribute type 23 has an invalid length. [ 212.657383][ T9181] netlink: 'syz-executor.4': attribute type 9 has an invalid length. 06:56:38 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x9}, 0x18010, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r0, &(0x7f00000000c0)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e24, @remote}}, 0x24) sendmmsg(0xffffffffffffffff, &(0x7f0000005c00), 0x0, 0x0) sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0xfffffffffffffd95, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0x1, "ec"}], 0x18}}], 0x1, 0x0) [ 212.737304][ T9181] netlink: 'syz-executor.4': attribute type 14 has an invalid length. [ 212.751751][ T9181] netlink: 'syz-executor.4': attribute type 8 has an invalid length. [ 212.772396][ T9181] netlink: 'syz-executor.4': attribute type 23 has an invalid length. 06:56:38 executing program 4: r0 = socket(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r2 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f00000002c0)=r1, 0x161) accept4$ax25(r1, 0x0, &(0x7f0000000100), 0x80000) setsockopt$EBT_SO_SET_ENTRIES(r0, 0xa00000000000000, 0x80, &(0x7f0000000040)=@broute={'\froute\x00', 0x20, 0x1, 0x948, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000b00000000000000000062726964676530000000000000000000626f6e645f736c6176655f3000000000736974300000000000000000000000007465716c3000000000000000000000000000000000000000000000000180c20000000000000000000000b8080000b8080000e8080000616d6f6e670000000000000000000000000000000000000000000400000000001804000000000000000000000c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000a74235951be70000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000095f379809ea0d0815215159132000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d6599200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000053cbf7eee533b170000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000da7728b2a10f85275591dc0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000094370000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000067a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000072656469726563740000000000000000000000000000000000000000000000000800000000000000"]}, 0x9c0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000600)={'\x00\xacs\x00\x00\x00\x00\x00\xec\x97?\x82\x0f|@\x00', 0xc201}) ioctl$TUNSETLINK(r3, 0x400454cd, 0x7) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) dup3(r4, r3, 0x0) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r4, 0x84, 0xc, &(0x7f0000000000), &(0x7f00000000c0)=0x4) 06:56:38 executing program 2: r0 = socket$kcm(0x2, 0x20000000002, 0x73) recvmsg$kcm(r0, 0x0, 0x100) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_MAP_FREEZE(0x16, &(0x7f0000000400)=r1, 0x4) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000c80)=[{0x0}, {&(0x7f0000000740)=""/146, 0x92}, {0x0}, {&(0x7f00000008c0)=""/223, 0xdf}, {&(0x7f0000000ac0)=""/243, 0xf3}, {&(0x7f0000000bc0)=""/144, 0x90}], 0x6}, 0x40) perf_event_open(0x0, 0xffffffffffffffff, 0x6, r2, 0x8) ioctl$TUNSETPERSIST(r2, 0x400454cb, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) close(0xffffffffffffffff) r6 = socket$kcm(0xa, 0xffffffffffffffff, 0x11) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000002f40)={&(0x7f0000001c40)=@sco, 0x80, &(0x7f0000002480)=[{0x0}, {&(0x7f0000001e80)=""/127, 0x7f}, {&(0x7f0000002080)=""/149, 0x95}, {&(0x7f0000001b80)=""/15, 0xf}, {&(0x7f0000002300)=""/193, 0xc1}, {&(0x7f0000002400)=""/106, 0x6a}], 0x6}, 0xb6c88da8666092df) socket$kcm(0x10, 0x3, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) sendmsg$kcm(r6, &(0x7f0000000100)={&(0x7f0000001bc0)=@nfc_llcp={0x27, 0x1, 0x2, 0x7, 0x7, 0x4c, "bff0664c2a7f9add443b618c992e4c659c753299f0f87d0242549f5483792c8fcff89e42eb0d124a6fe32f94f4243232631ba70b94843e7f248300eaf71f5d", 0x2c}, 0xfffffed9, 0x0}, 0x4000000) recvmsg(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000b80)=""/4096, 0x1000}, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000d80)={r2, 0x10, &(0x7f0000000d40)={&(0x7f0000000500)=""/148, 0x94}}, 0x10) perf_event_open$cgroup(&(0x7f00000002c0)={0x0, 0x70, 0xfc, 0x0, 0x81, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x5, 0x8001, 0x40, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x5, 0xc000000000000000, 0x2, 0x68, 0x0, 0x80, 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x0, 0x10, 0x2, @perf_config_ext={0x23, 0x8}, 0x0, 0x9, 0x1f, 0x5, 0x0, 0x6, 0x6}, r5, 0x8, 0xffffffffffffffff, 0x0) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='cpu.stat\x00', 0x0, 0x0) openat$cgroup_ro(r7, &(0x7f0000000240)='cpua\x9d]\x00\xea\x8b\xdd./cct.usage_all\x00', 0x26e1, 0x0) openat$cgroup(r3, &(0x7f0000000800)='syz0\x00', 0x200002, 0x0) write$cgroup_subtree(r3, &(0x7f0000000680)=ANY=[@ANYBLOB="51c880468d1dfd8580feb081b7dea2bc8cfd3bb09a8202a38b627a2ab693fa9326fcf50000000051dbca4d1bfeeafed29222880b32d2587bed91fbf1acf18c4319"], 0x41) write$cgroup_pid(r4, &(0x7f0000000280), 0x12) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x7eac8637, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r3, &(0x7f0000000200)=ANY=[], 0xfc28) ioctl$PERF_EVENT_IOC_PERIOD(r5, 0x4030582a, &(0x7f0000000040)) write$cgroup_pid(r4, &(0x7f0000000000), 0xfffffea6) 06:56:38 executing program 3: recvmmsg(0xffffffffffffffff, 0x0, 0x178, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x100000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) mkdir(&(0x7f0000002000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) unshare(0x0) mount$bpf(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x400000000001, 0x0) open(0x0, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000240)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000150600000fff07003506000002000000070600000ee60000bf050000000000001f650000000000006507000002000000270700004c0000001f75000000000000bf54000000000000070400000400f9ffad43010000000000950000000000000005000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x1f1}, 0x48) exit(0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000600)={'\x00\xacs\x00\x00\x00\x00\x00\xec\x97?\x82\x0f|@\x00', 0xc201}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x7) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) dup3(r1, r0, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000080)=0x0) ioprio_set$pid(0x2, r2, 0x9) r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0) write$binfmt_elf64(r3, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00'], 0x1) fallocate(r3, 0x3, 0x0, 0x8020003) lseek(r3, 0x0, 0x0) pwrite64(r3, &(0x7f0000000400)="98c049a97394a101955d1f6100af10f2d570ac3a947abd05a04790025ab27b2d5c350091de131683b30be0346eae796108bae505b9e25a700b2e056864ae62a65c1119600e0115706bbac50896de9ca09a08048298a35b9f5edc9ccd5820816f7df9212e31de75b5f66895049212bc680e3abadc787a7fb175137e99dfc462cd967faf95f360855d19b6ab5ef9200c64e1acb809be696f88efe0a570015fbe569a6513f9f4c164de2ce445020cd6a8261a08b1f2909544feed5b5c940ae60383703b017374ca365efccf41f247f60cb3fd195f185a53bbf043b257828c881e756337e63810054a1db24e477d0a4ff6", 0xef, 0x2e) syz_genetlink_get_family_id$SEG6(&(0x7f0000000500)='SEG6\x00') 06:56:38 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) close(r0) socket(0x840000000002, 0x3, 0xff) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='ip6_vti0\x00 \x00', 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @initdev}, 0x10) 06:56:39 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x9}, 0x18010, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r0, &(0x7f00000000c0)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e24, @remote}}, 0x24) sendmmsg(0xffffffffffffffff, &(0x7f0000005c00), 0x0, 0x0) sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0xfffffffffffffd95, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0x1, "ec"}], 0x18}}], 0x1, 0x0) 06:56:39 executing program 5: r0 = socket(0x10, 0x803, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r4 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r4, 0x1, 0x3e, &(0x7f00000002c0)=r3, 0x161) getsockopt$llc_int(r3, 0x10c, 0x9, &(0x7f0000000040), &(0x7f0000000080)=0x4) connect$vsock_dgram(r3, &(0x7f0000000180)={0x28, 0x0, 0x2711, @reserved}, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000600)={'\x00\xacs\x00\x00\x00\x00\x00\xec\x97?\x82\x0f|@\x00', 0xc201}) ioctl$TUNSETLINK(r5, 0x400454cd, 0x7) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r8 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r8, 0x1, 0x3e, &(0x7f00000002c0)=r7, 0x161) ioctl$MON_IOCX_GET(r7, 0x40189206, &(0x7f0000000100)={&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, &(0x7f0000000340)=""/201, 0xc9}) dup3(r6, r5, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000600)={'\x00\xacs\x00\x00\x00\x00\x00\xec\x97?\x82\x0f|@\x00', 0xc201}) ioctl$TUNSETLINK(r9, 0x400454cd, 0x7) r10 = socket$inet(0x2, 0x4000000000000001, 0x0) dup3(r10, r9, 0x0) r11 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_SIOCOUTQ(r11, 0x5411, &(0x7f0000000000)) write(r0, &(0x7f0000000300)="240000001e0025eaa87865f51e86041b0004000200bff20182a9000c080008000b000000", 0x1e2) [ 213.173783][ T9207] BPF:hdr_len not found 06:56:39 executing program 0: r0 = socket$kcm(0x2, 0x1000000000000805, 0x84) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x40286608, &(0x7f0000000180)={0x10, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}) bpf$MAP_CREATE(0x0, 0x0, 0x0) sendmsg(r0, &(0x7f0000000440)={&(0x7f0000000040)=@in={0x2, 0x0, @loopback}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000200)='c', 0x1}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) fcntl$setpipe(r0, 0x407, 0xfffffffffffffffb) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000180)=0xf, 0x4) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r2 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f00000002c0)=r1, 0x161) fsconfig$FSCONFIG_SET_PATH(r1, 0x3, &(0x7f00000000c0)='^#[cgroupvmnet0:md5sum.{posix_acl_accessproc%\x00', 0xfffffffffffffffe, 0xffffffffffffff9c) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x33, &(0x7f0000000300)={0x1, &(0x7f00000002c0)=[{0x6}]}, 0xfea2) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(0xffffffffffffffff, 0x84, 0x16, 0x0, 0x0) 06:56:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000000)=@nat={'nat\x00?\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0x19, 0x2, 0x208, [0x20000600, 0x0, 0x0, 0x20000690, 0x20000660], 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000100000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff020000000500000000000000000076657468305f746f5f7465616d00000064756d6d79300000000000000000000064756d0004300000000000000000000073797a6b616c6c8279a7e00000000000ffffffffffff000000000000ffffffffffff00000000000000007000000070000000a000000072656469726563740000000000000000000000000000000000000000000000000800000000000000ffffffff000000000b00000000000000000073797a6b616c6c65723100000000000067726574617030000000000000000000766c616e30000000000000000000000064756d6d7930000000a37609520000000180c2000000000000000000aaaaaaaaaabb00000000000000007000000070000000a8000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff00000000"]}, 0x280) 06:56:39 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x9}, 0x18010, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r0, &(0x7f00000000c0)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e24, @remote}}, 0x24) sendmmsg(0xffffffffffffffff, &(0x7f0000005c00), 0x0, 0x0) sendmmsg(r0, &(0x7f0000005c00)=[{{0x0, 0xfffffffffffffd95, 0x0, 0x0, &(0x7f0000000000)=[{0x18, 0x110, 0x1, "ec"}], 0x18}}], 0x1, 0x0) 06:56:39 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r2 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) r3 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x200004) tgkill(0xffffffffffffffff, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x800000000000937e, &(0x7f0000000000)) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x0, 0x0) ioctl(r4, 0x0, &(0x7f0000000000)) r5 = openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$FUSE_NOTIFY_POLL(r5, &(0x7f0000000380)={0x18, 0x1, 0x0, {0x3}}, 0x18) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000040)={0x0}) ioctl$EVIOCGLED(r4, 0x80404519, &(0x7f00000003c0)=""/240) r7 = syz_open_dev$vcsn(0x0, 0x8, 0x10000) ioctl$CAPI_CLR_FLAGS(0xffffffffffffffff, 0x80044325, &(0x7f00000000c0)=0x1) r8 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x3, 0x2) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r8, 0x4058534c, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(r7, 0xc008640a, &(0x7f0000000080)) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f00000000c0)={r6}) r9 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x8, 0x10000) connect$packet(r9, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x80}, 0x14) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x2010, r2, 0x29b82000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611) 06:56:39 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newsa={0x158, 0x10, 0x713, 0x0, 0x0, {{@in=@empty, @in6=@dev}, {@in6=@empty, 0x0, 0x33}, @in6=@mcast1, {0x0, 0x0, 0x0, 0x8}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0xdc}, [@replay_esn_val={0x20, 0x17, {0x1, 0x0, 0x0, 0x0, 0x0, 0x2, [0x0]}}, @algo_auth={0x3d4, 0x1, {{'md5\x00'}}}]}, 0x158}}, 0x0) [ 213.564083][ T9230] ================================================================== [ 213.572384][ T9230] BUG: KASAN: use-after-free in nf_ct_deliver_cached_events+0x5c3/0x6d0 [ 213.572412][ T9230] Read of size 1 at addr ffff8880a8126c04 by task syz-executor.1/9230 [ 213.572417][ T9230] [ 213.572434][ T9230] CPU: 0 PID: 9230 Comm: syz-executor.1 Not tainted 5.4.0-rc4-next-20191025 #0 [ 213.572444][ T9230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 213.572449][ T9230] Call Trace: [ 213.572468][ T9230] dump_stack+0x172/0x1f0 [ 213.572483][ T9230] ? nf_ct_deliver_cached_events+0x5c3/0x6d0 [ 213.572506][ T9230] print_address_description.constprop.0.cold+0xd4/0x30b [ 213.572519][ T9230] ? nf_ct_deliver_cached_events+0x5c3/0x6d0 [ 213.572533][ T9230] ? nf_ct_deliver_cached_events+0x5c3/0x6d0 [ 213.572548][ T9230] __kasan_report.cold+0x1b/0x41 [ 213.572565][ T9230] ? nf_ct_deliver_cached_events+0x5c3/0x6d0 [ 213.572581][ T9230] kasan_report+0x12/0x20 [ 213.572596][ T9230] __asan_report_load1_noabort+0x14/0x20 [ 213.572608][ T9230] nf_ct_deliver_cached_events+0x5c3/0x6d0 [ 213.572627][ T9230] ? nf_ct_expect_unregister_notifier+0x140/0x140 [ 213.675667][ T9230] nf_confirm+0x3d8/0x4d0 [ 213.679998][ T9230] ipv4_confirm+0x14c/0x240 [ 213.684485][ T9230] nf_hook_slow+0xbc/0x1e0 [ 213.688886][ T9230] ip_output+0x40d/0x670 [ 213.693109][ T9230] ? ip_mc_output+0xf60/0xf60 [ 213.697781][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 213.703222][ T9230] ? __ip_finish_output+0xbd0/0xbd0 [ 213.708415][ T9230] ? __this_cpu_preempt_check+0x35/0x190 [ 213.714029][ T9230] ? retint_kernel+0x2b/0x2b [ 213.718602][ T9230] ip_local_out+0xbb/0x1b0 [ 213.722999][ T9230] ip_send_skb+0x42/0xf0 [ 213.727222][ T9230] udp_send_skb.isra.0+0x6d5/0x11b0 [ 213.732401][ T9230] ? xfrm_lookup_route+0x5b/0x1e0 [ 213.737415][ T9230] udp_sendmsg+0x1e8f/0x2810 [ 213.741988][ T9230] ? ip_reply_glue_bits+0xc0/0xc0 [ 213.746996][ T9230] ? udp_unicast_rcv_skb.isra.0+0x360/0x360 [ 213.752870][ T9230] ? __kasan_check_read+0x11/0x20 [ 213.757885][ T9230] ? mark_lock+0xc2/0x1220 [ 213.762310][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 213.767752][ T9230] ? lockdep_hardirqs_on+0x421/0x5e0 [ 213.773018][ T9230] ? retint_kernel+0x2b/0x2b [ 213.777593][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 213.783035][ T9230] ? __this_cpu_preempt_check+0x35/0x190 [ 213.788648][ T9230] ? retint_kernel+0x2b/0x2b [ 213.793222][ T9230] ? inet_send_prepare+0x4e0/0x4e0 [ 213.798327][ T9230] inet_sendmsg+0x9e/0xe0 [ 213.802646][ T9230] ? inet_sendmsg+0x9e/0xe0 [ 213.807129][ T9230] ? inet_send_prepare+0x4e0/0x4e0 [ 213.812225][ T9230] sock_sendmsg+0xd7/0x130 [ 213.816621][ T9230] kernel_sendmsg+0x44/0x50 [ 213.821117][ T9230] rxrpc_send_data_packet+0x10cb/0x36b0 [ 213.826645][ T9230] ? mark_lock+0xc2/0x1220 [ 213.831047][ T9230] ? rxrpc_send_abort_packet+0xe70/0xe70 [ 213.836661][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 213.842102][ T9230] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 213.848243][ T9230] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 213.853778][ T9230] ? rxrpc_get_connection+0xa3/0x380 [ 213.859049][ T9230] rxrpc_send_data+0x1097/0x4130 [ 213.863965][ T9230] ? rxrpc_send_data+0x1097/0x4130 [ 213.869066][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 213.874516][ T9230] ? rxrpc_kernel_abort_call+0x8b0/0x8b0 [ 213.880134][ T9230] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 213.885662][ T9230] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 213.891636][ T9230] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 213.897865][ T9230] ? rxrpc_new_client_call+0xc31/0x1ad0 [ 213.903400][ T9230] ? rxrpc_put_peer+0x106/0x760 [ 213.908232][ T9230] rxrpc_do_sendmsg+0xb8e/0x1d5f [ 213.913148][ T9230] ? retint_kernel+0x2b/0x2b [ 213.917721][ T9230] ? rxrpc_kernel_send_data+0x4e0/0x4e0 [ 213.923251][ T9230] ? retint_kernel+0x2b/0x2b [ 213.927831][ T9230] rxrpc_sendmsg+0x4d6/0x5f0 [ 213.932413][ T9230] ? rxrpc_kernel_probe_life+0x40/0x40 [ 213.937851][ T9230] sock_sendmsg+0xd7/0x130 [ 213.942249][ T9230] ___sys_sendmsg+0x3e2/0x920 [ 213.946907][ T9230] ? copy_msghdr_from_user+0x440/0x440 [ 213.952346][ T9230] ? lock_downgrade+0x920/0x920 [ 213.957178][ T9230] ? rcu_read_lock_held+0x9c/0xb0 [ 213.962184][ T9230] ? __kasan_check_read+0x11/0x20 [ 213.967189][ T9230] ? __fget+0x37f/0x550 [ 213.971336][ T9230] ? ksys_dup3+0x3e0/0x3e0 [ 213.975733][ T9230] ? __lock_acquire+0x16f2/0x4a00 [ 213.980735][ T9230] ? __kasan_check_read+0x11/0x20 [ 213.985750][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 213.991191][ T9230] ? __fget_light+0x1a9/0x230 [ 213.995850][ T9230] ? __fdget+0x1b/0x20 [ 213.999896][ T9230] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 214.006126][ T9230] ? sockfd_lookup_light+0xcb/0x180 [ 214.011308][ T9230] __sys_sendmmsg+0x1bf/0x4d0 [ 214.015976][ T9230] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 214.020998][ T9230] ? _copy_to_user+0x118/0x160 [ 214.025746][ T9230] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 214.031968][ T9230] ? put_timespec64+0xda/0x140 [ 214.036721][ T9230] ? nsecs_to_jiffies+0x30/0x30 [ 214.041562][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 214.046999][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 214.052437][ T9230] ? do_syscall_64+0x26/0x760 [ 214.057100][ T9230] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 214.063163][ T9230] ? do_syscall_64+0x26/0x760 [ 214.067832][ T9230] __x64_sys_sendmmsg+0x9d/0x100 [ 214.072770][ T9230] do_syscall_64+0xfa/0x760 [ 214.077260][ T9230] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 214.083133][ T9230] RIP: 0033:0x459f39 [ 214.087009][ T9230] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 214.106595][ T9230] RSP: 002b:00007f21fa582c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 214.114986][ T9230] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459f39 [ 214.122948][ T9230] RDX: 0000000000000001 RSI: 0000000020005c00 RDI: 0000000000000004 [ 214.130898][ T9230] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 214.138847][ T9230] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f21fa5836d4 [ 214.146798][ T9230] R13: 00000000004c7b70 R14: 00000000004ddaa8 R15: 00000000ffffffff [ 214.154767][ T9230] [ 214.157075][ T9230] Allocated by task 9230: [ 214.161389][ T9230] save_stack+0x23/0x90 [ 214.165532][ T9230] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 214.171142][ T9230] kasan_krealloc+0x84/0xc0 [ 214.175622][ T9230] krealloc+0xa6/0xd0 [ 214.179586][ T9230] nf_ct_ext_add+0x2c7/0x630 [ 214.184153][ T9230] init_conntrack.isra.0+0x5ed/0x11a0 [ 214.189501][ T9230] nf_conntrack_in+0xd94/0x1460 [ 214.194329][ T9230] ipv4_conntrack_local+0x127/0x220 [ 214.199513][ T9230] nf_hook_slow+0xbc/0x1e0 [ 214.203907][ T9230] __ip_local_out+0x403/0x870 [ 214.208560][ T9230] ip_local_out+0x2d/0x1b0 [ 214.212954][ T9230] ip_send_skb+0x42/0xf0 [ 214.217176][ T9230] udp_send_skb.isra.0+0x6d5/0x11b0 [ 214.222349][ T9230] udp_sendmsg+0x1e8f/0x2810 [ 214.226918][ T9230] inet_sendmsg+0x9e/0xe0 [ 214.231227][ T9230] sock_sendmsg+0xd7/0x130 [ 214.235622][ T9230] kernel_sendmsg+0x44/0x50 [ 214.240102][ T9230] rxrpc_send_data_packet+0x10cb/0x36b0 [ 214.245627][ T9230] rxrpc_send_data+0x1097/0x4130 [ 214.250542][ T9230] rxrpc_do_sendmsg+0xb8e/0x1d5f [ 214.255457][ T9230] rxrpc_sendmsg+0x4d6/0x5f0 [ 214.260025][ T9230] sock_sendmsg+0xd7/0x130 [ 214.264417][ T9230] ___sys_sendmsg+0x3e2/0x920 [ 214.269070][ T9230] __sys_sendmmsg+0x1bf/0x4d0 [ 214.273724][ T9230] __x64_sys_sendmmsg+0x9d/0x100 [ 214.278641][ T9230] do_syscall_64+0xfa/0x760 [ 214.283123][ T9230] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 214.288988][ T9230] [ 214.291293][ T9230] Freed by task 9230: [ 214.295258][ T9230] save_stack+0x23/0x90 [ 214.299393][ T9230] __kasan_slab_free+0x102/0x150 [ 214.304306][ T9230] kasan_slab_free+0xe/0x10 [ 214.308785][ T9230] kfree+0x10a/0x2c0 [ 214.312657][ T9230] nf_ct_ext_destroy+0x2ab/0x2e0 [ 214.317571][ T9230] nf_conntrack_free+0x8f/0xe0 [ 214.322321][ T9230] destroy_conntrack+0x1a2/0x270 [ 214.327237][ T9230] nf_conntrack_destroy+0xed/0x230 [ 214.332325][ T9230] __nf_conntrack_confirm+0x21ca/0x2830 [ 214.337848][ T9230] nf_confirm+0x3e7/0x4d0 [ 214.342155][ T9230] ipv4_confirm+0x14c/0x240 [ 214.346634][ T9230] nf_hook_slow+0xbc/0x1e0 [ 214.351029][ T9230] ip_output+0x40d/0x670 [ 214.355246][ T9230] ip_local_out+0xbb/0x1b0 [ 214.359638][ T9230] ip_send_skb+0x42/0xf0 [ 214.363859][ T9230] udp_send_skb.isra.0+0x6d5/0x11b0 [ 214.369033][ T9230] udp_sendmsg+0x1e8f/0x2810 [ 214.373603][ T9230] inet_sendmsg+0x9e/0xe0 [ 214.377910][ T9230] sock_sendmsg+0xd7/0x130 [ 214.382303][ T9230] kernel_sendmsg+0x44/0x50 [ 214.386786][ T9230] rxrpc_send_data_packet+0x10cb/0x36b0 [ 214.392319][ T9230] rxrpc_send_data+0x1097/0x4130 [ 214.397231][ T9230] rxrpc_do_sendmsg+0xb8e/0x1d5f [ 214.402146][ T9230] rxrpc_sendmsg+0x4d6/0x5f0 [ 214.406728][ T9230] sock_sendmsg+0xd7/0x130 [ 214.411119][ T9230] ___sys_sendmsg+0x3e2/0x920 [ 214.415772][ T9230] __sys_sendmmsg+0x1bf/0x4d0 [ 214.420427][ T9230] __x64_sys_sendmmsg+0x9d/0x100 [ 214.425351][ T9230] do_syscall_64+0xfa/0x760 [ 214.429836][ T9230] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 214.435717][ T9230] [ 214.438028][ T9230] The buggy address belongs to the object at ffff8880a8126c00 [ 214.438028][ T9230] which belongs to the cache kmalloc-128 of size 128 [ 214.452059][ T9230] The buggy address is located 4 bytes inside of [ 214.452059][ T9230] 128-byte region [ffff8880a8126c00, ffff8880a8126c80) [ 214.465127][ T9230] The buggy address belongs to the page: [ 214.470737][ T9230] page:ffffea0002a04980 refcount:1 mapcount:0 mapping:ffff8880aa400700 index:0x0 [ 214.479818][ T9230] flags: 0x1fffc0000000200(slab) [ 214.484737][ T9230] raw: 01fffc0000000200 ffffea00024e34c8 ffffea0002a32848 ffff8880aa400700 [ 214.493309][ T9230] raw: 0000000000000000 ffff8880a8126000 0000000100000010 0000000000000000 [ 214.501866][ T9230] page dumped because: kasan: bad access detected [ 214.508252][ T9230] [ 214.510556][ T9230] Memory state around the buggy address: [ 214.516174][ T9230] ffff8880a8126b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 214.524217][ T9230] ffff8880a8126b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 214.532258][ T9230] >ffff8880a8126c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 214.540292][ T9230] ^ [ 214.544336][ T9230] ffff8880a8126c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 214.552379][ T9230] ffff8880a8126d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 214.564755][ T9230] ================================================================== [ 214.572790][ T9230] Disabling lock debugging due to kernel taint [ 214.587142][ T9235] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.0'. [ 214.602199][ T9230] Kernel panic - not syncing: panic_on_warn set ... [ 214.602442][ T9215] kobject: 'tun0' (00000000b81b7cc2): kobject_uevent_env [ 214.608814][ T9230] CPU: 0 PID: 9230 Comm: syz-executor.1 Tainted: G B 5.4.0-rc4-next-20191025 #0 [ 214.626204][ T9230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 214.636428][ T9230] Call Trace: [ 214.639715][ T9230] dump_stack+0x172/0x1f0 [ 214.644045][ T9230] panic+0x2e3/0x75c [ 214.647562][ T9215] kobject: 'tun0' (00000000b81b7cc2): fill_kobj_path: path = '/devices/virtual/net/tun0' [ 214.647941][ T9230] ? add_taint.cold+0x16/0x16 [ 214.662377][ T9230] ? nf_ct_deliver_cached_events+0x5c3/0x6d0 [ 214.666780][ T9215] kobject: 'queues' (000000000ed3345a): kobject_add_internal: parent: 'tun0', set: '' [ 214.668353][ T9230] ? preempt_schedule+0x4b/0x60 [ 214.668369][ T9230] ? ___preempt_schedule+0x16/0x18 [ 214.668385][ T9230] ? trace_hardirqs_on+0x5e/0x240 [ 214.693370][ T9230] ? nf_ct_deliver_cached_events+0x5c3/0x6d0 [ 214.696760][ T9215] kobject: 'queues' (000000000ed3345a): kobject_uevent_env [ 214.699347][ T9230] end_report+0x47/0x4f [ 214.699365][ T9230] ? nf_ct_deliver_cached_events+0x5c3/0x6d0 [ 214.708777][ T9215] kobject: 'queues' (000000000ed3345a): kobject_uevent_env: filter function caused the event to drop! [ 214.710666][ T9230] __kasan_report.cold+0xe/0x41 [ 214.710679][ T9230] ? nf_ct_deliver_cached_events+0x5c3/0x6d0 [ 214.710695][ T9230] kasan_report+0x12/0x20 [ 214.716718][ T9215] kobject: 'rx-0' (000000001d798c2c): kobject_add_internal: parent: 'queues', set: 'queues' [ 214.727544][ T9230] __asan_report_load1_noabort+0x14/0x20 [ 214.727557][ T9230] nf_ct_deliver_cached_events+0x5c3/0x6d0 [ 214.727572][ T9230] ? nf_ct_expect_unregister_notifier+0x140/0x140 [ 214.727591][ T9230] nf_confirm+0x3d8/0x4d0 [ 214.727603][ T9230] ipv4_confirm+0x14c/0x240 [ 214.727621][ T9230] nf_hook_slow+0xbc/0x1e0 [ 214.734666][ T9215] kobject: 'rx-0' (000000001d798c2c): kobject_uevent_env [ 214.738408][ T9230] ip_output+0x40d/0x670 [ 214.738419][ T9230] ? ip_mc_output+0xf60/0xf60 [ 214.738438][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 214.743960][ T3920] kobject: 'loop2' (0000000018a83cd2): kobject_uevent_env [ 214.752776][ T9230] ? __ip_finish_output+0xbd0/0xbd0 [ 214.752790][ T9230] ? __this_cpu_preempt_check+0x35/0x190 [ 214.752804][ T9230] ? retint_kernel+0x2b/0x2b [ 214.752818][ T9230] ip_local_out+0xbb/0x1b0 [ 214.752834][ T9230] ip_send_skb+0x42/0xf0 [ 214.770716][ T9243] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.0'. [ 214.774940][ T9230] udp_send_skb.isra.0+0x6d5/0x11b0 [ 214.774954][ T9230] ? xfrm_lookup_route+0x5b/0x1e0 [ 214.774968][ T9230] udp_sendmsg+0x1e8f/0x2810 [ 214.774987][ T9230] ? ip_reply_glue_bits+0xc0/0xc0 [ 214.790269][ T3920] kobject: 'loop2' (0000000018a83cd2): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 214.790867][ T9230] ? udp_unicast_rcv_skb.isra.0+0x360/0x360 [ 214.796317][ T9215] kobject: 'rx-0' (000000001d798c2c): fill_kobj_path: path = '/devices/virtual/net/tun0/queues/rx-0' [ 214.799739][ T9230] ? __kasan_check_read+0x11/0x20 [ 214.799757][ T9230] ? mark_lock+0xc2/0x1220 [ 214.813206][ T3920] kobject: 'loop0' (0000000024fcd10b): kobject_uevent_env [ 214.817462][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 214.817481][ T9230] ? lockdep_hardirqs_on+0x421/0x5e0 [ 214.829767][ T9215] kobject: 'tx-0' (000000001ff4f450): kobject_add_internal: parent: 'queues', set: 'queues' [ 214.832048][ T9230] ? retint_kernel+0x2b/0x2b [ 214.832066][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 214.832081][ T9230] ? __this_cpu_preempt_check+0x35/0x190 [ 214.832097][ T9230] ? retint_kernel+0x2b/0x2b [ 214.838656][ T9215] kobject: 'tx-0' (000000001ff4f450): kobject_uevent_env [ 214.845597][ T9230] ? inet_send_prepare+0x4e0/0x4e0 [ 214.845613][ T9230] inet_sendmsg+0x9e/0xe0 06:56:40 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newsa={0x158, 0x10, 0x713, 0x0, 0x0, {{@in=@empty, @in6=@dev}, {@in6=@empty, 0x0, 0x33}, @in6=@mcast1, {0x0, 0x0, 0x0, 0x8}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0xdc}, [@replay_esn_val={0x20, 0x17, {0x1, 0x0, 0x0, 0x0, 0x0, 0x2, [0x0]}}, @algo_auth={0x3d4, 0x1, {{'md5\x00'}}}]}, 0x158}}, 0x0) 06:56:40 executing program 2: socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) finit_module(r4, &(0x7f00000000c0)='bond\x00', 0x2) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x34, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r6}, [@IFLA_LINKINFO={0x14, 0x12, @bond={{0xc, 0x1, 'bond\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="2000000010000d04000000000000000000000000f218c8af8318a9a2f3db8c8f00c59a1717edb834e32df81ede8f6eb274ab35ff673640f08208aa674221bede53eaf62516da33b56e080d188af56c8436daf055f4b8bfd6f313bbb6812b4c148b9ba7dcc72a2062d8a46e661e93650d9b99d7c2dfa3eeac743c973e548c2d1109b7c1236d1a6df4279c983992f8d57405ab", @ANYRES32=r6, @ANYBLOB="0320000000000000"], 0x20}}, 0x0) 06:56:40 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newsa={0x158, 0x10, 0x713, 0x0, 0x0, {{@in=@empty, @in6=@dev}, {@in6=@empty, 0x0, 0x33}, @in6=@mcast1, {0x0, 0x0, 0x0, 0x8}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0xdc}, [@replay_esn_val={0x20, 0x17, {0x1, 0x0, 0x0, 0x0, 0x0, 0x2, [0x0]}}, @algo_auth={0x3d4, 0x1, {{'md5\x00'}}}]}, 0x158}}, 0x0) [ 214.845624][ T9230] ? inet_sendmsg+0x9e/0xe0 [ 214.845636][ T9230] ? inet_send_prepare+0x4e0/0x4e0 [ 214.845650][ T9230] sock_sendmsg+0xd7/0x130 [ 214.845662][ T9230] kernel_sendmsg+0x44/0x50 [ 214.845683][ T9230] rxrpc_send_data_packet+0x10cb/0x36b0 [ 214.858220][ T3920] kobject: 'loop0' (0000000024fcd10b): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 214.860523][ T9230] ? mark_lock+0xc2/0x1220 [ 214.860541][ T9230] ? rxrpc_send_abort_packet+0xe70/0xe70 [ 214.860559][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 214.870047][ T9215] kobject: 'tx-0' (000000001ff4f450): fill_kobj_path: path = '/devices/virtual/net/tun0/queues/tx-0' [ 214.875688][ T9230] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 214.875706][ T9230] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 214.875722][ T9230] ? rxrpc_get_connection+0xa3/0x380 [ 214.875738][ T9230] rxrpc_send_data+0x1097/0x4130 [ 214.875749][ T9230] ? rxrpc_send_data+0x1097/0x4130 [ 214.875769][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 214.895433][ T3920] kobject: 'loop0' (0000000024fcd10b): kobject_uevent_env [ 214.897475][ T9230] ? rxrpc_kernel_abort_call+0x8b0/0x8b0 [ 214.897494][ T9230] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 214.915027][ T9250] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.0'. [ 214.919671][ T9230] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 214.919696][ T9230] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 214.935402][ T3920] kobject: 'loop0' (0000000024fcd10b): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 214.939743][ T9230] ? rxrpc_new_client_call+0xc31/0x1ad0 [ 214.939761][ T9230] ? rxrpc_put_peer+0x106/0x760 [ 215.119106][ T9230] rxrpc_do_sendmsg+0xb8e/0x1d5f [ 215.124023][ T9230] ? retint_kernel+0x2b/0x2b [ 215.128591][ T9230] ? rxrpc_kernel_send_data+0x4e0/0x4e0 [ 215.134199][ T9230] ? retint_kernel+0x2b/0x2b [ 215.138774][ T9230] rxrpc_sendmsg+0x4d6/0x5f0 [ 215.143344][ T9230] ? rxrpc_kernel_probe_life+0x40/0x40 [ 215.148783][ T9230] sock_sendmsg+0xd7/0x130 [ 215.153178][ T9230] ___sys_sendmsg+0x3e2/0x920 [ 215.157834][ T9230] ? copy_msghdr_from_user+0x440/0x440 [ 215.163271][ T9230] ? lock_downgrade+0x920/0x920 [ 215.168100][ T9230] ? rcu_read_lock_held+0x9c/0xb0 [ 215.173103][ T9230] ? __kasan_check_read+0x11/0x20 [ 215.178106][ T9230] ? __fget+0x37f/0x550 [ 215.182239][ T9230] ? ksys_dup3+0x3e0/0x3e0 [ 215.186635][ T9230] ? __lock_acquire+0x16f2/0x4a00 [ 215.191634][ T9230] ? __kasan_check_read+0x11/0x20 [ 215.196638][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 215.202073][ T9230] ? __fget_light+0x1a9/0x230 [ 215.206725][ T9230] ? __fdget+0x1b/0x20 [ 215.210772][ T9230] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 215.216991][ T9230] ? sockfd_lookup_light+0xcb/0x180 [ 215.222167][ T9230] __sys_sendmmsg+0x1bf/0x4d0 [ 215.226821][ T9230] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 215.231829][ T9230] ? _copy_to_user+0x118/0x160 [ 215.236570][ T9230] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 215.242786][ T9230] ? put_timespec64+0xda/0x140 [ 215.247538][ T9230] ? nsecs_to_jiffies+0x30/0x30 [ 215.252370][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 215.257808][ T9230] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 215.263241][ T9230] ? do_syscall_64+0x26/0x760 [ 215.267897][ T9230] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 215.273953][ T9230] ? do_syscall_64+0x26/0x760 [ 215.279581][ T9230] __x64_sys_sendmmsg+0x9d/0x100 [ 215.284504][ T9230] do_syscall_64+0xfa/0x760 [ 215.288991][ T9230] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 215.294861][ T9230] RIP: 0033:0x459f39 [ 215.298736][ T9230] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 215.318324][ T9230] RSP: 002b:00007f21fa582c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 215.326717][ T9230] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459f39 [ 215.334666][ T9230] RDX: 0000000000000001 RSI: 0000000020005c00 RDI: 0000000000000004 [ 215.342615][ T9230] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 215.350566][ T9230] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f21fa5836d4 [ 215.358515][ T9230] R13: 00000000004c7b70 R14: 00000000004ddaa8 R15: 00000000ffffffff [ 215.367755][ T9230] Kernel Offset: disabled [ 215.372107][ T9230] Rebooting in 86400 seconds..