[ 38.951118][ T27] audit: type=1800 audit(1555534121.087:28): pid=7528 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 39.790057][ T27] audit: type=1800 audit(1555534122.017:29): pid=7528 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 39.810954][ T27] audit: type=1800 audit(1555534122.017:30): pid=7528 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 [....] startpar: service(s) returned failure: ssh ...[?25l[?1c7[FAIL8[?25h[?0c failed! Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.80' (ECDSA) to the list of known hosts. 2019/04/17 20:48:56 fuzzer started 2019/04/17 20:48:59 dialing manager at 10.128.0.26:45059 2019/04/17 20:48:59 syscalls: 2278 2019/04/17 20:48:59 code coverage: enabled 2019/04/17 20:48:59 comparison tracing: enabled 2019/04/17 20:48:59 extra coverage: extra coverage is not supported by the kernel 2019/04/17 20:48:59 setuid sandbox: enabled 2019/04/17 20:48:59 namespace sandbox: enabled 2019/04/17 20:48:59 Android sandbox: /sys/fs/selinux/policy does not exist 2019/04/17 20:48:59 fault injection: enabled 2019/04/17 20:48:59 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/04/17 20:48:59 net packet injection: enabled 2019/04/17 20:48:59 net device setup: enabled 20:49:52 executing program 0: clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x37) ptrace$cont(0x18, r0, 0x0, 0x0) dup2(0xffffffffffffff9c, 0xffffffffffffff9c) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x5, 0xa4}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getpgid(r0) ptrace$cont(0x20, r0, 0x0, 0x0) syzkaller login: [ 110.240322][ T7715] IPVS: ftp: loaded support on port[0] = 21 20:49:52 executing program 1: r0 = socket$inet(0x2, 0x3, 0x1e) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0ad401003c123f319bd070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) listen(r1, 0x3) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000004, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c) [ 110.340995][ T7715] chnl_net:caif_netlink_parms(): no params data found [ 110.412760][ T7715] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.422104][ T7715] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.441098][ T7715] device bridge_slave_0 entered promiscuous mode [ 110.473488][ T7715] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.480839][ T7715] bridge0: port 2(bridge_slave_1) entered disabled state [ 110.499980][ T7715] device bridge_slave_1 entered promiscuous mode [ 110.544301][ T7715] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 110.545651][ T7718] IPVS: ftp: loaded support on port[0] = 21 [ 110.567060][ T7715] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 110.603431][ T7715] team0: Port device team_slave_0 added [ 110.613112][ T7715] team0: Port device team_slave_1 added 20:49:52 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='veth1_to_team\x00', 0x10) setsockopt$inet_int(r0, 0x0, 0x32, &(0x7f0000001f40)=0x1000000, 0x4) [ 110.703681][ T7715] device hsr_slave_0 entered promiscuous mode [ 110.773754][ T7720] IPVS: ftp: loaded support on port[0] = 21 [ 110.780440][ T7715] device hsr_slave_1 entered promiscuous mode 20:49:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000240)="0adc1f123c123f319bd070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r1, 0x0, 0x47, 0x200007fd, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) ppoll(&(0x7f0000000140)=[{r1}, {}], 0x2, 0x0, 0x0, 0x0) [ 110.839617][ T7715] bridge0: port 2(bridge_slave_1) entered blocking state [ 110.846897][ T7715] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.854742][ T7715] bridge0: port 1(bridge_slave_0) entered blocking state [ 110.861864][ T7715] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.063404][ T7718] chnl_net:caif_netlink_parms(): no params data found [ 111.074495][ T7720] chnl_net:caif_netlink_parms(): no params data found [ 111.128855][ T7715] 8021q: adding VLAN 0 to HW filter on device bond0 [ 111.151697][ T7724] IPVS: ftp: loaded support on port[0] = 21 [ 111.203357][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 111.217010][ T3481] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.237216][ T3481] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.247233][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready 20:49:53 executing program 4: setxattr$security_selinux(&(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0) creat(&(0x7f0000000140)='./file0\x00', 0x0) [ 111.282235][ T7718] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.289314][ T7718] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.297707][ T7718] device bridge_slave_0 entered promiscuous mode [ 111.320585][ T7715] 8021q: adding VLAN 0 to HW filter on device team0 [ 111.338536][ T7718] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.351660][ T7718] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.380303][ T7718] device bridge_slave_1 entered promiscuous mode [ 111.389809][ T7720] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.411693][ T7720] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.421274][ T7720] device bridge_slave_0 entered promiscuous mode [ 111.442371][ T7728] IPVS: ftp: loaded support on port[0] = 21 [ 111.468473][ T7720] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.477192][ T7720] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.485425][ T7720] device bridge_slave_1 entered promiscuous mode [ 111.492993][ T7725] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 111.503088][ T7725] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 111.513765][ T7725] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.520888][ T7725] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.560814][ T7718] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 111.571752][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 111.580867][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 111.589272][ T22] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.596392][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.656009][ T7718] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 111.684654][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 111.696728][ T7720] bond0: Enslaving bond_slave_0 as an active interface with an up link 20:49:53 executing program 5: syz_open_dev$vcsa(&(0x7f00000001c0)='/dev/vcsa#\x00', 0x0, 0x0) fdatasync(0xffffffffffffff9c) socket$inet6(0xa, 0x801, 0x8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, 0x0) fsetxattr$trusted_overlay_upper(r0, 0x0, &(0x7f00000005c0)={0x0, 0xfb, 0x15, 0x7, 0x1, "232fe44eaafa44e568ed9d95da88cf0c"}, 0x15, 0x2) fcntl$setstatus(r0, 0x4, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r2 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r1, 0x6) ioctl$DRM_IOCTL_GET_STATS(r0, 0x80f86406, &(0x7f0000000140)=""/79) connect$inet(r2, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000340)='tls\x00', 0x4) [ 111.711873][ T7718] team0: Port device team_slave_0 added [ 111.735751][ T7720] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 111.758697][ T7715] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 111.770883][ T7715] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 111.784393][ T7718] team0: Port device team_slave_1 added [ 111.794609][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 111.803611][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 111.815979][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 111.824792][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 111.836488][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 111.846083][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 111.854847][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 111.864236][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 111.872895][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 111.909071][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 111.916705][ T7730] IPVS: ftp: loaded support on port[0] = 21 [ 111.917797][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 111.989395][ T7720] team0: Port device team_slave_0 added [ 112.014857][ T7724] chnl_net:caif_netlink_parms(): no params data found [ 112.091790][ T7718] device hsr_slave_0 entered promiscuous mode [ 112.140401][ T7718] device hsr_slave_1 entered promiscuous mode [ 112.201514][ T7720] team0: Port device team_slave_1 added [ 112.214918][ T7715] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 112.311245][ T7728] chnl_net:caif_netlink_parms(): no params data found [ 112.361747][ T7720] device hsr_slave_0 entered promiscuous mode [ 112.410396][ T7720] device hsr_slave_1 entered promiscuous mode [ 112.494002][ T7724] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.501737][ T7724] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.509718][ T7724] device bridge_slave_0 entered promiscuous mode [ 112.543983][ T7724] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.557234][ T7724] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.567680][ T7724] device bridge_slave_1 entered promiscuous mode 20:49:54 executing program 0: msgsnd(0x0, &(0x7f0000000100)={0x2, "50dedc782335ff9e8efacc7c69be936d26a5399fab7b600afe3ae07c312bec0f1279b6788b8d5578802803d46fbd178bda5c6a7e2ab475a16bac84a681505627b562d9ae870970109ad5598774290a05490d8fd6c4d0fc598baf04047972b0dfdea0ab5b7cc008782a99d16712135ce72dcc8e7e3f9394a68ec2369a028855a1a5d8c09c9d002d28dc6f667165c474a1d56811c33f90f71a3e93ddc2fcf304b03bd97c48f1844d6e54228e1535ff7ea6c6ff47fa107a800f0adb0633de2d9920482e3dfe32bbfdf5756309d82f184a89946af02833"}, 0x34, 0x800) r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000000)={0x0, 0x4f, "68b339070dac1743967607bc07b3c62c3df072b531fccc659306b4ddb7c8d73f336b604b68c5f81675ffea154d0c03490bb91f1608ef530286942d5a3f2de92009a5c9c9b0e33afd2e1a342d9e2a73"}, &(0x7f0000000080)=0x57) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f00000000c0)={r1, 0x5, 0x20}, 0xc) [ 112.673626][ T7724] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 112.682510][ T7728] bridge0: port 1(bridge_slave_0) entered blocking state [ 112.689576][ T7728] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.699215][ T7728] device bridge_slave_0 entered promiscuous mode [ 112.716098][ T7728] bridge0: port 2(bridge_slave_1) entered blocking state 20:49:54 executing program 0: r0 = socket$inet6(0xa, 0x800, 0x100000008000001) setsockopt$inet6_int(r0, 0x29, 0x1000000000024, &(0x7f00000005c0)=0x1, 0x4) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffeffff, 0x8001}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f00000002c0)=ANY=[@ANYRES32=r1, @ANYBLOB="72000000e3351ed6fe6172a39749e62a92ea8eaa16fc4385b510f2e1e30119d591191c2b742bf5aa485ed5a7825250a034ccb1d90852cb38891122d595e0eb0300000065dcd3ada91f302577583515e831e2877542f839f45136b2171ccc3700200b69fec8340f02cda40a00adb8b2d5292990965a58728d0a073e60b34b1a46ad5547e58a39e611c2a7b01f2a34311b91"], &(0x7f0000000200)=0x7a) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000240)={0x0, 0x0, 0xffffffffffffff9c}) ioctl$DRM_IOCTL_MODESET_CTL(r2, 0x40086408, &(0x7f0000000280)={0x101, 0x6}) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x380000, @loopback}, 0x1c) exit(0x3) setxattr$trusted_overlay_origin(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.origin\x00', &(0x7f0000000100)='y\x00', 0x2, 0x1) sendmmsg$alg(r0, &(0x7f0000002500)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)=[@assoc={0x18, 0x29, 0xb, 0x28}], 0x18}], 0x3, 0x0) [ 112.727962][ T7728] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.737401][ T7728] device bridge_slave_1 entered promiscuous mode [ 112.778365][ T7724] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 112.814657][ T7724] team0: Port device team_slave_0 added [ 112.825543][ T7728] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 112.873267][ T7724] team0: Port device team_slave_1 added [ 112.881214][ T7728] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 112.900625][ T7730] chnl_net:caif_netlink_parms(): no params data found [ 112.959480][ T7718] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.970453][ T7720] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.978730][ T7728] team0: Port device team_slave_0 added [ 112.994245][ T7730] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.001627][ T7730] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.009468][ T7730] device bridge_slave_0 entered promiscuous mode [ 113.017768][ T7730] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.024952][ T7730] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.032668][ T7730] device bridge_slave_1 entered promiscuous mode [ 113.046982][ T7720] 8021q: adding VLAN 0 to HW filter on device team0 [ 113.056059][ T7728] team0: Port device team_slave_1 added [ 113.081581][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 113.089397][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 113.153096][ T7724] device hsr_slave_0 entered promiscuous mode [ 113.200553][ T7724] device hsr_slave_1 entered promiscuous mode [ 113.254236][ T7718] 8021q: adding VLAN 0 to HW filter on device team0 [ 113.270492][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 113.279442][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 113.287958][ T22] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.295033][ T22] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.302777][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 113.311377][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 113.319811][ T22] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.326933][ T22] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.334703][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 113.343561][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 113.352262][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 113.367528][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 113.389247][ T7730] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 113.404784][ T7730] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 113.451789][ T7728] device hsr_slave_0 entered promiscuous mode [ 113.500660][ T7728] device hsr_slave_1 entered promiscuous mode 20:49:55 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 113.573079][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 113.588716][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 113.606303][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 113.616536][ T7751] input: syz1 as /devices/virtual/input/input5 [ 113.657868][ T7730] team0: Port device team_slave_0 added [ 113.667651][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 113.678544][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 113.693311][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 113.702005][ T3481] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.709072][ T3481] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.716923][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 113.725631][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 113.734196][ T3481] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.741800][ T3481] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.750601][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 113.759314][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 113.767826][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 113.780143][ T7730] team0: Port device team_slave_1 added [ 113.789732][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 113.799019][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 113.808399][ T7753] input: syz1 as /devices/virtual/input/input7 [ 113.819596][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready 20:49:56 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 113.857389][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 113.876201][ T7720] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 113.888090][ T7720] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 113.939077][ T7757] input: syz1 as /devices/virtual/input/input8 [ 113.952699][ T7730] device hsr_slave_0 entered promiscuous mode [ 113.990458][ T7730] device hsr_slave_1 entered promiscuous mode [ 114.016348][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 114.025093][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 20:49:56 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 114.050181][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 114.058924][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 114.082262][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 114.095095][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 114.115688][ T7724] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.139016][ T7720] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.153669][ T7761] input: syz1 as /devices/virtual/input/input10 [ 114.177241][ T7728] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.184930][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 114.201994][ T7724] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.227341][ T7728] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.234720][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 114.244964][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 114.253294][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 114.264593][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 114.273439][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 114.284439][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 20:49:56 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 114.320481][ T7718] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 114.348732][ T7718] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 20:49:56 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x7ff, 0xfe) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f00000000c0)=0x2, 0x4) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'bond_slave_1\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000"]}) [ 114.448501][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 114.457376][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 114.466201][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 114.475908][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 114.477132][ T7772] input: syz1 as /devices/virtual/input/input12 [ 114.493668][ T7733] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.500829][ T7733] bridge0: port 1(bridge_slave_0) entered forwarding state [ 114.511929][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 114.527255][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 114.536256][ T7733] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.543416][ T7733] bridge0: port 2(bridge_slave_1) entered forwarding state [ 114.551442][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 114.560985][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 114.569740][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 114.579372][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 114.588087][ T7733] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.595229][ T7733] bridge0: port 1(bridge_slave_0) entered forwarding state [ 114.637803][ T7718] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.648324][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 114.657576][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 114.667068][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 114.677087][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 114.700795][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 114.709359][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 114.720141][ T7747] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.727236][ T7747] bridge0: port 2(bridge_slave_1) entered forwarding state [ 114.734965][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 114.743783][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 114.754349][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 114.780124][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 114.788814][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 114.797442][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 114.809122][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 114.818301][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 114.839759][ T7728] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 114.851977][ T7728] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 114.867378][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 114.876453][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 114.885453][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 114.893853][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 114.902177][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 114.910590][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 114.918655][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 114.956014][ T7728] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 114.977207][ T7730] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.988372][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 115.000124][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 115.008360][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 115.017486][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 115.027438][ T7724] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 115.048827][ T7730] 8021q: adding VLAN 0 to HW filter on device team0 20:49:57 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x4000001000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") clone(0x803102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() pselect6(0x169, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3b) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$cont(0x1f, r1, 0x0, 0x4) 20:49:57 executing program 2: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='oom_score_adj\x00') ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x2}) openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x20001, 0x0) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x7) [ 115.076812][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 115.088452][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 115.115418][ T7724] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 115.178991][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 115.203722][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 115.227624][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 115.234824][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 115.265962][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 115.275286][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 115.290104][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.297195][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 115.313048][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 115.322068][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 115.330958][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 115.339408][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 115.348368][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 115.356690][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 115.380781][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 115.398443][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 115.420404][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 115.428704][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 115.444813][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 115.455145][ T7733] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 115.472456][ T7730] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 20:49:57 executing program 3: mknod$loop(&(0x7f0000000080)='./file0\x00', 0x2008, 0x0) r0 = open$dir(&(0x7f0000000040)='./file0\x00', 0x40000400000002c2, 0x0) writev(r0, &(0x7f0000000340)=[{0x0}], 0x1) 20:49:57 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 115.507127][ T7730] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 115.602876][ T7810] input: syz1 as /devices/virtual/input/input14 20:49:57 executing program 5: r0 = openat$zero(0xffffffffffffff9c, 0x0, 0x101000, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) link(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./file0\x00') connect$inet6(0xffffffffffffffff, 0x0, 0xffffffffffffff43) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xff) socket$can_raw(0x1d, 0x3, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') sendmsg$FOU_CMD_ADD(r0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8400000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r1, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x32}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e21}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8080}, 0x44) sched_setattr(0x0, &(0x7f0000000000)={0x30, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r0, 0xc0305616, &(0x7f0000000040)={0x0, {0x6, 0x28ec}}) ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000001840)={0x53, 0x0, 0x16, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000001740)="27d16347a54151f1908ef36a0eb3e10ba13f613b7162", 0x0, 0x8c, 0x31, 0x2, 0x0}) request_key(0x0, &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000140)='security\x00', 0xfffffffffffffffe) unshare(0x40000000) 20:49:57 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x0, @broadcast}, {0x2, 0x0, @empty}, {0x2, 0x0, @multicast2}, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x3cda, 0x8}) 20:49:57 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x4000000004002) ioctl$BLKDISCARD(r0, 0x1277, 0x0) 20:49:57 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000600)=0x74, 0x28) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) write$binfmt_elf64(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="7f454c460100f30700000000000000000300000002000000f80100000000000040000000000000008800000000000000f1d70000000038000200c8000180070057e5746406000000010000000000000008000000ce6ed0b83d2270790000000006f1fffffffffffffe070000000000f71c9d5b0200"/201], 0xc9) sendto(r0, &(0x7f00000007c0)="7589f0da892457ee2c04b3303d1176a13baaebf2227828025640d922cab9eba23410a07246127b486e98e302910479646091dfef95b0368b0b19c338b1306db81cea8edfc66a6212607f01496a9963ef1a83caee01bd36339f26dd287a0755ca00801959badb1253", 0x68, 0x0, 0x0, 0x0) sendto$inet(r0, &(0x7f0000001bc0)="d763ec34bfe26ad2b9d9fb7f4b98de31f5dc47bd7ae5eeceba2e977e432f103b988c19d71150515b1e85734b186237d704ec8b9430fec0a3117d1440a928fb5730ac9eb53022e5108d5e6f8fa861b991fcb0123281d4150b0506e8f00c4590b571e43dc126ea669e8e4e2c88f4b8cf4b4540dd7d1bb2981a7fb052afed9c842be23349319c9ef8d893fd656f968ea7e389dc9d942f7a88e123a00f0a215c4281e732e613eeab652fcd162b62bc2d6707625c5d46cefdefc691", 0xb9, 0x34ff, 0x0, 0x0) 20:49:57 executing program 3: memfd_create(&(0x7f0000000040)='\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00', 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000) 20:49:57 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 115.806790][ T7824] input: syz1 as /devices/virtual/input/input15 [ 115.902433][ T7842] IPVS: ftp: loaded support on port[0] = 21 20:49:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000080)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) clone(0x20002104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) ioctl$TCSETX(r0, 0x5433, 0x0) 20:49:58 executing program 3: mlock(&(0x7f0000222000/0x1000)=nil, 0x1000) mmap(&(0x7f00002c8000/0x3000)=nil, 0x3000, 0x0, 0x31, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000311000/0x4000)=nil, 0x4000) mmap(&(0x7f000035d000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) mmap(&(0x7f0000759000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000779000/0x2000)=nil, 0x2000, 0x0, 0x1132, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a97000/0x1000)=nil, 0x1000, 0x0, 0x1000000000002032, 0xffffffffffffffff, 0x0) 20:49:58 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1f}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="660f382b1a0f01dfdde80f32d9e90f086665676426f7c5000000000f2245deef0f23f5", 0x23}], 0xaaaaaaaaaaaae88, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x87, &(0x7f0000000080)='/dev/kvm\x00'}, 0x79) ioctl$KVM_RUN(r2, 0xae80, 0x0) 20:49:58 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 115.988182][ T7852] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 20:49:58 executing program 2: mkdir(&(0x7f00000003c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) memfd_create(&(0x7f00000001c0)='-B\xd5NI\xc5j\xbappp\xf0\b\x84\xa2m\x00:)\x00\xbb\x8d\xac\xacva}knh#\xcb)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8bCc\xad\x89\x9ck\xde\xc5\xe96\xddU\xa9=\xcdJx\xaa\x8f~\xb90a\xa9\xb2\x04K\x98\x93?\x88Q\xf7\xd6\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xab\xb6\xa5$4\xd6\xfe7\x0f\xe7\xd9$\xce \xabN\xae\xc9\xbd\xd3g@\xe1\'s\x0e\x90\xf2\xcdr\xb8(', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) read$FUSE(r0, &(0x7f00000040c0), 0x1000) [ 116.097112][ T7861] input: syz1 as /devices/virtual/input/input16 [ 116.209312][ T7870] IPVS: ftp: loaded support on port[0] = 21 20:49:58 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @local, 0x3}, 0x1c) sendmmsg(r0, &(0x7f0000000440), 0x400000000000211, 0x810) sendmsg$TIPC_NL_SOCK_GET(0xffffffffffffffff, 0x0, 0x4005) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 116.405059][ C1] hrtimer: interrupt took 36465 ns 20:49:58 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x1c) accept4(r0, 0x0, 0x0, 0x0) 20:49:58 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x4000000004002) ioctl$BLKDISCARD(r0, 0x1277, &(0x7f0000000000)) 20:49:58 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:49:58 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000600)=0x74, 0x28) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) write$binfmt_elf64(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="7f454c460100f30700000000000000000300000002000000f80100000000000040000000000000008800000000000000f1d70000000038000200c8000180070057e5746406000000010000000000000008000000ce6ed0b83d2270790000000006f1fffffffffffffe070000000000f71c9d5b0200"/201], 0xc9) sendto(r0, &(0x7f00000007c0)="7589f0da892457ee2c04b3303d1176a13baaebf2227828025640d922cab9eba23410a07246127b486e98e302910479646091dfef95b0368b0b19c338b1306db81cea8edfc66a6212607f01496a9963ef1a83caee01bd36339f26dd287a0755ca00801959badb1253", 0x68, 0x0, 0x0, 0x0) sendto$inet(r0, &(0x7f0000001bc0)="d763ec34bfe26ad2b9d9fb7f4b98de31f5dc47bd7ae5eeceba2e977e432f103b988c19d71150515b1e85734b186237d704ec8b9430fec0a3117d1440a928fb5730ac9eb53022e5108d5e6f8fa861b991fcb0123281d4150b0506e8f00c4590b571e43dc126ea669e8e4e2c88f4b8cf4b4540dd7d1bb2981a7fb052afed9c842be23349319c9ef8d893fd656f968ea7e389dc9d942f7a88e123a00f0a215c4281e732e613eeab652fcd162b62bc2d6707625c5d46cefdefc691", 0xb9, 0x34ff, 0x0, 0x0) 20:49:58 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhci\x00', 0x0) timer_settime(0x0, 0x0, &(0x7f0000000980)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) readv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x40008032, 0xffffffffffffffff, 0x0) tkill(r0, 0x1000000000014) [ 116.510659][ T7888] input: syz1 as /devices/virtual/input/input17 [ 116.513127][ C0] TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 20:49:58 executing program 2: mkdir(&(0x7f00000003c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) memfd_create(&(0x7f00000001c0)='-B\xd5NI\xc5j\xbappp\xf0\b\x84\xa2m\x00:)\x00\xbb\x8d\xac\xacva}knh#\xcb)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8bCc\xad\x89\x9ck\xde\xc5\xe96\xddU\xa9=\xcdJx\xaa\x8f~\xb90a\xa9\xb2\x04K\x98\x93?\x88Q\xf7\xd6\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xab\xb6\xa5$4\xd6\xfe7\x0f\xe7\xd9$\xce \xabN\xae\xc9\xbd\xd3g@\xe1\'s\x0e\x90\xf2\xcdr\xb8(', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) read$FUSE(r0, &(0x7f00000040c0), 0x1000) 20:49:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r1, &(0x7f0000000140), 0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x4, &(0x7f000051e000)={r1, &(0x7f00000002c0), 0x0}, 0x20) [ 116.743401][ C0] TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 20:49:59 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:49:59 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bd070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000080)={0x7b, 0x600000000000000, [0x0, 0x0, 0x2ff], [0xc2]}) 20:49:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r1, &(0x7f0000000140), 0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x4, &(0x7f000051e000)={r1, &(0x7f00000002c0), 0x0}, 0x20) 20:49:59 executing program 5: clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x37) ptrace$cont(0x18, r0, 0x0, 0x0) dup2(0xffffffffffffff9c, 0xffffffffffffff9c) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x5, 0xa4}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 20:49:59 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhci\x00', 0x0) timer_settime(0x0, 0x0, &(0x7f0000000980)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) readv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x40008032, 0xffffffffffffffff, 0x0) tkill(r0, 0x1000000000014) [ 116.930475][ T7923] ptrace attach of "/root/syz-executor.5"[7920] was attempted by "/root/syz-executor.5"[7923] 20:49:59 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:49:59 executing program 2: mlock(&(0x7f0000222000/0x1000)=nil, 0x1000) mmap(&(0x7f00002c8000/0x3000)=nil, 0x3000, 0x0, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f000035d000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) mmap(&(0x7f0000759000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000779000/0x2000)=nil, 0x2000, 0x0, 0x1132, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a97000/0x1000)=nil, 0x1000, 0x0, 0x1000000000002032, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0, 0x1000031, 0xffffffffffffffff, 0x0) 20:49:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r1, &(0x7f0000000140), 0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x4, &(0x7f000051e000)={r1, &(0x7f00000002c0), 0x0}, 0x20) 20:49:59 executing program 5: sched_setattr(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(0xffffffffffffffff, 0x8917, &(0x7f0000000080)={'bridge0\x00', {0x2, 0x4e23, @local}}) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 20:49:59 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhci\x00', 0x0) timer_settime(0x0, 0x0, &(0x7f0000000980)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) readv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x40008032, 0xffffffffffffffff, 0x0) tkill(r0, 0x1000000000014) 20:49:59 executing program 4: rt_sigaction(0x0, &(0x7f0000000100)={&(0x7f0000000080)="c4c3955eb4a7faa2584e5a1c054498c4235d40bcad00100000fe0f0f05f3000000b7f2a4c403015e1500000000020f38055df4c4e2a1b6fc0f9d2ddbda0000", {}, 0x0, 0x0}, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000440)="3e9b1b28c9e57fece14d41e55964182eb4677a3a76cf69fec4d421ec1daefca49191e1309297bb3937f337c55154bdd59b068d413d04c97d191b1f268b12b659e14aa36a4eeb6f01e20aa3d0c73f9db5feb497e354437a4b70a629ad3a9a3741bc36b27c3bf675fe644c63ab9078e9797b80f3414b6faf10ecf84d5948f59f8f19f7f402131454f79e05012273a58463189d2053729254ad2705ceeef56883fe75aedc5a57448dc89a4865be2ad130b5ab204ba591be0ce510731b26f061b65ba2173e7458ff939fae34b73e3d80c07e9d810c0f86a2770db12f55a22475f46229daf60de561abbf78ff5c780985bf848def827eccb9730c65e6be4f1b248fe715d90da866311e8a34ebf485a57400b4aeb57ae86587f11307b95474c61910b40ee54a8b6eaea76f80f8765eb617c624129b32b2758857db12586eb0c06a04bf3d3ac7320ad9afd3ba24c9d5c3f5a54d695e3673dcd5871fdc496af8b162b39e656ec64986e3774ee7c579d401a2677189d9b1c11c37a907bd1097aa397399560421952973a53afe2c4f64cd5bf52e2451955cb59c6df0ec4572a3c4c3e337f05da35b511312f397dbf6a6ca2f52d7988c5a8b1a01b8c9532922626197f1c0b7353dea62aa2cc6db1985e5cbeba584623724bf24845f51d4cd218d026090375c243ba50c610bcb4a3204926837fe5ec33ceb682e1b11277ab89e5b66d17939f0b7040803959bda5717b1ffc4aa5e0f1c2d9fcce0314d91e482d8ebc5506f58502d74d2125a114844f1aa0590c2ddc06ea6ef60304fe996c3b760bccbcc9fd0587c1c86fae0fadd798387364fd1da7fe123afc86a31034bc9ec2f1591003765e4e8858700595bc1686c1e2fc45cc9916805dfa83d18f0e23c2309b29782fe47f9036b094458d870e1faf4d5e8fff748345c9162d32e3c23531a4b76f0df124e106ff500aaa00b6fd2f6e8426b04609935a5f487b0958e5e633e05a4e065679494cf3fd7c71177b72ea08ccef2d9816b3b38287e36d2593db2d466de2ec08b349e5a2b27d339d856f0d9cf4401a8e5f350fa448e179eb5b9f34f01f287d1bafcd4711946c072a9d9c1c31d5d8638012ee41002aa99c2a181eaca32d8ef2560bab2346b1324e0c4ed3f193a17294511edf5d1398358b5d11efa74464d2906b63fe9499dfc4691fba80fc214d8c5518c235e48ff9b52b35407425f42d7517360c295bb31572e9b4f8e80b5e0b5ba0600eb139a626ded874a6ec921c093f5dd6d7d9f4d506b16ebc05f6235996769ae48225994351d7fccb0b3823a69a4965304b7866f23c46daddd0fdd78e32139e5855fb86fa669dc7f272a4c1c61e0f4ceb7fffea36b3e0e940cdc4529b7d9a583cdd91d6d8000f3febb7f743e3737086573d76f5dcd52f1db0d576a0238343923efb08633b7e1c34129c49c627d9308e4e0d651f35696a229924d95e9f6cc22daa853892efd3447783cfc02e4257ff478f8b96321fb6554c6887d9a6faffdc494aac3f1d7f39097833298ba61a63c78ba7d6e12317745e464801c51fe06ae8427647a7cd5b2cb1857b97661ad1e7baa3f8a7cdb62500330ee8dab1ef45e0681b0837cef348712887c2d341159a1a6062a5e5019876c75c8fed08f5f74265155d29ddc248ead80bb00818316c3f16534097fa19f761a30fe79aa29370a70b87670d2e5da35378ef671f9a7fc0d8d7521704a69473df6a6c2374190966a4b253dbd5f1f05de4ca957fe7649ff4fdb4f5ca3cac7dc8976c559cb6f9c7a68141f3700aea83301bfa1802efe6171b57829134b72ff1f7b336181cfb0fcbb84a5e897687e167c457b062b3087f58b9a8ed6318a6e3c22c805c545bf306a9d8fb3175875e334f18ca03237ad033b51014edebe50c9481d1dfec7c970da227189a6a7e55dadcd6857c08ee49a1d746c52f18e803e2438ec951b723ec2307a397f0aa5b3ab6d6f8ddd0deac5d170777650cd4d2ce26a36b15b47acf24c696d4d4b70cbec17175422520bc52b9a1dca03a5c14f570c118725c18bf312b6a890462b9cb7b6c02ddde99e116de35281ec8879e1c22cd63368a10c8d662a45ff795ddcc2487b225c5e04aaabe32e0da60bb157fe4003ab3bff6c55496294175dd97e99b744fda5c6245b12a6f692097ff1d6e30daa723bb7341757c62c4e5e3edcd955d7b10e99ab2a6ec5e40fe1a9f9fd181c6599b64e687cb9e884899a380dcd1e4374335aff638ba9a3c9f8c3003ea4a9d4c7bb7dcc4c5391bfdf920e44056d3d8a368801ad004f7bd5fec208f2357685ee1dae8cc534fec1bfed62b876e8b25d621e14682892ad67e9c963eb7abe335e5efeff1dac64d091894261b04d4f0be7264e91e2d7a55c0da4ebdf3025e524cff488e98569852a859998f02aacb66ec90a544576bb878e5cd78da44acb2c0a3e65a646f6403d08403aa1415c71fe9fe1e7806372b053229c281e15e3577a11d2ff83c972d97275e6712073e2fe9c067fd8a85412a0875f8e19d50562169b749c70feeb4d7d46659a7642a5703c32b6fb479c831b4521916a4fe5bc9d48063ae967caf8225902f368656ca747233990676342a357166e6d5b0591db8711810d1cfa92d1d725c64014206822c4329db80cbdf3febb2c74805451605fc10da67723b5b349d474ad1fcbaf368091b9eff0fb2ad7b5170adbb0443cc61893406b734deb39509ed664b4766cae0e221be55bc31176577500e0565d31bb7a0fb489a00d35040ce1ac1fc3790c6bb44f0a4757ae769c6d473337ee8145287d8a472022c1ba99d4849af47323784acb667b456589490a5af164afcbe54d246613cce975f0ae35ad46dde7047de4d411624dc5c85c43ca6fe08a2e94c8f1364b0d00c8a0ac4028ff602428ad21190de7bb0ba7e29f3828b4ac7a5a3003abe426f8f129bb30dd09c95a4eadc29ef7b60f029dc16417acaf461a7eb8079e13499ab4ee2febe866a3454e9215dac2a46825f3e5ea00a6d33e8f769e492252bb16fb2c4324749c1a68663a72608bd71a7dafbeffe980ccfa67c2e27f9f1ce5b0be18298ab6070d60c48d047f879598c8c66151a10d8ab6c21f934f01620e584064720f60c08e308acdf423c25372153cc4c9be1522c62a43bd06bae2fc9b9878ce74a78481cc46cb2428337b32f8ad6ea8e1f373fa7e85e0ce02fd16485b5ceddb364625afa4c4874927065634405428afd5b462d7d09b3e401884eb39f4a969c40536477194bce52c4fd966b4b32e60e160f8c46f91ab00869fbbe7b28585aebe58b2e815e547457e1ef5e9839b6aa4ed4098f6900aa3b1417c7aae714aebbc0d99677cae94639a7522208df39e78be862c9851f4aec490bab6e6d6f2a3f497a9cb3c8f598670a5bf8c0cbc03e398956086375efa1fbb399e83ac5b04cbdabdd61bf7c53ad2e797f3891be57207815257063b631b1d6a4f041ba472ece29b2aa44d72d2ae2a844993f7b81542772ec16229a4ac18cd4c248988209742a8c3769c85d6658c457cde8d917a6701c74acff85f2d96757df71d803c320f2c773574873b215fe6486abe306dd861cbbfc80bfcfd522c8172b63adebe28e7ad92720fa2bf893d03e4069f4a22c4a3afb300151d130f7e9f1f0b58537383105436f857de6ca818e7304c44d50a3ab05bd6fdd07a24d3f84d9f2f519f7082a5b468e98e0b010c816b80b8d95e875a61b2ef2fbfce6fe62d440bd72d0a55ac4e22bc8faf0a942c61f1a0efec901bda0e8414bd017f65d7e371f8bf98596b0767ec078f7dbc5878601a2bfdc502f8d25a1da2c391cdd9b9b929527e97dd0e07d3ec111bcaec0bf46a4e03840e9452aeb94caf87045098335dd355fec3d80a950238953245bc8e6dc820b5e7b48ac3fb81221ac241265a85bfe55940e3a070111983e77809e721e9e39e82debbab84bcbaa4c53ffbd5d8dd2fe99d0a8a517f6f3b7023ff2d7d0b5d12bbb1fd842f01807c59c2ce36d861d4ab032d28c4a50504c13f482bce89c598914ae5ea308186efb50802a4a038d1dfa3966c101b47d221830cb7c3d806c149839d12277878a5c7b7e608909863", 0xb42) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") setxattr$trusted_overlay_upper(0x0, &(0x7f0000000040)='trusted.overlay.upper\x00', 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0xfffffffffffffeaf, 0x0, 0x0, 0xffffffae) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x73, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 20:49:59 executing program 2: symlink(&(0x7f0000000000)='./bus\x00', &(0x7f0000000040)='./bus\x00') creat(&(0x7f0000000700)='./bus\x00', 0x0) 20:49:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r1, &(0x7f0000000140), 0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x4, &(0x7f000051e000)={r1, &(0x7f00000002c0), 0x0}, 0x20) 20:49:59 executing program 2: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000980)={0x2, 0x1}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c1241319bd070") syz_emit_ethernet(0x423, &(0x7f0000000080)={@link_local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0x0, 0x0, 0x0, 0x200000000000011, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) recvmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f00000004c0)=""/255, 0xff}, {&(0x7f00000009c0)=""/4096, 0x1000}], 0x2}, 0x0) 20:49:59 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhci\x00', 0x0) timer_settime(0x0, 0x0, &(0x7f0000000980)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) readv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x40008032, 0xffffffffffffffff, 0x0) tkill(r0, 0x1000000000014) 20:49:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r1, &(0x7f0000000140), 0x0}, 0x20) 20:49:59 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:49:59 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x400000001, 0x70, 0x2005, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000140)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) sendmmsg(r2, &(0x7f0000000440), 0x400000000000211, 0x810) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_SOCK_GET(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) keyctl$clear(0x7, 0x0) 20:50:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000140), 0x0}, 0x20) 20:50:00 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:00 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='io\x00') gettid() write$P9_RUNLINKAT(r0, 0x0, 0xfddd) 20:50:00 executing program 4: mlock(&(0x7f0000222000/0x1000)=nil, 0x1000) mmap(&(0x7f00002c8000/0x3000)=nil, 0x3000, 0x0, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f000035d000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x0, 0x0) mmap(&(0x7f0000759000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000779000/0x2000)=nil, 0x2000, 0x0, 0x1132, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000a97000/0x1000)=nil, 0x1000, 0x0, 0x1000000000002032, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfda000)=nil, 0xfda000, 0x0, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) 20:50:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000140), 0x0}, 0x20) 20:50:00 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhci\x00', 0x0) timer_settime(0x0, 0x0, &(0x7f0000000980)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x40008032, 0xffffffffffffffff, 0x0) 20:50:00 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000140), 0x0}, 0x20) 20:50:00 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x4004556a, &(0x7f0000000040)) 20:50:00 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:00 executing program 5: r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0xffdbc2ca) 20:50:00 executing program 4: eventfd(0x0) close(0xffffffffffffffff) r0 = socket$unix(0x1, 0x1, 0x0) write$eventfd(0xffffffffffffffff, 0x0, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$eventfd(0xffffffffffffffff, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) write$cgroup_int(r0, 0x0, 0x0) 20:50:00 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:00 executing program 0: ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) 20:50:00 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x400000001, 0x70, 0x2005, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8090, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) sendmmsg(r1, &(0x7f0000000440), 0x400000000000211, 0x810) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) r2 = socket$key(0xf, 0x3, 0x2) ioctl$sock_SIOCDELDLCI(r2, 0x8981, 0x0) sendmsg$TIPC_NL_SOCK_GET(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x4200000000000005, 0x1) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:50:01 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x4004556a, &(0x7f0000000040)) 20:50:01 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:01 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhci\x00', 0x0) timer_settime(0x0, 0x0, &(0x7f0000000980)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x40008032, 0xffffffffffffffff, 0x0) 20:50:01 executing program 0: ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) 20:50:01 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x4004556a, &(0x7f0000000040)) 20:50:01 executing program 3: r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:01 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x400000001, 0x70, 0x2005, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8090, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) sendmmsg(r1, &(0x7f0000000440), 0x400000000000211, 0x810) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, 0xffffffffffffffff) r2 = socket$key(0xf, 0x3, 0x2) ioctl$sock_SIOCDELDLCI(r2, 0x8981, 0x0) sendmsg$TIPC_NL_SOCK_GET(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x2, 0x4200000000000005, 0x1) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:50:01 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x1000000077, 0x0, [0x40000108]}) 20:50:01 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x4004556a, &(0x7f0000000040)) 20:50:01 executing program 3: r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:01 executing program 0: ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) 20:50:01 executing program 2: ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x4004556a, &(0x7f0000000040)) 20:50:01 executing program 3: r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:01 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:02 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhci\x00', 0x0) timer_settime(0x0, 0x0, &(0x7f0000000980)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x40008032, 0xffffffffffffffff, 0x0) 20:50:02 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000840)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000080)={0x200000000bd, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r0, 0x80045301, &(0x7f0000000040)) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r0, 0xc08c5334, &(0x7f0000000400)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x12}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) tkill(r1, 0x1000000000013) 20:50:02 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x0, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:02 executing program 2: ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x4004556a, &(0x7f0000000040)) 20:50:02 executing program 5: r0 = open(&(0x7f0000000000)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000340)='./file0\x00', 0x0, 0x0) write$9p(r0, &(0x7f0000000800)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb9693dd6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b804bfe70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706", 0x200) sendfile(r0, r1, 0x0, 0x10000) setxattr$security_capability(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='security.capability\x00', &(0x7f00000002c0)=@v3={0x3000000, [{0x8000, 0x7f0000000}, {0x0, 0x2}]}, 0x18, 0x0) 20:50:02 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:02 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x0, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:02 executing program 2: ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x4004556a, &(0x7f0000000040)) 20:50:02 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) 20:50:02 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x4004556a, &(0x7f0000000040)) 20:50:02 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:02 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x0, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:03 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhci\x00', 0x0) timer_settime(0x0, 0x0, &(0x7f0000000980)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) readv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) tkill(r0, 0x1000000000014) 20:50:05 executing program 4: openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000002c0)={0x0, 0x3}, 0x4) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r2, 0x7001) ioctl$RTC_ALM_SET(r2, 0x40247007, &(0x7f0000000180)) setsockopt$sock_int(r0, 0x1, 0x6, 0x0, 0x0) fadvise64(r1, 0x0, 0xfffffffffffffffa, 0x0) 20:50:05 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007d0000000000000073013d00000000009500000000000000"], 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70) 20:50:05 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x4004556a, &(0x7f0000000040)) 20:50:05 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0x0, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:05 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:05 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhci\x00', 0x0) timer_settime(0x0, 0x0, &(0x7f0000000980)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) readv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) tkill(r0, 0x1000000000014) 20:50:05 executing program 5: r0 = socket(0x10, 0x20000000802, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'bond0\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="4c0000000500e1ff0000000020000003"]}) 20:50:05 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x4004556a, &(0x7f0000000040)) 20:50:05 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0x0, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:05 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000006440)=[{{0x0, 0x0, &(0x7f00000025c0)=[{&(0x7f0000001380)=""/206, 0xce}], 0x1a3}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip6_mr_vif\x00') preadv(r0, &(0x7f00000017c0), 0x12b, 0x2000000) 20:50:05 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:05 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f00000002c0)=ANY=[@ANYBLOB="6e61843167377400000100000000000000000000e4dbb77487e90104000000000040800000000000171b23000005c7ec1ea0e3b9adc8000000ac010000000000001004d1e090e1fe916dd282e0f34f8dfac0dc1695c4d700001004000010040002d3a379b87c5ade6e27a603551ae6543351c2f2d3c00f3f72e211777424c9814f1fb4921c6c3768c3388b2aa66b63012812d04b94d660aab341cfe8364422b866cd445d5d0f4d6715ba885900323e00000000000071cfe0a00095"], 0x1) ptrace$setopts(0x4206, r2, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) tkill(r2, 0x16) 20:50:05 executing program 2: openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x4004556a, &(0x7f0000000040)) 20:50:05 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0x0, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:05 executing program 4: r0 = eventfd2(0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00\x13\xcd\xe8\xe9Z\x02\x12[x\x99e\a\xafs\x95\xbbv\xb2\x8f5\xcd\x05\x89\x7f\xe8w\xc2\xc1\x9daZ\x99\x16\x12\x85O\xdb') flock(r0, 0xa3862a32a7814cb7) sendfile(r1, r1, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:05 executing program 2: openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x4004556a, &(0x7f0000000040)) 20:50:05 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) [ 123.506564][ T8237] ptrace attach of "/root/syz-executor.5"[8235] was attempted by "/root/syz-executor.5"[8237] 20:50:06 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhci\x00', 0x0) timer_settime(0x0, 0x0, &(0x7f0000000980)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) readv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) tkill(r0, 0x1000000000014) 20:50:06 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x0, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:06 executing program 4: r0 = eventfd2(0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00\x13\xcd\xe8\xe9Z\x02\x12[x\x99e\a\xafs\x95\xbbv\xb2\x8f5\xcd\x05\x89\x7f\xe8w\xc2\xc1\x9daZ\x99\x16\x12\x85O\xdb') flock(r0, 0xa3862a32a7814cb7) sendfile(r1, r1, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:06 executing program 2: openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x4004556a, &(0x7f0000000040)) 20:50:06 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:06 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x4004556a, 0x0) 20:50:08 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaff86dd6076605100303a00fe8000000000000000000000000000ffff020000000000000000000000000001890090780014000060c5961e00000000ff010000000000001803000000000001d80636a41d4e601aff020000000000000000000000000001"], 0x0) 20:50:08 executing program 4: r0 = eventfd2(0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00\x13\xcd\xe8\xe9Z\x02\x12[x\x99e\a\xafs\x95\xbbv\xb2\x8f5\xcd\x05\x89\x7f\xe8w\xc2\xc1\x9daZ\x99\x16\x12\x85O\xdb') flock(r0, 0xa3862a32a7814cb7) sendfile(r1, r1, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:08 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:08 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x0, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:08 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x4004556a, 0x0) 20:50:08 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhci\x00', 0x0) readv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x40008032, 0xffffffffffffffff, 0x0) tkill(r0, 0x1000000000014) 20:50:08 executing program 4: r0 = eventfd2(0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00\x13\xcd\xe8\xe9Z\x02\x12[x\x99e\a\xafs\x95\xbbv\xb2\x8f5\xcd\x05\x89\x7f\xe8w\xc2\xc1\x9daZ\x99\x16\x12\x85O\xdb') flock(r0, 0xa3862a32a7814cb7) sendfile(r1, r1, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:08 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r0, 0x4004556a, 0x0) 20:50:08 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x0, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:08 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, 0x0) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:08 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet_group_source_req(r1, 0x0, 0x30, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1000000003c) fcntl$setstatus(r1, 0x4, 0x42804) 20:50:08 executing program 4: eventfd2(0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00\x13\xcd\xe8\xe9Z\x02\x12[x\x99e\a\xafs\x95\xbbv\xb2\x8f5\xcd\x05\x89\x7f\xe8w\xc2\xc1\x9daZ\x99\x16\x12\x85O\xdb') sendfile(r0, r0, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:08 executing program 2: r0 = socket(0x800000000000001e, 0x200000000000002, 0x0) sendmsg(r0, &(0x7f0000000700)={&(0x7f0000fdbf80)=@generic={0x10000000001e, "02010000000020df0000000000000000805bf86c57020002000000f1fffff400000000000000000000010300000000e4ff064b3fdf3a000000080000000000000000ac50d5fe32c4000000007fffffff6a008356edb9a6341c1fd45624281e00070ece000206000000090000fd00000900000000000b0000db000004da36"}, 0x80, 0x0}, 0x0) 20:50:08 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:09 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:09 executing program 4: eventfd2(0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00\x13\xcd\xe8\xe9Z\x02\x12[x\x99e\a\xafs\x95\xbbv\xb2\x8f5\xcd\x05\x89\x7f\xe8w\xc2\xc1\x9daZ\x99\x16\x12\x85O\xdb') sendfile(r0, r0, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:09 executing program 2: memfd_create(0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) io_uring_setup(0xefd, &(0x7f0000001580)={0x0, 0x0, 0x5}) [ 126.892272][ T8325] input: syz1 as /devices/virtual/input/input37 20:50:20 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000200000002, &(0x7f00000002c0)=0x2, 0x4) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0xfffffefffffffffe, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 20:50:20 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) 20:50:20 executing program 4: eventfd2(0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00\x13\xcd\xe8\xe9Z\x02\x12[x\x99e\a\xafs\x95\xbbv\xb2\x8f5\xcd\x05\x89\x7f\xe8w\xc2\xc1\x9daZ\x99\x16\x12\x85O\xdb') sendfile(r0, r0, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:20 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhci\x00', 0x0) readv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x40008032, 0xffffffffffffffff, 0x0) tkill(r0, 0x1000000000014) 20:50:20 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x1000000077, 0x0, [0x186, 0x1]}) 20:50:20 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:20 executing program 4: r0 = eventfd2(0x0, 0x0) flock(r0, 0xa3862a32a7814cb7) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:20 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000140), 0x0}, 0x20) [ 138.221013][ T8352] input: syz1 as /devices/virtual/input/input38 [ 138.240843][ T8351] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 138.251196][ T8347] kvm [8346]: vcpu0, guest rIP: 0xfff0 disabled perfctr wrmsr: 0x186 data 0x1 20:50:20 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x1000000077, 0x0, [0x1b, 0x1]}) 20:50:20 executing program 4: r0 = eventfd2(0x0, 0x0) flock(r0, 0xa3862a32a7814cb7) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:20 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:20 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) 20:50:20 executing program 2: r0 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'erspan0\x00'}, 0x18) ioctl(r0, 0x8982, &(0x7f0000000000)) [ 138.535451][ T8380] input: syz1 as /devices/virtual/input/input39 20:50:20 executing program 4: r0 = eventfd2(0x0, 0x0) flock(r0, 0xa3862a32a7814cb7) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:20 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) 20:50:31 executing program 2: 20:50:31 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhci\x00', 0x0) readv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x40008032, 0xffffffffffffffff, 0x0) tkill(r0, 0x1000000000014) 20:50:31 executing program 5: request_key(0x0, 0x0, 0x0, 0xfffffffffffffffc) creat(&(0x7f0000000100)='./bus\x00', 0x0) r0 = open(&(0x7f0000000780)='./bus\x00', 0x14102e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x4002011, r0, 0x0) 20:50:31 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) 20:50:31 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:31 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00\x13\xcd\xe8\xe9Z\x02\x12[x\x99e\a\xafs\x95\xbbv\xb2\x8f5\xcd\x05\x89\x7f\xe8w\xc2\xc1\x9daZ\x99\x16\x12\x85O\xdb') flock(0xffffffffffffffff, 0xa3862a32a7814cb7) sendfile(r0, r0, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:31 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000140), 0x0}, 0x20) 20:50:31 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00\x13\xcd\xe8\xe9Z\x02\x12[x\x99e\a\xafs\x95\xbbv\xb2\x8f5\xcd\x05\x89\x7f\xe8w\xc2\xc1\x9daZ\x99\x16\x12\x85O\xdb') flock(0xffffffffffffffff, 0xa3862a32a7814cb7) sendfile(r0, r0, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:31 executing program 5: 20:50:31 executing program 2: 20:50:31 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000140), 0x0}, 0x20) 20:50:32 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:32 executing program 5: 20:50:43 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000980)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) readv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x40008032, 0xffffffffffffffff, 0x0) tkill(r0, 0x1000000000014) 20:50:43 executing program 2: 20:50:43 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00\x13\xcd\xe8\xe9Z\x02\x12[x\x99e\a\xafs\x95\xbbv\xb2\x8f5\xcd\x05\x89\x7f\xe8w\xc2\xc1\x9daZ\x99\x16\x12\x85O\xdb') flock(0xffffffffffffffff, 0xa3862a32a7814cb7) sendfile(r0, r0, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:43 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000140), 0x0}, 0x20) 20:50:43 executing program 5: 20:50:43 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x5501, 0x0) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:43 executing program 5: r0 = socket$inet6(0xa, 0x400000000001, 0x0) close(r0) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vhci\x00', 0x6) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ioctl$int_out(0xffffffffffffffff, 0x0, 0x0) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) write$P9_RLERRORu(r2, &(0x7f0000000380)=ANY=[@ANYBLOB="ffc0a42105"], 0x5) sendfile(r0, r2, &(0x7f0000000140), 0x2) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, 0x0) 20:50:43 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=ANY=[@ANYBLOB="2c0000001600010400000000000000000a0000000000000014000100fe880000000000010000000000000000"], 0x1}}, 0x0) 20:50:43 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, 0x0, 0x0}, 0x20) 20:50:43 executing program 4: r0 = eventfd2(0x0, 0x0) r1 = syz_open_procfs(0x0, 0x0) flock(r0, 0xa3862a32a7814cb7) sendfile(r1, r1, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:43 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(0x0, 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:43 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) clone(0xbffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f00000000c0)={'nr0\x00', {0x2, 0x0, @empty}}) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3d) wait4(0x0, 0x0, 0x0, 0x0) 20:50:43 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000980)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) readv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/134, 0x86}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x40008032, 0xffffffffffffffff, 0x0) tkill(r0, 0x1000000000014) 20:50:43 executing program 4: r0 = eventfd2(0x0, 0x0) r1 = syz_open_procfs(0x0, 0x0) flock(r0, 0xa3862a32a7814cb7) sendfile(r1, r1, &(0x7f00000001c0)=0xa00, 0x7ffc) 20:50:43 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0xe, 0x3, 0x2}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, 0x0, 0x0}, 0x20) 20:50:43 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x8004ae98, &(0x7f0000000000)) [ 161.391482][ T8476] input: syz1 as /devices/virtual/input/input43 20:50:43 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000000c0)={{}, 'syz1\x00', 0x50}) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) syz_open_dev$evdev(0x0, 0x4, 0x0) ioctl$UI_DEV_DESTROY(r0, 0x5502) 20:50:43 executing program 4: r0 = eventfd2(0x0, 0x0) r1 = syz_open_procfs(0x0, 0x0) flock(r0, 0xa3862a32a7814cb7) sendfile(r1, r1, &(0x7f00000001c0)=0xa00, 0x7ffc) [ 161.589352][ T8499] input: syz1 as /devices/virtual/input/input44 [ 162.074281][ T8510] WARNING: CPU: 1 PID: 8510 at fs/kernfs/dir.c:494 kernfs_get.part.0+0x73/0x90 [ 162.075235][ T8460] kobject: 'hci0' (00000000c0de4ca4): kobject_cleanup, parent (null) [ 162.084225][ T8510] Kernel panic - not syncing: panic_on_warn set ... [ 162.084273][ T8510] CPU: 1 PID: 8510 Comm: syz-executor.5 Not tainted 5.1.0-rc5+ #72 [ 162.084283][ T8510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 162.084299][ T8510] Call Trace: [ 162.084349][ T8510] dump_stack+0x172/0x1f0 [ 162.093369][ T8460] kobject: 'hci0' (00000000c0de4ca4): calling ktype release [ 162.099861][ T8510] ? kernfs_get.part.0+0x50/0x90 [ 162.099878][ T8510] panic+0x2cb/0x65c [ 162.099892][ T8510] ? __warn_printk+0xf3/0xf3 [ 162.099912][ T8510] ? kernfs_get.part.0+0x73/0x90 [ 162.099927][ T8510] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 162.099948][ T8510] ? __warn.cold+0x5/0x45 [ 162.107976][ T8460] kobject: 'hci0': free name [ 162.117896][ T8510] ? kernfs_get.part.0+0x73/0x90 [ 162.117912][ T8510] __warn.cold+0x20/0x45 [ 162.117928][ T8510] ? kernfs_get.part.0+0x73/0x90 [ 162.117944][ T8510] report_bug+0x263/0x2b0 [ 162.117968][ T8510] do_error_trap+0x11b/0x200 [ 162.189791][ T8510] do_invalid_op+0x37/0x50 [ 162.194207][ T8510] ? kernfs_get.part.0+0x73/0x90 [ 162.199246][ T8510] invalid_op+0x14/0x20 [ 162.203509][ T8510] RIP: 0010:kernfs_get.part.0+0x73/0x90 [ 162.209040][ T8510] Code: e6 e8 31 c2 9a ff 45 85 e4 74 1a e8 a7 c0 9a ff be 04 00 00 00 48 89 df e8 1a aa d2 ff f0 ff 03 5b 41 5c 5d c3 e8 8d c0 9a ff <0f> 0b eb dd 48 89 df e8 11 d0 d2 ff eb c1 0f 1f 44 00 00 66 2e 0f [ 162.229029][ T8510] RSP: 0018:ffff888060c97250 EFLAGS: 00010212 [ 162.235093][ T8510] RAX: 0000000000040000 RBX: ffff88808f029a80 RCX: ffffc90010c76000 [ 162.243053][ T8510] RDX: 0000000000001e68 RSI: ffffffff81d5cc23 RDI: 0000000000000005 [ 162.251109][ T8510] RBP: ffff888060c97260 R08: ffff888060c8c0c0 R09: ffffed1011e05351 [ 162.259155][ T8510] R10: ffffed1011e05350 R11: ffff88808f029a83 R12: 0000000000000000 [ 162.267289][ T8510] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 [ 162.275295][ T8510] ? kernfs_get.part.0+0x73/0x90 [ 162.280236][ T8510] kernfs_new_node+0xb8/0x130 [ 162.284907][ T8510] kernfs_create_dir_ns+0x52/0x160 [ 162.290066][ T8510] sysfs_create_dir_ns+0x131/0x2a0 [ 162.295224][ T8510] ? sysfs_create_mount_point+0xa0/0xa0 [ 162.300786][ T8510] ? class_dir_child_ns_type+0xd/0x60 [ 162.306274][ T8510] kobject_add_internal.cold+0xe5/0x5d4 [ 162.311815][ T8510] kobject_add+0x150/0x1c0 [ 162.316415][ T8510] ? kset_create_and_add+0x1a0/0x1a0 [ 162.321700][ T8510] ? kasan_check_read+0x11/0x20 [ 162.326556][ T8510] ? mutex_unlock+0xd/0x10 [ 162.330972][ T8510] device_add+0x3d5/0x18a0 [ 162.335390][ T8510] ? device_initialize+0x440/0x440 [ 162.340507][ T8510] ? get_device_parent.isra.0+0x570/0x570 [ 162.346345][ T8510] hci_register_dev+0x2e8/0x860 [ 162.351398][ T8510] __vhci_create_device+0x2d0/0x5a0 [ 162.356604][ T8510] vhci_write+0x2d0/0x470 [ 162.361052][ T8510] new_sync_write+0x4c7/0x760 [ 162.365775][ T8510] ? default_llseek+0x2e0/0x2e0 [ 162.370629][ T8510] ? find_lock_entry+0x1a3/0x510 [ 162.375825][ T8510] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 162.382071][ T8510] ? shmem_getpage_gfp+0x1648/0x2500 [ 162.387645][ T8510] __vfs_write+0xe4/0x110 [ 162.391973][ T8510] __kernel_write+0x110/0x3b0 [ 162.396655][ T8510] write_pipe_buf+0x15d/0x1f0 [ 162.401339][ T8510] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 162.407584][ T8510] ? do_splice_direct+0x2a0/0x2a0 [ 162.412622][ T8510] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 162.418863][ T8510] ? splice_from_pipe_next.part.0+0x255/0x2f0 [ 162.424965][ T8510] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 162.431322][ T8510] __splice_from_pipe+0x395/0x7d0 [ 162.436349][ T8510] ? do_splice_direct+0x2a0/0x2a0 [ 162.441427][ T8510] ? do_splice_direct+0x2a0/0x2a0 [ 162.446450][ T8510] splice_from_pipe+0x108/0x170 [ 162.451285][ T8510] ? splice_shrink_spd+0xd0/0xd0 [ 162.456227][ T8510] default_file_splice_write+0x3c/0x90 [ 162.461682][ T8510] ? generic_splice_sendpage+0x50/0x50 [ 162.467133][ T8510] direct_splice_actor+0x126/0x1a0 [ 162.472238][ T8510] splice_direct_to_actor+0x369/0x970 [ 162.477905][ T8510] ? generic_pipe_buf_nosteal+0x10/0x10 [ 162.483448][ T8510] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 162.489667][ T8510] ? do_splice_to+0x190/0x190 [ 162.494336][ T8510] ? rw_verify_area+0x118/0x360 [ 162.499169][ T8510] do_splice_direct+0x1da/0x2a0 [ 162.504003][ T8510] ? splice_direct_to_actor+0x970/0x970 [ 162.509639][ T8510] ? rw_verify_area+0x118/0x360 [ 162.515049][ T8510] do_sendfile+0x597/0xd00 [ 162.519469][ T8510] ? do_compat_pwritev64+0x1c0/0x1c0 [ 162.524750][ T8510] __ia32_compat_sys_sendfile+0x169/0x230 [ 162.530621][ T8510] ? __ia32_sys_sendfile64+0x220/0x220 [ 162.536351][ T8510] ? do_fast_syscall_32+0xd1/0xc98 [ 162.541467][ T8510] ? lockdep_hardirqs_on+0x418/0x5d0 [ 162.546869][ T8510] ? trace_hardirqs_on+0x67/0x230 [ 162.551905][ T8510] do_fast_syscall_32+0x281/0xc98 [ 162.556916][ T8510] entry_SYSENTER_compat+0x70/0x7f [ 162.562048][ T8510] RIP: 0023:0xf7f55869 [ 162.566103][ T8510] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 162.585803][ T8510] RSP: 002b:00000000f5d0f0cc EFLAGS: 00000296 ORIG_RAX: 00000000000000bb [ 162.594213][ T8510] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000004 [ 162.602170][ T8510] RDX: 0000000020000140 RSI: 0000000000000002 RDI: 0000000000000000 [ 162.610134][ T8510] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 162.618086][ T8510] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 162.626094][ T8510] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 162.635169][ T8510] Kernel Offset: disabled [ 162.639597][ T8510] Rebooting in 86400 seconds..