syzkaller login: [   65.048683][   T38] audit: type=1400 audit(1575106338.436:41): avc:  denied  { map } for  pid=8049 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1
Warning: Permanently added '[localhost]:38934' (ECDSA) to the list of known hosts.
[   67.202554][   T38] audit: type=1400 audit(1575106340.586:42): avc:  denied  { map } for  pid=8059 comm="syz-fuzzer" path="/syz-fuzzer" dev="sda1" ino=16525 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1
2019/11/30 09:32:20 fuzzer started
2019/11/30 09:32:21 dialing manager at 10.0.2.10:40921
2019/11/30 09:32:21 syscalls: 2533
2019/11/30 09:32:21 code coverage: enabled
2019/11/30 09:32:21 comparison tracing: enabled
2019/11/30 09:32:21 extra coverage: extra coverage is not supported by the kernel
2019/11/30 09:32:21 setuid sandbox: enabled
2019/11/30 09:32:21 namespace sandbox: enabled
2019/11/30 09:32:21 Android sandbox: /sys/fs/selinux/policy does not exist
2019/11/30 09:32:21 fault injection: enabled
2019/11/30 09:32:21 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2019/11/30 09:32:21 net packet injection: enabled
2019/11/30 09:32:21 net device setup: enabled
2019/11/30 09:32:21 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist
2019/11/30 09:32:21 devlink PCI setup: PCI device 0000:00:10.0 is not available
09:32:33 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
dup(0xffffffffffffffff)
shutdown(0xffffffffffffffff, 0x0)
readv(r0, &(0x7f0000000000)=[{&(0x7f0000000140)=""/217, 0xd8}], 0x6e)
r1 = dup(r0)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
recvfrom$inet(r2, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00505)
shutdown(r1, 0x0)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
getsockopt$sock_timeval(r2, 0xffff, 0x1005, 0x0, &(0x7f0000000080))
recvfrom$inet(r3, 0x0, 0x22b41b9a8748b1b5, 0x0, 0x0, 0x800e00510)
shutdown(r2, 0x0)
shutdown(r3, 0x0)

[   80.536957][   T38] audit: type=1400 audit(1575106353.916:43): avc:  denied  { map } for  pid=8084 comm="syz-executor.0" path="/sys/kernel/debug/kcov" dev="debugfs" ino=2074 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1
09:32:34 executing program 1:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$inet6(0xa, 0x800000000000002, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
getrandom(0x0, 0x0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9)
ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000000040)={0xd000000, 0xffffffffffffffff, 0x0, 0x3})

[   80.715891][ T8085] IPVS: ftp: loaded support on port[0] = 21
[   80.728571][ T8087] IPVS: ftp: loaded support on port[0] = 21
[   80.818471][ T8085] chnl_net:caif_netlink_parms(): no params data found
[   80.846210][ T8087] chnl_net:caif_netlink_parms(): no params data found
[   80.879130][ T8085] bridge0: port 1(bridge_slave_0) entered blocking state
[   80.886696][ T8085] bridge0: port 1(bridge_slave_0) entered disabled state
[   80.895942][ T8085] device bridge_slave_0 entered promiscuous mode
[   80.913328][ T8085] bridge0: port 2(bridge_slave_1) entered blocking state
[   80.920872][ T8085] bridge0: port 2(bridge_slave_1) entered disabled state
[   80.928975][ T8085] device bridge_slave_1 entered promiscuous mode
[   80.936300][ T8087] bridge0: port 1(bridge_slave_0) entered blocking state
[   80.944587][ T8087] bridge0: port 1(bridge_slave_0) entered disabled state
[   80.953251][ T8087] device bridge_slave_0 entered promiscuous mode
[   80.966384][ T8087] bridge0: port 2(bridge_slave_1) entered blocking state
[   80.974614][ T8087] bridge0: port 2(bridge_slave_1) entered disabled state
[   80.983693][ T8087] device bridge_slave_1 entered promiscuous mode
[   81.006791][ T8085] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   81.018722][ T8087] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   81.031530][ T8085] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   81.042956][ T8087] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   81.072395][ T8085] team0: Port device team_slave_0 added
[   81.080666][ T8087] team0: Port device team_slave_0 added
[   81.088423][ T8085] team0: Port device team_slave_1 added
[   81.097050][ T8087] team0: Port device team_slave_1 added
[   81.160416][ T8085] device hsr_slave_0 entered promiscuous mode
[   81.208550][ T8085] device hsr_slave_1 entered promiscuous mode
[   81.350540][ T8087] device hsr_slave_0 entered promiscuous mode
[   81.408456][ T8087] device hsr_slave_1 entered promiscuous mode
[   81.488355][ T8087] debugfs: Directory 'hsr0' with parent '/' already present!
[   81.525590][   T38] audit: type=1400 audit(1575106354.906:44): avc:  denied  { create } for  pid=8085 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[   81.550825][   T38] audit: type=1400 audit(1575106354.906:45): avc:  denied  { write } for  pid=8085 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[   81.575835][   T38] audit: type=1400 audit(1575106354.906:46): avc:  denied  { read } for  pid=8085 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
[   81.600891][ T8085] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   81.691049][ T8087] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   81.760548][ T8085] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   81.819602][ T8087] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   81.890320][ T8085] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   81.975119][ T8087] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   82.069886][ T8087] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   82.139889][ T8085] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   82.254513][ T8087] 8021q: adding VLAN 0 to HW filter on device bond0
[   82.264828][ T8085] 8021q: adding VLAN 0 to HW filter on device bond0
[   82.278431][ T1204] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[   82.286535][ T1204] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   82.294637][ T1204] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[   82.302830][ T1204] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   82.312600][ T8085] 8021q: adding VLAN 0 to HW filter on device team0
[   82.323482][ T8087] 8021q: adding VLAN 0 to HW filter on device team0
[   82.330926][ T8093] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[   82.339578][ T8093] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   82.348356][ T8093] bridge0: port 1(bridge_slave_0) entered blocking state
[   82.355656][ T8093] bridge0: port 1(bridge_slave_0) entered forwarding state
[   82.364085][ T8093] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[   82.374878][ T3112] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[   82.383689][ T3112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   82.393445][ T3112] bridge0: port 2(bridge_slave_1) entered blocking state
[   82.400665][ T3112] bridge0: port 2(bridge_slave_1) entered forwarding state
[   82.409093][ T3112] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[   82.418466][ T3112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   82.427319][ T3112] bridge0: port 1(bridge_slave_0) entered blocking state
[   82.434926][ T3112] bridge0: port 1(bridge_slave_0) entered forwarding state
[   82.442940][ T3112] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[   82.456523][   T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[   82.465259][   T33] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[   82.474133][   T33] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   82.482659][   T33] bridge0: port 2(bridge_slave_1) entered blocking state
[   82.490073][   T33] bridge0: port 2(bridge_slave_1) entered forwarding state
[   82.514295][ T8085] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   82.525177][ T8085] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   82.536985][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[   82.546009][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[   82.554672][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[   82.563243][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   82.571880][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[   82.580611][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[   82.589182][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   82.597515][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[   82.606325][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   82.615084][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[   82.623590][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   82.632375][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[   82.641229][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   82.649729][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[   82.658083][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   82.666550][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[   82.675296][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[   82.683887][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   82.691913][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   82.700063][ T2959] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[   82.712925][   T61] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[   82.721640][   T61] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[   82.731431][ T8087] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[   82.753051][ T1204] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[   82.761050][ T1204] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[   82.769313][ T1204] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[   82.776960][ T1204] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[   82.787106][ T8085] 8021q: adding VLAN 0 to HW filter on device batadv0
[   82.799314][ T8087] 8021q: adding VLAN 0 to HW filter on device batadv0
[   82.799914][   T38] audit: type=1400 audit(1575106356.186:47): avc:  denied  { associate } for  pid=8085 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1
[   82.905982][   T38] audit: type=1400 audit(1575106356.286:48): avc:  denied  { open } for  pid=8098 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1
[   82.930718][   T38] audit: type=1400 audit(1575106356.286:49): avc:  denied  { kernel } for  pid=8098 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1
09:32:36 executing program 0:
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/snmp\x00')
recvmmsg(0xffffffffffffffff, &(0x7f00000036c0)=[{{0x0, 0x0, &(0x7f0000001c00)=[{&(0x7f0000001b80)=""/4, 0x4}], 0x1}}], 0x1, 0x0, 0x0)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0)='devlink\x00')
ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000100)=<r2=>0x0)
r3 = open(&(0x7f0000000080)='./file0\x00', 0x40002, 0x0)
write$P9_RRENAMEAT(r3, &(0x7f0000000280)={0x7}, 0x7)
r4 = perf_event_open(&(0x7f000025c000)={0x400000001, 0x70, 0x2005, 0x0, 0x0, 0x0, 0x0, 0x1, 0x182b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x200}, 0x103}, 0x0, 0xffffffffffffffff, r4, 0x0)
pipe(&(0x7f0000000280)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
splice(0xffffffffffffffff, 0x0, r5, 0x0, 0x100000000000a, 0x0)
ioctl$sock_TIOCINQ(r5, 0x541b, &(0x7f0000000100))
r6 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000b80)={{{@in=@local, @in6=@loopback}}, {{}, 0x0, @in=@remote}}, &(0x7f0000000c80)=0xe8)
getegid()
lstat(&(0x7f0000000cc0)='./file0/file0\x00', &(0x7f0000000d00))
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r6, 0xc0502100, &(0x7f0000000d80)={0x0, <r7=>0x0})
r8 = socket(0xa, 0x2, 0x0)
getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r9=>0x0}, 0x0)
setreuid(0x0, r9)
getsockopt$ARPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000140)={'filter\x00'}, &(0x7f00000001c0)=0x44)
socket$inet(0x2, 0x4000020000000001, 0x0)
getsockopt$ARPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x60, 0x0, 0x0)
r10 = socket$inet(0x2, 0x4000020000000001, 0x0)
getsockopt$ARPT_SO_GET_INFO(r10, 0x0, 0x60, &(0x7f0000000140)={'filter\x00'}, &(0x7f00000001c0)=0x44)
socket$inet(0x2, 0x4000020000000001, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={<r11=>r7, r0, 0x0, 0x9, &(0x7f0000000140)='net/snmp\x00'}, 0x30)
sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000300)={&(0x7f0000000000), 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="efb50033", @ANYRES16=r1, @ANYBLOB="00012cbd7000ffdbdf2525000000100001006e657464657673696d000000100002006e657464657673696d30000008008b00", @ANYRES32=r2, @ANYBLOB="080001007063690014000200303030303a30303a31302e300000000008008a00", @ANYRES32=r0, @ANYBLOB="080001007063690014000200303030303a30303a31302e300000000008008a00", @ANYRES32, @ANYRES32=r11], 0x9}}, 0x4004001)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
preadv(r0, &(0x7f00000017c0), 0x1be, 0x0)

09:32:36 executing program 1:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
fcntl$setpipe(r2, 0x407, 0x100000000)
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3, 0x60000000}, 0x0)
sched_setattr(0x0, 0x0, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/syz0\x00', 0x1ff)
clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
add_key(0x0, &(0x7f0000000180)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe)
add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)="486adf8e647799e3899bfd1ababf3e758281f472", 0x14, 0xfffffffffffffffb)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='cpuacct.usage_percpu\x00', 0x0, 0x0)
add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000240)={'syz', 0x1}, &(0x7f00000003c0)='@', 0x1, 0xfffffffffffffff8)
creat(0x0, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0)
r6 = creat(&(0x7f0000000480)='./file0\x00', 0x1)
fallocate(r6, 0x0, 0x0, 0x2000002)
fallocate(r5, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0x0, r6})
r7 = perf_event_open$cgroup(&(0x7f0000000400)={0x0, 0x70, 0x1, 0x4e, 0x89, 0x2, 0x0, 0x0, 0x4000, 0x8, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f00000002c0), 0x8}, 0x14200, 0x5, 0x9, 0x1, 0x3, 0x8, 0xad3}, r3, 0x6, r6, 0x0)
perf_event_open(&(0x7f0000000340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r7, 0x0)
write$FUSE_NOTIFY_POLL(r4, &(0x7f00000004c0)={0x18, 0x1, 0x0, {0x6}}, 0x18)
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r8, &(0x7f0000d84000)={0xa, 0x2}, 0x1c)
bind$inet6(r8, &(0x7f0000000500)={0xa, 0x4e22, 0xffffff01, @dev={0xfe, 0x80, [], 0x16}}, 0x1c)

[   83.281932][    C3] hrtimer: interrupt took 26819 ns
09:32:40 executing program 1:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
fcntl$setpipe(r2, 0x407, 0x100000000)
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3, 0x60000000}, 0x0)
sched_setattr(0x0, 0x0, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/syz0\x00', 0x1ff)
clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
add_key(0x0, &(0x7f0000000180)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe)
add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)="486adf8e647799e3899bfd1ababf3e758281f472", 0x14, 0xfffffffffffffffb)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='cpuacct.usage_percpu\x00', 0x0, 0x0)
add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000240)={'syz', 0x1}, &(0x7f00000003c0)='@', 0x1, 0xfffffffffffffff8)
creat(0x0, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0)
r6 = creat(&(0x7f0000000480)='./file0\x00', 0x1)
fallocate(r6, 0x0, 0x0, 0x2000002)
fallocate(r5, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0x0, r6})
r7 = perf_event_open$cgroup(&(0x7f0000000400)={0x0, 0x70, 0x1, 0x4e, 0x89, 0x2, 0x0, 0x0, 0x4000, 0x8, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f00000002c0), 0x8}, 0x14200, 0x5, 0x9, 0x1, 0x3, 0x8, 0xad3}, r3, 0x6, r6, 0x0)
perf_event_open(&(0x7f0000000340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r7, 0x0)
write$FUSE_NOTIFY_POLL(r4, &(0x7f00000004c0)={0x18, 0x1, 0x0, {0x6}}, 0x18)
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r8, &(0x7f0000d84000)={0xa, 0x2}, 0x1c)
bind$inet6(r8, &(0x7f0000000500)={0xa, 0x4e22, 0xffffff01, @dev={0xfe, 0x80, [], 0x16}}, 0x1c)

09:32:42 executing program 1:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0)
pipe(&(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
fcntl$setpipe(r2, 0x407, 0x100000000)
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3, 0x60000000}, 0x0)
sched_setattr(0x0, 0x0, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/syz0\x00', 0x1ff)
clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
add_key(0x0, &(0x7f0000000180)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe)
add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)="486adf8e647799e3899bfd1ababf3e758281f472", 0x14, 0xfffffffffffffffb)
r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='cpuacct.usage_percpu\x00', 0x0, 0x0)
add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000240)={'syz', 0x1}, &(0x7f00000003c0)='@', 0x1, 0xfffffffffffffff8)
creat(0x0, 0x0)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0)
r6 = creat(&(0x7f0000000480)='./file0\x00', 0x1)
fallocate(r6, 0x0, 0x0, 0x2000002)
fallocate(r5, 0x0, 0x0, 0x110001)
ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0x0, r6})
r7 = perf_event_open$cgroup(&(0x7f0000000400)={0x0, 0x70, 0x1, 0x4e, 0x89, 0x2, 0x0, 0x0, 0x4000, 0x8, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f00000002c0), 0x8}, 0x14200, 0x5, 0x9, 0x1, 0x3, 0x8, 0xad3}, r3, 0x6, r6, 0x0)
perf_event_open(&(0x7f0000000340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r7, 0x0)
write$FUSE_NOTIFY_POLL(r4, &(0x7f00000004c0)={0x18, 0x1, 0x0, {0x6}}, 0x18)
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r8, &(0x7f0000d84000)={0xa, 0x2}, 0x1c)
bind$inet6(r8, &(0x7f0000000500)={0xa, 0x4e22, 0xffffff01, @dev={0xfe, 0x80, [], 0x16}}, 0x1c)

[  241.178475][ T1114] INFO: task syz-executor.0:8106 blocked for more than 140 seconds.
[  241.188281][ T1114]       Not tainted 5.4.0-syzkaller #0
[  241.194737][ T1114] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  241.204868][ T1114] syz-executor.0  D28144  8106   8085 0x00004004
[  241.212419][ T1114] Call Trace:
[  241.216355][ T1114]  __schedule+0x8e1/0x1f30
[  241.221548][ T1114]  ? __sched_text_start+0x8/0x8
[  241.227212][ T1114]  ? lock_downgrade+0x920/0x920
[  241.232972][ T1114]  ? rwlock_bug.part.0+0x90/0x90
[  241.238715][ T1114]  schedule+0xdc/0x2b0
[  241.243489][ T1114]  schedule_preempt_disabled+0x13/0x20
[  241.249954][ T1114]  __mutex_lock+0x7ab/0x13c0
[  241.255286][ T1114]  ? perf_event_ctx_lock_nested+0x296/0x4c0
[  241.262205][ T1114]  ? mutex_trylock+0x2f0/0x2f0
[  241.267781][ T1114]  ? find_held_lock+0x35/0x130
[  241.273422][ T1114]  ? perf_event_ctx_lock_nested+0x262/0x4c0
[  241.280221][ T1114]  ? lock_downgrade+0x920/0x920
[  241.285851][ T1114]  mutex_lock_nested+0x16/0x20
[  241.291393][ T1114]  ? mutex_lock_nested+0x16/0x20
[  241.297078][ T1114]  perf_event_ctx_lock_nested+0x296/0x4c0
[  241.303710][ T1114]  ? __perf_event_read+0xe10/0xe10
[  241.309919][ T1114]  perf_event_release_kernel+0x121/0xef0
[  241.316480][ T1114]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  241.323933][ T1114]  ? __perf_event_exit_context+0x170/0x170
[  241.330917][ T1114]  ? __sanitizer_cov_trace_const_cmp2+0x18/0x20
[  241.338123][ T1114]  perf_release+0x37/0x50
[  241.343631][ T1114]  __fput+0x2ff/0x890
[  241.348338][ T1114]  ? perf_event_release_kernel+0xef0/0xef0
[  241.355031][ T1114]  ____fput+0x16/0x20
[  241.359768][ T1114]  task_work_run+0x145/0x1c0
[  241.364976][ T1114]  exit_to_usermode_loop+0x316/0x380
[  241.371279][ T1114]  do_syscall_64+0x676/0x790
[  241.376609][ T1114]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  241.383651][ T1114] RIP: 0033:0x413d81
[  241.388345][ T1114] Code: 89 44 24 10 e8 40 c1 04 00 48 8b 6c 24 18 48 83 c4 20 c3 48 8b 4c 24 30 48 89 0c 24 48 8b 4c 24 38 48 89 4c 24 08 48 89 44 24 <10> e8 99 0c 00 00 48 8b 44 24 40 eb b5 48 8b 44 24 40 eb ae 48 8b
[  241.410973][ T1114] RSP: 002b:00007ffe5225cd70 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[  241.421260][ T1114] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000413d81
[  241.430674][ T1114] RDX: 0000000000000000 RSI: 0000000000000c65 RDI: 0000000000000004
[  241.440119][ T1114] RBP: 000000000071c980 R08: 00000000e1114c65 R09: 00000000e1114c69
[  241.449582][ T1114] R10: 00007ffe5225cea0 R11: 0000000000000293 R12: 0000000000000001
[  241.458968][ T1114] R13: 000000000071c980 R14: 0000000000723258 R15: 00007ffe5225ce80
[  241.467790][ T1114] 
[  241.467790][ T1114] Showing all locks held in the system:
[  241.475736][ T1114] 1 lock held by khungtaskd/1114:
[  241.480903][ T1114]  #0: ffffffff895a4080 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x279
[  241.490477][ T1114] 2 locks held by rsyslogd/7908:
[  241.495552][ T1114]  #0: ffff88802bf440e0 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110
[  241.504267][ T1114]  #1: ffff88802d537398 (&rq->lock){-.-.}, at: newidle_balance+0xa28/0xe80
[  241.513074][ T1114] 2 locks held by getty/8031:
[  241.517759][ T1114]  #0: ffff888020437090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[  241.526917][ T1114]  #1: ffffc900040122e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10
[  241.536889][ T1114] 2 locks held by getty/8032:
[  241.541688][ T1114]  #0: ffff8880295c7090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[  241.550891][ T1114]  #1: ffffc9000400a2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10
[  241.560566][ T1114] 2 locks held by getty/8033:
[  241.565317][ T1114]  #0: ffff88802aa35090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[  241.574642][ T1114]  #1: ffffc900040162e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10
[  241.584412][ T1114] 2 locks held by getty/8034:
[  241.589274][ T1114]  #0: ffff88802bb92090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[  241.598306][ T1114]  #1: ffffc900026fa2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10
[  241.607911][ T1114] 2 locks held by getty/8035:
[  241.612863][ T1114]  #0: ffff888029d44090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[  241.621892][ T1114]  #1: ffffc9000401a2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10
[  241.631646][ T1114] 2 locks held by getty/8036:
[  241.636313][ T1114]  #0: ffff88802a505090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[  241.645664][ T1114]  #1: ffffc900040222e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10
[  241.655396][ T1114] 2 locks held by getty/8037:
[  241.660217][ T1114]  #0: ffff88802b0fd090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[  241.669264][ T1114]  #1: ffffc900026f22e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1c10
[  241.678987][ T1114] 2 locks held by kworker/u16:2/8090:
[  241.684365][ T1114]  #0: ffff88802d537398 (&rq->lock){-.-.}, at: newidle_balance+0xa28/0xe80
[  241.693091][ T1114]  #1: ffffffff895a4080 (rcu_read_lock){....}, at: __update_idle_core+0x45/0x3f0
[  241.702332][ T1114] 1 lock held by syz-executor.0/8106:
[  241.707750][ T1114]  #0: ffff8880248700a0 (&ctx->mutex){+.+.}, at: perf_event_ctx_lock_nested+0x296/0x4c0
[  241.717642][ T1114] 3 locks held by syz-executor.0/8108:
[  241.723168][ T1114] 
[  241.725524][ T1114] =============================================
[  241.725524][ T1114] 
[  241.734108][ T1114] NMI backtrace for cpu 2
[  241.738655][ T1114] CPU: 2 PID: 1114 Comm: khungtaskd Not tainted 5.4.0-syzkaller #0
[  241.746602][ T1114] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[  241.748588][ T1114] Call Trace:
[  241.748588][ T1114]  dump_stack+0x197/0x210
[  241.748588][ T1114]  nmi_cpu_backtrace.cold+0x70/0xb2
[  241.748588][ T1114]  ? vprintk_func+0x86/0x189
[  241.748588][ T1114]  ? lapic_can_unplug_cpu.cold+0x3a/0x3a
[  241.748588][ T1114]  nmi_trigger_cpumask_backtrace+0x23b/0x28b
[  241.748588][ T1114]  arch_trigger_cpumask_backtrace+0x14/0x20
[  241.748588][ T1114]  watchdog+0xb11/0x10c0
[  241.748588][ T1114]  kthread+0x361/0x430
[  241.748588][ T1114]  ? reset_hung_task_detector+0x30/0x30
[  241.748588][ T1114]  ? kthread_mod_delayed_work+0x1f0/0x1f0
[  241.748588][ T1114]  ret_from_fork+0x24/0x30
[  241.820100][ T1114] Sending NMI from CPU 2 to CPUs 0-1,3:
[  241.825883][    C1] NMI backtrace for cpu 1 skipped: idling at native_safe_halt+0xe/0x10
[  241.825921][    C3] NMI backtrace for cpu 3 skipped: idling at native_safe_halt+0xe/0x10
[  241.826582][    C0] NMI backtrace for cpu 0
[  241.826586][    C0] CPU: 0 PID: 8108 Comm: syz-executor.0 Not tainted 5.4.0-syzkaller #0
[  241.826592][    C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[  241.826595][    C0] RIP: 0010:native_write_msr+0x6/0x30
[  241.826603][    C0] Code: d0 c3 0f 21 d8 c3 0f 21 f0 c3 0f 0b 0f 1f 84 00 00 00 00 00 0f 0b 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 89 f9 89 f0 0f 30 <0f> 1f 44 00 00 c3 55 48 c1 e2 20 89 f6 48 89 e5 48 09 d6 31 d2 e8
[  241.826605][    C0] RSP: 0018:ffff88802d2097c8 EFLAGS: 00000082
[  241.826611][    C0] RAX: 000000000ba725f8 RBX: 0000000000000000 RCX: 00000000000006e0
[  241.826614][    C0] RDX: 0000000000000073 RSI: 000000000ba725f8 RDI: 00000000000006e0
[  241.826618][    C0] RBP: ffff88802d2097e0 R08: ffff88806ef84180 R09: ffff88806ef84a10
[  241.826621][    C0] R10: fffffbfff146dba0 R11: ffffffff8a36dd07 R12: ffff88802d2227c0
[  241.826625][    C0] R13: 00000000000002bb R14: 0000000000000000 R15: 0000000000000001
[  241.826629][    C0] FS:  00007f5efe11d700(0000) GS:ffff88802d200000(0000) knlGS:0000000000000000
[  241.826632][    C0] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  241.826635][    C0] CR2: ffffffffff600400 CR3: 000000006ecc6000 CR4: 00000000003406f0
[  241.826639][    C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  241.826642][    C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  241.826644][    C0] Call Trace:
[  241.826646][    C0]  <IRQ>
[  241.826648][    C0]  ? lapic_next_deadline+0x4d/0x80
[  241.826651][    C0]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  241.826654][    C0]  clockevents_program_event+0x25c/0x370
[  241.826656][    C0]  tick_program_event+0xb4/0x130
[  241.826658][    C0]  hrtimer_interrupt+0x369/0x770
[  241.826661][    C0]  smp_apic_timer_interrupt+0x160/0x610
[  241.826663][    C0]  apic_timer_interrupt+0xf/0x20
[  241.826666][    C0] RIP: 0010:dst_alloc+0x10e/0x200
[  241.826673][    C0] Code: 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 ce 00 00 00 49 8b 7c 24 78 be 20 0a 00 00 e8 a2 ba a3 fb <48> 85 c0 49 89 c5 74 1e e8 75 fc 66 fb 44 0f b7 4d d4 41 89 d8 44
[  241.826676][    C0] RSP: 0018:ffff88802d2099f8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
[  241.826682][    C0] RAX: ffff888021a3f2c0 RBX: 00000000ffffffff RCX: 0000000000000000
[  241.826685][    C0] RDX: dffffc0000000000 RSI: ffffffff895a4000 RDI: 0000000000000282
[  241.826689][    C0] RBP: ffff88802d209a30 R08: 0000000000000000 R09: ffffed1005a47045
[  241.826693][    C0] R10: ffffed1005a47044 R11: ffff88802d238223 R12: ffff8880119f4ac0
[  241.826696][    C0] R13: ffff8880119f4ac8 R14: ffff888025846000 R15: 0000000000000001
[  241.826698][    C0]  ? apic_timer_interrupt+0xa/0x20
[  241.826701][    C0]  ? dst_alloc+0x10e/0x200
[  241.826703][    C0]  ip6_dst_alloc+0x34/0xa0
[  241.826705][    C0]  icmp6_dst_alloc+0x69/0x4a0
[  241.826708][    C0]  ndisc_send_skb+0xfb7/0x1490
[  241.826710][    C0]  ? h5_recv+0xba/0x500
[  241.826712][    C0]  ? nf_hook.constprop.0+0x560/0x560
[  241.826748][    C0]  ? memset+0x32/0x40
[  241.826752][    C0]  ndisc_send_rs+0x134/0x720
[  241.826754][    C0]  addrconf_rs_timer+0x30f/0x6e0
[  241.826757][    C0]  ? ipv6_get_lladdr+0x490/0x490
[  241.826759][    C0]  ? rcu_read_lock_any_held.part.0+0x50/0x50
[  241.826762][    C0]  call_timer_fn+0x1ac/0x780
[  241.826764][    C0]  ? ipv6_get_lladdr+0x490/0x490
[  241.826766][    C0]  ? msleep_interruptible+0x150/0x150
[  241.826769][    C0]  ? run_timer_softirq+0x6b1/0x1790
[  241.826771][    C0]  ? trace_hardirqs_on+0x67/0x240
[  241.826774][    C0]  ? ipv6_get_lladdr+0x490/0x490
[  241.826776][    C0]  ? ipv6_get_lladdr+0x490/0x490
[  241.826778][    C0]  run_timer_softirq+0x6c3/0x1790
[  241.826781][    C0]  ? add_timer+0x930/0x930
[  241.826783][    C0]  ? rcu_lockdep_current_cpu_online+0xe3/0x130
[  241.826786][    C0]  ? rcu_read_lock_sched_held+0x9c/0xd0
[  241.826789][    C0]  ? rcu_read_lock_any_held.part.0+0x50/0x50
[  241.826791][    C0]  __do_softirq+0x262/0x98c
[  241.826793][    C0]  ? sched_clock_cpu+0x14e/0x1b0
[  241.826795][    C0]  irq_exit+0x19b/0x1e0
[  241.826798][    C0]  smp_apic_timer_interrupt+0x1a3/0x610
[  241.826800][    C0]  apic_timer_interrupt+0xf/0x20
[  241.826802][    C0]  </IRQ>
[  241.826805][    C0] RIP: 0010:_raw_spin_unlock_irq+0x4f/0x80
[  241.826813][    C0] Code: c0 68 34 53 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 33 48 83 3d 12 2a 99 01 00 74 20 fb 66 0f 1f 44 00 00 <bf> 01 00 00 00 e8 e7 6b 96 f9 65 8b 05 18 14 48 78 85 c0 74 06 41
[  241.826815][    C0] RSP: 0018:ffff88806ef8f8d8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
[  241.826821][    C0] RAX: 1ffffffff12a668d RBX: ffff88806ef84180 RCX: 0000000000000006
[  241.826825][    C0] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88806ef84a14
[  241.826829][    C0] RBP: ffff88806ef8f8e0 R08: 1ffffffff15d29b8 R09: fffffbfff15d29b9
[  241.826832][    C0] R10: fffffbfff15d29b8 R11: ffffffff8ae94dc7 R12: ffff88802d237380
[  241.826836][    C0] R13: ffffffff8947a1c0 R14: ffff888020d2c580 R15: 0000000000000000
[  241.826838][    C0]  ? _raw_spin_unlock_irq+0x23/0x80
[  241.826841][    C0]  finish_task_switch+0x147/0x750
[  241.826843][    C0]  ? finish_task_switch+0x119/0x750
[  241.826845][    C0]  __schedule+0x8e9/0x1f30
[  241.826848][    C0]  ? __sched_text_start+0x8/0x8
[  241.826850][    C0]  ? __this_cpu_preempt_check+0x35/0x190
[  241.826852][    C0]  ? retint_kernel+0x2b/0x2b
[  241.826855][    C0]  ? perf_duration_warn+0x40/0x40
[  241.826857][    C0]  ? preempt_schedule+0x4b/0x60
[  241.826860][    C0]  preempt_schedule_common+0x4f/0xe0
[  241.826862][    C0]  ? __perf_event_enable+0x930/0x930
[  241.826865][    C0]  preempt_schedule+0x4b/0x60
[  241.826867][    C0]  ___preempt_schedule+0x16/0x18
[  241.826870][    C0]  ? smp_call_function_single+0x40b/0x480
[  241.826872][    C0]  smp_call_function_single+0x410/0x480
[  241.826875][    C0]  ? perf_duration_warn+0x40/0x40
[  241.826877][    C0]  ? generic_exec_single+0x4c0/0x4c0
[  241.826880][    C0]  ? __do_sys_perf_event_open+0x174c/0x2c70
[  241.826883][    C0]  ? __perf_event_enable+0x930/0x930
[  241.826885][    C0]  task_function_call+0xe9/0x180
[  241.826888][    C0]  ? perf_event_addr_filters_exec+0x310/0x310
[  241.826891][    C0]  ? __do_sys_perf_event_open+0x174c/0x2c70
[  241.826893][    C0]  ? __perf_event_enable+0x930/0x930
[  241.826896][    C0]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  241.826899][    C0]  ? exclusive_event_installable+0x257/0x320
[  241.826901][    C0]  perf_install_in_context+0x308/0x5a0
[  241.826904][    C0]  ? list_add_event+0xed0/0xed0
[  241.826906][    C0]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  241.826909][    C0]  ? __perf_event_header_size.isra.0+0x166/0x1c0
[  241.826912][    C0]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  241.826915][    C0]  __do_sys_perf_event_open+0x1cbc/0x2c70
[  241.826917][    C0]  ? perf_event_set_output+0x4e0/0x4e0
[  241.826920][    C0]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[  241.826922][    C0]  ? put_timespec64+0xda/0x140
[  241.826925][    C0]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  241.826928][    C0]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  241.826930][    C0]  ? do_syscall_64+0x26/0x790
[  241.826933][    C0]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  241.826935][    C0]  ? do_syscall_64+0x26/0x790
[  241.826938][    C0]  __x64_sys_perf_event_open+0xbe/0x150
[  241.826940][    C0]  do_syscall_64+0xfa/0x790
[  241.826943][    C0]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  241.826945][    C0] RIP: 0033:0x45a759
[  241.826952][    C0] Code: bd b1 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 8b b1 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  241.826955][    C0] RSP: 002b:00007f5efe11cc88 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
[  241.826961][    C0] RAX: ffffffffffffffda RBX: 000000000071bf00 RCX: 000000000045a759
[  241.826964][    C0] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000020000040
[  241.826968][    C0] RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000000
[  241.826971][    C0] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f5efe11d6d4
[  241.826975][    C0] R13: 00000000004aec2b R14: 00000000006f1ca8 R15: 00000000ffffffff
[  241.827247][ T1114] Kernel panic - not syncing: hung_task: blocked tasks
[  241.830028][ T1114] CPU: 2 PID: 1114 Comm: khungtaskd Not tainted 5.4.0-syzkaller #0
[  241.830028][ T1114] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[  241.830028][ T1114] Call Trace:
[  241.830028][ T1114]  dump_stack+0x197/0x210
[  241.830028][ T1114]  panic+0x2e3/0x75c
[  241.830028][ T1114]  ? add_taint.cold+0x16/0x16
[  241.830028][ T1114]  ? lapic_can_unplug_cpu.cold+0x3a/0x3a
[  241.830028][ T1114]  ? ___preempt_schedule+0x16/0x18
[  241.830028][ T1114]  ? nmi_trigger_cpumask_backtrace+0x21b/0x28b
[  241.830028][ T1114]  ? nmi_trigger_cpumask_backtrace+0x24c/0x28b
[  241.830028][ T1114]  ? nmi_trigger_cpumask_backtrace+0x256/0x28b
[  241.830028][ T1114]  ? nmi_trigger_cpumask_backtrace+0x21b/0x28b
[  241.830028][ T1114]  watchdog+0xb22/0x10c0
[  241.830028][ T1114]  kthread+0x361/0x430
[  241.830028][ T1114]  ? reset_hung_task_detector+0x30/0x30
[  241.830028][ T1114]  ? kthread_mod_delayed_work+0x1f0/0x1f0
[  241.830028][ T1114]  ret_from_fork+0x24/0x30
[  241.830028][ T1114] Kernel Offset: disabled
[  241.830028][ T1114] Rebooting in 86400 seconds..