[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 65.397691][ T27] audit: type=1800 audit(1575338276.794:25): pid=8827 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 65.417690][ T27] audit: type=1800 audit(1575338276.804:26): pid=8827 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 65.438647][ T27] audit: type=1800 audit(1575338276.804:27): pid=8827 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.1.44' (ECDSA) to the list of known hosts. 2019/12/03 01:58:08 fuzzer started 2019/12/03 01:58:09 dialing manager at 10.128.0.26:44481 2019/12/03 01:58:09 syscalls: 2694 2019/12/03 01:58:09 code coverage: enabled 2019/12/03 01:58:09 comparison tracing: enabled 2019/12/03 01:58:09 extra coverage: enabled 2019/12/03 01:58:09 setuid sandbox: enabled 2019/12/03 01:58:09 namespace sandbox: enabled 2019/12/03 01:58:09 Android sandbox: /sys/fs/selinux/policy does not exist 2019/12/03 01:58:09 fault injection: enabled 2019/12/03 01:58:09 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/12/03 01:58:09 net packet injection: enabled 2019/12/03 01:58:09 net device setup: enabled 2019/12/03 01:58:09 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2019/12/03 01:58:09 devlink PCI setup: PCI device 0000:00:10.0 is not available 02:00:13 executing program 0: clone(0x200, 0x0, 0x0, 0x0, 0x0) mknod(&(0x7f0000000300)='./file0\x00', 0x1042, 0x0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) execve(&(0x7f0000000840)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000580)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x119) creat(&(0x7f0000000000)='./file1\x00', 0x40) dup2(r0, r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) r2 = semget$private(0x0, 0x5, 0x0) semtimedop(r2, &(0x7f0000000040)=[{0x0, 0x5}, {}], 0x2, 0x0) 02:00:13 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) close(r0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) read(r1, &(0x7f0000000100)=""/17, 0xffffffe1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000180)) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) syzkaller login: [ 202.019766][ T8993] IPVS: ftp: loaded support on port[0] = 21 [ 202.057507][ T8995] IPVS: ftp: loaded support on port[0] = 21 02:00:13 executing program 2: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) read(r1, &(0x7f0000000240)=""/11, 0xb) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000200)) ioctl$KDFONTOP_GET(r1, 0x4b72, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 202.212244][ T8993] chnl_net:caif_netlink_parms(): no params data found [ 202.316650][ T8995] chnl_net:caif_netlink_parms(): no params data found [ 202.367749][ T8993] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.390988][ T8993] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.398804][ T8993] device bridge_slave_0 entered promiscuous mode [ 202.430196][ T8995] bridge0: port 1(bridge_slave_0) entered blocking state [ 202.439585][ T8995] bridge0: port 1(bridge_slave_0) entered disabled state [ 202.447889][ T8995] device bridge_slave_0 entered promiscuous mode [ 202.457908][ T8993] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.465358][ T8993] bridge0: port 2(bridge_slave_1) entered disabled state [ 202.475432][ T8993] device bridge_slave_1 entered promiscuous mode [ 202.484430][ T8995] bridge0: port 2(bridge_slave_1) entered blocking state [ 202.501120][ T8995] bridge0: port 2(bridge_slave_1) entered disabled state [ 202.508802][ T8995] device bridge_slave_1 entered promiscuous mode 02:00:13 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8982, 0x0) pipe(0x0) write$P9_RSETATTR(0xffffffffffffffff, &(0x7f0000000180)={0x7, 0x1b, 0x1}, 0x7) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8982, 0x0) write$P9_RMKNOD(0xffffffffffffffff, &(0x7f0000000140)={0x14, 0x13, 0x1}, 0x14) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x50000}]}) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) [ 202.554854][ T8999] IPVS: ftp: loaded support on port[0] = 21 [ 202.578959][ T8995] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 202.617160][ T8995] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 202.628928][ T8993] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 202.664089][ T8993] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 202.685078][ T8995] team0: Port device team_slave_0 added [ 202.715696][ T8995] team0: Port device team_slave_1 added [ 202.740656][ T8993] team0: Port device team_slave_0 added [ 202.779477][ T8993] team0: Port device team_slave_1 added 02:00:14 executing program 4: accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) r0 = openat$random(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/urandom\x00', 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) geteuid() getegid() fstatfs(r0, &(0x7f00000003c0)=""/96) ioctl$TCSETX(0xffffffffffffffff, 0x5433, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(0xffffffffffffffff, 0x10e, 0x5, &(0x7f0000000500), 0x4) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ID_VALID(0xffffffffffffffff, 0x80082102, 0x0) syz_open_pts(0xffffffffffffffff, 0x0) [ 202.843955][ T8995] device hsr_slave_0 entered promiscuous mode [ 202.891219][ T8995] device hsr_slave_1 entered promiscuous mode 02:00:14 executing program 5: read(0xffffffffffffffff, 0x0, 0xffffffa5) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000003a40)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1e) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xbb8) [ 203.076729][ T9001] IPVS: ftp: loaded support on port[0] = 21 [ 203.124580][ T9003] IPVS: ftp: loaded support on port[0] = 21 [ 203.203623][ T8993] device hsr_slave_0 entered promiscuous mode [ 203.251377][ T8993] device hsr_slave_1 entered promiscuous mode [ 203.311092][ T8993] debugfs: Directory 'hsr0' with parent '/' already present! [ 203.336510][ T8999] chnl_net:caif_netlink_parms(): no params data found [ 203.406923][ T9006] IPVS: ftp: loaded support on port[0] = 21 [ 203.425241][ T8995] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 203.505519][ T8995] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 203.568510][ T8995] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 203.634394][ T8995] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 203.734386][ T8999] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.742107][ T8999] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.749983][ T8999] device bridge_slave_0 entered promiscuous mode [ 203.787054][ T8999] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.795026][ T8999] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.803501][ T8999] device bridge_slave_1 entered promiscuous mode [ 203.815230][ T8993] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 203.874769][ T8993] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 203.956865][ T8993] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 204.040351][ T8993] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 204.096067][ T8999] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 204.111634][ T8999] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 204.140068][ T8999] team0: Port device team_slave_0 added [ 204.151614][ T8999] team0: Port device team_slave_1 added [ 204.274086][ T8999] device hsr_slave_0 entered promiscuous mode [ 204.321579][ T8999] device hsr_slave_1 entered promiscuous mode [ 204.362642][ T8999] debugfs: Directory 'hsr0' with parent '/' already present! [ 204.410950][ T9006] chnl_net:caif_netlink_parms(): no params data found [ 204.450397][ T9001] chnl_net:caif_netlink_parms(): no params data found [ 204.489587][ T9003] chnl_net:caif_netlink_parms(): no params data found [ 204.588075][ T9001] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.595556][ T9001] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.604249][ T9001] device bridge_slave_0 entered promiscuous mode [ 204.616666][ T9001] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.624583][ T9001] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.632757][ T9001] device bridge_slave_1 entered promiscuous mode [ 204.644705][ T8999] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 204.718817][ T8999] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 204.774482][ T8995] 8021q: adding VLAN 0 to HW filter on device bond0 [ 204.781708][ T9003] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.788769][ T9003] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.799815][ T9003] device bridge_slave_0 entered promiscuous mode [ 204.816921][ T9006] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.824860][ T9006] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.833416][ T9006] device bridge_slave_0 entered promiscuous mode [ 204.842168][ T9006] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.849212][ T9006] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.857176][ T9006] device bridge_slave_1 entered promiscuous mode [ 204.865774][ T8999] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 204.913242][ T8999] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 204.957516][ T9003] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.964821][ T9003] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.973734][ T9003] device bridge_slave_1 entered promiscuous mode [ 204.987771][ T9001] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 205.018184][ T8995] 8021q: adding VLAN 0 to HW filter on device team0 [ 205.042328][ T9001] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 205.053812][ T9006] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 205.067873][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 205.076374][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 205.093760][ T9003] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 205.112088][ T9006] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 205.125463][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 205.134891][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 205.143571][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 205.151245][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 205.159673][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 205.179320][ T9003] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 205.206465][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 205.215259][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 205.225708][ T3067] bridge0: port 2(bridge_slave_1) entered blocking state [ 205.232835][ T3067] bridge0: port 2(bridge_slave_1) entered forwarding state [ 205.240506][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 205.252155][ T9001] team0: Port device team_slave_0 added [ 205.276179][ T8993] 8021q: adding VLAN 0 to HW filter on device bond0 [ 205.294642][ T9006] team0: Port device team_slave_0 added [ 205.303959][ T9001] team0: Port device team_slave_1 added [ 205.310789][ T9006] team0: Port device team_slave_1 added [ 205.327881][ T9003] team0: Port device team_slave_0 added [ 205.363502][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 205.381849][ T9003] team0: Port device team_slave_1 added [ 205.432922][ T9001] device hsr_slave_0 entered promiscuous mode [ 205.461469][ T9001] device hsr_slave_1 entered promiscuous mode [ 205.521001][ T9001] debugfs: Directory 'hsr0' with parent '/' already present! [ 205.584274][ T9006] device hsr_slave_0 entered promiscuous mode [ 205.641982][ T9006] device hsr_slave_1 entered promiscuous mode [ 205.681223][ T9006] debugfs: Directory 'hsr0' with parent '/' already present! [ 205.700623][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 205.710237][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 205.718820][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 205.727904][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 205.737125][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 205.745129][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 205.753537][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 205.762079][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 205.770435][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 205.780573][ T8993] 8021q: adding VLAN 0 to HW filter on device team0 [ 205.823914][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 205.836389][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 205.846754][ T9010] bridge0: port 1(bridge_slave_0) entered blocking state [ 205.853895][ T9010] bridge0: port 1(bridge_slave_0) entered forwarding state [ 205.887139][ T8995] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 205.903596][ T8995] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 205.913747][ T9006] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 205.963577][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 205.972457][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 205.982003][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 205.990774][ T3067] bridge0: port 2(bridge_slave_1) entered blocking state [ 205.997894][ T3067] bridge0: port 2(bridge_slave_1) entered forwarding state [ 206.007040][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 206.016600][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 206.025705][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 206.076092][ T9003] device hsr_slave_0 entered promiscuous mode [ 206.121289][ T9003] device hsr_slave_1 entered promiscuous mode [ 206.181067][ T9003] debugfs: Directory 'hsr0' with parent '/' already present! [ 206.189106][ T9006] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 206.245031][ T9006] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 206.308215][ T9006] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 206.381264][ T8999] 8021q: adding VLAN 0 to HW filter on device bond0 [ 206.400248][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 206.423623][ T9001] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 206.479170][ T9001] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 206.519548][ T8999] 8021q: adding VLAN 0 to HW filter on device team0 [ 206.534280][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 206.544450][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 206.553410][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 206.562831][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 206.571632][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 206.579890][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 206.588395][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 206.596819][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 206.605227][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 206.613007][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 206.620887][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 206.632993][ T8993] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 206.647480][ T9001] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 206.733758][ T8995] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 206.742074][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 206.749465][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 206.760531][ T9001] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 206.820722][ T8993] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 206.850542][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 206.869708][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 206.878355][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.885493][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 206.903967][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 206.912043][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 206.938013][ T9003] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 207.004387][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 207.012434][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 207.024828][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 207.034024][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 207.041150][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 207.089051][ T9003] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 207.126025][ T9003] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 207.174083][ T9003] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 207.235260][ T9011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 207.244096][ T9011] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 207.253459][ T9011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 207.265568][ T9011] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 207.313289][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 207.325892][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 207.343734][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 207.370451][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 207.379362][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 207.388369][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 207.397031][ T3067] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 02:00:18 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='hugetlb.2MB.usage_in_bytes\x00', 0xf0, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu\x00', 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\xff', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) close(r1) write$cgroup_subtree(r0, &(0x7f0000000440)=ANY=[@ANYPTR=&(0x7f0000000840)=ANY=[@ANYRES16, @ANYBLOB="c820ff993f0770457a43f6f48110dff38fd50e8dc66f424134b7ffa210b9"], @ANYPTR, @ANYBLOB, @ANYPTR=&(0x7f0000000400)=ANY=[@ANYRES16=0x0, @ANYRES16]], 0x18) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 207.436753][ T8999] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 207.463429][ T9006] 8021q: adding VLAN 0 to HW filter on device bond0 02:00:18 executing program 1: [ 207.538413][ T9006] 8021q: adding VLAN 0 to HW filter on device team0 [ 207.562458][ T9011] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 207.570323][ T9011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 207.594298][ T9011] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 207.612167][ T9011] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 207.630456][ T8999] 8021q: adding VLAN 0 to HW filter on device batadv0 02:00:19 executing program 1: socket$inet(0x10, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000040)) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_procfs(0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsa(&(0x7f00000002c0)='/dev/vcsa\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) lchown(0x0, 0x0, 0x0) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0, r2}, 0xc) lseek(r1, 0x0, 0x0) ioctl$RTC_WKALM_RD(r1, 0x80287010, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80000000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) r5 = socket$packet(0x11, 0x3, 0x300) dup3(r0, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'batadv0\x00', 0x0}) bind$packet(r4, &(0x7f0000000100)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @local}, 0x14) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r7}}, 0x20}}, 0x0) [ 207.651174][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 207.660159][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 207.670560][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.677673][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 207.686552][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 207.695417][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 207.705871][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 207.713012][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 207.726116][ T9001] 8021q: adding VLAN 0 to HW filter on device bond0 [ 207.737879][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 207.769288][ T9011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 207.779460][ T9011] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 207.794676][ T9011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 207.806627][ T9011] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 207.815295][ T9011] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 207.823873][ T9011] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 207.855184][ T9001] 8021q: adding VLAN 0 to HW filter on device team0 [ 207.881085][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 207.887062][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:00:19 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3}, 0x0) add_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f00000000c0)={'.\x00'}, &(0x7f0000000080), 0xfe28, 0xfffffffffffffffb) 02:00:19 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_LINKINFO={0x14, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0x4}}}]}, 0x34}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002700)=@newlink={0x28, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_MASTER={0x8, 0xa, r5}]}, 0x28}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r8}}, 0x20}}, 0x0) [ 208.245395][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 208.257736][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 208.266284][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 208.282193][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 208.290653][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 208.299960][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 208.307938][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 208.316099][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 208.327681][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 208.336435][ T2617] bridge0: port 1(bridge_slave_0) entered blocking state [ 208.343552][ T2617] bridge0: port 1(bridge_slave_0) entered forwarding state [ 208.352131][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 208.361275][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 208.369767][ T2617] bridge0: port 2(bridge_slave_1) entered blocking state [ 208.376967][ T2617] bridge0: port 2(bridge_slave_1) entered forwarding state [ 208.387724][ T9006] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 208.401221][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 208.401726][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 208.407106][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 208.416409][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready 02:00:19 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5, 0x1ff, 0x3ff}, 0x0) r1 = socket(0x10, 0x2, 0x0) recvmmsg(r1, &(0x7f0000006080), 0x3ea818461ad51e9, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) creat(&(0x7f0000000080)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x4002) recvmmsg(0xffffffffffffffff, 0x0, 0xffffffffffffff4f, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000200)={0x30, 0x6, 0x0, 0xffffffff, 0x80000001, 0xfffffffffffff57a, 0x80000000, 0x2}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) unshare(0x6c060000) [ 208.455281][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 208.480247][ T9003] 8021q: adding VLAN 0 to HW filter on device bond0 [ 208.500923][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 208.506758][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 208.527901][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 208.549081][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 208.558771][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 208.574722][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 208.585016][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 208.586488][ C0] hrtimer: interrupt took 47256 ns [ 208.719459][ T9064] IPVS: ftp: loaded support on port[0] = 21 [ 208.730920][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 208.736761][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 208.758161][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 208.794552][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 02:00:20 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000180)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x0) r1 = syz_open_dev$mice(&(0x7f00000001c0)='/dev/input/mice\x00', 0x0, 0x0) dup3(r0, r1, 0x0) [ 208.907440][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 208.915816][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 208.923889][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 208.939342][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready 02:00:20 executing program 0: [ 208.968718][ T9006] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 209.007427][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready 02:00:20 executing program 0: [ 209.041326][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 209.067325][ T9003] 8021q: adding VLAN 0 to HW filter on device team0 [ 209.113585][ T9001] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 209.140592][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 209.154516][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 209.164670][ T26] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.176597][ T26] bridge0: port 1(bridge_slave_0) entered forwarding state [ 209.196182][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 209.216296][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 209.230271][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 209.239505][ T26] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.246673][ T26] bridge0: port 2(bridge_slave_1) entered forwarding state [ 209.261991][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 209.273405][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 209.316238][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 209.330687][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 209.345518][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 209.353285][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 209.353580][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 209.371600][ T9061] IPVS: ftp: loaded support on port[0] = 21 [ 209.435121][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 209.444314][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 209.456072][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 209.467960][ T9010] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 209.479321][ T9001] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 209.518489][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 209.534493][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 209.542749][ T184] tipc: TX() has been purged, node left! [ 209.563580][ T9003] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 209.639560][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 209.649268][ T2617] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 209.693318][ T9003] 8021q: adding VLAN 0 to HW filter on device batadv0 02:00:21 executing program 3: 02:00:21 executing program 4: 02:00:21 executing program 5: read(0xffffffffffffffff, 0x0, 0xffffffa5) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000003a40)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1e) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xbb8) 02:00:21 executing program 0: 02:00:21 executing program 1: 02:00:21 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5, 0x1ff, 0x3ff}, 0x0) r1 = socket(0x10, 0x2, 0x0) recvmmsg(r1, &(0x7f0000006080), 0x3ea818461ad51e9, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) creat(&(0x7f0000000080)='./bus\x00', 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x4002) recvmmsg(0xffffffffffffffff, 0x0, 0xffffffffffffff4f, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000200)={0x30, 0x6, 0x0, 0xffffffff, 0x80000001, 0xfffffffffffff57a, 0x80000000, 0x2}, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) unshare(0x6c060000) 02:00:21 executing program 3: 02:00:21 executing program 4: 02:00:21 executing program 3: read(0xffffffffffffffff, 0x0, 0xffffffa5) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000003a40)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1e) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xbb8) 02:00:21 executing program 0: read(0xffffffffffffffff, 0x0, 0xffffffa5) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000003a40)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1e) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xbb8) 02:00:21 executing program 4: 02:00:21 executing program 1: [ 210.607757][ T9126] IPVS: ftp: loaded support on port[0] = 21 02:00:22 executing program 4: 02:00:22 executing program 1: 02:00:22 executing program 5: read(0xffffffffffffffff, 0x0, 0xffffffa5) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000003a40)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1e) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xbb8) 02:00:22 executing program 4: open(&(0x7f0000000080)='./file0\x00', 0x2442, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount(&(0x7f0000000240)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000000)='./file0\x00', 0x0, 0x1001004, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x106c8ae, &(0x7f0000000180)={[{@resgid={'resgid'}}]}) 02:00:22 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f00000039c0)=[{{&(0x7f0000000400)=@nfc, 0x80, 0x0}}, {{&(0x7f00000018c0)=@l2, 0x80, 0x0, 0x0, &(0x7f0000000340)=""/52, 0x34}, 0x7ff}, {{&(0x7f0000001740)=@nl=@unspec, 0x80, &(0x7f0000001c00)=[{&(0x7f0000003b80)=""/100, 0x64}], 0x1}}, {{&(0x7f0000001c40)=@vsock, 0x80, &(0x7f0000002f00)=[{&(0x7f00000017c0)=""/38, 0x26}, {&(0x7f0000001d00)=""/195, 0xc3}, {&(0x7f0000001e00)=""/4096, 0x1000}, {&(0x7f0000002ec0)=""/9, 0x9}], 0x4, &(0x7f0000002f80)=""/132, 0x84}, 0x2}, {{&(0x7f0000003040)=@ipx, 0x80, &(0x7f0000003180)=[{&(0x7f00000030c0)=""/188, 0xbc}], 0x1, &(0x7f00000031c0)=""/209, 0xd1}, 0x40}, {{&(0x7f00000032c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000003480), 0x0, &(0x7f0000000680)=""/42, 0x2a}, 0xfffff9f0}, {{&(0x7f0000003500)=@pptp={0x18, 0x2, {0x0, @dev}}, 0x80, 0x0, 0x0, &(0x7f0000003900)=""/167, 0xa7}, 0xdd0}], 0x7, 0x10000, 0x0) r2 = socket$inet6(0xa, 0x80000, 0x2) ioctl$FS_IOC_GETFLAGS(r2, 0x80086601, &(0x7f00000001c0)) pipe(0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'eql\x00\x00\x04\x00\x00\x00\x03\x00\x00\x00\xf2\a\x00', 0x2}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='oom_score\x00') preadv(r3, &(0x7f00000017c0), 0x199, 0x0) [ 211.235832][ T9146] EXT4-fs (sda1): re-mounted. Opts: resgid=0x0000000000000000, 02:00:22 executing program 2: 02:00:22 executing program 0: 02:00:22 executing program 3: 02:00:22 executing program 4: 02:00:22 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0xc0406618, 0x0) 02:00:22 executing program 2: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) socketpair(0x0, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, 0x0) 02:00:22 executing program 3: pipe(0x0) ioctl$KDSETLED(0xffffffffffffffff, 0x4b32, 0x0) ioctl$KDSETLED(0xffffffffffffffff, 0x4b32, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KDSETLED(r0, 0x4b32, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)={{0x0, 0x0, 0x0, 0x0, 0x2ab, 0x2, 0x275, 0x4}, "", [[], []]}, 0x220) 02:00:23 executing program 1: ioctl$KDSETLED(0xffffffffffffffff, 0x4b32, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x40, 0x0) ioctl$KDSETLED(0xffffffffffffffff, 0x4b32, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x400, 0x0) syz_open_pts(r0, 0x10000) 02:00:23 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(0xffffffffffffffff, 0x0, 0x0) r2 = dup2(r1, r1) sendmmsg$unix(r0, &(0x7f0000006f00), 0x0, 0x0) dup2(r0, r2) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) 02:00:23 executing program 5: read(0xffffffffffffffff, 0x0, 0xffffffa5) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000003a40)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1e) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xbb8) 02:00:23 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = semget$private(0x0, 0x0, 0x0) pipe(0x0) semctl$GETNCNT(r0, 0x0, 0xe, 0x0) 02:00:23 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0xcc, 0x9}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0xfffffd9f, 0x0}, 0xe) 02:00:23 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) 02:00:23 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x80011, r1, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 02:00:23 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:23 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) userfaultfd(0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='fdinfo/4\x00') readv(r0, &(0x7f0000f46000)=[{&(0x7f0000000480)=""/101, 0x65}], 0x2000000000000264) [ 212.248442][ T9207] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 212.282048][ T9210] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. 02:00:23 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:23 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) mount$overlay(0x40000f, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=:/file0,workdir=./file1']) 02:00:23 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) [ 212.508096][ T9225] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 02:00:24 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) userfaultfd(0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='fdinfo/4\x00') readv(r0, &(0x7f0000f46000)=[{&(0x7f0000000480)=""/101, 0x65}], 0x2000000000000264) 02:00:24 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) [ 212.755695][ T9232] overlayfs: empty lowerdir [ 212.787407][ T9234] overlayfs: empty lowerdir 02:00:24 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x9, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x161, 0x11, 0x3c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) 02:00:24 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) [ 212.937030][ T9239] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 212.953192][ T27] kauditd_printk_skb: 3 callbacks suppressed 02:00:24 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) 02:00:24 executing program 3: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) 02:00:24 executing program 4: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) 02:00:24 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) [ 212.953208][ T27] audit: type=1800 audit(1575338424.354:31): pid=9209 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.1" name=7374617409C0D2FEBCF9DF2DEAC8C177FF171248E91193513049F831550D6F7DE66CF637BDBF1311920C8A26EDA4DCC3783F9DB5116B34D31B0512A5608AAFF01E7952340CD6FD dev="sda1" ino=16562 res=0 [ 212.990589][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 212.990644][ C0] protocol 88fb is buggy, dev hsr_slave_1 02:00:24 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) [ 213.170128][ T9256] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 02:00:24 executing program 5: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) 02:00:24 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:24 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:24 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) 02:00:25 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:25 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) fcntl$dupfd(r2, 0x0, r1) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:25 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:25 executing program 3: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0, 0x2812, r0, 0x0) write$FUSE_DIRENTPLUS(r0, &(0x7f0000000500)=ANY=[@ANYBLOB='|'], 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 02:00:25 executing program 4: mkdir(0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x10, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9f, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(0x0, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x80000, 0x80) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ftruncate(0xffffffffffffffff, 0x208200) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x11, 0xffffffffffffffff, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:00:25 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) fcntl$dupfd(r2, 0x0, r1) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:25 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r1) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) [ 214.202734][ T9302] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 02:00:25 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r1) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:25 executing program 5: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x10, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9f, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(0x0, 0x0) open(0x0, 0x80000, 0x80) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = creat(0x0, 0x0) ftruncate(r4, 0x208200) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, 0xffffffffffffffff, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:00:25 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) fcntl$dupfd(r2, 0x0, r1) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) [ 214.444558][ T5] BUG: sleeping function called from invalid context at mm/page_alloc.c:4681 [ 214.453916][ T5] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5, name: kworker/0:0 [ 214.462827][ T5] 4 locks held by kworker/0:0/5: [ 214.467771][ T5] #0: ffff8880aa026d28 ((wq_completion)events){+.+.}, at: process_one_work+0x88b/0x1740 [ 214.477672][ T5] #1: ffffc90000cbfdc0 (pcpu_balance_work){+.+.}, at: process_one_work+0x8c1/0x1740 [ 214.487199][ T5] #2: ffffffff89a3ff20 (pcpu_alloc_mutex){+.+.}, at: pcpu_balance_workfn+0xb7/0x1310 [ 214.496838][ T5] #3: ffffffff89a51ad8 (vmap_area_lock){+.+.}, at: pcpu_get_vm_areas+0x3b27/0x3f00 [ 214.506303][ T5] Preemption disabled at: [ 214.506325][ T5] [] pcpu_get_vm_areas+0x3b27/0x3f00 [ 214.517555][ T5] CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.4.0-next-20191202-syzkaller #0 [ 214.526468][ T5] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 214.536511][ T5] Workqueue: events pcpu_balance_workfn [ 214.542042][ T5] Call Trace: [ 214.545322][ T5] dump_stack+0x197/0x210 [ 214.549640][ T5] ? pcpu_get_vm_areas+0x3b27/0x3f00 [ 214.554902][ T5] ___might_sleep.cold+0x1fb/0x23e [ 214.559990][ T5] __might_sleep+0x95/0x190 [ 214.564479][ T5] __alloc_pages_nodemask+0x523/0x910 [ 214.569857][ T5] ? __kasan_check_read+0x11/0x20 [ 214.574884][ T5] ? __alloc_pages_slowpath+0x2900/0x2900 [ 214.580608][ T5] ? kasan_populate_vmalloc_pte+0xfd/0x1c0 [ 214.586469][ T5] ? __kasan_check_read+0x11/0x20 [ 214.591507][ T5] ? __lock_acquire+0x16f2/0x4a00 [ 214.596540][ T5] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 214.602764][ T5] alloc_pages_current+0x107/0x210 [ 214.607981][ T5] __get_free_pages+0xc/0x40 [ 214.612562][ T5] kasan_populate_vmalloc_pte+0x2f/0x1c0 [ 214.618187][ T5] apply_to_page_range+0x445/0x700 [ 214.623285][ T5] ? memset+0x40/0x40 [ 214.627264][ T5] kasan_populate_vmalloc+0x68/0x90 [ 214.632447][ T5] pcpu_get_vm_areas+0x3c77/0x3f00 [ 214.637538][ T5] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 214.643774][ T5] pcpu_create_chunk+0x24e/0x7f0 [ 214.648696][ T5] pcpu_balance_workfn+0xf1b/0x1310 [ 214.653877][ T5] ? __alloc_percpu+0x30/0x30 [ 214.658543][ T5] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 214.664069][ T5] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 214.670030][ T5] ? trace_hardirqs_on+0x67/0x240 [ 214.675036][ T5] process_one_work+0x9af/0x1740 [ 214.679952][ T5] ? pwq_dec_nr_in_flight+0x320/0x320 [ 214.685315][ T5] ? lock_acquire+0x190/0x410 [ 214.689974][ T5] worker_thread+0x98/0xe40 [ 214.694470][ T5] kthread+0x361/0x430 [ 214.698515][ T5] ? process_one_work+0x1740/0x1740 [ 214.703687][ T5] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 214.709383][ T5] ret_from_fork+0x24/0x30 02:00:26 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) [ 214.768577][ T9309] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 02:00:26 executing program 3: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0, 0x2812, r0, 0x0) write$FUSE_DIRENTPLUS(r0, &(0x7f0000000500)=ANY=[@ANYBLOB='|'], 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 02:00:26 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r1) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) [ 214.997980][ T9318] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 02:00:26 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) [ 215.158119][ T9321] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 02:00:26 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:26 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) [ 215.333045][ T9326] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 02:00:26 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) dup(0xffffffffffffffff) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x2f0, 0x20000008, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x101) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x20000, 0x0) write(r4, &(0x7f0000000280)="7b1d4c94f5eb252500003e00", 0xffffffffffffff8e) epoll_pwait(r3, &(0x7f0000000300)=[{}], 0x1, 0x0, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x50) r5 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x0, 0x0) write$eventfd(r5, &(0x7f00000001c0), 0xffffff7f) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x1fe, 0x4) sendfile(r0, r2, 0x0, 0x8000fffffffe) pselect6(0x40, &(0x7f00000000c0)={0x10}, 0x0, 0x0, 0x0, 0x0) 02:00:26 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)) socket$packet(0x11, 0x3, 0x300) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:26 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:27 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) [ 215.631421][ T9341] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 215.749508][ T9347] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 215.926324][ T27] audit: type=1804 audit(1575338427.324:32): pid=9347 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir239673185/syzkaller.0JxZ6R/12/bus" dev="sda1" ino=16542 res=1 02:00:27 executing program 5: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x10, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9f, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(0x0, 0x0) open(0x0, 0x80000, 0x80) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = creat(0x0, 0x0) ftruncate(r4, 0x208200) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, 0xffffffffffffffff, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:00:27 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0xfc0004) r2 = accept4(r1, 0x0, 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000140)=@sack_info={0x0, 0x1, 0xb0}, 0xc) 02:00:27 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:27 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)) socket$packet(0x11, 0x3, 0x300) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:27 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) 02:00:27 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:27 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)) socket$packet(0x11, 0x3, 0x300) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:28 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r2) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) [ 216.659485][ T27] audit: type=1804 audit(1575338428.054:33): pid=9352 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir239673185/syzkaller.0JxZ6R/12/bus" dev="sda1" ino=16542 res=1 [ 216.723382][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 216.723884][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 216.821731][ T27] audit: type=1804 audit(1575338428.104:34): pid=9377 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir239673185/syzkaller.0JxZ6R/12/bus" dev="sda1" ino=16542 res=1 [ 216.971059][ T27] audit: type=1804 audit(1575338428.124:35): pid=9378 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir239673185/syzkaller.0JxZ6R/12/bus" dev="sda1" ino=16542 res=1 02:00:28 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) dup(0xffffffffffffffff) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x2f0, 0x20000008, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x101) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x20000, 0x0) write(r4, &(0x7f0000000280)="7b1d4c94f5eb252500003e00", 0xffffffffffffff8e) epoll_pwait(r3, &(0x7f0000000300)=[{}], 0x1, 0x0, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x50) r5 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x0, 0x0) write$eventfd(r5, &(0x7f00000001c0), 0xffffff7f) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x1fe, 0x4) sendfile(r0, r2, 0x0, 0x8000fffffffe) pselect6(0x40, &(0x7f00000000c0)={0x10}, 0x0, 0x0, 0x0, 0x0) 02:00:28 executing program 3: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x10, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9f, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41be, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(0x0, 0x0) open(0x0, 0x80000, 0x80) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = creat(0x0, 0x0) ftruncate(r4, 0x208200) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x10, 0xffffffffffffffff, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 02:00:28 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:28 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:28 executing program 5: r0 = socket$inet6(0xa, 0x400000000001, 0x0) dup(0xffffffffffffffff) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x2f0, 0x20000008, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x101) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x20000, 0x0) write(r4, &(0x7f0000000280)="7b1d4c94f5eb252500003e00", 0xffffffffffffff8e) epoll_pwait(r3, &(0x7f0000000300)=[{}], 0x1, 0x0, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x50) r5 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x0, 0x0) write$eventfd(r5, &(0x7f00000001c0), 0xffffff7f) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x1fe, 0x4) sendfile(r0, r2, 0x0, 0x8000fffffffe) pselect6(0x40, &(0x7f00000000c0)={0x10}, 0x0, 0x0, 0x0, 0x0) 02:00:28 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r2) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) 02:00:28 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:28 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) [ 217.627406][ T9419] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 02:00:29 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:29 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) [ 217.658462][ T27] audit: type=1804 audit(1575338429.054:36): pid=9413 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir239673185/syzkaller.0JxZ6R/13/bus" dev="sda1" ino=16585 res=1 02:00:29 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r2) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) 02:00:29 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) [ 217.883695][ T27] audit: type=1804 audit(1575338429.254:37): pid=9419 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir835916347/syzkaller.tm0JZ9/8/bus" dev="sda1" ino=16542 res=1 [ 218.336319][ T184] tipc: TX() has been purged, node left! 02:00:29 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) dup(0xffffffffffffffff) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x2f0, 0x20000008, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x101) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x20000, 0x0) write(r4, &(0x7f0000000280)="7b1d4c94f5eb252500003e00", 0xffffffffffffff8e) epoll_pwait(r3, &(0x7f0000000300)=[{}], 0x1, 0x0, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x50) r5 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x0, 0x0) write$eventfd(r5, &(0x7f00000001c0), 0xffffff7f) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x1fe, 0x4) sendfile(r0, r2, 0x0, 0x8000fffffffe) pselect6(0x40, &(0x7f00000000c0)={0x10}, 0x0, 0x0, 0x0, 0x0) 02:00:29 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) r1 = socket$packet(0x11, 0x3, 0x300) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:29 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) 02:00:29 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) [ 218.483466][ T9442] __nla_validate_parse: 3 callbacks suppressed [ 218.483477][ T9442] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 218.511240][ T184] tipc: TX() has been purged, node left! [ 218.753565][ T27] audit: type=1804 audit(1575338430.154:38): pid=9446 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir239673185/syzkaller.0JxZ6R/14/bus" dev="sda1" ino=16572 res=1 02:00:30 executing program 5: r0 = socket$inet6(0xa, 0x400000000001, 0x0) dup(0xffffffffffffffff) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x2f0, 0x20000008, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x101) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x20000, 0x0) write(r4, &(0x7f0000000280)="7b1d4c94f5eb252500003e00", 0xffffffffffffff8e) epoll_pwait(r3, &(0x7f0000000300)=[{}], 0x1, 0x0, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x50) r5 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x0, 0x0) write$eventfd(r5, &(0x7f00000001c0), 0xffffff7f) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x1fe, 0x4) sendfile(r0, r2, 0x0, 0x8000fffffffe) pselect6(0x40, &(0x7f00000000c0)={0x10}, 0x0, 0x0, 0x0, 0x0) 02:00:30 executing program 3: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r1, 0x0) sendto$inet6(r1, &(0x7f00000000c0)="bd", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x0, @loopback}, 0x1c) close(r1) 02:00:30 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:30 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) r1 = socket$packet(0x11, 0x3, 0x300) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:30 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) 02:00:30 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:30 executing program 3: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r1, 0x0) sendto$inet6(r1, &(0x7f00000000c0)="bd", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x0, @loopback}, 0x1c) close(r1) [ 218.861229][ T9452] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 02:00:30 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) r1 = socket$packet(0x11, 0x3, 0x300) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) [ 219.035175][ T9465] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 219.348381][ T27] audit: type=1804 audit(1575338430.744:39): pid=9474 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir835916347/syzkaller.tm0JZ9/9/bus" dev="sda1" ino=16524 res=1 02:00:31 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) dup(0xffffffffffffffff) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x2f0, 0x20000008, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x101) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x20000, 0x0) write(r4, &(0x7f0000000280)="7b1d4c94f5eb252500003e00", 0xffffffffffffff8e) epoll_pwait(r3, &(0x7f0000000300)=[{}], 0x1, 0x0, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x50) r5 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x0, 0x0) write$eventfd(r5, &(0x7f00000001c0), 0xffffff7f) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x1fe, 0x4) sendfile(r0, r2, 0x0, 0x8000fffffffe) pselect6(0x40, &(0x7f00000000c0)={0x10}, 0x0, 0x0, 0x0, 0x0) 02:00:31 executing program 3: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r1, 0x0) sendto$inet6(r1, &(0x7f00000000c0)="bd", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x0, @loopback}, 0x1c) close(r1) 02:00:31 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:31 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) socketpair$unix(0x1, 0x5, 0x0, 0x0) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) [ 219.716273][ T9479] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 220.070544][ T27] audit: type=1804 audit(1575338431.464:40): pid=9490 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir239673185/syzkaller.0JxZ6R/15/bus" dev="sda1" ino=16589 res=1 02:00:31 executing program 5: r0 = socket$inet6(0xa, 0x400000000001, 0x0) dup(0xffffffffffffffff) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x2f0, 0x20000008, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x101) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x20000, 0x0) write(r4, &(0x7f0000000280)="7b1d4c94f5eb252500003e00", 0xffffffffffffff8e) epoll_pwait(r3, &(0x7f0000000300)=[{}], 0x1, 0x0, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x50) r5 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x0, 0x0) write$eventfd(r5, &(0x7f00000001c0), 0xffffff7f) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x1fe, 0x4) sendfile(r0, r2, 0x0, 0x8000fffffffe) pselect6(0x40, &(0x7f00000000c0)={0x10}, 0x0, 0x0, 0x0, 0x0) 02:00:31 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r1 = socket$packet(0x11, 0x3, 0x300) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) writev(0xffffffffffffffff, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:31 executing program 3: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r1, 0x0) sendto$inet6(r1, &(0x7f00000000c0)="bd", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x0, @loopback}, 0x1c) close(r1) 02:00:31 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:31 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) [ 220.189519][ T9498] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 02:00:31 executing program 3: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r1, 0x0) close(r1) 02:00:31 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:31 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r1 = socket$packet(0x11, 0x3, 0x300) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) writev(0xffffffffffffffff, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) [ 220.453712][ T9505] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 220.681321][ T27] audit: type=1804 audit(1575338432.084:41): pid=9514 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir835916347/syzkaller.tm0JZ9/10/bus" dev="sda1" ino=16616 res=1 02:00:32 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) dup(0xffffffffffffffff) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x2f0, 0x20000008, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x101) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x20000, 0x0) write(r3, &(0x7f0000000280)="7b1d4c94f5eb252500003e00", 0xffffffffffffff8e) epoll_pwait(r2, &(0x7f0000000300)=[{}], 0x1, 0x0, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x50) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x0, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x1fe, 0x4) pselect6(0x40, &(0x7f00000000c0)={0x10}, 0x0, 0x0, 0x0, 0x0) 02:00:32 executing program 3: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r1, 0x0) close(r1) 02:00:32 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r1 = socket$packet(0x11, 0x3, 0x300) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) writev(0xffffffffffffffff, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:32 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) [ 221.087187][ T9521] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 02:00:32 executing program 5: r0 = socket$inet6(0xa, 0x400000000001, 0x0) dup(0xffffffffffffffff) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x2f0, 0x20000008, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x101) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x20000, 0x0) write(r4, &(0x7f0000000280)="7b1d4c94f5eb252500003e00", 0xffffffffffffff8e) epoll_pwait(r3, &(0x7f0000000300)=[{}], 0x1, 0x0, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x50) r5 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x0, 0x0) write$eventfd(r5, &(0x7f00000001c0), 0xffffff7f) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x1fe, 0x4) sendfile(r0, r2, 0x0, 0x8000fffffffe) 02:00:32 executing program 3: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = socket$inet6(0xa, 0x1, 0x8010000400000084) shutdown(r1, 0x0) close(r1) 02:00:32 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) [ 221.382300][ T27] audit: type=1804 audit(1575338432.784:42): pid=9529 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir239673185/syzkaller.0JxZ6R/16/bus" dev="sda1" ino=16577 res=1 [ 221.400653][ T9532] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 02:00:32 executing program 0: r0 = syz_open_dev$tty(0x0, 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:32 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) 02:00:32 executing program 3: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = socket$inet6(0xa, 0x1, 0x8010000400000084) sendto$inet6(r1, &(0x7f00000000c0)="bd", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x0, @loopback}, 0x1c) close(r1) 02:00:32 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) [ 221.585609][ T9541] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 02:00:33 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) [ 221.710246][ T27] audit: type=1804 audit(1575338433.104:43): pid=9549 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir835916347/syzkaller.tm0JZ9/11/bus" dev="sda1" ino=16585 res=1 [ 221.830124][ T9555] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 02:00:33 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) dup(0xffffffffffffffff) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x2f0, 0x20000008, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x101) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x20000, 0x0) write(r3, &(0x7f0000000280)="7b1d4c94f5eb252500003e00", 0xffffffffffffff8e) epoll_pwait(r2, &(0x7f0000000300)=[{}], 0x1, 0x0, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x50) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x0, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x1fe, 0x4) pselect6(0x40, &(0x7f00000000c0)={0x10}, 0x0, 0x0, 0x0, 0x0) 02:00:33 executing program 3: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") sendto$inet6(0xffffffffffffffff, &(0x7f00000000c0)="bd", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x0, @loopback}, 0x1c) close(0xffffffffffffffff) 02:00:33 executing program 0: r0 = syz_open_dev$tty(0x0, 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:33 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:33 executing program 5: r0 = socket$inet6(0xa, 0x400000000001, 0x0) dup(0xffffffffffffffff) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x2f0, 0x20000008, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x101) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x20000, 0x0) write(r4, &(0x7f0000000280)="7b1d4c94f5eb252500003e00", 0xffffffffffffff8e) epoll_pwait(r3, &(0x7f0000000300)=[{}], 0x1, 0x0, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x50) r5 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x0, 0x0) write$eventfd(r5, &(0x7f00000001c0), 0xffffff7f) sendfile(r0, r2, 0x0, 0x8000fffffffe) 02:00:33 executing program 3: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") sendto$inet6(0xffffffffffffffff, &(0x7f00000000c0)="bd", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x0, @loopback}, 0x1c) close(0xffffffffffffffff) 02:00:33 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_script(r2, &(0x7f0000000240)=ANY=[@ANYBLOB='l'], 0x1) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) 02:00:33 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:33 executing program 0: r0 = syz_open_dev$tty(0x0, 0x0, 0x40282) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) [ 222.622394][ T27] audit: type=1804 audit(1575338434.024:44): pid=9569 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir239673185/syzkaller.0JxZ6R/17/bus" dev="sda1" ino=16545 res=1 02:00:34 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:34 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:34 executing program 3: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") sendto$inet6(0xffffffffffffffff, &(0x7f00000000c0)="bd", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x0, @loopback}, 0x1c) close(0xffffffffffffffff) [ 223.158960][ T27] audit: type=1804 audit(1575338434.554:45): pid=9593 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir835916347/syzkaller.tm0JZ9/12/bus" dev="sda1" ino=16564 res=1 02:00:34 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) dup(0xffffffffffffffff) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x2f0, 0x20000008, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x101) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x20000, 0x0) write(r3, &(0x7f0000000280)="7b1d4c94f5eb252500003e00", 0xffffffffffffff8e) epoll_pwait(r2, &(0x7f0000000300)=[{}], 0x1, 0x0, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x50) r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x0, 0x0) write$eventfd(r4, &(0x7f00000001c0), 0xffffff7f) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000001c0)=0x1fe, 0x4) pselect6(0x40, &(0x7f00000000c0)={0x10}, 0x0, 0x0, 0x0, 0x0) 02:00:34 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:34 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:34 executing program 3: socket$inet6(0xa, 0x80003, 0x6b) r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) sendto$inet6(r0, &(0x7f00000000c0)="bd", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x0, @loopback}, 0x1c) close(r0) [ 223.529859][ T9600] __nla_validate_parse: 3 callbacks suppressed [ 223.529869][ T9600] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 223.800967][ T27] audit: type=1804 audit(1575338435.194:46): pid=9608 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir239673185/syzkaller.0JxZ6R/18/bus" dev="sda1" ino=16545 res=1 02:00:35 executing program 5: r0 = socket$inet6(0xa, 0x400000000001, 0x0) dup(0xffffffffffffffff) getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r1 = dup(r0) bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x2f0, 0x20000008, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x101) socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x20000, 0x0) write(r4, &(0x7f0000000280)="7b1d4c94f5eb252500003e00", 0xffffffffffffff8e) epoll_pwait(r3, &(0x7f0000000300)=[{}], 0x1, 0x0, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, 0x0, 0x50) r5 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./bus\x00', 0x0, 0x0) write$eventfd(r5, &(0x7f00000001c0), 0xffffff7f) sendfile(r0, r2, 0x0, 0x8000fffffffe) 02:00:35 executing program 3: socket$inet6(0xa, 0x80003, 0x6b) r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) sendto$inet6(r0, &(0x7f00000000c0)="bd", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x0, @loopback}, 0x1c) close(r0) 02:00:35 executing program 1: syz_open_dev$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) close(r2) fallocate(r1, 0x0, 0x40000, 0x4) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0xd000000, r1, 0x0, 0x8}) 02:00:35 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) 02:00:35 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) [ 224.157168][ T9616] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 02:00:35 executing program 3: socket$inet6(0xa, 0x80003, 0x6b) r0 = socket$inet6(0xa, 0x1, 0x8010000400000084) sendto$inet6(r0, &(0x7f00000000c0)="bd", 0x1, 0x0, &(0x7f0000bb6000)={0xa, 0x0, 0x0, @loopback}, 0x1c) close(r0) 02:00:35 executing program 0: r0 = syz_open_dev$tty(&(0x7f0000000240)='/dev/tty1\x00', 0x0, 0x40282) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) writev(r0, &(0x7f0000001840)=[{&(0x7f0000000580)="fe058f6424e36b09e9f92c", 0xb}], 0x1) 02:00:35 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000400)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@getsa={0x28, 0x12, 0x1, 0x0, 0x0, {@in6=@empty, 0x0, 0x0, 0x32}}, 0x28}, 0x8}, 0x0) [ 224.420809][ T9628] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.