syzkaller login: [ 40.413986] audit: type=1400 audit(1570346965.209:35): avc: denied { map } for pid=7462 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 Warning: Permanently added '10.128.1.13' (ECDSA) to the list of known hosts. 2019/10/06 07:29:31 fuzzer started [ 46.915633] audit: type=1400 audit(1570346971.719:36): avc: denied { map } for pid=7472 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2019/10/06 07:29:33 dialing manager at 10.128.0.105:34719 2019/10/06 07:29:33 syscalls: 2516 2019/10/06 07:29:33 code coverage: enabled 2019/10/06 07:29:33 comparison tracing: enabled 2019/10/06 07:29:33 extra coverage: extra coverage is not supported by the kernel 2019/10/06 07:29:33 setuid sandbox: enabled 2019/10/06 07:29:33 namespace sandbox: enabled 2019/10/06 07:29:33 Android sandbox: /sys/fs/selinux/policy does not exist 2019/10/06 07:29:33 fault injection: enabled 2019/10/06 07:29:33 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/10/06 07:29:33 net packet injection: enabled 2019/10/06 07:29:33 net device setup: enabled 2019/10/06 07:29:33 concurrency sanitizer: /proc/kcsaninfo does not exist 07:32:08 executing program 0: [ 203.384887] audit: type=1400 audit(1570347128.179:37): avc: denied { map } for pid=7490 comm="syz-executor.0" path="/sys/kernel/debug/kcov" dev="debugfs" ino=14991 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 203.499558] IPVS: ftp: loaded support on port[0] = 21 07:32:08 executing program 1: [ 203.640630] chnl_net:caif_netlink_parms(): no params data found [ 203.708583] IPVS: ftp: loaded support on port[0] = 21 [ 203.738726] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.746524] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.754141] device bridge_slave_0 entered promiscuous mode [ 203.778001] bridge0: port 2(bridge_slave_1) entered blocking state 07:32:08 executing program 2: [ 203.784396] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.792602] device bridge_slave_1 entered promiscuous mode [ 203.870859] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 203.892854] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 203.919953] chnl_net:caif_netlink_parms(): no params data found [ 203.964471] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 203.973269] team0: Port device team_slave_0 added [ 203.979289] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 203.983008] IPVS: ftp: loaded support on port[0] = 21 [ 203.987011] team0: Port device team_slave_1 added [ 204.007515] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 204.036689] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 204.059888] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.067798] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.075700] device bridge_slave_0 entered promiscuous mode 07:32:08 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x1c, 0x2f, 0x3ff, 0x0, 0x0, {0xd}, [@typed={0x8, 0x3, @uid}]}, 0x1c}}, 0x0) [ 204.084297] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.091377] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.099039] device bridge_slave_1 entered promiscuous mode [ 204.147623] device hsr_slave_0 entered promiscuous mode [ 204.184974] device hsr_slave_1 entered promiscuous mode [ 204.225489] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 204.232569] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 204.253893] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 204.270488] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 204.291717] IPVS: ftp: loaded support on port[0] = 21 [ 204.311346] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 204.319835] team0: Port device team_slave_0 added 07:32:09 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000140)='./bus\x00', 0x40, 0x0) close(r0) r1 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) readv(r1, &(0x7f0000000180)=[{&(0x7f0000001200)=""/4096, 0xfffffe19}], 0x1) [ 204.327049] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.333520] bridge0: port 2(bridge_slave_1) entered forwarding state [ 204.340548] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.346960] bridge0: port 1(bridge_slave_0) entered forwarding state [ 204.366652] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 204.379141] team0: Port device team_slave_1 added [ 204.396526] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 204.427151] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready 07:32:09 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x80000000002) setsockopt$inet_int(r0, 0x0, 0x80000000000c8, &(0x7f00000000c0), 0x4) setsockopt$inet_int(r0, 0x0, 0x100000000c9, 0x0, 0x0) [ 204.577408] device hsr_slave_0 entered promiscuous mode [ 204.615689] device hsr_slave_1 entered promiscuous mode [ 204.675366] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 204.691205] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.699911] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.711156] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 204.722356] IPVS: ftp: loaded support on port[0] = 21 [ 204.727735] chnl_net:caif_netlink_parms(): no params data found [ 204.727790] IPVS: ftp: loaded support on port[0] = 21 [ 204.817607] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 204.852744] bridge0: port 1(bridge_slave_0) entered blocking state [ 204.859449] bridge0: port 1(bridge_slave_0) entered disabled state [ 204.866586] device bridge_slave_0 entered promiscuous mode [ 204.891838] bridge0: port 2(bridge_slave_1) entered blocking state [ 204.899607] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.906807] device bridge_slave_1 entered promiscuous mode [ 204.930015] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 204.940357] 8021q: adding VLAN 0 to HW filter on device bond0 [ 204.949631] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 204.959954] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 204.967153] chnl_net:caif_netlink_parms(): no params data found [ 204.980550] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 205.000029] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 205.007705] team0: Port device team_slave_0 added [ 205.012963] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 205.020604] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 205.030429] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 205.037047] 8021q: adding VLAN 0 to HW filter on device team0 [ 205.068432] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 205.076849] team0: Port device team_slave_1 added [ 205.082170] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 205.091363] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 205.100384] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 205.110976] bridge0: port 1(bridge_slave_0) entered blocking state [ 205.118631] bridge0: port 1(bridge_slave_0) entered disabled state [ 205.126661] device bridge_slave_0 entered promiscuous mode [ 205.135366] bridge0: port 2(bridge_slave_1) entered blocking state [ 205.141711] bridge0: port 2(bridge_slave_1) entered disabled state [ 205.149965] device bridge_slave_1 entered promiscuous mode [ 205.157685] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 205.165878] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 205.173482] bridge0: port 1(bridge_slave_0) entered blocking state [ 205.179889] bridge0: port 1(bridge_slave_0) entered forwarding state [ 205.213150] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 205.229424] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 205.253261] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 205.297605] device hsr_slave_0 entered promiscuous mode [ 205.355125] device hsr_slave_1 entered promiscuous mode [ 205.417466] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 205.424553] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 205.432685] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 205.440446] bridge0: port 2(bridge_slave_1) entered blocking state [ 205.446847] bridge0: port 2(bridge_slave_1) entered forwarding state [ 205.455752] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 205.499181] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 205.507319] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 205.524406] 8021q: adding VLAN 0 to HW filter on device bond0 [ 205.549725] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 205.558142] team0: Port device team_slave_0 added [ 205.563930] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 205.571908] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 205.579748] team0: Port device team_slave_1 added [ 205.586385] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 205.592750] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 205.602070] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 205.616944] chnl_net:caif_netlink_parms(): no params data found [ 205.631510] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 205.641982] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 205.649487] chnl_net:caif_netlink_parms(): no params data found [ 205.726901] device hsr_slave_0 entered promiscuous mode [ 205.774968] device hsr_slave_1 entered promiscuous mode [ 205.815791] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 205.822049] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 205.830594] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 205.838431] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 205.845344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 205.852457] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 205.861914] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 205.879695] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 205.888558] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 205.901655] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 205.909861] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 205.946566] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 205.963791] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 205.969977] 8021q: adding VLAN 0 to HW filter on device team0 [ 205.977367] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 205.989181] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 206.001144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 206.008855] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.015402] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.022323] device bridge_slave_0 entered promiscuous mode [ 206.030516] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.036977] bridge0: port 2(bridge_slave_1) entered disabled state [ 206.043877] device bridge_slave_1 entered promiscuous mode [ 206.069202] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 206.080794] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 206.089376] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 206.098687] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 206.107737] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 206.115728] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 206.123296] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.129677] bridge0: port 1(bridge_slave_0) entered forwarding state [ 206.136683] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 206.144423] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 206.152476] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.158870] bridge0: port 2(bridge_slave_1) entered forwarding state [ 206.166968] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 206.173768] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.180604] bridge0: port 1(bridge_slave_0) entered disabled state [ 206.190570] device bridge_slave_0 entered promiscuous mode [ 206.197509] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.203845] bridge0: port 2(bridge_slave_1) entered disabled state [ 206.211027] device bridge_slave_1 entered promiscuous mode [ 206.230825] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 206.239209] team0: Port device team_slave_0 added [ 206.244266] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 206.252005] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 206.259752] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 206.269747] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 206.276488] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 206.298273] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 206.306667] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 206.317054] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 206.324148] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 206.331736] team0: Port device team_slave_1 added [ 206.337246] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 206.344916] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 206.364309] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 206.373516] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 206.381646] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 206.393882] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 206.437807] device hsr_slave_0 entered promiscuous mode [ 206.465562] device hsr_slave_1 entered promiscuous mode [ 206.506423] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 206.514295] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 206.521513] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 206.532022] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 206.539916] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 206.548051] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 206.557255] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 206.590694] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 206.598555] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 206.612083] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 206.620456] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 206.628762] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 206.638999] team0: Port device team_slave_0 added [ 206.645674] 8021q: adding VLAN 0 to HW filter on device bond0 [ 206.654451] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 206.668296] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 206.676079] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 206.683338] team0: Port device team_slave_1 added [ 206.689722] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 206.699344] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 206.708069] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 206.718925] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 206.726873] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 206.735534] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 206.745453] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 206.751524] 8021q: adding VLAN 0 to HW filter on device team0 [ 206.759839] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 206.773524] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 206.781775] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 206.789188] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 206.797245] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 206.806554] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 206.820587] audit: type=1400 audit(1570347131.619:38): avc: denied { associate } for pid=7491 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 206.826231] 8021q: adding VLAN 0 to HW filter on device bond0 [ 206.850263] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 206.857324] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 206.884274] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 206.893585] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 206.902680] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 206.910726] bridge0: port 1(bridge_slave_0) entered blocking state [ 206.917133] bridge0: port 1(bridge_slave_0) entered forwarding state 07:32:11 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xfffffffffffffe52, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="1400000022000104000000a6ffffffffffffffe28f139814a2b0bf0b6511932bfa21a9ba54615f6d349dab4f078f12b71406822ddc8af61121be129ca86ecd55927a3d6d4ee9a52d00003ec6cf5f2b916620e885549b0c1412faf440a80b63810ef54a9633b4296262be61f43a6312049deccfc3be8159fbafc462cba40eaa335c23fcebdbca7af1cebb5e5bcc9a60647acc76cad16c265cb4bc175fa483c6366bdb5837769040b2c85a8e6bd4c56e677862d3df2b479313bdc7abb052ef6bfd4d507b08eebb0bbbd73ac06623f4b025c6ded9ac4cf42e4fc93b79"], 0x14}}, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in=@multicast2, @in=@remote}, {@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x0, 0x33}, @in=@dev}}}, 0xf8}, 0x8}, 0x0) syz_read_part_table(0x0, 0x1, &(0x7f0000000000)=[{&(0x7f00000000c0)="0200eeffffff1fffffff", 0xa, 0x1c0}]) [ 206.930742] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 206.948401] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 206.956864] bridge0: port 2(bridge_slave_1) entered blocking state [ 206.963242] bridge0: port 2(bridge_slave_1) entered forwarding state [ 206.981643] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 207.027724] device hsr_slave_0 entered promiscuous mode [ 207.050520] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. [ 207.065283] device hsr_slave_1 entered promiscuous mode [ 207.087100] Dev loop0: unable to read RDB block 1 [ 207.092108] loop0: AHDI p1 [ 207.095694] loop0: partition table partially beyond EOD, truncated [ 207.107633] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 207.115260] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 207.127863] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 207.139077] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 207.148189] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 207.155100] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 207.162020] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 207.174516] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 207.192637] 8021q: adding VLAN 0 to HW filter on device bond0 [ 207.208541] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 207.222094] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 207.235075] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 207.239826] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. [ 207.244049] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 207.262783] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 207.279709] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 207.287391] Dev loop0: unable to read RDB block 1 [ 207.292288] loop0: AHDI p1 [ 207.295759] loop0: partition table partially beyond EOD, truncated [ 207.303884] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 207.310668] 8021q: adding VLAN 0 to HW filter on device team0 [ 207.317433] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 207.331060] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready 07:32:12 executing program 0: syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x6) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x80880, 0x0) ioctl$PPPOEIOCDFWD(r0, 0xb101, 0x0) [ 207.339266] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 207.352520] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 207.362452] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 207.376932] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 207.403544] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 207.428701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 207.440611] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 07:32:12 executing program 1: sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'crc32\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00') sendfile(r1, r2, 0x0, 0x1000007ffff000) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) openat$cgroup_int(r3, &(0x7f0000000180)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) r4 = socket$kcm(0xa, 0x5, 0x0) sendmsg(r4, &(0x7f00000006c0)={&(0x7f0000000100)=@in={0x2, 0x0, @local={0xa}}, 0x101d8, &(0x7f0000000640), 0x98, &(0x7f0000000180)=[{0x20}], 0x20}, 0x0) [ 207.451734] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready 07:32:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r1, r2) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000001, 0x12, r4, 0x1) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000001c0)={@in, 0x0, 0x5, 0x0, "9527eb1fe4a70061631dce40540ea584dc670e8a5b346583b4b9fd983552f8df14ee9ef7112f35b7d06988ac8f9131a1d9718dde8c44f8ab9d20c6894f2929496f17cef927115402414625e9abc4eb6a"}, 0xd8) setsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f0000000500)=0x5, 0x4) sendto$inet(r4, 0x0, 0x0, 0x20000801, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) r5 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbcf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r6 = dup2(r4, r5) write$cgroup_type(r6, &(0x7f0000000080)='threaded\x00', 0xffeb) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r3, 0x200, 0x5, r6}) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x21fffffe, 0x1, &(0x7f0000000080)=[{&(0x7f00000001c0)="4380ceaf62c656e96689247692d0a72380e7d601ad1bb8", 0xffffffb5, 0xfffffffffffffffd}], 0x2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f0000000100)=[@in={0x2, 0x4e20, @local}], 0x10) setsockopt$inet6_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f00000000c0), 0x4) [ 207.486813] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 207.525622] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 207.533578] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 207.542016] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.548406] bridge0: port 1(bridge_slave_0) entered forwarding state [ 207.558112] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 207.564193] 8021q: adding VLAN 0 to HW filter on device team0 [ 207.567490] hrtimer: interrupt took 47208 ns [ 207.592480] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 207.601706] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 207.613207] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 207.636396] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 207.650199] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 207.662169] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 207.694783] bridge0: port 2(bridge_slave_1) entered blocking state [ 207.701211] bridge0: port 2(bridge_slave_1) entered forwarding state [ 207.728206] BFS-fs: bfs_fill_super(): No BFS filesystem on loop0 (magic=afce8043) [ 207.745037] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 207.752853] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 207.768844] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 207.779517] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 207.791459] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.797893] bridge0: port 1(bridge_slave_0) entered forwarding state [ 207.809283] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 207.823968] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 207.836684] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 07:32:12 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r1, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) sendmsg$alg(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="e76ca8d746004e9bdf8a5214bf90c0ec6640a5422039b45da8f08d6888b5678bd7013f870779a07cec9690b3f65568f691a2b2100b970a87e62b5f2e81a7900e2ec852391867336764cea31cf90789aa94ae5f86993d44325755d207a404517d9f91f2e509098f7bfcb3eb1b4fd92f22079ff6c60c737de12f0253", 0x7b}, {&(0x7f0000000180)="130e19d7a6e25781a1fb7bc98b91244d346a16b60aa7b52baa6c3e8b95a6854b94f5aed1ee483e43a14b9beb5eaa005186230d0abc396bf473021c418c62b42b7dfdde258c9a12ab3cbe630bea5877d979cb5883d6d54b0016d5b7e119132438eb76f37729ee32f6295bb0865aefbdda72a1767946d096a598e55daf6ce54881b90f2cbc01f995702ebc59a228c252210e3f4a614abde72ecfad7ebbe3b69fe8c3969a1f0cd88acc62014c", 0xab}, {&(0x7f0000000240)="d55cc2e832a7fd6ffc17b08aaf6c57540b56ae175454b6f3b35c517ff28c836b0745853ec32ab95bd99ec51c5773dcaf0f8e3f977e53a912d228d328daf1b0139be339ec1adfd56d45c8aa18732508d8652c7b7e222e732715c8b04e6096fdd3af3ae5ffa7db9c3cf8ec205244deaacc173657db09becaf7958278456bd06b47646bdfc3c6c235d82ca918c22211", 0x8e}, {&(0x7f00000003c0)="be5acaa28a26a1972b7c2b7583a95a98655aa56795e74ee8dbce8c0990e61195876e04aed589cec0f22e067c23301f64cdc8dec1c7ec30fa6844da5dd8a26e9e5f4dfdee6b394f64eddc059581df095d3ad0ed0b2daff6380140e185b020f953c6227d5d380dec9249c61903cb247681d5fadb8bd1d9b049e41ddc23281fb4d6aa6251db6fc29aae0468a1ac1bf0fa77cb19a8b51b8d5fbddeff8eb9f57583a24ec16cab6b01ff5c2839", 0xaa}, {&(0x7f0000000480)="889b40d07aa5d82496c94b86867c19675939c8036f10ee5a66dce6e54496af04d8ff2ece230d21d53f7ebf1f50967ac0c57e7b3f4913c8fa14b5a42c538421e8faa3d3a1e1ec8969456335dab4cf9b3dd8104cb6e97f55b8a73fe1bc2515760e2d8670dae1616999503314140dac2ec8d77905ac73747c0d783fcf8ad6495594220a5ec9f185bab97c3efa6b5f6d9211cab66bf9c276b0af0f2a749cb3e0c5bb82a2bf25825a08aba4a5", 0xaa}], 0x5, &(0x7f0000000300)=[@assoc={0x18, 0x117, 0x4, 0x3f}, @assoc={0x18, 0x117, 0x4, 0x1f}, @assoc={0x18, 0x117, 0x4, 0x3}, @op={0x18}], 0x60, 0x800}, 0x40) socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x40, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5}, [@IFLA_OPERSTATE={0x8, 0xa, 0xdb2e}, @IFLA_LINKINFO={0x18, 0x12, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, [@IFLA_VTI_REMOTE={0x8, 0x5, @multicast2}]}}}]}, 0x40}}, 0x0) [ 207.850479] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 207.872027] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 207.896418] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 207.907044] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 207.915225] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 207.923124] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 207.931187] bridge0: port 2(bridge_slave_1) entered blocking state [ 207.937578] bridge0: port 2(bridge_slave_1) entered forwarding state [ 207.955800] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 207.966290] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 207.975285] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 207.985960] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 207.994936] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 208.003391] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 208.011650] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 208.019910] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 208.027828] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 208.150322] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 208.160523] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 208.174591] 8021q: adding VLAN 0 to HW filter on device bond0 [ 208.181095] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 208.188557] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 208.196923] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 208.204476] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 208.212336] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 208.220230] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 208.237116] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 208.244316] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 208.253039] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 208.265278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 208.272774] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 208.281069] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 208.289180] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 208.299057] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 208.312580] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 208.321769] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready 07:32:13 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x90680, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000040)=0x13, 0x4) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) r2 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00') sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)={0x58, r2, 0x21, 0x0, 0x0, {}, [{{0x8, 0x1, r1}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8}}}]}}]}, 0x58}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}]}, 0x48}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r8, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r7, r8) fcntl$dupfd(r8, 0x0, r5) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) write$evdev(r5, &(0x7f0000000240)=[{{r9, r10/1000+10000}, 0x12, 0xff, 0x7}, {{0x77359400}, 0x4636ad38297c7316, 0x7f, 0x7}], 0x30) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}]}, 0x48}}, 0x0) r11 = socket(0x10, 0x803, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000340)={0x0, 0x0}) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 208.344857] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 208.352512] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 208.382833] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready 07:32:13 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cpuset.effective_mems\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e21, 0x33780000, @remote, 0x20}}, 0x80, 0x4}, &(0x7f0000000380)=0x90) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000003c0)={r1, 0xe90f}, 0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r3, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f00000005c0)={0x6, 0x5}, 0x2) prctl$PR_GET_DUMPABLE(0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x2, 0x0, "8b63e98a6e9a990ceacccaa0722f7b17adbfb251c09e5993d319d88199f6923e646c1d3eaad49bc3c0a86bd1683c51ec36b5d2dab5a220e04e0b20637e2b5a8dd3403bbe1ccf681d083e2307d3f5597b"}, 0xd8) sendto$inet6(r4, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ftruncate(r5, 0x2081ff) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='wlan0&\x00', r5}, 0x10) r7 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000180)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r7, 0x80008) keyctl$describe(0xb, r7, 0x0, 0x0) ioctl$FITRIM(r6, 0xc0185879, &(0x7f0000000140)={0x2, 0xca, 0x2}) keyctl$read(0xb, r7, &(0x7f0000000080)=""/170, 0xaa) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000400)={&(0x7f0000734000/0x2000)=nil, 0x2000}, &(0x7f00000004c0)=0x10) ioctl$sock_proto_private(r4, 0x89e9, &(0x7f0000000500)="c50368a3110883940c5c68d254d1926dde458475a0a638d843925e2097e15689efe3e5f633adba4531d4e691926f0e9ee73b3b0a14b053cbaa819ca5e1f963d8cd9e266c1fb7f3960ecadf1becb15ccfc24e254dbbbfdcc93702dfca6ea0bef303514ee9eca5e285498850659656558d65582a4da97aaa36a4bee3af5e95858eab523854531453aea51d8e15d82762d8583cb1e2d2221c6824e0d790c58ae15e54a8ca32") mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) mmap(&(0x7f0000000000/0xddf000)=nil, 0xddf000, 0x0, 0x32, 0xffffffffffffffff, 0x0) [ 208.406541] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 208.416364] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 208.422378] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 208.458070] audit: type=1400 audit(1570347133.259:39): avc: denied { create } for pid=7551 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 208.492498] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 208.532002] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 208.551328] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 208.589582] audit: type=1400 audit(1570347133.299:40): avc: denied { setopt } for pid=7551 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 208.625845] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 208.631944] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 208.685723] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 208.696051] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 208.703559] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 208.750390] audit: type=1400 audit(1570347133.349:41): avc: denied { ioctl } for pid=7551 comm="syz-executor.0" path="socket:[27236]" dev="sockfs" ino=27236 ioctlcmd=0x8933 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 208.778390] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 208.779941] audit: type=1400 audit(1570347133.369:42): avc: denied { write } for pid=7551 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 208.811258] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 208.840335] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 208.894102] audit: type=1400 audit(1570347133.449:43): avc: denied { read } for pid=7551 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 209.138912] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 209.158797] 8021q: adding VLAN 0 to HW filter on device team0 [ 209.215137] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 209.255076] syz-executor.0 (7552) used greatest stack depth: 22368 bytes left 07:32:14 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = dup2(r0, r0) getsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, &(0x7f0000000000), &(0x7f0000000040)=0x6) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) sendto$unix(r4, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r4, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000480)={0x14, r6, 0x31b, 0x0, 0x0, {0xe}}, 0x14}}, 0x0) sendmsg$TIPC_NL_MON_GET(r4, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2480}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x114, r6, 0x100, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MEDIA={0xc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_LINK={0xc8, 0x4, [@TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_PRIO={0xfffffcfb, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80b2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x70b7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xbc}, @TIPC_NLA_PROP_PRIO={0x0, 0x1, 0x1d}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}]}, @TIPC_NLA_LINK={0x20, 0x4, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}]}]}, 0x114}, 0x1, 0x0, 0x0, 0x8004}, 0x24000004) ioctl$ASHMEM_PURGE_ALL_CACHES(r2, 0x770a, 0x0) [ 209.265279] netlink: 'syz-executor.0': attribute type 3 has an invalid length. [ 209.292885] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 209.338817] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 209.362453] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready 07:32:14 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x90680, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000040)=0x13, 0x4) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) r2 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00') sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)={0x58, r2, 0x21, 0x0, 0x0, {}, [{{0x8, 0x1, r1}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8}}}]}}]}, 0x58}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}]}, 0x48}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r8, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r7, r8) fcntl$dupfd(r8, 0x0, r5) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) write$evdev(r5, &(0x7f0000000240)=[{{r9, r10/1000+10000}, 0x12, 0xff, 0x7}, {{0x77359400}, 0x4636ad38297c7316, 0x7f, 0x7}], 0x30) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}]}, 0x48}}, 0x0) r11 = socket(0x10, 0x803, 0x0) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000340)={0x0, 0x0}) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) [ 209.388635] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.395083] bridge0: port 1(bridge_slave_0) entered forwarding state [ 209.431928] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 209.461832] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 209.510352] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 209.606854] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 209.630998] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 209.641137] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 209.651472] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 209.664400] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 209.673021] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 209.681913] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.688357] bridge0: port 2(bridge_slave_1) entered forwarding state [ 209.721506] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 209.741381] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 209.752296] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 209.761398] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 209.777956] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 209.792122] netlink: 'syz-executor.0': attribute type 3 has an invalid length. [ 209.804000] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 209.812897] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 209.840106] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 209.893420] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 210.123145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 210.138879] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready 07:32:15 executing program 3: socket$unix(0x1, 0x5, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_SET_FPEMU(0xa, 0x3) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000580)={0x0, 0xc8, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x50, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_OPERSTATE={0x8, 0xd}, @IFLA_LINKINFO={0x28, 0x12, @veth={{0xc, 0x1, 'veth\x00'}, {0x18, 0x2, @VETH_INFO_PEER={0x14}}}}]}, 0x50}}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r3, 0x18000000000002a0, 0xe80, 0x0, &(0x7f00000000c0)="b9ff0300000d698cb89e40f086dd01000005a4004000ffa377fbac14140ce9", 0x0, 0x100}, 0x28) finit_module(r3, &(0x7f0000000040)='veth\x00', 0x1) [ 210.172001] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 210.192808] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 210.204675] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 210.247577] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 210.259374] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 210.381703] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 210.402240] audit: type=1400 audit(1570347135.199:44): avc: denied { prog_load } for pid=7581 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 [ 210.440046] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 210.520169] audit: type=1400 audit(1570347135.259:45): avc: denied { prog_run } for pid=7581 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 07:32:15 executing program 4: syz_mount_image$xfs(&(0x7f00000006c0)='\x144\xc0\x00', &(0x7f0000000700)='./file1\x00', 0x0, 0x2, &(0x7f0000000980)=[{&(0x7f0000000080)="584653428af75a4cd53f818554e299fab2000000007d774572cef430761395b641b8b8d497696803272b4792bc7e0128b30b99bbb9ed03bc6fe60fc2be68091b8fb28375b8c2b8d400b5a1b37d947f0bfe222154d9d931a36ef513b156556120692be12cd4ee38e976f5d6b129028ea0561c4bbd9c12ae5b408a6e6b5597e54bcaae2636b3b9461782de3485fa4cacfdcd41602684736b6912911d0db71e807074a65064c4ccb24ae98104c414bc89617f42ebafda1cd21691d54a0e78d34c48c2b5e828cdf8a642d9307441fe", 0xcd}, {0x0, 0x0, 0x3}], 0x0, 0x0) 07:32:15 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$alg(0x26, 0x5, 0x0) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x6000242}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)={0x4c, 0x0, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@SEG6_ATTR_HMACKEYID={0x8}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x4}, @SEG6_ATTR_DST={0x14, 0x1, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}}, @SEG6_ATTR_DST={0x14, 0x1, @remote}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8008804) bind$alg(r2, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus640-generic\x00'}, 0x58) ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f0000000100)) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r3 = accept$alg(r2, 0x0, 0x0) sendmsg$alg(r3, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@assoc={0x18, 0x117, 0x4, 0xd4e5}, @op={0x18, 0x117, 0x3, 0x1}], 0x30}, 0x0) write$binfmt_script(r3, &(0x7f0000000600)=ANY=[], 0xfec8) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008912, &(0x7f0000000000)="0800b5055e0bcfe87b0071") r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r8, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r7, r8) r9 = fcntl$dupfd(r8, 0x0, r5) shutdown(r9, 0x0) write$P9_RSETATTR(r9, &(0x7f00000003c0)={0x7, 0x1b, 0x2}, 0x7) setsockopt$EBT_SO_SET_COUNTERS(r4, 0x0, 0x81, &(0x7f00000001c0)=ANY=[@ANYBLOB="6e61740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'/64], @ANYBLOB="00ffffffff0000000600"/24], 0x88) recvmmsg(r3, &(0x7f0000007e00)=[{{&(0x7f0000001240)=@alg, 0x80, &(0x7f0000004700)=[{&(0x7f00000012c0)=""/167, 0xf}, {&(0x7f00000023c0)=""/49, 0x200023f1}, {&(0x7f0000003580)=""/4096, 0xcd3}], 0x3, &(0x7f0000004780)=""/245, 0xffffffffffffff52}}], 0x30, 0x0, &(0x7f0000008000)={0x0, 0x989680}) 07:32:15 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x2000000000000074, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) r1 = socket$unix(0x1, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0xfebc89ca8c32c2ac, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x0) sendto$unix(r5, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r5, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x139) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x22, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, r8}, 0x10) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r5, 0x84, 0x23, &(0x7f00000002c0)={r8, 0x5}, 0x8) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmmsg$inet(r0, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="8c2fb08f70aca1f2e24e7dc4636db1607852800ad7239bfbb123065f680fcd8bd0da6e13b662424ccd67943bc81a1d56defee801abbb295542689614ad3cf075062ecc8fff703998f05b4a75cd21c51a0cdf5c1d22ec6c88b2f328c35d2284ce37375165fc7b892d9211b9f2b8d60d65de6a11b376b8379dea0e24d9d54997f9b0c35fdbb691b6a85b1dd235877eaf2c6b56cdebc12feefdd198891969cc07ec80aa29bcc95a7fa0866e97a784c0ac21edab15d06cfb51b0f47e5f4404", 0xbd}, {&(0x7f0000000340)="4520d8c1ee8e08b9ee293229", 0xc}], 0x2}}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000006840)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000004c0)=""/62, 0x3e}], 0x1}, 0x4}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)=""/38, 0x22}, {&(0x7f0000000a80)=""/108, 0x6c}], 0x2}}], 0x2, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='yeah\x00', 0x5) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 07:32:15 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) sendto$unix(r1, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r1, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x14, r3}, 0x14}}, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x88000}, 0xc, &(0x7f0000000280)={&(0x7f0000000340)={0x58, r3, 0x409, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x61}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x5561}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x58}, 0x1, 0x0, 0x0, 0xc0}, 0x20000000) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x0) sendto$unix(r5, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r5, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) sendto$unix(r7, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r7, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r9, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r8, 0x84, 0x22, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, r10}, 0x10) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000600)={r10, @in6={{0xa, 0x4e21, 0xe414, @rand_addr="338b19790b017663556505e4044722ad", 0x6}}, 0x7ff, 0x6, 0xffffff1c, 0x5}, &(0x7f0000000440)=0x98) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r5, 0x84, 0xf, &(0x7f0000000840)={r11, @in={{0x2, 0x4e24, @loopback}}, 0x100, 0xff, 0xc0000000, 0x66, 0xba}, &(0x7f0000000900)=0x98) r12 = add_key$user(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000740)="4acf665ff77df4f20690a5a83bc1a1e6519321db1dc2bf7eae06d978abdfbb33f3bc7025e6befda3c827875946eb75c14639ab6e76811a733653f72afc34e5fce1bed277a8faa02e6da16041b40bab677d6555e94a42b7ac236c8c35d729ac501cf28293c919f2f3ceec4703c892adeac90504aeb3ba485e09bda66d2b96124cabc4d2e653848e2bd909287d0d2c433d72bbd4333cf37f2a8972bba453c776d2c73c61b9fa2153405fc0253992c918682c7018f6a280a9ff312ae4a6996bd9547aed66e72f94342a7d27b9483f7e2e8e3c5bbb89452fd9bb6708ae89ba2960c795ec7d080fa9ae54b0", 0xe9, 0xfffffffffffffffe) lstat(&(0x7f0000000700)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000400), &(0x7f0000000540), &(0x7f00000006c0)=0x0) keyctl$chown(0x4, r12, r13, r14) lsetxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f0000000080)=@v3={0x3000000, [{0x6, 0x5}, {0x6, 0x8000}], r13}, 0x18, 0x4) r15 = syz_open_dev$vcsn(&(0x7f0000000180)='/dev/vcs#\x00', 0x0, 0x0) ioctl$VIDIOC_S_OUTPUT(r15, 0xc004562f, &(0x7f00000001c0)=0x1ff) r16 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000200)='/dev/capi20\x00', 0x0, 0x0) r17 = syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0x3, 0x0) getsockopt$netrom_NETROM_IDLE(r17, 0x103, 0x7, &(0x7f0000000100)=0x80, &(0x7f0000000140)=0x4) ioctl$CAPI_REGISTER(r16, 0x400c4301, 0x0) 07:32:15 executing program 3: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000040)='memory.high\x00', 0x2, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000440)=@xdp, 0x80, &(0x7f00000009c0)=[{&(0x7f00000004c0)=""/136, 0x88}], 0x1}, 0x0) writev(r1, &(0x7f0000000700), 0x100000000000000d) r2 = accept4$x25(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)=0x12, 0x100400) sendto$x25(r2, &(0x7f00000001c0)='z_w:', 0x4, 0x40000, 0x0, 0x0) [ 210.609108] audit: type=1400 audit(1570347135.379:46): avc: denied { map } for pid=7586 comm="syz-executor.4" path="/dev/loop0" dev="devtmpfs" ino=605 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=1 07:32:15 executing program 5: perf_event_open(&(0x7f0000000680)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f00000001c0)='/dev/nbd#\x00', 0x0, 0x0) r2 = syz_open_dev$ndb(0x0, 0x0, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_SET_SIZE_BLOCKS(r2, 0xab07, 0x7) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) ioctl$NBD_CLEAR_SOCK(r2, 0xab03) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000200)=ANY=[@ANYBLOB="000000000000000002004e23ac14141b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000002004e21ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000047fd30fb109c0ff3092c7ecfd246da9a438df5d809d4e8f194d5f057c41a531f4e54b082eca4b77586f68f8f03c632e2b7c79382cdaf9f50c0ec7f"], 0x190) syz_open_dev$ndb(0x0, 0x0, 0x0) pipe(0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) close(0xffffffffffffffff) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) socket$l2tp(0x18, 0x1, 0x1) r3 = syz_open_dev$dspn(0x0, 0xd911, 0x40000) bind$alg(r3, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) connect$l2tp(0xffffffffffffffff, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x40087708, &(0x7f0000000440)='\x00\x00\x03\x00\x00\x00\x00\x05\x00x\x92\x12\xbc\x06^\xbewV\xf3\xb3\xa4e\xfb\xc5}\x9c\"\xc4\x04\xbb\x0642\x9c\x1a\xd1\xcb{\xb0\xd6\x1e\x00gQ\xca\x0eU\xf7\'\x8c\xc1\xc6\xbb\xc5\x1c\xf7\xaf\x95\x83=\t7\x96\x1a\xad\xd0\xd0\xee\x9c\x962\bu\xba\xfc\xae\xc2\x19\xeb\x91\xc9\t\xbc\xc1\xcb\xba\xe3\x8e\xf6\x89\xc2\'\xdfn(Q=v-<\r\xd1?$\x8b\x17Bn\x17h\x1b\xac\xfc\x82\x1c\xf4\xd0\xf5\xd5\x80\xc0\xb4a \x15\x9a\x9f\xf0:\xfd$\xad\xbb\x9a|b\xe2\xff\xee\xc4\x93Q\x82\x16\xbf\xe3c\x8d \x0f\xb1\xe9\xf2oci(\xcb\x82\x05\xfe[H\xaf\x01\x18\xc8\x1b\x1e\xbe\xd8>\xec\x9f~\xa7\xf7\xafdd\xf1\xdbjE\x01\xd1sD\x89\x94&\\U\f\x18\x99]\xaba\xe93\x01\xa23\xc9hP1\xdc-\'\xd0\x9e}\x89\xff\x8c') 07:32:15 executing program 2: openat$uinput(0xffffffffffffff9c, &(0x7f0000000680)='/dev/uinput\x00', 0x4000000000000000, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYBLOB="020700090200000000000000000000000021475a2adeaf3e4301889c91de072b67845e1a9daa204ac1c96c47fbea02d3869fceed860e6c97da3254b1cad7cb694664a56d53e150ce9f992673000000000000007e434dd334c740ed6ecaf67bf3626c2c892ad223dc94781e84c8fcae4547822f088407759a41d340000000000000000ac96fc9a04eccb11adc59ba6fafdeac32445119ada8afd12dbc2b805c5339be4c202b0ff1deb2ff5a1e89cdcebcf887eb6fb7c751de4eecbb6aaa3a4b1905e66f705b295da1e63bfe4f1b3574709269ef61022262e27d0ffc687633d226c14c829140a53e5cc3dc31da8a0ed1dbd75d2973dc204acbb4a381ef7c9c300185184299e4d73752e04fc336f23939842101638a704c4030d40c4cb7683f771fe3f11274f5d0ff9c9b5297de5a2ad9ff1668c62218381c8894803f7a651867"], 0x10}}, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x81) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000380)={{{@in6, @in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x0, 0x1, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x6e6bbc, 0x1, 0x1}, {{@in=@loopback, 0x0, 0x33}, 0x0, @in6=@local, 0x0, 0x0, 0x0, 0x6}}, 0xe8) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2) ioctl$TIOCLINUX3(r1, 0x541c, &(0x7f0000000240)) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) lsetxattr$trusted_overlay_origin(&(0x7f0000000100)='./file1\x00', &(0x7f0000000140)='trusted.overlay.origin\x00', &(0x7f0000000240)='y\x00', 0x2, 0x1) sendmmsg(r0, &(0x7f0000007e00), 0x400000000000058, 0x0) 07:32:15 executing program 0: r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f00000000c0)={0x10, 0x4, 0x4, 0x4, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x3c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000c88000)={r0, &(0x7f0000847f95), 0x0}, 0xfffffffffffffffa) [ 211.179811] audit: type=1400 audit(1570347135.979:47): avc: denied { map_create } for pid=7622 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 [ 211.235681] block nbd5: Receive control failed (result -22) [ 211.262064] audit: type=1400 audit(1570347136.059:48): avc: denied { map_read map_write } for pid=7622 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 [ 211.292914] block nbd5: Attempted send on invalid socket [ 211.298572] block nbd5: shutting down sockets [ 211.303366] print_req_error: I/O error, dev nbd5, sector 0 [ 211.309244] Buffer I/O error on dev nbd5, logical block 0, async page read [ 211.325567] print_req_error: I/O error, dev nbd5, sector 2 [ 211.331248] Buffer I/O error on dev nbd5, logical block 1, async page read [ 211.338952] print_req_error: I/O error, dev nbd5, sector 4 [ 211.345248] Buffer I/O error on dev nbd5, logical block 2, async page read [ 211.355973] print_req_error: I/O error, dev nbd5, sector 6 [ 211.361645] Buffer I/O error on dev nbd5, logical block 3, async page read [ 211.369445] print_req_error: I/O error, dev nbd5, sector 0 [ 211.375191] Buffer I/O error on dev nbd5, logical block 0, async page read [ 211.382878] print_req_error: I/O error, dev nbd5, sector 2 [ 211.388610] Buffer I/O error on dev nbd5, logical block 1, async page read [ 211.396415] print_req_error: I/O error, dev nbd5, sector 4 [ 211.402076] Buffer I/O error on dev nbd5, logical block 2, async page read [ 211.415780] print_req_error: I/O error, dev nbd5, sector 6 [ 211.421471] Buffer I/O error on dev nbd5, logical block 3, async page read [ 211.431000] print_req_error: I/O error, dev nbd5, sector 0 [ 211.436732] Buffer I/O error on dev nbd5, logical block 0, async page read [ 211.444260] print_req_error: I/O error, dev nbd5, sector 2 [ 211.450001] Buffer I/O error on dev nbd5, logical block 1, async page read [ 211.469240] ldm_validate_partition_table(): Disk read failed. [ 211.503599] Dev nbd5: unable to read RDB block 0 [ 211.521481] nbd5: unable to read partition table [ 211.531858] nbd5: partition table beyond EOD, truncated 07:32:16 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cpuset.effective_mems\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e21, 0x33780000, @remote, 0x20}}, 0x80, 0x4}, &(0x7f0000000380)=0x90) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000003c0)={r1, 0xe90f}, 0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r3, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f00000005c0)={0x6, 0x5}, 0x2) prctl$PR_GET_DUMPABLE(0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x2, 0x0, "8b63e98a6e9a990ceacccaa0722f7b17adbfb251c09e5993d319d88199f6923e646c1d3eaad49bc3c0a86bd1683c51ec36b5d2dab5a220e04e0b20637e2b5a8dd3403bbe1ccf681d083e2307d3f5597b"}, 0xd8) sendto$inet6(r4, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ftruncate(r5, 0x2081ff) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='wlan0&\x00', r5}, 0x10) r7 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000180)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r7, 0x80008) keyctl$describe(0xb, r7, 0x0, 0x0) ioctl$FITRIM(r6, 0xc0185879, &(0x7f0000000140)={0x2, 0xca, 0x2}) keyctl$read(0xb, r7, &(0x7f0000000080)=""/170, 0xaa) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000400)={&(0x7f0000734000/0x2000)=nil, 0x2000}, &(0x7f00000004c0)=0x10) ioctl$sock_proto_private(r4, 0x89e9, &(0x7f0000000500)="c50368a3110883940c5c68d254d1926dde458475a0a638d843925e2097e15689efe3e5f633adba4531d4e691926f0e9ee73b3b0a14b053cbaa819ca5e1f963d8cd9e266c1fb7f3960ecadf1becb15ccfc24e254dbbbfdcc93702dfca6ea0bef303514ee9eca5e285498850659656558d65582a4da97aaa36a4bee3af5e95858eab523854531453aea51d8e15d82762d8583cb1e2d2221c6824e0d790c58ae15e54a8ca32") mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) mmap(&(0x7f0000000000/0xddf000)=nil, 0xddf000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 07:32:16 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) sendto$unix(r4, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000001, 0x12, r5, 0x1) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f00000001c0)={@in, 0x0, 0x5, 0x0, "9527eb1fe4a70061631dce40540ea584dc670e8a5b346583b4b9fd983552f8df14ee9ef7112f35b7d06988ac8f9131a1d9718dde8c44f8ab9d20c6894f2929496f17cef927115402414625e9abc4eb6a"}, 0xd8) setsockopt$inet_mtu(r5, 0x0, 0xa, &(0x7f0000000500)=0x5, 0x4) sendto$inet(r5, 0x0, 0x0, 0x20000801, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) r6 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbcf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r7 = dup2(r5, r6) write$cgroup_type(r7, &(0x7f0000000080)='threaded\x00', 0xffeb) r8 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = fcntl$dupfd(r9, 0x0, r9) ioctl$PERF_EVENT_IOC_ENABLE(r10, 0x8912, 0x400200) r11 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r11, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r10, r11) fcntl$dupfd(r11, 0x0, r8) ioctl$SNDRV_TIMER_IOCTL_SELECT(r8, 0x40345410, &(0x7f0000000200)={{0x0, 0x1, 0x5, 0xb84390527c722fa0, 0xfffffffc}}) recvmsg$kcm(r4, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e22, 0x3, @dev={0xfe, 0x80, [], 0x12}, 0x5}}, 0xb9b, 0x3ff}, &(0x7f00000003c0)=0x90) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x70, &(0x7f0000000280)={r12, @in6={{0xa, 0x4e20, 0x80000000, @local, 0x316}}, [0x7, 0xffff, 0x40, 0x4da, 0x0, 0x7, 0x8001, 0x10001, 0x0, 0x300000000, 0x100000000, 0x0, 0x2, 0x1, 0x401]}, &(0x7f0000000380)=0x100) r13 = socket$inet(0x10, 0x3, 0xc) syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x7fff, 0x101000) sendmsg(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="24000000080107031dfffd946fa2830020200a0009000200001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 07:32:16 executing program 0: setxattr$security_ima(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.ima\x00', &(0x7f0000000100)=@v2={0x0, 0x1, 0x0, 0x40, 0x51, "1fc348affe1e7eab45b9c0606fe50d58d8fcc0e848f35524009233a0ce43c128eeed2cb1f05da9b1e85b9ca85f55cbb8e2d45e30f5852c817cb983b52820133d3632e4901dde635f653338bb441dd691da"}, 0x5b, 0x2) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000480)="390000001300090468fe0700000000000000ff3f03000000450001070000001419002b000a00040014a4e91ee438d2fd000000000000006e00", 0x39}], 0x1) 07:32:16 executing program 4: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) bind$inet6(r0, &(0x7f0000000600)={0xa, 0x4e20, 0x80000, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x8080, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f00000000c0)={0xffffffffffffffff, r1}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x0) sendto$unix(r4, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r4, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x13, &(0x7f0000000080)=0x4, 0x4) setsockopt$inet_tcp_int(r1, 0x6, 0x18, &(0x7f0000000000)=0xffffffff, 0xfffffffffffffd51) r5 = open(&(0x7f0000000240)='./bus\x00', 0x100000141042, 0x0) ftruncate(r5, 0x10099b7) r6 = syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x101, 0x200000) sendfile(r0, r6, 0x0, 0x8000fffffffe) connect$unix(r1, &(0x7f0000000400)=@abs, 0x6e) 07:32:16 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x20000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioprio_set$pid(0x2, 0x0, 0x0) r0 = mq_open(&(0x7f0000001380)='eth0\x00', 0x42, 0x0, 0x0) mq_timedsend(r0, 0x0, 0x0, 0x0, 0x0) mq_timedsend(r0, 0x0, 0x0, 0xc0, 0x0) close(r0) mq_unlink(0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) getsockopt$inet_mreqn(r1, 0x0, 0x52, 0x0, 0x0) clone(0x80000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_SYNC(0xffffffffffffffff, 0x4) ioctl$RTC_ALM_READ(0xffffffffffffffff, 0x80247008, 0x0) 07:32:16 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) ioctl$KVM_GET_MP_STATE(0xffffffffffffffff, 0x8004ae98, &(0x7f0000000140)) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r3, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) bind$isdn_base(r3, &(0x7f0000000000)={0x22, 0xe0, 0x1f, 0x7, 0x6}, 0x6) r4 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000100)={0x2, 0x0, 0x0, @ipv4={[], [], @broadcast}}, 0x1c) [ 211.774275] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 211.800987] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 211.815089] netlink: 9 bytes leftover after parsing attributes in process `syz-executor.0'. [ 211.837648] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 211.848818] netlink: 9 bytes leftover after parsing attributes in process `syz-executor.0'. 07:32:16 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0xc}}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xf6, 0x5, 0x2, 0x7, 0x0, 0x0, 0x800, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000, 0x6, @perf_config_ext={0xffffffffffffffff, 0x3f}, 0x10, 0xf9, 0x400, 0x8, 0x200, 0x3, 0x3}, 0x0, 0x5, r0, 0x1) syz_emit_ethernet(0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaa5aaaaaaaaaaaaaaaaaa86dd6007000000142c00fe8000000000001af6f775c3e78a9a11232dbaf3071717f850a0b2c8b73c8f94840ddc7c2b7b3ea7de502efbe4a02bb67476f562b26ffdd23a237731b2869f6fbb26364b4bb7ade34474521a1a2e1ecd172f732d4900d8b69ff8c30d148ac69fbc803668858e47e5996adc3990442281f22792f92c8011bf812e95ea82a6f43365d3fa01db8e45e829da7a55af868ea27eca0231bc9a5f7f1894c0dfcfe8515f31a7aee13ec101301381745d931063cfcc3054a9b3e44c1a6079d1ec42601fe2454991a735c08018b8b3d39585da7b9ea7ebffed838b42861c9218746359c75f855477757dd71d0b74cb1b05c0496f4b50e8992d3ae6ea76a7d0020cd0828c945d", @ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000007c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)=ANY=[@ANYBLOB="8b800408", @ANYRES16=r3, @ANYBLOB="010027bd7000fbdbdf250a000000080005004000000028000100080001007f7300000800080081ffffff14000300ff02000000000000000000000000000108000400ff010000080005003f000000"], 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000800) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000001, 0x12, r4, 0x1) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000001c0)={@in, 0x0, 0x5, 0x0, "9527eb1fe4a70061631dce40540ea584dc670e8a5b346583b4b9fd983552f8df14ee9ef7112f35b7d06988ac8f9131a1d9718dde8c44f8ab9d20c6894f2929496f17cef927115402414625e9abc4eb6a"}, 0xd8) setsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f0000000500)=0x5, 0x4) sendto$inet(r4, 0x0, 0x0, 0x20000801, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) r5 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbcf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r6 = dup2(r4, r5) write$cgroup_type(r6, &(0x7f0000000080)='threaded\x00', 0xffeb) ioctl$RTC_AIE_OFF(r6, 0x7002) ioctl$FITRIM(r2, 0xc0185879, &(0x7f0000000040)={0x0, 0x80000000}) unshare(0x12040400) openat$zero(0xffffffffffffff9c, &(0x7f0000000940)='/dev/zero\x00', 0x301200, 0x0) syz_mount_image$ceph(&(0x7f00000001c0)='ceph\x00', &(0x7f00000003c0)='./file1\x00', 0x0, 0x4, &(0x7f00000006c0)=[{&(0x7f0000000400)="57ef639e8a0e8e6e665336ac4384963c9a56898ef92a5b44f64633b48f751f2b9ab47e270d7de059d829da339cd57662d8c9c876089d8a902ccf84d7114725d0d81a581fc07b629b1705e865c8981be54c3e3b5203c263e45b9baf3035d9987af747512d2cc1dd97c64d7e973e9417691b7b5fad9834ef0184a78b37b99cccf215cdfabe5f311bc68acf09aec0752391ab61725b375ecd4789", 0x99, 0x238}, {&(0x7f00000004c0)="8143379485bc9caba9ab0307907d9df7f3fb371a9edeb6a92f68cc14525ebc0301b4464d9f86adf8edf6826a28c1e405a9654debfc21bf23e0b634300021563b50d1813cf416c250a1d5053da4e6c4b1071fbb725d5153ce3479f824ad311f1ae4fc37ff9eac1baf038b5c625100aa3057bfc9a3c1dc446a5375bb16c578f8ed452e0656903d2407a502ad69ff5823880c1dac75014a63ec37395cff61a8587f2a61a867ff9097624e779da2d39f8117ebc8d88920de6b8f80826e4cd6e92dbc8310ec42bffab0725cd744867e9ff7146d11ac10f3b964a3e51484487698b5b610b7161b21e10a1d872cb181dcc2b38e4ac57808f021", 0xf6, 0x4}, {&(0x7f00000005c0)="b44a3eda50e7520f0e2150afb85fb05c4b24eef2b3261635e1eedf3c6e290922ce9f3b356869397b4d625ae5c42a79", 0x2f, 0x3}, {&(0x7f0000000600)="f5de3b8cca9aa586cc07b57376924a9155cb31d44138e2bc64205a485e76f1e0fe81c86e8a6b9a33f76df1bb6a43d8cec902926901a7dc07ff2a339ab1d69a9cebc0661c8938665345cc3a9dbff9fae77d5641f2bf3371aebc1e2f750f65bae04749a175141266093c5ef36a32b08271f5f11b5c3767dac6d361d7092dd2aff184f81893c16a7f9036fac2031fa2f95746ef731417d30518aae62d73bbb6ad6b3139052e6402d1f76f20321e1f22ebf106e9", 0xb2, 0x8}], 0x1000, &(0x7f0000000740)='\x00') r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000001, 0x12, r8, 0x1) bind$inet(r8, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r8, 0x6, 0xe, &(0x7f00000001c0)={@in, 0x0, 0x5, 0x0, "9527eb1fe4a70061631dce40540ea584dc670e8a5b346583b4b9fd983552f8df14ee9ef7112f35b7d06988ac8f9131a1d9718dde8c44f8ab9d20c6894f2929496f17cef927115402414625e9abc4eb6a"}, 0xd8) setsockopt$inet_mtu(r8, 0x0, 0xa, &(0x7f0000000500)=0x5, 0x4) sendto$inet(r8, 0x0, 0x0, 0x20000801, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) r9 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbcf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$SO_BINDTODEVICE(r8, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r10 = dup2(r8, r9) write$cgroup_type(r10, &(0x7f0000000080)='threaded\x00', 0xffeb) ioctl$VIDIOC_QUERYBUF(r10, 0xc0585609, &(0x7f00000009c0)={0x97, 0x3, 0x4, 0x400, {0x77359400}, {0x2, 0x0, 0x8, 0x4, 0x40, 0x7, "05797cf5"}, 0x1, 0x1, @planes=&(0x7f0000000980)={0x4, 0xed1, @userptr=0x1, 0x3f}, 0x4}) r11 = openat$audio(0xffffffffffffff9c, &(0x7f0000000900)='/dev/audio\x00', 0x2002, 0x0) ioctl$UI_SET_MSCBIT(r11, 0x40045568, 0x27) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000340)={'ip6_vti0\x00', &(0x7f0000000a40)=ANY=[@ANYBLOB="6bac013a0800000000000000090000fffa03084f09000000fbffffff01800904d63e43257f00000029856614cd8c8c6b6545cb589829f5957a0d120c9a7cdbed312e4e9eef3e40d311f187942fbbab833eb972556622dfc584efac1507abbd49c69e206dbc4ca9713049184167522b0ecee4bd6a43ee6bdbef711f87d7c597fbb8d5b09015e4be19019bea3e822b079635bac7d8e5e179c346950e550629bf2edd7727702e0c1ef11198d53ff8b1bf2e586a14d426f4a58a9b921308ad1ee158e5a96b7ddfbd3824e2efa12e0a68d73eb188f2"]}) ioctl$FITRIM(r7, 0xc0185879, &(0x7f0000000040)) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r7, 0x84, 0x15, 0x0, 0x0) ioctl$SG_SET_TIMEOUT(r7, 0x2201, &(0x7f0000000380)) 07:32:16 executing program 4: r0 = fcntl$getown(0xffffffffffffffff, 0x9) syz_open_procfs(r0, &(0x7f0000000140)) r1 = syz_open_procfs(r0, &(0x7f00000002c0)='net/raw6\x00HT\xf4\xfa\x92\xcaH\x1ci\xccui\x13W}9\x00ah\xde\x84\xf0\xbdU\x96\xbd11=*w\x81\x8d\x1c\x82\x04\x99n\xdf\xbcD\xe6{\t\x04\xaf\x92W\x00\xe4wt&\xff-\xae\x19\x9b\x97\nS\xe5\xafu_s\xf6\xf7\x14P\a\xe3\xc0\xed\xe28F/S\xcc\xcc\xeae\r\x97Z\xd1Q0\xa8Aj\x15\xaf\xf0\xc96bJ\xeeH%\x0f=\x01\x82\xf00\x9bE!\x9e\xbf\x12w\xcb\xc1\xd0\xf1*\xf9\xe7\xc7\xd3uI\x1c#\xfa\x92\x95\xca\xd6\xa39\xd1\xf0g\xe2!\f\\;qO\x97\xce\xcc\xbcU\xadLR\xf5 \xb0\xe8\x00'/176) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x249, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r6, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r5, r6) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r5, 0xc0bc5310, &(0x7f00000000c0)) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x4800) 07:32:16 executing program 3: bind$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e23}, 0x1c) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) listen(0xffffffffffffffff, 0x10001) io_setup(0x8001, &(0x7f0000000000)) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000380)='/dev/uinput\x00', 0x802, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f00000003c0)={0x0, 0x3, 0xa960, 0x5}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r4, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r2, r4) ioctl$KDSKBMETA(r2, 0x4b63, &(0x7f0000000200)=0x8) setsockopt$sock_int(r0, 0x1, 0x9, &(0x7f00000000c0)=0x3, 0x4) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0xc800) ioctl$VHOST_SET_LOG_BASE(r5, 0x4008af04, &(0x7f0000000180)=&(0x7f0000000140)) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) sendto$unix(r7, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r7, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r7, 0x0, 0x10, &(0x7f0000000480)={{{@in6=@mcast2, @in6=@initdev}}, {{@in6=@local}, 0x0, @in6=@empty}}, &(0x7f0000000580)=0xfffffffffffffe2b) r8 = syz_open_procfs(0x0, &(0x7f0000000400)='net/tcp\x00\xcdWq\xe9*\a4g\a^\x90\xb6\xe4kH2\x80/\x88\xb6\xbb\xeb`\xb8@#\x83tH\xae\xa4y\x1d\\]\x93\x93\xb5e\xd9\xd4\xb8A# \xc8*s\xd0g>\x16\xabM\x7foK\xec\x17f\xb9x\x11\xbf\xab\x16\xc5\xcb\x94\xff\x1c\xa0\x01\xb3I\x1c\xb9\xcc\xbb\xbe\x9c\xd0!\x13\xe1\xbc.\xfaG3\x85\xe0,') sendfile(r0, r8, 0x0, 0x80000003) 07:32:17 executing program 2: fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_cancel(0x0, 0x0, 0x0) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000001500)=ANY=[], 0x0) modify_ldt$write2(0x11, &(0x7f00000000c0)={0x4, 0x20000800, 0x2000, 0xfffffffffffffffe, 0x0, 0x0, 0x100, 0x0, 0x3}, 0x10) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x1780, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x0, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r0, 0x0) write$P9_RWALK(r0, &(0x7f00000003c0)=ANY=[@ANYRES64], 0x8) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x28812, r0, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r0, r1) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000001, 0x12, r2, 0x1) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f00000001c0)={@in, 0x0, 0x5, 0x0, "9527eb1fe4a70061631dce40540ea584dc670e8a5b346583b4b9fd983552f8df14ee9ef7112f35b7d06988ac8f9131a1d9718dde8c44f8ab9d20c6894f2929496f17cef927115402414625e9abc4eb6a"}, 0xd8) setsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000500)=0x5, 0x4) sendto$inet(r2, 0x0, 0x0, 0x20000801, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) r3 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbcf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r4 = dup2(r2, r3) write$cgroup_type(r4, &(0x7f0000000080)='threaded\x00', 0xffeb) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r6 = accept4(r5, 0x0, 0x0, 0x0) sendto$unix(r6, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r6, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r6, 0x29, 0x22, &(0x7f0000000200)={{{@in6=@initdev, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000040)=0xe8) getresgid(&(0x7f0000000080), &(0x7f0000000100)=0x0, &(0x7f0000000140)) write$P9_RGETATTR(r4, &(0x7f0000000300)={0xa0, 0x19, 0x2, {0x100, {0x80, 0x4, 0x1}, 0x0, r7, r8, 0x8, 0x3f, 0xd00b, 0x100000000, 0x400, 0x3, 0x9, 0x2, 0x5, 0x4, 0x5, 0x8, 0x2, 0x8, 0x10000}}, 0xa0) 07:32:17 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x8000000000000010, 0x0, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRES16], 0x1}, 0x1, 0xfdffffff00000000, 0x0, 0x80d4}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000090703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000000e87d60b7030000000000000000000000000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r3, 0x18000000000002a0, 0xe80, 0x0, &(0x7f00000000c0)="b9ff0300000d698cb89e40f086dd01000005a4004000ffa377fbac14140ce9", 0x0, 0x100}, 0x28) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) dup(r3) 07:32:17 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x80022, 0x0) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, &(0x7f0000000080)={0x1, 0x50}, 0x2) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x40}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r4, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r3, r4) fcntl$dupfd(r4, 0x0, r1) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f0000000000)='syz1\x00') ioctl$VIDIOC_G_OUTPUT(0xffffffffffffffff, 0x8004562e, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) connect$inet6(r5, &(0x7f0000d83fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x3ff, 0x20000) 07:32:17 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cpuset.effective_mems\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e21, 0x33780000, @remote, 0x20}}, 0x80, 0x4}, &(0x7f0000000380)=0x90) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000003c0)={r1, 0xe90f}, 0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r3, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f00000005c0)={0x6, 0x5}, 0x2) prctl$PR_GET_DUMPABLE(0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x2, 0x0, "8b63e98a6e9a990ceacccaa0722f7b17adbfb251c09e5993d319d88199f6923e646c1d3eaad49bc3c0a86bd1683c51ec36b5d2dab5a220e04e0b20637e2b5a8dd3403bbe1ccf681d083e2307d3f5597b"}, 0xd8) sendto$inet6(r4, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ftruncate(r5, 0x2081ff) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='wlan0&\x00', r5}, 0x10) r7 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000180)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r7, 0x80008) keyctl$describe(0xb, r7, 0x0, 0x0) ioctl$FITRIM(r6, 0xc0185879, &(0x7f0000000140)={0x2, 0xca, 0x2}) keyctl$read(0xb, r7, &(0x7f0000000080)=""/170, 0xaa) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000400)={&(0x7f0000734000/0x2000)=nil, 0x2000}, &(0x7f00000004c0)=0x10) ioctl$sock_proto_private(r4, 0x89e9, &(0x7f0000000500)="c50368a3110883940c5c68d254d1926dde458475a0a638d843925e2097e15689efe3e5f633adba4531d4e691926f0e9ee73b3b0a14b053cbaa819ca5e1f963d8cd9e266c1fb7f3960ecadf1becb15ccfc24e254dbbbfdcc93702dfca6ea0bef303514ee9eca5e285498850659656558d65582a4da97aaa36a4bee3af5e95858eab523854531453aea51d8e15d82762d8583cb1e2d2221c6824e0d790c58ae15e54a8ca32") mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) mmap(&(0x7f0000000000/0xddf000)=nil, 0xddf000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 07:32:17 executing program 4: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r3, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r2, r3) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_ONE_REG(r4, 0x4010aeac, &(0x7f0000000000)={0x100000000, 0x8}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) clone(0x4000000000407fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) 07:32:17 executing program 5: sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x1014d}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000980)=ANY=[@ANYBLOB="020100021000000000000600000000000800130040ffff400000cfa82be90000e592c35c260cf3390000800000000000e0000001df00000000000000000035000000000000000100000e02ff00000000030006000000000002000004000000bb0000e000000000000300050000000000e70040000000e0c0038446bdeba4580f7d73f9910b1b49140d94ecda0ca68eedd5ea506eaf7e31ab65b8c11d6d27d1dc583ebd6bc7dfcac2b3fdbbff0b229920db0080000000bd6454c6288a42599dcc440b8f088607cecd801df8aed31f0100f0c8cac0b1b82696908d1176f54f734f3b8f0c5d86587031ce112345af849454a7b28c4d69d0000102c12b5a149322a02ccf02ce0c04c460acfd55f3d599e5f508e5085946cf4998746fcad4aed4897ed0c9d3b7e3fbc715d4661b53d06a2935277de5d89429a513181e14b807e64550574d1c97507829e041dbdbb7f5d5dc562aaa3f8bf10f93749e67d91d7e28607086f821d99d049a6708e4b2a6280469dcef00e2000000000000000000000085b3b542bb5caceca36d827c2ccb92e95dbadf069c518afe7bbe51faa2facfbe4fd77ff3e2acb0b4740eb0c9117ebdfaee21323cbd12fd94d96736554216b20816fe87afa11ad2853aba1fe81decc1e9f213fe042c68919a9e972ab698000000e9bae61107e8fe5a764dcd807616c6565192531b8501339d9ba34e83020799fb2250f0e482cf08515e013a71034904812ceed0bdbab7f15d8a3e59ea5f7adb27daad4c2f5af22ee5b0104ba1fa2a317a065e91e280f188dd561697ef46ad6e1287248478c660cc649bab6e131a2ccae5b96daca9040b3e1fd7e6924164c699340bb448f7518f4f4d8c7e2df3fa4cfaa50bc3df77ea77c7c2e02092dda1a517bc8a1ea47002d2fae38aae31412ba56e005fbfa66bc91d5aa146f7d30075a0d82170dd820437e4c8d0c39799b9f75e91dd6bef024e29b21d67814235c8ed80eab23abe346313308dd47fd2f829f8ed6385dd50d51567f1ed2feac04446b5f9a791f874a7e669531202a8f1de7f2921099caa739ffb6cbd461e187a6fc6bfae91649720076dd48feda6d80eb9b1bd80d4c9a6e0e7434ad45503d07193c55490ce"], 0x80}}, 0x0) r0 = socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = syz_open_dev$media(&(0x7f00000000c0)='/dev/media#\x00', 0x7ff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000200)={{{@in6=@remote, @in6=@ipv4={[], [], @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@empty}}, &(0x7f0000000100)=0xe8) r3 = add_key$user(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x2}, &(0x7f00000005c0)="4acf665ff77df4f20690a5a83bc1a1e6519321db1dc2bf7eee06d978abdfbb33f3bc7025e6befda3c827875946eb75c14639ab6e76811a733653f72afc34e5fce1bed277a8faa02e6da16041b40bab677d6555e94a42b7ac236c8c35d729ac501cf28293c919f2f3ceec4703c892adeac90504aeb3ba485e09bda66d2b96124cabc4d2e653848e2bd909287d0d2c433d72bbd4333cf37f2a8972bba453c776d2c73c61b9fa2153405fc0253992c918682c7018f6a280a9ff312ae4a6996bd9547aed66e72f94342a7d27b9483f7e2e8e3c5bbb89452fd9bb6708ae89ba29", 0xde, 0xfffffffffffffffe) lstat(&(0x7f0000000700)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000400), &(0x7f0000000540), &(0x7f00000006c0)=0x0) r6 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x1000, 0x90100) ioctl$BLKRESETZONE(r6, 0x40101283, &(0x7f0000000440)={0x8, 0x9}) keyctl$chown(0x4, r3, r4, r5) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x40000, &(0x7f0000000780)=ANY=[@ANYBLOB="6621b8589e499af0c9020be77c4c3c2382bd0dd08467ecd3e56190a5276c0fea1dc8ce00e24629ac8c5dfc058b7e2ef49f815df5c1b45c5bf7620e1804c317043d2dd0326d2eb94ee72a84cf53386d4b0e7642b17b4484bf229f0d3638d5d1eb5bf6a39d10e5f4c8fd95124d552a4339d25e259600000000000037e480edfa5bcb5ba28724332dea903ac00db867351b2760cc2048ab873e213268447b445c7ae35c0614dd636ce7d460172724cf06e3dc88bfe9de999826", @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000140000,user_id=', @ANYRESDEC=r2, @ANYBLOB=',group_id=', @ANYRESDEC=r5, @ANYBLOB=',blksize=0x0000000000000a00,default_permissions,default_permissions,default_permissions,default_permissions,blksize=0x0000000000000c00,max_read=0x00000000ffffffff,default_permissions,\x00']) socket$can_raw(0x1d, 0x3, 0x1) sendmmsg(r0, &(0x7f0000000180), 0x400000000000117, 0x0) 07:32:17 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r6, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r5, r6) r7 = fcntl$dupfd(r6, 0x0, r3) shutdown(r7, 0x0) write$UHID_CREATE(r7, &(0x7f00000002c0)={0x0, 'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000280)=""/38, 0x26, 0x3ad, 0x1f, 0x6, 0xda, 0x80000001}, 0xfffffffffffffcd7) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r11, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000848aaf2f6eb2993a15a8ec45991c100e1817086f00eb35e70a1ad0d362b47b8c8ff683a2d82e0cf4df0b8c4cb48360dc0b8cb043599c9c4f504e0fa4e7a34d1f70f46ea1e1024632d140980dc29eeff367ec3e89f4a4c20de9609e37f2f84b0d398c27cbd8043c113a7b335e322c5ac0bd6cdc3bf3bfc863823d12b4a809c33b8639d7e3267c909fb647903296de60d3339ef0191106e0691a792ad9dfe644c6cc55acf4702e2149cf37744b7146dd4f70148779a55ac648323648c6fd0f39d07e3d5d936f0b95a5"], 0x48}}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x507, 0x0, 0x0, {0x0, r11, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8, 0x1, 'sfb\x00'}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28}}}]}, 0x58}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x507, 0x0, 0x0, {0x0, r11, {}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8, 0x1, 'sfb\x00'}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28}}}]}, 0x58}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x364, &(0x7f0000000200)={&(0x7f0000000000)=@ipv4_getnetconf={0x24, 0x52, 0x4, 0x70bd2b, 0x25dfdbfc, {}, [@NETCONFA_FORWARDING={0x8, 0x2, 0x7fffffff}, @NETCONFA_PROXY_NEIGH={0x0, 0x5, 0x3}]}, 0x24}}, 0x0) r13 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0) r14 = socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r14, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r15, 0x105, 0x0, 0x0, {{}, 0x0, 0x4102, 0x0, {0x2, 0x13, @udp='udp:syz1\x00'}}}, 0x2c}}, 0x0) sendmsg$TIPC_CMD_GET_NETID(r13, &(0x7f00000001c0)={&(0x7f0000000100), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r15, 0x200, 0x70bd2b, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4001809}, 0xc05200b) 07:32:17 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) chmod(&(0x7f0000000140)='./file0\x00', 0x10) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f00000000c0)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x4c6]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xe, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) fallocate(r0, 0x20, 0x1ff, 0x9) [ 213.116033] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. 07:32:18 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000100)=ANY=[@ANYBLOB="a9802974394f6814037e0dcf08503cf469920352baad490b5fa4d92f64f6ac7fa20b7919ffc4c1083dbb76c2e60c866d88dd1dc315eb2ec051667bd2f49d3e2a051940fb2aff070000dd42657b9fbb0e"], 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, 0x0, 0x0) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r3, &(0x7f0000000200)={&(0x7f0000000080)=@sco, 0x670d, &(0x7f0000000580)=[{&(0x7f0000000380)=""/143, 0x8f}], 0x392, 0x0, 0xfffffffffffffea8}, 0x40000000) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x0) sendto$unix(r5, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r5, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) sendto$unix(r7, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r7, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r9 = accept4(r8, 0x0, 0x0, 0x0) sendto$unix(r9, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r9, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) r10 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000480)='/dev/dlm_plock\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r10, 0x84, 0x77, 0x0, 0x0) geteuid() setresgid(0x0, 0x0, 0x0) syz_init_net_socket$ax25(0x3, 0x0, 0x0) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x6, 0x0, 0x0) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x6, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) signalfd(0xffffffffffffffff, 0x0, 0x0) fstat(r0, 0x0) gettid() getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x6, 0x0, 0x0) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x0, 0x0, 0x0) syz_init_net_socket$ax25(0x3, 0x0, 0x0) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x0, 0x0, &(0x7f0000000040)) socket$isdn_base(0x22, 0x3, 0x0) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, 0x0, &(0x7f0000000280)) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, 0x0) dup(0xffffffffffffffff) recvfrom$unix(0xffffffffffffffff, &(0x7f00000002c0)=""/129, 0x81, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) signalfd(0xffffffffffffffff, 0x0, 0x0) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x0, 0x0, 0x0) fstat(0xffffffffffffffff, 0x0) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) getpid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0) r11 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) getdents(r11, &(0x7f00000005c0)=""/223, 0xfc61) 07:32:18 executing program 3: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r3, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r2, r3) fcntl$dupfd(r3, 0x0, r0) ioctl$BLKRRPART(r0, 0x125f, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=@framed={{0xffffffb7, 0xa, 0x0, 0x0, 0x0, 0xffffffcf}, [@ldst={0x7}]}, &(0x7f0000003ff6)='OPL\x00', 0x1, 0xff06, &(0x7f000000cf3d)=""/195}, 0x48) 07:32:18 executing program 2: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) close(r0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) close(r2) bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0x0, 0x0, 0x2, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffff9c}, 0x3c) setsockopt$sock_attach_bpf(r3, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000340)={0x0, 0x0}) close(r4) setsockopt$sock_attach_bpf(r5, 0x10f, 0x87, &(0x7f0000000180), 0x127) r6 = fcntl$getown(0xffffffffffffffff, 0x9) syz_open_procfs(r6, &(0x7f0000000140)) r7 = syz_open_procfs(r6, &(0x7f0000000080)='net/rt_cache\x00') sendmsg$tipc(r7, &(0x7f0000000000)={&(0x7f0000000040)=@id={0x1e, 0x3, 0x1, {0x4e21, 0x1}}, 0x10, 0x0, 0x1ba, 0x0, 0x0, 0x80}, 0x0) 07:32:18 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r3, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) ioctl$sock_rose_SIOCRSCLRRT(r3, 0x89e4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=@delneigh={0x2c, 0x1d, 0x8, 0x70bd28, 0x25dfdbfc, {0xa, 0x0, 0x0, r4, 0x20, 0x30, 0x3}, [@NDA_LINK_NETNSID={0x8, 0xa, 0x9}, @NDA_VNI={0x8, 0x7, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x44}, 0x8000020) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r4, @ANYBLOB="000000279000000024001200140001006272696467655f736c617665000000000c0005000800190002000400"], 0x44}}, 0x0) r5 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = fcntl$dupfd(r6, 0x0, r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r8, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r7, r8) fcntl$dupfd(r8, 0x0, r5) ioctl$KVM_DEASSIGN_PCI_DEVICE(r5, 0x4040ae72, &(0x7f0000000240)={0x4, 0x400, 0x6, 0x3, 0x3}) 07:32:18 executing program 2: r0 = syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0x7, 0x910400) ioctl$VFIO_IOMMU_MAP_DMA(r0, 0x3b71, &(0x7f0000000140)={0x20, 0x2, 0xfffffffffffffff8, 0x1, 0x3}) r1 = socket(0x10, 0x80002, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_emit_ethernet(0x300cce, &(0x7f0000000280)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000520600008100000086dd60b4090000b7d2000b024300800080000000ffffe0000002ff1877372b59cc692ecd0200000000000000000000000000872b83964af54f2844a7a8d4013c0090780007040060b680fa000000000000000000000000001393470e5b515cda911262948a00088e8a972fb889230c6943bdc2f8796ae97d9263bfafa58968dad75e498684b16e2d184cfe3327c51469d4ef34adab28bfde6c1e683a6506715ca16fae28332276d24941f4d76780350040a0d9ca5f7bec0511fea6cd47a889c03c91597a9cfa756c03cb72eda517913cf906597ce4bdb316c77df01c4c0a2cfce89d79b5508a9b55c2ab6f95f005acb9003950a9f0"], 0x0) mbind(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x4002, &(0x7f0000000180)=0x100000000, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x800000, &(0x7f00000001c0)=ANY=[@ANYBLOB="7472616e733d66642c7266646e6f3dac2d4ecf0bd98ba49b320149996c828a1c41d636bc4460b817104c76627ba398c9b64d94f43375bf6d8c4a4bc206405767e302e0baef70451e240eb42eca1e03c58761", @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB=',fscache,access=user,nodevmap,fscache,measure,hash,\x00']) [ 213.809934] netlink: 'syz-executor.4': attribute type 25 has an invalid length. 07:32:18 executing program 5: perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r3, 0x18000000000002a0, 0xe80, 0x0, &(0x7f00000000c0)="b9ff0300000d698cb89e40f086dd01000005a4004000ffa377fbac14140ce9", 0x0, 0x100}, 0x28) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000280)={0x0, @remote, @dev}, &(0x7f0000000300)=0xc) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000500)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], r4, 0xd, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x2}, 0x8, 0x10, &(0x7f0000000000)={0xfffffffc, 0x0, 0x0, 0x4}, 0x10}, 0x70) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r5, 0x18000000000002a0, 0xe80, 0x0, &(0x7f00000000c0)="b9ff0300000d698cb89e40f086dd01000005a4004000ffa377fbac14140ce9", 0x0, 0x100}, 0x28) write$binfmt_misc(r1, &(0x7f00000002c0)=ANY=[@ANYRESHEX=r5], 0x12) r6 = socket$inet(0x2, 0x3, 0x29) openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000001440)={0x0, 0x0, 0xfffffffffffffffe}, 0x4) lstat(&(0x7f0000000340)='./file0\x00', 0x0) ioctl$TIOCGSID(r0, 0x5429, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = fcntl$dupfd(r8, 0x0, r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) r10 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r10, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r9, r10) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x3800, 0x0) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) r12 = fcntl$dupfd(r11, 0x0, r11) ioctl$PERF_EVENT_IOC_ENABLE(r12, 0x8912, 0x400200) r13 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r13, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r12, r13) ioctl$KVM_GET_SREGS(r12, 0x8138ae83, &(0x7f0000000600)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000004e00)) stat(0x0, 0x0) bind$inet(r6, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 213.877587] netlink: 'syz-executor.4': attribute type 25 has an invalid length. 07:32:18 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x80000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) linkat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x800) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x1) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x2000}, 0x800) accept4$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, &(0x7f0000000040)=0x32a, 0x1400) r1 = socket$nl_route(0x10, 0x3, 0x0) lsetxattr$security_smack_entry(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='security.SMACK64\x00', &(0x7f0000000300)='\x00', 0x1, 0x3) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r2, 0x0, 0x5, &(0x7f0000000540)=0x7, 0x4) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000001, 0x12, r3, 0x1) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f00000001c0)={@in, 0x0, 0x5, 0x0, "9527eb1fe4a70061631dce40540ea584dc670e8a5b346583b4b9fd983552f8df14ee9ef7112f35b7d06988ac8f9131a1d9718dde8c44f8ab9d20c6894f2929496f17cef927115402414625e9abc4eb6a"}, 0xd8) setsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000500)=0x5, 0x4) sendto$inet(r3, 0x0, 0x0, 0x20000801, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) r4 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbcf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r5 = dup2(r3, r4) write$cgroup_type(r5, &(0x7f0000000080)='threaded\x00', 0xffeb) ioctl$TUNSETVNETBE(r5, 0x400454de, &(0x7f00000004c0)) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000400)='/dev/video36\x00', 0x2, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r1, 0x0, 0x480, &(0x7f0000000440), &(0x7f0000000480)=0x40) ioctl$BLKIOMIN(0xffffffffffffffff, 0x1278, &(0x7f0000000340)) setsockopt$inet6_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x2, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x40000}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') renameat2(r0, &(0x7f0000000280)='./file0\x00', r0, &(0x7f0000000380)='./file0\x00', 0x4) ioctl$PIO_FONTX(0xffffffffffffffff, 0x4b6c, 0x0) 07:32:22 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cpuset.effective_mems\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e21, 0x33780000, @remote, 0x20}}, 0x80, 0x4}, &(0x7f0000000380)=0x90) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000003c0)={r1, 0xe90f}, 0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r3, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f00000005c0)={0x6, 0x5}, 0x2) prctl$PR_GET_DUMPABLE(0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x2, 0x0, "8b63e98a6e9a990ceacccaa0722f7b17adbfb251c09e5993d319d88199f6923e646c1d3eaad49bc3c0a86bd1683c51ec36b5d2dab5a220e04e0b20637e2b5a8dd3403bbe1ccf681d083e2307d3f5597b"}, 0xd8) sendto$inet6(r4, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ftruncate(r5, 0x2081ff) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='wlan0&\x00', r5}, 0x10) r7 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000180)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r7, 0x80008) keyctl$describe(0xb, r7, 0x0, 0x0) ioctl$FITRIM(r6, 0xc0185879, &(0x7f0000000140)={0x2, 0xca, 0x2}) keyctl$read(0xb, r7, &(0x7f0000000080)=""/170, 0xaa) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000400)={&(0x7f0000734000/0x2000)=nil, 0x2000}, &(0x7f00000004c0)=0x10) ioctl$sock_proto_private(r4, 0x89e9, &(0x7f0000000500)="c50368a3110883940c5c68d254d1926dde458475a0a638d843925e2097e15689efe3e5f633adba4531d4e691926f0e9ee73b3b0a14b053cbaa819ca5e1f963d8cd9e266c1fb7f3960ecadf1becb15ccfc24e254dbbbfdcc93702dfca6ea0bef303514ee9eca5e285498850659656558d65582a4da97aaa36a4bee3af5e95858eab523854531453aea51d8e15d82762d8583cb1e2d2221c6824e0d790c58ae15e54a8ca32") mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) mmap(&(0x7f0000000000/0xddf000)=nil, 0xddf000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 07:32:22 executing program 3: r0 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(0xffffffffffffffff, 0x1d7) r1 = socket$unix(0x1, 0x2, 0x0) recvmsg(r1, &(0x7f0000000000)={0x0, 0xffffff87, 0x0, 0x0, 0x0, 0x1f0}, 0x0) setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f0000000080), 0x4) bind$unix(r1, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) write$binfmt_elf32(r1, 0x0, 0x0) ioctl$SIOCGSTAMPNS(r1, 0x8907, &(0x7f0000000140)) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_sctp(0x2, 0x801, 0x84) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) r7 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = fcntl$dupfd(r8, 0x0, r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) r10 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r10, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r9, r10) r11 = fcntl$dupfd(r10, 0x0, r7) shutdown(r11, 0x0) ioctl$SCSI_IOCTL_SYNC(r11, 0x4) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000000bfa3030000f73bf8637a0af0fff8ffffff79a4f0ff00000000b700100000ffffff2d6400000000000065040400010000400404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500"/105], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r12, 0x18000000000002a0, 0xe80, 0x0, &(0x7f00000000c0)="b9ff0300000d698cb89e40f086dd01000005a4004000ffa377fbac14140ce9", 0x0, 0x100}, 0x28) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYPTR=&(0x7f00000003c0)=ANY=[@ANYRESOCT=r12, @ANYRESOCT], @ANYBLOB="0000000000000000280012000c0001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYRES16], 0x5}}, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r13, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x507, 0x0, 0x0, {0x0, r6, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8, 0x1, 'sfb\x00'}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28}}}]}, 0x58}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x507, 0x0, 0x0, {0x0, r6, {}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8, 0x1, 'sfb\x00'}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28}}}]}, 0x58}}, 0x0) sendmsg(r2, &(0x7f0000000180)={&(0x7f0000000000)=@hci={0x1f, r6}, 0x7e, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x9000004}, 0x2000a809) 07:32:22 executing program 4: r0 = memfd_create(&(0x7f0000000880)='#em1#+\x00', 0x0) write$eventfd(r0, &(0x7f0000000240)=0x20000000000080, 0x8) write(r0, &(0x7f0000000040)="0600", 0xffffffffffffff7e) sendfile(r0, r0, &(0x7f00000000c0), 0xfeff) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video36\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) dup(0xffffffffffffffff) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) dup(0xffffffffffffffff) syz_open_dev$dri(0x0, 0x80000000, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x0, 0x0) ioctl$KVM_SET_XCRS(0xffffffffffffffff, 0x4188aea7, &(0x7f0000000040)={0x1, 0xfffffffffffff000, [{}]}) ioctl$EVIOCGKEY(0xffffffffffffffff, 0xc0487c04, &(0x7f00000003c0)=""/226) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VIDIOC_QUERYCAP(r1, 0x80685600, &(0x7f0000000180)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f000002eff0)={0x1, &(0x7f0000000000)=[{0x8}]}, 0x10) memfd_create(0x0, 0x0) 07:32:22 executing program 0: inotify_init1(0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$TCSETXF(0xffffffffffffffff, 0x5434, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x40, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) r1 = syz_open_procfs(0x0, 0x0) fchdir(r1) quotactl(0x0, &(0x7f0000000080)='./file1\x00', 0x0, &(0x7f0000000100)='-') fchdir(r0) syz_mount_image$vfat(&(0x7f0000000000)='e\xc5\xdfz\x00', &(0x7f00000004c0)='./file0\x00', 0x8, 0xe4cd502769fae911, &(0x7f0000000040)=[{&(0x7f0000000100)="0204010f02000270f7f8492500007f00000000000000", 0x16}], 0x800000, 0x0) umount2(&(0x7f0000000540)='./file0\x00', 0x4) setpriority(0x2, 0x0, 0x475) r2 = socket(0xa, 0x1, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) r3 = fcntl$getown(0xffffffffffffffff, 0x9) syz_open_procfs(r3, &(0x7f0000000140)) r4 = perf_event_open(&(0x7f0000000140)={0x2000000001, 0x70, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r3, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000000c0)={0x8, 0x70, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r4, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r6 = creat(&(0x7f0000000140)='./file0\x00', 0x0) write$P9_RREAD(r6, &(0x7f0000000800)=ANY=[@ANYBLOB="53c3cf12526d357a3638ad7ab2a16d784feb8b6b89d0b23c3f392a34231354f728f57606597e95c6500329b766851b2dcb35472b988a1ff8942f7e9bfa6c19193e8e68892ef5e51423e98dd5afcfa46c8b4fea953bab84f28b9feec7e5d5fa5f3b988517e06cff489a4450b69470fa468a8a6dd298d4e7d39eaedbca1eb874a9c91c2c635b6be6a186c9eaf2a2958ca793000005d4f05995d65780a786dedd037bb6002fa73c63fd954c7649fd34e70acb661102c8619a0dad231a29e1e42204abbc181b41226ab7e33fd428dcd4bcdf01901d20180eb0d527a8aa269d4b2a571de92278fe70dc238ccffa9fe938eba34c0e9516c8be025b65ea3d32235dcb83f1402aa7ad91b4456823a28ea4000b716a643078330fe9518140add1109d3fe550f437687348f7264f0afd6001146f88f383a7920a5b7dcfa6ab43d7065fdba6adae3a4df91059146733a91d98757991e629c08df398921b3ae193485a011673bbbccf53b3f2c9803f1d3f823c2670b3dd679012afed0814901f11588920c75d920a17bcffb1b1da90355ca5a7c1cdcfcd0a455f10797f444d9e8f593239afc1c5e891c56cc07407c1d0e4b3a2e10059d758f191dee0138d9cb7aadcf0fa1288b1bb0a3a45f168b6fefbe73101baaed7518883588afc275d34028e6d7d1aedfbc24a590705322d63ea8d11c45e80a13447d30ca12a775c5880d4d7e869201db4eb33da2f74a5b85c66918c972f65c05ea8737179d4dd4fab97abff6a33c6d1fd76d4e63e76ff11be04b1e9fc3d7ed997cb7c98312d9e4a18ce27f0f5e96292e5b61e8c59fee6715ad2434e2668ac5a73c0388dd71dd507975eb49fab189475e022291d3b968957"], 0x25c) fallocate(r6, 0x0, 0x40000, 0x4) fallocate(r5, 0x0, 0x0, 0x110001) fdatasync(r6) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0xd000000, r6, 0x0, 0x8, 0x0, 0x8}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={0xffffffffffffffff, 0xc0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=0xfffffffffffffffb, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x3, 0x3}, 0x0, 0x0, &(0x7f0000000180)={0x3, 0x9, 0x63b1, 0x5}, &(0x7f00000001c0)=0x9e9, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=0x19}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000480)={0xffffffffffffffff, r6, 0x0, 0x1, &(0x7f0000000080)='\x00', r7}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, r4, 0x0, 0x5, &(0x7f00000000c0)='vfat\x00', r7}, 0x30) fcntl$setown(r0, 0x8, r8) r9 = syz_open_procfs(0x0, 0x0) sendfile(0xffffffffffffffff, r9, 0x0, 0x8000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00'}) 07:32:22 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0xe80, 0x0, &(0x7f00000000c0)="b9ff0300000d698cb89e40f086dd01000005a4004000ffa377fbac14140ce9", 0x0, 0x100}, 0x28) r2 = fcntl$dupfd(r0, 0x406, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r3, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r2, r3) ioctl$USBDEVFS_RELEASEINTERFACE(r2, 0x80045510, &(0x7f0000000000)=0x400) r4 = socket$nl_route(0x10, 0x3, 0x0) write(r4, &(0x7f0000000400)="fc0000004900071f8a092504090007000aab6000000000000000e293210001c000000000000000000000ffff0000000000001ec28656aaa79bb94b46fe000000bc000200000300f92fbe780196370d1151ffd633d450000000e5d18064b1ed548d59c40a366c57c6a55e00000100d07302ade01720d7d5bbc91a3e2e80772c05defd5a32e280fc83ab820f06f70cce190a60aa47e988399ddef2fe082038f4f8b29d97f391064e763b6f380f5bd92c83170e5bba4a463a1e00566f91cfded815b2ccd243f295ed94e0ad91bd0734babc7c737d67013375533417e583df0200000000000000a6b567b4d5715587e6d8a1ad0a4f0108a8835d731d05b0", 0xfc) [ 217.541840] kauditd_printk_skb: 3 callbacks suppressed [ 217.541855] audit: type=1400 audit(1570347142.339:52): avc: denied { map } for pid=7757 comm="syz-executor.4" path=2F6D656D66643A23656D31232B202864656C6574656429 dev="tmpfs" ino=28802 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:tmpfs_t:s0 tclass=file permissive=1 07:32:23 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x37) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mount$bpf(0x20000000, &(0x7f0000000380)='./file0\x00', 0x0, 0x2001001, 0x0) syz_mount_image$ext4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x139c4e8, 0x0) [ 218.629317] EXT4-fs (sda1): re-mounted. Opts: 07:32:24 executing program 0: bind$alg(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x220101, 0x0) fchdir(r0) socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x2, r1, &(0x7f0000000080)}]) connect$vsock_stream(0xffffffffffffffff, &(0x7f00000001c0)={0x28, 0x0, 0x0, @my=0x1}, 0x10) r3 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fallocate(r3, 0x4000000000000010, 0x0, 0x7fff) r4 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video37\x00', 0x2, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000001, 0x12, r5, 0x1) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f00000001c0)={@in, 0x0, 0x5, 0x0, "9527eb1fe4a70061631dce40540ea584dc670e8a5b346583b4b9fd983552f8df14ee9ef7112f35b7d06988ac8f9131a1d9718dde8c44f8ab9d20c6894f2929496f17cef927115402414625e9abc4eb6a"}, 0xd8) setsockopt$inet_mtu(r5, 0x0, 0xa, &(0x7f0000000500)=0x5, 0x4) sendto$inet(r5, 0x0, 0x0, 0x20000801, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) r6 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0xbcf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x5, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = fcntl$dupfd(r7, 0x0, r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r9, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r8, r9) ioctl$KVM_INTERRUPT(r8, 0x4004ae86, &(0x7f0000000180)=0x6) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r10 = dup2(r5, r6) write$cgroup_type(r10, &(0x7f0000000080)='threaded\x00', 0xffeb) ioctl$KVM_GET_CLOCK(r10, 0x8030ae7c, &(0x7f0000000140)) ioctl$VIDIOC_RESERVED(r4, 0x5601, 0x0) [ 219.870178] bridge0: port 2(bridge_slave_1) entered disabled state [ 219.877268] bridge0: port 1(bridge_slave_0) entered disabled state 07:32:27 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cpuset.effective_mems\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e21, 0x33780000, @remote, 0x20}}, 0x80, 0x4}, &(0x7f0000000380)=0x90) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000003c0)={r1, 0xe90f}, 0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r3, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f00000005c0)={0x6, 0x5}, 0x2) prctl$PR_GET_DUMPABLE(0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x2, 0x0, "8b63e98a6e9a990ceacccaa0722f7b17adbfb251c09e5993d319d88199f6923e646c1d3eaad49bc3c0a86bd1683c51ec36b5d2dab5a220e04e0b20637e2b5a8dd3403bbe1ccf681d083e2307d3f5597b"}, 0xd8) sendto$inet6(r4, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ftruncate(r5, 0x2081ff) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='wlan0&\x00', r5}, 0x10) r7 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000180)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r7, 0x80008) keyctl$describe(0xb, r7, 0x0, 0x0) ioctl$FITRIM(r6, 0xc0185879, &(0x7f0000000140)={0x2, 0xca, 0x2}) keyctl$read(0xb, r7, &(0x7f0000000080)=""/170, 0xaa) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000400)={&(0x7f0000734000/0x2000)=nil, 0x2000}, &(0x7f00000004c0)=0x10) ioctl$sock_proto_private(r4, 0x89e9, &(0x7f0000000500)="c50368a3110883940c5c68d254d1926dde458475a0a638d843925e2097e15689efe3e5f633adba4531d4e691926f0e9ee73b3b0a14b053cbaa819ca5e1f963d8cd9e266c1fb7f3960ecadf1becb15ccfc24e254dbbbfdcc93702dfca6ea0bef303514ee9eca5e285498850659656558d65582a4da97aaa36a4bee3af5e95858eab523854531453aea51d8e15d82762d8583cb1e2d2221c6824e0d790c58ae15e54a8ca32") mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) 07:32:31 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cpuset.effective_mems\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e21, 0x33780000, @remote, 0x20}}, 0x80, 0x4}, &(0x7f0000000380)=0x90) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000003c0)={r1, 0xe90f}, 0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r3, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f00000005c0)={0x6, 0x5}, 0x2) prctl$PR_GET_DUMPABLE(0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x2, 0x0, "8b63e98a6e9a990ceacccaa0722f7b17adbfb251c09e5993d319d88199f6923e646c1d3eaad49bc3c0a86bd1683c51ec36b5d2dab5a220e04e0b20637e2b5a8dd3403bbe1ccf681d083e2307d3f5597b"}, 0xd8) sendto$inet6(r4, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ftruncate(r5, 0x2081ff) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='wlan0&\x00', r5}, 0x10) r7 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000180)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r7, 0x80008) keyctl$describe(0xb, r7, 0x0, 0x0) ioctl$FITRIM(r6, 0xc0185879, &(0x7f0000000140)={0x2, 0xca, 0x2}) keyctl$read(0xb, r7, &(0x7f0000000080)=""/170, 0xaa) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000400)={&(0x7f0000734000/0x2000)=nil, 0x2000}, &(0x7f00000004c0)=0x10) ioctl$sock_proto_private(r4, 0x89e9, &(0x7f0000000500)="c50368a3110883940c5c68d254d1926dde458475a0a638d843925e2097e15689efe3e5f633adba4531d4e691926f0e9ee73b3b0a14b053cbaa819ca5e1f963d8cd9e266c1fb7f3960ecadf1becb15ccfc24e254dbbbfdcc93702dfca6ea0bef303514ee9eca5e285498850659656558d65582a4da97aaa36a4bee3af5e95858eab523854531453aea51d8e15d82762d8583cb1e2d2221c6824e0d790c58ae15e54a8ca32") mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) 07:32:32 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cpuset.effective_mems\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e21, 0x33780000, @remote, 0x20}}, 0x80, 0x4}, &(0x7f0000000380)=0x90) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000003c0)={r1, 0xe90f}, 0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r3, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f00000005c0)={0x6, 0x5}, 0x2) prctl$PR_GET_DUMPABLE(0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x2, 0x0, "8b63e98a6e9a990ceacccaa0722f7b17adbfb251c09e5993d319d88199f6923e646c1d3eaad49bc3c0a86bd1683c51ec36b5d2dab5a220e04e0b20637e2b5a8dd3403bbe1ccf681d083e2307d3f5597b"}, 0xd8) sendto$inet6(r4, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ftruncate(r5, 0x2081ff) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='wlan0&\x00', r5}, 0x10) r7 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000180)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r7, 0x80008) keyctl$describe(0xb, r7, 0x0, 0x0) ioctl$FITRIM(r6, 0xc0185879, &(0x7f0000000140)={0x2, 0xca, 0x2}) keyctl$read(0xb, r7, &(0x7f0000000080)=""/170, 0xaa) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000400)={&(0x7f0000734000/0x2000)=nil, 0x2000}, &(0x7f00000004c0)=0x10) ioctl$sock_proto_private(r4, 0x89e9, &(0x7f0000000500)="c50368a3110883940c5c68d254d1926dde458475a0a638d843925e2097e15689efe3e5f633adba4531d4e691926f0e9ee73b3b0a14b053cbaa819ca5e1f963d8cd9e266c1fb7f3960ecadf1becb15ccfc24e254dbbbfdcc93702dfca6ea0bef303514ee9eca5e285498850659656558d65582a4da97aaa36a4bee3af5e95858eab523854531453aea51d8e15d82762d8583cb1e2d2221c6824e0d790c58ae15e54a8ca32") mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) 07:32:32 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, r0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='bridge0\x00', 0x3ee) connect$inet(r1, &(0x7f0000000140)={0x2, 0x0, @multicast1}, 0x10) setxattr$security_ima(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='security.ima\x00', &(0x7f0000000180)=@v2={0x3, 0x2, 0x9, 0x10000, 0x6e, "b0d9f05a3c738401060ba9c15d63d72b15f2176c1e0812f50797d0c8e9ddf39f8d4f09c5647b36e52d8c2b31bf439438185639e1b3161f6e2af1547d4efc525a87ad33dbd2c2182141b9fddb8f8692c6e5a9bbf2876cd0029e770c35f3fd816efaccfc30efde8f8662597591d7ad"}, 0x78, 0x4) setsockopt$inet_udp_int(r1, 0x11, 0x67, &(0x7f0000000100)=0x3, 0x4) sendmmsg(r1, &(0x7f0000007fc0), 0xc3, 0x0) 07:32:32 executing program 0: bind$alg(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x1ff}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x220101, 0x0) fchdir(r0) socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x2, r1, &(0x7f0000000080)}]) connect$vsock_stream(0xffffffffffffffff, &(0x7f00000001c0)={0x28, 0x0, 0x0, @my=0x1}, 0x10) r3 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fallocate(r3, 0x4000000000000010, 0x0, 0x7fff) r4 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video37\x00', 0x2, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000001, 0x12, r5, 0x1) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f00000001c0)={@in, 0x0, 0x5, 0x0, "9527eb1fe4a70061631dce40540ea584dc670e8a5b346583b4b9fd983552f8df14ee9ef7112f35b7d06988ac8f9131a1d9718dde8c44f8ab9d20c6894f2929496f17cef927115402414625e9abc4eb6a"}, 0xd8) setsockopt$inet_mtu(r5, 0x0, 0xa, &(0x7f0000000500)=0x5, 0x4) sendto$inet(r5, 0x0, 0x0, 0x20000801, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) r6 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0xbcf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x5, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = fcntl$dupfd(r7, 0x0, r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r9, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r8, r9) ioctl$KVM_INTERRUPT(r8, 0x4004ae86, &(0x7f0000000180)=0x6) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r10 = dup2(r5, r6) write$cgroup_type(r10, &(0x7f0000000080)='threaded\x00', 0xffeb) ioctl$KVM_GET_CLOCK(r10, 0x8030ae7c, &(0x7f0000000140)) ioctl$VIDIOC_RESERVED(r4, 0x5601, 0x0) 07:32:32 executing program 3: openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) lsetxattr$trusted_overlay_opaque(&(0x7f0000000440)='./bus\x00', &(0x7f0000000480)='trusted.overlay.opaque\x00', &(0x7f00000004c0)='y\x00', 0x2, 0x6) openat$zero(0xffffffffffffff9c, &(0x7f0000000200)='/dev/zero\x00', 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000080)='vgat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x2a, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) getxattr(&(0x7f0000000000)='./bus\x00', &(0x7f0000000100)=@random={'trusted.', 'trusted.overlay.opaque\x00'}, &(0x7f0000000500)=""/166, 0xa6) write$binfmt_aout(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="bcef637615f704c4f004000010006b2fe0cc7ba626ab55a14f42ff858272a3203611c611f3082ba58f7999a7487de970dc0ef7ceebfe9cff2d213855b50792461597723e24a4386f19cd199d1609bc6e9d419717fa0ad20a91a67f74525be599daad5d7827cab0accce71e2ff18fb62af3550577b42100120ac7b5ef87e68f1f957520b59bee0300000000000000f3a0e080656c36f6021fb75a"], 0x7b) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000001e00)='./bus\x00') stat(&(0x7f0000000400)='./file0\x00', &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setxattr$security_capability(&(0x7f0000000280)='./bus\x00', &(0x7f00000003c0)='security.capability\x00', &(0x7f0000000640)=@v3={0x3000000, [{0x4, 0x3}, {0x19a8, 0x80000001}], r2}, 0x18, 0x3) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r6, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r5, r6) fcntl$dupfd(r6, 0x0, r3) ioctl$TIOCPKT(r3, 0x5420, &(0x7f0000000240)=0xfffffffb) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) r7 = creat(&(0x7f0000000040)='./file0/bus\x00', 0x6857b21ff1155d90) fcntl$lock(r7, 0x7, &(0x7f0000027000)={0x1}) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) 07:32:32 executing program 4: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000b40)='oom_adj\x00') r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='oom_score_adj\x00\x9f\xc5r\x0e8J\xdb@\xf8\xbfj1\xe8\xce\x88\x02^\xb2\xf4hTR2\xf1\x89\x1e~m\x19\xc9lG^l\x13c7\xf7$\x7f?9>b\xe8/<\xdbj>:\xd9\x10\x04r\x18\x15\xdc)\x10I<\xd0:\x0f\x18\xec\x00\xc2w\x8a0C\xf8\xa9\xeaa\x16\x8c\xe6C\xf5\xcb\xdc\x1c\xea`\x9c\xe1\x8e\xdd\x8e\xaa\x1f\xf4\xaf\xa3Z\xbf\x17M\x1a\xff\xb1\x8dP]<\x9e\xe1B[y\xe6\xae\xe9I\xdb)\x9b\xcb\xa3Wlt\xe9\xa9\xfc\xf8\xde\xf0]\n\xa5S\x16\x1dh\x88\xc5\xea\xcf\xca5\xd2.\x93\xfd\t\x90#hq\r\x9b;\x83\xdd\x0fs\x80\x12\xc6\x8e~\xd4\xef\xc7:\xee4cu\xb2\x03\xd5\xd5)\xc9\xf1/\xea\x95_\'\xfb\xb9\xa94\xca\x9e\xf3\xfb\xc9\xd6~\xd5\xb7}B\xe5.\x86\xbf\xbb#\xb9\xf7N\xb3\xfe?x\xccX^\x16bz\"\x8a\xa45\x10t\xbb\xb7\xca\xa7\xcc\xde_\xdc\xab\xf2\xb8\xc7\xb3\xd3&$\xbb4\x81\t\xbb\xe3\xbfB(ln\xbc\xe9E<6$\x8f)\xb0\x1a\xc9\xe3\x18\xa6\xd9zk\x94Z\xed\x96\xad\xe2\\\xcb,!\x13\rv)r\xf1\x00E\xcccgr\xbf\xd4uB\x9f\xa5\x8c8\xe4D\x0f\xd3Vtd\x89\xc8V\x14\x17=\xd9\xcf*\xc8\xc7\xb7\xcc\x182/Jm\x8c5\x93\x14\xfd\x02\'\xe3\xc9\x12~\xc3\x10\xb7\xc7\xae\xcfA\x823|\xfd\xba2\xbd\xc6-\xe0E_x\xc7i\x8dV\xd9\\_l\xfb\xd8xX.N\x9bd\x91\xd5\xc1\xa1\xbahL\x95wF\x13{\xfd\xc8T\x1f\xe1)h\a\xe8Wn]\xe4') sendfile(r1, r0, 0x0, 0xa) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000b40)='oom_adj\x00') r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r5, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r4, r5) r6 = add_key$user(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x2}, &(0x7f00000005c0)="4acf665ff77df4f20690a5a83bc1a1e6519321db1dc2bf7eee06d978abdfbb33f3bc7025e6befda3c827875946eb75c14639ab6e76811a733653f72afc34e5fce1bed277a8faa02e6da16041b40bab677d6555e94a42b7ac236c8c35d729ac501cf28293c919f2f3ceec4703c892adeac90504aeb3ba485e09bda66d2b96124cabc4d2e653848e2bd909287d0d2c433d72bbd4333cf37f2a8972bba453c776d2c73c61b9fa2153405fc0253992c918682c7018f6a280a9ff312ae4a6996bd9547aed66e72f94342a7d27b9483f7e2e8e3c5bbb89452fd9bb6708ae89ba29", 0xde, 0xfffffffffffffffe) lstat(&(0x7f0000000700)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000400), &(0x7f0000000540), &(0x7f00000006c0)=0x0) keyctl$chown(0x4, r6, r7, r8) r9 = add_key$user(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x2}, &(0x7f00000005c0)="4acf665ff77df4f20690a5a83bc1a1e6519321db1dc2bf7eee06d978abdfbb33f3bc7025e6befda3c827875946eb75c14639ab6e76811a733653f72afc34e5fce1bed277a8faa02e6da16041b40bab677d6555e94a42b7ac236c8c35d729ac501cf28293c919f2f3ceec4703c892adeac90504aeb3ba485e09bda66d2b96124cabc4d2e653848e2bd909287d0d2c433d72bbd4333cf37f2a8972bba453c776d2c73c61b9fa2153405fc0253992c918682c7018f6a280a9ff312ae4a6996bd9547aed66e72f94342a7d27b9483f7e2e8e3c5bbb89452fd9bb6708ae89ba29", 0xde, 0xfffffffffffffffe) lstat(&(0x7f0000000700)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000400), &(0x7f0000000540), &(0x7f00000006c0)=0x0) keyctl$chown(0x4, r9, r10, r11) write$P9_RSTATu(r4, &(0x7f0000000380)=ANY=[@ANYBLOB="110200007d02000000f701030007000000140000000006000000000000000000000208000000ff030000ff0700000000000007006d643573756d2a1b006e6f6465765b6e6f6452765d2d76626f786e657431656d305d092408006f6f6d5f61646a009a016f6f6d5f73636f72655f61646a009fc5720e384adb40f8bf6a31e8ce88025eb2f468545232f1891e7e6d19c96c475e6c136337f7247f3f393e62e82f3cdb6a3e3ad91004721815dc2910493cd03a0f18ec00c2778a3043f8a9ea61168ce643f5cbdc1cea609ce18edd8eaa1ff4afa35abf174d1affb18d505d3c9ee1425b79e6aee949db299bcba3576c74e9a9fcf8def05d0aa553161d6888c5eacfca35d22e93fd09902368710d9b3b83dd0f738012c68e7ed4efc73aee346375b203d5d529c9f12fea955f27fbb9a934ca9ef3fbc9d67ed5b77d42e52e86bfbb23b9f74eb3fe3f78cc585e16627a228aa4351074bbb7caa7ccde5fdcabf2b8c7b3d32624bb348109bbe3bf42286c6ebce9453c36248f29b01ac9e318a6d97a6b945aed96ade25ccb2c21130d762972f10045cc636772bfd475429fa58c38e4440fd356746489c85614173dd9cf2ac8c7b7cc18322f4a6d8c359314fd0227e3c9127ec310b7c7aecf4182337cfdba32bdc62de0455f78c7698d56d95c5f6cfbd878582e4e9b6491d5c1a1ba684c957746137bfdc8541fe1296807e8576e5de40500657468313a", @ANYRES32=r7, @ANYRES32=0x0, @ANYRES32=r10], 0x211) r12 = syz_open_procfs(0x0, &(0x7f00000001c0)='oom_score_adj\x00\x9f\xc5r\x0e8J\xdb@\xf8\xbfj1\xe8\xce\x88\x02^\xb2\xf4hTR2\xf1\x89\x1e~m\x19\xc9lG^l\x13c7\xf7$\x7f?9>b\xe8/<\xdbj>:\xd9\x10\x04r\x18\x15\xdc)\x10I<\xd0:\x0f\x18\xec\x00\xc2w\x8a0C\xf8\xa9\xeaa\x16\x8c\xe6C\xf5\xcb\xdc\x1c\xea`\x9c\xe1\x8e\xdd\x8e\xaa\x1f\xf4\xaf\xa3Z\xbf\x17M\x1a\xff\xb1\x8dP]<\x9e\xe1B[y\xe6\xae\xe9I\xdb)\x9b\xcb\xa3Wlt\xe9\xa9\xfc\xf8\xde\xf0]\n\xa5S\x16\x1dh\x88\xc5\xea\xcf\xca5\xd2.\x93\xfd\t\x90#hq\r\x9b;\x83\xdd\x0fs\x80\x12\xc6\x8e~\xd4\xef\xc7:\xee4cu\xb2\x03\xd5\xd5)\xc9\xf1/\xea\x95_\'\xfb\xb9\xa94\xca\x9e\xf3\xfb\xc9\xd6~\xd5\xb7}B\xe5.\x86\xbf\xbb#\xb9\xf7N\xb3\xfe?x\xccX^\x16bz\"\x8a\xa45\x10t\xbb\xb7\xca\xa7\xcc\xde_\xdc\xab\xf2\xb8\xc7\xb3\xd3&$\xbb4\x81\t\xbb\xe3\xbfB(ln\xbc\xe9E<6$\x8f)\xb0\x1a\xc9\xe3\x18\xa6\xd9zk\x94Z\xed\x96\xad\xe2\\\xcb,!\x13\rv)r\xf1\x00E\xcccgr\xbf\xd4uB\x9f\xa5\x8c8\xe4D\x0f\xd3Vtd\x89\xc8V\x14\x17=\xd9\xcf*\xc8\xc7\xb7\xcc\x182/Jm\x8c5\x93\x14\xfd\x02\'\xe3\xc9\x12~\xc3\x10\xb7\xc7\xae\xcfA\x823|\xfd\xba2\xbd\xc6-\xe0E_x\xc7i\x8dV\xd9\\_l\xfb\xd8xX.N\x9bd\x91\xd5\xc1\xa1\xbahL\x95wF\x13{\xfd\xc8T\x1f\xe1)h\a\xe8Wn]\xe4') socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r13, 0x8912, 0x400200) sendfile(r12, r2, 0x0, 0xa) 07:32:32 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0xfffffffffffffffb, &(0x7f0000000000)="0800b5055e0bcfe87b0071") r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000002180)=0xfc, 0x4) r3 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x9, 0x80) r4 = syz_open_dev$audion(&(0x7f0000000240)='/dev/audio#\x00', 0x1000, 0x420500) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r4, 0x800443d2, &(0x7f0000000180)={0x39d, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}]}) socket$alg(0x26, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000500)={'erspan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000040)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @link_local}, 0x14) sendto$inet6(r1, &(0x7f00000002c0)="030400000300600000000000fff57b016d2763bd56373780398d537500e50600591f301ee616d5c0184374a7ffe4ec55e0654786a70100935ba514d40008efa000801600002fd08d49a47eff71bc4131fe4c1f99bf00a900000000d1843e770afd6e9ef5837dbd0000000053", 0x6c, 0x0, 0x0, 0x0) mmap$perf(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2000000, 0x810, r3, 0x0) 07:32:32 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_open_procfs(0x0, 0x0) munmap(&(0x7f0000004000/0x1000)=nil, 0x1000) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)={0x7, 0x4, 0x800, 0x1031, 0x24, 0xffffffffffffffff, 0x0, [0x15f, 0x0, 0x200100]}, 0x3c) getitimer(0x3a013f3c47c20a7, &(0x7f0000000040)) 07:32:33 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000100)={0xc0000002}) r1 = openat$cgroup_ro(r0, 0x0, 0x275a, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000000c0)={0x0, 0x0}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000300), 0xcf0df1549394c624}, 0x0, 0x2, 0xfffffffd, 0x1, 0x0, 0x0, 0x1f}, r2, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = semget$private(0x0, 0x3, 0x400) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f00000005c0)) semctl$SEM_STAT(r3, 0x0, 0x12, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mkdirat$cgroup(r4, 0x0, 0x1ff) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='veth1\x00\x00\x00\x00\xff\xff\xff\xff\xff\xef\x00', 0x10) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x13, &(0x7f0000000540)=0x72, 0x1) bind$inet(r5, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000480)={0xf8, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) fsetxattr$security_smack_transmute(0xffffffffffffffff, &(0x7f0000000140)='security.SMACK64TRANSMUTE\x00', &(0x7f00000002c0)='TRUE', 0x4, 0x1) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x3) sendto$inet(0xffffffffffffffff, &(0x7f0000000640), 0x0, 0x0, 0x0, 0x0) r6 = openat$selinux_status(0xffffffffffffff9c, 0x0, 0x0, 0x0) accept$inet(r6, &(0x7f0000000200)={0x2, 0x0, @local}, &(0x7f0000000240)=0x10) r7 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/4\x00') read$FUSE(r7, 0x0, 0x0) prctl$PR_GET_NO_NEW_PRIVS(0x27) r8 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x986, 0x216044) ioctl$DRM_IOCTL_CONTROL(r8, 0x40086414, &(0x7f0000000580)={0xdf271595003baa18, 0xffff}) sendto$inet(r5, &(0x7f0000000180)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf9221a7511bf746bec66ba5c0fe3ac47b61db6b4c41bd1a5259e62506cda287b857aac", 0x8293, 0x4000002, 0x0, 0x27) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r9 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/status\x00', 0x0, 0x0) ioctl$TCSETSW(r9, 0x5403, &(0x7f0000000380)={0x7, 0x5a9dac80, 0x66c, 0x2, 0x2, 0xfc, 0x3f, 0xf7, 0x6, 0x9, 0xfffff000, 0x6}) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, &(0x7f0000000500)={0x4, 0x8, 0x0, 0x4, "0a6b8de6db5ade2ff02acf007628d5c66faabac290efe89176633d347768b2fb"}) 07:32:33 executing program 0: open(0x0, 0x101000, 0x14c) syz_open_dev$sg(0x0, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0x1, 0x2) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f0000000200)={0x4, &(0x7f00000004c0)=[{}, {}, {}, {}]}) syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') mount$bpf(0x0, 0x0, &(0x7f0000000100)='bpf\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="6d6f64653d3030303030303030303030303030305752920da871e6c02c6d6f64653d30303030303030303030303030303030303030303030332c6d6f64653d30303030303030303030303030303030303030333737372c6d6f64653d30303030303030303030303030303030303030303030302c66756e633d4b455845435f4b45ef9018292f2fd6bf34524e454c5f434845434b2c6f626a5f726f6c653d4d41"]) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') writev(r2, &(0x7f0000000080), 0x5b) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r3, 0x0) write$P9_RWALK(r3, &(0x7f00000003c0)=ANY=[@ANYRES64], 0x8) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x28812, r3, 0x0) r4 = perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffeffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r3, r4) r5 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x28001, 0x0) ioctl$int_in(r5, 0x80006080045006, &(0x7f0000000140)) ioctl$TCSETXW(r5, 0x5435, &(0x7f0000000080)={0x878e, 0x2, [0x9, 0x1201, 0x9e, 0x7, 0x5], 0x5}) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x28812, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x1000}, 0x0, 0xd, 0xffffffffffffffff, 0x4) r6 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet(r6, &(0x7f0000006400), 0x3ffffffffffff5f, 0x4004) 07:32:33 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="0800b5055e0bcfe87b0071") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r3, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r2, r3) r4 = openat(r2, &(0x7f0000000040)='./file0\x00', 0x100, 0x6) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = fcntl$dupfd(r5, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r7, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r6, r7) ioctl$VHOST_NET_SET_BACKEND(r4, 0x4008af30, &(0x7f0000000100)={0x0, r6}) r8 = openat$md(0xffffffffffffff9c, &(0x7f0000000080)='/dev/md0\x00', 0x0, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = fcntl$dupfd(r9, 0x0, r9) ioctl$PERF_EVENT_IOC_ENABLE(r10, 0x8912, 0x400200) r11 = socket$inet6(0xa, 0x4, 0x0) setsockopt$SO_TIMESTAMP(r11, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r10, r11) ioctl$KDGKBTYPE(r10, 0x4b33, &(0x7f0000000000)) ioctl$BLKPG(r8, 0x40480923, 0x0) 07:32:33 executing program 4: socket$alg(0x26, 0x5, 0x0) r0 = socket(0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./bus\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000019c0)="eb3c906d6b66732e66617400020401ed01000270fff85ce027bee38c56b9de7b5b6cbe87737f7458c1d9042f3da7ffc7455677965c452eeb1eec5b0dd6756f308e7f9c68fee43dde98396efaf3668780104a6668080d69bfb7d7b8465a7ae13097c306a5b540105b2fb8f4daae8fdfaf84e251cac69646731b6759d78a4d7f355a4f5fc15a90d6b13d276c40affa95f0ab5b657f1a19d3766f2aa0da9e4f3eadf3c5aad0d053f935382a5e99410d77cbfbc0cca5bf99bacbeb7b8b324f3ba8949b8ce1cf723e3dc8fc612fd758d7f5c7dd63c0fd34450046850f839ad4d2887fa69342a14a9f6b2799f1220a24ee4fd0a759b319c72d3c7d8b80e6e00f61c3c3b3f555032db1", 0x106, 0xfffffffffffffffb}], 0x0, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) r1 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r1) perf_event_open(0x0, 0x0, 0x2, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x1fe, 0x0) write$binfmt_aout(r2, &(0x7f0000000880)=ANY=[@ANYBLOB="56ef637615b704c4f0040000000000"], 0xf) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x100, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f00000018c0)=ANY=[@ANYBLOB="06000000000000000000000000000000dc00000000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00'/220], @ANYBLOB="000000000000000000f00000000000000010000000000000", @ANYPTR=&(0x7f00000008c0)=ANY=[@ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e900"/4096], @ANYBLOB="00000000000000000030000000000000f100000000000000", @ANYPTR=&(0x7f0000000400)=ANY=[@ANYBLOB='\x00'/241], @ANYBLOB="00000000000000000040000000000000f300000000000000", @ANYPTR=&(0x7f0000000500)=ANY=[@ANYBLOB='\x00'/243], @ANYBLOB="00000000000000000060000000000000f500000000000000", @ANYPTR=&(0x7f0000000600)=ANY=[@ANYBLOB='\x00'/245], @ANYBLOB="000000000000000000b0000000000000ff00000000000000", @ANYPTR=&(0x7f0000000700)=ANY=[@ANYBLOB='\x00'/255], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000001e00)='./bus\x00') sendfile(r2, r2, &(0x7f00000001c0), 0x8080fffffffe) creat(&(0x7f0000000280)='./file0\x00', 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, 0x0) 07:32:35 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cpuset.effective_mems\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e21, 0x33780000, @remote, 0x20}}, 0x80, 0x4}, &(0x7f0000000380)=0x90) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000003c0)={r1, 0xe90f}, 0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r3, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f00000005c0)={0x6, 0x5}, 0x2) prctl$PR_GET_DUMPABLE(0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x2, 0x0, "8b63e98a6e9a990ceacccaa0722f7b17adbfb251c09e5993d319d88199f6923e646c1d3eaad49bc3c0a86bd1683c51ec36b5d2dab5a220e04e0b20637e2b5a8dd3403bbe1ccf681d083e2307d3f5597b"}, 0xd8) sendto$inet6(r4, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ftruncate(r5, 0x2081ff) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='wlan0&\x00', r5}, 0x10) r7 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000180)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r7, 0x80008) keyctl$describe(0xb, r7, 0x0, 0x0) ioctl$FITRIM(r6, 0xc0185879, &(0x7f0000000140)={0x2, 0xca, 0x2}) keyctl$read(0xb, r7, &(0x7f0000000080)=""/170, 0xaa) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000400)={&(0x7f0000734000/0x2000)=nil, 0x2000}, &(0x7f00000004c0)=0x10) ioctl$sock_proto_private(r4, 0x89e9, &(0x7f0000000500)="c50368a3110883940c5c68d254d1926dde458475a0a638d843925e2097e15689efe3e5f633adba4531d4e691926f0e9ee73b3b0a14b053cbaa819ca5e1f963d8cd9e266c1fb7f3960ecadf1becb15ccfc24e254dbbbfdcc93702dfca6ea0bef303514ee9eca5e285498850659656558d65582a4da97aaa36a4bee3af5e95858eab523854531453aea51d8e15d82762d8583cb1e2d2221c6824e0d790c58ae15e54a8ca32") mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) [ 230.903135] FAT-fs (loop4): bogus number of reserved sectors [ 230.926436] FAT-fs (loop4): Can't find a valid FAT filesystem [ 231.025856] FAT-fs (loop4): bogus number of reserved sectors [ 231.031711] FAT-fs (loop4): Can't find a valid FAT filesystem [ 231.049055] audit: type=1804 audit(1570347155.849:53): pid=7878 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir231211550/syzkaller.5xEASN/13/file0" dev="sda1" ino=16536 res=1 07:32:35 executing program 5: syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="12d056a30af8c40d2942b6cc8c0bafdcae844f130a252b7cae44"]) 07:32:35 executing program 3: openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) lsetxattr$trusted_overlay_opaque(&(0x7f0000000440)='./bus\x00', &(0x7f0000000480)='trusted.overlay.opaque\x00', &(0x7f00000004c0)='y\x00', 0x2, 0x6) openat$zero(0xffffffffffffff9c, &(0x7f0000000200)='/dev/zero\x00', 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000080)='vgat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x2a, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x14107e, 0x0) getxattr(&(0x7f0000000000)='./bus\x00', &(0x7f0000000100)=@random={'trusted.', 'trusted.overlay.opaque\x00'}, &(0x7f0000000500)=""/166, 0xa6) write$binfmt_aout(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="bcef637615f704c4f004000010006b2fe0cc7ba626ab55a14f42ff858272a3203611c611f3082ba58f7999a7487de970dc0ef7ceebfe9cff2d213855b50792461597723e24a4386f19cd199d1609bc6e9d419717fa0ad20a91a67f74525be599daad5d7827cab0accce71e2ff18fb62af3550577b42100120ac7b5ef87e68f1f957520b59bee0300000000000000f3a0e080656c36f6021fb75a"], 0x7b) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000001e00)='./bus\x00') stat(&(0x7f0000000400)='./file0\x00', &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setxattr$security_capability(&(0x7f0000000280)='./bus\x00', &(0x7f00000003c0)='security.capability\x00', &(0x7f0000000640)=@v3={0x3000000, [{0x4, 0x3}, {0x19a8, 0x80000001}], r2}, 0x18, 0x3) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r6, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r5, r6) fcntl$dupfd(r6, 0x0, r3) ioctl$TIOCPKT(r3, 0x5420, &(0x7f0000000240)=0xfffffffb) sendfile(r1, r1, &(0x7f00000001c0), 0x8080fffffffe) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) r7 = creat(&(0x7f0000000040)='./file0/bus\x00', 0x6857b21ff1155d90) fcntl$lock(r7, 0x7, &(0x7f0000027000)={0x1}) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) 07:32:35 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cpuset.effective_mems\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e21, 0x33780000, @remote, 0x20}}, 0x80, 0x4}, &(0x7f0000000380)=0x90) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000003c0)={r1, 0xe90f}, 0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r3, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f00000005c0)={0x6, 0x5}, 0x2) prctl$PR_GET_DUMPABLE(0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x2, 0x0, "8b63e98a6e9a990ceacccaa0722f7b17adbfb251c09e5993d319d88199f6923e646c1d3eaad49bc3c0a86bd1683c51ec36b5d2dab5a220e04e0b20637e2b5a8dd3403bbe1ccf681d083e2307d3f5597b"}, 0xd8) sendto$inet6(r4, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ftruncate(r5, 0x2081ff) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='wlan0&\x00', r5}, 0x10) r7 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000180)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r7, 0x80008) keyctl$describe(0xb, r7, 0x0, 0x0) ioctl$FITRIM(r6, 0xc0185879, &(0x7f0000000140)={0x2, 0xca, 0x2}) keyctl$read(0xb, r7, &(0x7f0000000080)=""/170, 0xaa) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000400)={&(0x7f0000734000/0x2000)=nil, 0x2000}, &(0x7f00000004c0)=0x10) ioctl$sock_proto_private(r4, 0x89e9, &(0x7f0000000500)="c50368a3110883940c5c68d254d1926dde458475a0a638d843925e2097e15689efe3e5f633adba4531d4e691926f0e9ee73b3b0a14b053cbaa819ca5e1f963d8cd9e266c1fb7f3960ecadf1becb15ccfc24e254dbbbfdcc93702dfca6ea0bef303514ee9eca5e285498850659656558d65582a4da97aaa36a4bee3af5e95858eab523854531453aea51d8e15d82762d8583cb1e2d2221c6824e0d790c58ae15e54a8ca32") mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) 07:32:35 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0xfffffffffffffe27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$KVM_INTERRUPT(r1, 0x4004ae86, &(0x7f0000000080)) openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/user\x00', 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r3, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) getsockopt$MISDN_TIME_STAMP(r3, 0x0, 0x1, &(0x7f0000000200), &(0x7f0000000240)=0x4) 07:32:36 executing program 5: madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x400000000e) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f000057bff0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f0000000040)='./file0\x00', 0x1, 0x0, &(0x7f0000000080), 0x80000, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x23, &(0x7f00000000c0)=0x1000, 0x4) dup2(r1, r2) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f00000000c0)={0x4, &(0x7f0000000080)=[{0x4, 0x0, 0x1, 0x3}, {0xbee, 0x35, 0x31, 0x50800000}, {0xc43, 0x28, 0x81, 0x7}, {0xff81, 0x6, 0x0, 0x40}]}) mremap(&(0x7f00003fb000/0x400000)=nil, 0x400000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) 07:32:36 executing program 4: pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x4200, 0x0) ioctl$ION_IOC_HEAP_QUERY(r2, 0xc0184908, &(0x7f0000000200)={0x34, 0x0, &(0x7f00000000c0)}) mkdir(&(0x7f0000000800)='./file0\x00', 0x0) write$P9_RVERSION(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="1300000036ffff018000000600395032303030"], 0x13) r3 = dup(r1) write$FUSE_BMAP(r3, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_ENTRY(r3, &(0x7f0000000140)={0x90}, 0x90) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB='=', @ANYRESHEX=r1, @ANYBLOB=',\x00']) r4 = syz_open_dev$amidi(&(0x7f0000000280)='/dev/amidi#\x00', 0x2, 0x434a00) r5 = openat$vfio(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/vfio/vfio\x00', 0x10000, 0x0) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x1) r6 = socket$l2tp(0x18, 0x1, 0x1) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) r8 = syz_open_dev$media(&(0x7f0000000440)='/dev/media#\x00', 0x10001, 0x40041) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000480)=@assoc_value={0x0}, &(0x7f00000004c0)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r8, 0x84, 0x7b, &(0x7f0000000500)={r9, 0x1}, &(0x7f0000000540)=0x8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x18000000000002a0, 0xe80, 0x0, &(0x7f00000000c0)="b9ff0300000d698cb89e40f086dd01000005a4004000ffa377fbac14140ce9", 0x0, 0x100}, 0x28) ioctl$int_out(r7, 0x2a30, &(0x7f00000003c0)) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x4000, 0x1) setresuid(0x0, r10, 0x0) ioctl$SIOCRSGL2CALL(0xffffffffffffffff, 0x89e5, &(0x7f0000000580)=@netrom) lchown(&(0x7f0000000300)='./file0\x00', 0x0, 0xee01) [ 231.695693] 9pnet: Insufficient options for proto=fd [ 231.768117] 9pnet: Insufficient options for proto=fd 07:32:36 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x0, 0x42, &(0x7f0000000180)={'TPROXY\x00'}, &(0x7f00000001c0)=0x1e) close(0xffffffffffffffff) socket(0x840000000002, 0x3, 0xff) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000000)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0) getpgrp(0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='net/ipv6_route\x00') preadv(r1, &(0x7f00000017c0), 0x1b4, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x0, 0x0) [ 232.358384] IPVS: ftp: loaded support on port[0] = 21 [ 232.820463] chnl_net:caif_netlink_parms(): no params data found [ 232.856818] bridge0: port 1(bridge_slave_0) entered blocking state [ 232.863298] bridge0: port 1(bridge_slave_0) entered disabled state [ 232.870656] device bridge_slave_0 entered promiscuous mode [ 232.878189] bridge0: port 2(bridge_slave_1) entered blocking state [ 232.884695] bridge0: port 2(bridge_slave_1) entered disabled state [ 232.892051] device bridge_slave_1 entered promiscuous mode [ 232.911627] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 232.921224] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 232.940914] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 232.974037] team0: Port device team_slave_0 added [ 232.995918] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 233.003442] team0: Port device team_slave_1 added [ 233.042901] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 233.071831] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 233.138301] device hsr_slave_0 entered promiscuous mode [ 233.175556] device hsr_slave_1 entered promiscuous mode [ 233.217091] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 233.241679] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 233.315560] bridge0: port 2(bridge_slave_1) entered blocking state [ 233.321966] bridge0: port 2(bridge_slave_1) entered forwarding state [ 233.328679] bridge0: port 1(bridge_slave_0) entered blocking state [ 233.335078] bridge0: port 1(bridge_slave_0) entered forwarding state [ 233.471489] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 233.478544] 8021q: adding VLAN 0 to HW filter on device bond0 [ 233.491518] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 233.548276] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 233.563495] bridge0: port 1(bridge_slave_0) entered disabled state [ 233.613164] bridge0: port 2(bridge_slave_1) entered disabled state [ 233.662324] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 233.709302] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 233.735980] 8021q: adding VLAN 0 to HW filter on device team0 [ 233.786398] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 233.838005] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 233.845347] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 233.875085] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 233.882769] bridge0: port 1(bridge_slave_0) entered blocking state [ 233.889177] bridge0: port 1(bridge_slave_0) entered forwarding state [ 233.962074] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 233.993221] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 234.036016] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.042458] bridge0: port 2(bridge_slave_1) entered forwarding state [ 234.103546] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 234.110758] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 234.121540] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 234.129289] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 234.188915] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 234.229939] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 234.246130] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 234.291580] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 234.335359] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 234.343511] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 234.438515] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 234.495421] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 234.534547] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 234.588724] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 234.597462] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 234.630130] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 234.672454] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 234.713159] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 234.728513] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 234.742980] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 234.762830] 8021q: adding VLAN 0 to HW filter on device batadv0 07:32:39 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x1c, 0x2f, 0x3ff, 0x0, 0x0, {0x9}, [@typed={0x8, 0x3, @uid}]}, 0x1c}}, 0x0) 07:32:39 executing program 4: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0xc008ae88, &(0x7f0000000040)={0x7b, 0x5, [0x174], [0xc1]}) 07:32:39 executing program 5: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000080)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x125f, 0x0) 07:32:39 executing program 2: futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) r0 = gettid() ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 07:32:39 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cpuset.effective_mems\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e21, 0x33780000, @remote, 0x20}}, 0x80, 0x4}, &(0x7f0000000380)=0x90) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000003c0)={r1, 0xe90f}, 0x8) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x195) recvmsg$kcm(r3, &(0x7f00000005c0)={&(0x7f0000000080)=@sco, 0x165, &(0x7f0000000580)=[{&(0x7f0000000480)=""/143, 0xfffffdde}], 0x3, 0x0, 0x1cf}, 0x0) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f00000005c0)={0x6, 0x5}, 0x2) prctl$PR_GET_DUMPABLE(0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000180)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x2, 0x0, "8b63e98a6e9a990ceacccaa0722f7b17adbfb251c09e5993d319d88199f6923e646c1d3eaad49bc3c0a86bd1683c51ec36b5d2dab5a220e04e0b20637e2b5a8dd3403bbe1ccf681d083e2307d3f5597b"}, 0xd8) sendto$inet6(r4, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) getsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ftruncate(r5, 0x2081ff) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='wlan0&\x00', r5}, 0x10) r7 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz'}, &(0x7f0000000180)='F', 0x1, 0xfffffffffffffffe) keyctl$setperm(0x5, r7, 0x80008) keyctl$describe(0xb, r7, 0x0, 0x0) ioctl$FITRIM(r6, 0xc0185879, &(0x7f0000000140)={0x2, 0xca, 0x2}) keyctl$read(0xb, r7, &(0x7f0000000080)=""/170, 0xaa) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000400)={&(0x7f0000734000/0x2000)=nil, 0x2000}, &(0x7f00000004c0)=0x10) ioctl$sock_proto_private(r4, 0x89e9, &(0x7f0000000500)="c50368a3110883940c5c68d254d1926dde458475a0a638d843925e2097e15689efe3e5f633adba4531d4e691926f0e9ee73b3b0a14b053cbaa819ca5e1f963d8cd9e266c1fb7f3960ecadf1becb15ccfc24e254dbbbfdcc93702dfca6ea0bef303514ee9eca5e285498850659656558d65582a4da97aaa36a4bee3af5e95858eab523854531453aea51d8e15d82762d8583cb1e2d2221c6824e0d790c58ae15e54a8ca32") mlockall(0x3) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mmap(&(0x7f0000000000/0xddf000)=nil, 0xddf000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 07:32:39 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video36\x00', 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f00000002c0)={0x0, 0x6, 0x4, {0x2, @raw_data="37eff2653430a431c64fbfa30c2a38dac2bfec391e57a058488681818c09f696cb927986149d147e5bdb188052955e73dbf46d0c32aeefcf9e6d9c6dfa4d837c7d89baad901a0c27dadb0b9776316a2c36b33646115376e3602346de9a65e5d812ecf6eeb88f247ed31abc084429e7d6a0f8935c808ac4a805487b5567ebe45005271260780a78abcf70deaff66bccb36c3d9fb3c831a9e576ad07f3ce722003c54f90a4dfba0e81095ad2f4c1089003cdd592bb47b86b4224fee36fbe35865d14833c4094de11b3"}}) ioctl$VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000000)=0x2) socketpair$unix(0x1, 0x80001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fcntl$dupfd(r3, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) dup3(r0, r1, 0x0) 07:32:39 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020b000007000000000021003f54036205001a00f50b9aa24dd520175e3b8f8886264fe600081000e0880000004ee2ba575d48775a64e2a597f3c5040069a1920a651003dabb22b27ebf770727af96ec1543ae874078ea69213dedfb94dd9401a59e886b1ecc921dbb707f91ae8a9398dc3ec1b5fa08fb8e00"/131], 0x38}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x400000000000581, 0x0) recvmmsg(r0, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x100, 0x0) [ 235.155007] ================================================================== [ 235.162593] BUG: KASAN: use-after-free in v4l2_ctrl_grab+0x159/0x160 [ 235.169101] Read of size 8 at addr ffff88808a56ade0 by task syz-executor.3/7964 [ 235.176549] [ 235.178195] CPU: 1 PID: 7964 Comm: syz-executor.3 Not tainted 4.19.77 #0 [ 235.185029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 235.185039] Call Trace: [ 235.185059] dump_stack+0x172/0x1f0 [ 235.185079] ? v4l2_ctrl_grab+0x159/0x160 [ 235.185099] print_address_description.cold+0x7c/0x20d [ 235.185115] ? v4l2_ctrl_grab+0x159/0x160 [ 235.185128] kasan_report.cold+0x8c/0x2ba [ 235.185145] ? vidioc_querycap+0x110/0x110 [ 235.185162] __asan_report_load8_noabort+0x14/0x20 [ 235.185174] v4l2_ctrl_grab+0x159/0x160 [ 235.185189] ? vidioc_querycap+0x110/0x110 [ 235.185202] vicodec_stop_streaming+0x158/0x1a0 [ 235.185213] ? vicodec_return_bufs+0x220/0x220 [ 235.185229] __vb2_queue_cancel+0xb1/0x790 [ 235.185249] ? vidioc_querycap+0x110/0x110 07:32:40 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setitimer(0x2, 0x0, &(0x7f00000010c0)) [ 235.185268] ? dev_debug_store+0x110/0x110 [ 235.185283] vb2_core_queue_release+0x28/0x80 [ 235.185301] vb2_queue_release+0x16/0x20 [ 235.185320] v4l2_m2m_ctx_release+0x2d/0x40 [ 235.185334] vicodec_release+0xc0/0x120 [ 235.185350] v4l2_release+0xf9/0x1a0 [ 235.185367] __fput+0x2dd/0x8b0 [ 235.185389] ____fput+0x16/0x20 [ 235.185405] task_work_run+0x145/0x1c0 [ 235.185428] exit_to_usermode_loop+0x273/0x2c0 [ 235.185446] do_syscall_64+0x53d/0x620 [ 235.185466] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 235.185477] RIP: 0033:0x459a59 [ 235.185491] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 235.185500] RSP: 002b:00007f77fafa9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000124 [ 235.185514] RAX: 0000000000000004 RBX: 0000000000000003 RCX: 0000000000459a59 [ 235.185522] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003 [ 235.185530] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 235.185539] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f77fafaa6d4 [ 235.185548] R13: 00000000004c011a R14: 00000000004d2490 R15: 00000000ffffffff [ 235.185569] [ 235.185576] Allocated by task 7964: [ 235.185590] save_stack+0x45/0xd0 [ 235.185603] kasan_kmalloc+0xce/0xf0 [ 235.185614] __kmalloc_node+0x51/0x80 [ 235.185626] kvmalloc_node+0x68/0x100 [ 235.185638] v4l2_ctrl_new.part.0+0x214/0x1450 [ 235.185650] v4l2_ctrl_new_std+0x22d/0x360 [ 235.185661] vicodec_open+0x1a8/0xb30 [ 235.185671] v4l2_open+0x1b2/0x360 [ 235.185682] chrdev_open+0x245/0x6b0 [ 235.185691] do_dentry_open+0x4c3/0x1210 [ 235.185702] vfs_open+0xa0/0xd0 [ 235.185714] path_openat+0x10d7/0x45e0 [ 235.185724] do_filp_open+0x1a1/0x280 [ 235.185734] do_sys_open+0x3fe/0x550 [ 235.185746] __x64_sys_openat+0x9d/0x100 [ 235.185758] do_syscall_64+0xfd/0x620 [ 235.185771] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 235.185774] [ 235.185780] Freed by task 7964: [ 235.185792] save_stack+0x45/0xd0 [ 235.185805] __kasan_slab_free+0x102/0x150 [ 235.185833] kasan_slab_free+0xe/0x10 [ 235.185845] kfree+0xcf/0x220 [ 235.185857] kvfree+0x61/0x70 [ 235.185870] v4l2_ctrl_handler_free+0x4a8/0x7e0 [ 235.185881] vicodec_release+0x6b/0x120 [ 235.185893] v4l2_release+0xf9/0x1a0 [ 235.185905] __fput+0x2dd/0x8b0 [ 235.185917] ____fput+0x16/0x20 [ 235.185928] task_work_run+0x145/0x1c0 [ 235.185942] exit_to_usermode_loop+0x273/0x2c0 [ 235.185954] do_syscall_64+0x53d/0x620 [ 235.185967] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 235.185971] 07:32:40 executing program 5: r0 = open(&(0x7f0000000140)='./bus\x00', 0x40, 0x0) close(r0) r1 = syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) readv(r1, &(0x7f0000000180)=[{&(0x7f0000001200)=""/4096, 0xfffffe19}], 0x1) [ 235.185981] The buggy address belongs to the object at ffff88808a56adc0 [ 235.185981] which belongs to the cache kmalloc-256 of size 256 [ 235.185993] The buggy address is located 32 bytes inside of [ 235.185993] 256-byte region [ffff88808a56adc0, ffff88808a56aec0) [ 235.185998] The buggy address belongs to the page: [ 235.186009] page:ffffea0002295a80 count:1 mapcount:0 mapping:ffff88812c3f07c0 index:0x0 [ 235.186021] flags: 0x1fffc0000000100(slab) [ 235.186039] raw: 01fffc0000000100 ffffea0002a3ab88 ffff88812c3f1648 ffff88812c3f07c0 [ 235.186054] raw: 0000000000000000 ffff88808a56a000 000000010000000c 0000000000000000 [ 235.186060] page dumped because: kasan: bad access detected [ 235.186063] [ 235.186067] Memory state around the buggy address: [ 235.186079] ffff88808a56ac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 235.186089] ffff88808a56ad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 235.186100] >ffff88808a56ad80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 235.186106] ^ 07:32:40 executing program 5: pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) write$P9_RVERSION(r1, &(0x7f0000000340)={0x15, 0x65, 0xffff, 0x8001, 0x8, '9P2000.L'}, 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='9p\x00', 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) write$RDMA_USER_CM_CMD_JOIN_MCAST(r2, &(0x7f0000000380)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, @in6={0xa, 0x4e20, 0x0, @rand_addr="6b2de324f5c62cd491a574888eebe6be"}}}, 0xa0) removexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'user.', '9P2000.L'}) [ 235.186116] ffff88808a56ae00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 235.186127] ffff88808a56ae80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 235.186131] ================================================================== [ 235.186137] Disabling lock debugging due to kernel taint [ 235.223563] syz-executor.5 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 235.225302] kobject: 'loop5' (0000000082caaddc): kobject_uevent_env [ 235.270106] Kernel panic - not syncing: panic_on_warn set ... [ 235.270106] [ 235.273879] kobject: 'loop5' (0000000082caaddc): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 235.275957] CPU: 1 PID: 7964 Comm: syz-executor.3 Tainted: G B 4.19.77 #0 [ 235.275964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 235.275969] Call Trace: [ 235.275987] dump_stack+0x172/0x1f0 [ 235.276002] ? v4l2_ctrl_grab+0x159/0x160 [ 235.276014] panic+0x263/0x507 [ 235.276025] ? __warn_printk+0xf3/0xf3 [ 235.276038] ? v4l2_ctrl_grab+0x159/0x160 [ 235.276050] ? preempt_schedule+0x4b/0x60 [ 235.276068] ? ___preempt_schedule+0x16/0x18 [ 235.280262] kobject: 'kvm' (000000009a1b0924): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 235.283036] ? trace_hardirqs_on+0x5e/0x220 [ 235.283057] ? v4l2_ctrl_grab+0x159/0x160 [ 235.294090] kobject: 'loop5' (0000000082caaddc): kobject_uevent_env [ 235.294759] kasan_end_report+0x47/0x4f [ 235.294772] kasan_report.cold+0xa9/0x2ba [ 235.294786] ? vidioc_querycap+0x110/0x110 [ 235.294802] __asan_report_load8_noabort+0x14/0x20 [ 235.298702] kobject: 'loop5' (0000000082caaddc): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 235.303873] v4l2_ctrl_grab+0x159/0x160 [ 235.596933] kobject: 'loop0' (000000003e9a6b17): kobject_uevent_env [ 235.600507] ? vidioc_querycap+0x110/0x110 [ 235.600520] vicodec_stop_streaming+0x158/0x1a0 [ 235.600536] ? vicodec_return_bufs+0x220/0x220 [ 235.608212] kobject: 'loop0' (000000003e9a6b17): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 235.615239] __vb2_queue_cancel+0xb1/0x790 [ 235.615256] ? vidioc_querycap+0x110/0x110 [ 235.615268] ? dev_debug_store+0x110/0x110 [ 235.615280] vb2_core_queue_release+0x28/0x80 [ 235.615292] vb2_queue_release+0x16/0x20 [ 235.615311] v4l2_m2m_ctx_release+0x2d/0x40 [ 235.642722] kobject: '9p-1' (0000000069c9864c): kobject_add_internal: parent: 'bdi', set: 'devices' [ 235.644450] vicodec_release+0xc0/0x120 [ 235.644464] v4l2_release+0xf9/0x1a0 [ 235.644487] __fput+0x2dd/0x8b0 [ 235.652257] kobject: '9p-1' (0000000069c9864c): kobject_uevent_env [ 235.661277] ____fput+0x16/0x20 [ 235.661291] task_work_run+0x145/0x1c0 [ 235.661307] exit_to_usermode_loop+0x273/0x2c0 [ 235.661320] do_syscall_64+0x53d/0x620 [ 235.661337] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 235.661346] RIP: 0033:0x459a59 [ 235.661357] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 235.661363] RSP: 002b:00007f77fafa9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000124 [ 235.679560] kobject: '9p-1' (0000000069c9864c): fill_kobj_path: path = '/devices/virtual/bdi/9p-1' [ 235.681508] RAX: 0000000000000004 RBX: 0000000000000003 RCX: 0000000000459a59 [ 235.681522] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003 [ 235.681529] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 235.681541] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f77fafaa6d4 [ 235.691911] kobject: '9p-2' (0000000088c040ab): kobject_add_internal: parent: 'bdi', set: 'devices' [ 235.692470] R13: 00000000004c011a R14: 00000000004d2490 R15: 00000000ffffffff [ 235.696897] kobject: '9p-2' (0000000088c040ab): kobject_uevent_env [ 235.701852] Kernel Offset: disabled [ 235.962152] Rebooting in 86400 seconds..