Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.23' (ECDSA) to the list of known hosts. 2020/06/14 19:45:35 fuzzer started 2020/06/14 19:45:35 dialing manager at 10.128.0.26:35501 2020/06/14 19:45:35 syscalls: 3085 2020/06/14 19:45:35 code coverage: enabled 2020/06/14 19:45:35 comparison tracing: enabled 2020/06/14 19:45:35 extra coverage: enabled 2020/06/14 19:45:35 setuid sandbox: enabled 2020/06/14 19:45:35 namespace sandbox: enabled 2020/06/14 19:45:35 Android sandbox: /sys/fs/selinux/policy does not exist 2020/06/14 19:45:35 fault injection: enabled 2020/06/14 19:45:35 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2020/06/14 19:45:35 net packet injection: enabled 2020/06/14 19:45:35 net device setup: enabled 2020/06/14 19:45:35 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2020/06/14 19:45:35 devlink PCI setup: PCI device 0000:00:10.0 is not available 2020/06/14 19:45:35 USB emulation: enabled 19:46:55 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010008506000000000000ff0100000000", @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r3, @ANYRES32], 0x50}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r7 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r7, &(0x7f00000000c0), 0x492492492492627, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x4c}}, 0x0) syzkaller login: [ 137.680274][ T6845] IPVS: ftp: loaded support on port[0] = 21 19:46:55 executing program 1: rt_sigprocmask(0x1, &(0x7f0000000000), &(0x7f0000000080), 0x8) [ 137.831798][ T6845] chnl_net:caif_netlink_parms(): no params data found [ 137.926608][ T6845] bridge0: port 1(bridge_slave_0) entered blocking state [ 137.945670][ T6845] bridge0: port 1(bridge_slave_0) entered disabled state [ 137.954083][ T6845] device bridge_slave_0 entered promiscuous mode [ 137.980085][ T6845] bridge0: port 2(bridge_slave_1) entered blocking state [ 137.990868][ T6845] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.017795][ T6845] device bridge_slave_1 entered promiscuous mode [ 138.077094][ T6845] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 138.101174][ T6975] IPVS: ftp: loaded support on port[0] = 21 [ 138.108611][ T6845] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 19:46:55 executing program 2: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3a0100001900010000000000000000001d0100721e0106000000000000da5a271fc7ff7328777c2b0c8660bce578f1dd5c9d9468bdff0af6a3e28132f3482f627f298e29066287945a9e6fae5a9d62680d172a4e8ee1498c1c0135d5024a33de24c38eae5735fc6c3d74d3988a01e0940a7fd2daa5b551b4aa3befda13212c49f75ba67d55374f8e98ecfc732fb48a3619fbf0d69b1490bc5cf9dba7963307217e8910c11e853fd37f3be706b953fadf01cfd8a58379d1f7251da10aae8834f146ecf9939f0c400b5ec903a3f837a4286b47edb15688f75f6ae2bc221e946b244a5be46e916ccef678d742e76091fc2c2ef57a75f8086a8d9cf206538c6beabab5109f83a2debc5e63df6fc78f97b47caba9def9de6ab0cf320d32db9400e6986935e678c296d097795d64fa28d39c09a53d00001500010000000000000000000d7af5b5df0c482d350000006e1ed311d4ecb6b9f06f1bce41921563eb3ca380e3f1c180829b7faae5a878533771b8420fbec77792d3bd0e5b21b27a90316d719732f8e422fb21cbf7f1e4d7224dc5c6d1a25da88b974ee2922515abd51f3646507b53fa27d399996c613628b1e1d8e050d8a30ee7ea404dfde08d2b93a535e90fce"], 0x14c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000040)={0x5, 0x5, 0xfffffffe, 0x3, 'syz0\x00', 0xffff5625}) socket$inet(0x2, 0x3, 0x19) connect$ax25(r0, &(0x7f0000000000)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0xc0096616, 0x0) recvfrom$unix(r3, &(0x7f0000000080)=""/155, 0x9b, 0x2041, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e23}, 0x6e) [ 138.174214][ T6845] team0: Port device team_slave_0 added [ 138.206758][ T6845] team0: Port device team_slave_1 added [ 138.279334][ T6845] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 138.287897][ T6845] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 138.318222][ T6845] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 138.373289][ T6845] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 138.381765][ T6845] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 138.411376][ T6845] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 138.450251][ T6975] chnl_net:caif_netlink_parms(): no params data found [ 138.544327][ T6845] device hsr_slave_0 entered promiscuous mode 19:46:56 executing program 3: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000002000010000000001000000000200000000000022000000001400030076"], 0x30}}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0xcc, 0x0) [ 138.586116][ T6845] device hsr_slave_1 entered promiscuous mode [ 138.761075][ T7062] IPVS: ftp: loaded support on port[0] = 21 [ 138.833579][ T7138] IPVS: ftp: loaded support on port[0] = 21 [ 138.877359][ T6975] bridge0: port 1(bridge_slave_0) entered blocking state [ 138.884935][ T6975] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.909454][ T6975] device bridge_slave_0 entered promiscuous mode [ 138.954117][ T6975] bridge0: port 2(bridge_slave_1) entered blocking state [ 138.962638][ T6975] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.975230][ T6975] device bridge_slave_1 entered promiscuous mode 19:46:56 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) migrate_pages(0x0, 0x1000, &(0x7f0000000100), 0x0) [ 139.120399][ T6975] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 139.148355][ T6975] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 139.170023][ T6845] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 139.272096][ T6975] team0: Port device team_slave_0 added [ 139.288360][ T6845] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 139.342793][ T6975] team0: Port device team_slave_1 added [ 139.377324][ T6845] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 139.391783][ T7248] IPVS: ftp: loaded support on port[0] = 21 [ 139.431413][ T6845] netdevsim netdevsim0 netdevsim3: renamed from eth3 19:46:57 executing program 5: io_setup(0x83, &(0x7f00000003c0)=0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) io_submit(r0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x2703000000000000, 0x0, 0x3, 0x1, 0x0, r1, 0x0}]) [ 139.492078][ T6975] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 139.503331][ T6975] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 139.536332][ T6975] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 139.622347][ T6975] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 139.632004][ T6975] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 139.659663][ T6975] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 139.706329][ T7335] IPVS: ftp: loaded support on port[0] = 21 [ 139.733866][ T7138] chnl_net:caif_netlink_parms(): no params data found [ 139.849629][ T6975] device hsr_slave_0 entered promiscuous mode [ 139.917765][ T6975] device hsr_slave_1 entered promiscuous mode [ 139.975816][ T6975] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 139.983867][ T6975] Cannot create hsr debugfs directory [ 140.010625][ T7062] chnl_net:caif_netlink_parms(): no params data found [ 140.168390][ T7138] bridge0: port 1(bridge_slave_0) entered blocking state [ 140.176523][ T7138] bridge0: port 1(bridge_slave_0) entered disabled state [ 140.184300][ T7138] device bridge_slave_0 entered promiscuous mode [ 140.231806][ T7138] bridge0: port 2(bridge_slave_1) entered blocking state [ 140.244161][ T7138] bridge0: port 2(bridge_slave_1) entered disabled state [ 140.253302][ T7138] device bridge_slave_1 entered promiscuous mode [ 140.309393][ T7062] bridge0: port 1(bridge_slave_0) entered blocking state [ 140.328253][ T7062] bridge0: port 1(bridge_slave_0) entered disabled state [ 140.339787][ T7062] device bridge_slave_0 entered promiscuous mode [ 140.354209][ T7062] bridge0: port 2(bridge_slave_1) entered blocking state [ 140.363953][ T7062] bridge0: port 2(bridge_slave_1) entered disabled state [ 140.372709][ T7062] device bridge_slave_1 entered promiscuous mode [ 140.422623][ T7138] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 140.432858][ T7248] chnl_net:caif_netlink_parms(): no params data found [ 140.482053][ T7138] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 140.542813][ T7062] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 140.566263][ T7335] chnl_net:caif_netlink_parms(): no params data found [ 140.599549][ T7062] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 140.667457][ T7138] team0: Port device team_slave_0 added [ 140.692088][ T7062] team0: Port device team_slave_0 added [ 140.737196][ T7138] team0: Port device team_slave_1 added [ 140.758079][ T7062] team0: Port device team_slave_1 added [ 140.811179][ T6845] 8021q: adding VLAN 0 to HW filter on device bond0 [ 140.819939][ T7062] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 140.829378][ T7062] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 140.857016][ T7062] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 140.896358][ T7062] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 140.903522][ T7062] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 140.936781][ T7062] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 140.954516][ T7138] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 140.965632][ T7138] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 140.992734][ T7138] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 141.009336][ T7138] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 141.018301][ T7138] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 141.046376][ T7138] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 141.082441][ T6975] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 141.183889][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 141.198458][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 141.212746][ T7335] bridge0: port 1(bridge_slave_0) entered blocking state [ 141.222825][ T7335] bridge0: port 1(bridge_slave_0) entered disabled state [ 141.231845][ T7335] device bridge_slave_0 entered promiscuous mode [ 141.242335][ T6845] 8021q: adding VLAN 0 to HW filter on device team0 [ 141.254961][ T6975] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 141.409326][ T7138] device hsr_slave_0 entered promiscuous mode [ 141.455772][ T7138] device hsr_slave_1 entered promiscuous mode [ 141.515497][ T7138] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 141.524737][ T7138] Cannot create hsr debugfs directory [ 141.530982][ T7248] bridge0: port 1(bridge_slave_0) entered blocking state [ 141.538487][ T7248] bridge0: port 1(bridge_slave_0) entered disabled state [ 141.547156][ T7248] device bridge_slave_0 entered promiscuous mode [ 141.556235][ T7335] bridge0: port 2(bridge_slave_1) entered blocking state [ 141.563312][ T7335] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.573218][ T7335] device bridge_slave_1 entered promiscuous mode [ 141.596450][ T6975] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 141.679062][ T7062] device hsr_slave_0 entered promiscuous mode [ 141.745929][ T7062] device hsr_slave_1 entered promiscuous mode [ 141.805495][ T7062] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 141.813353][ T7062] Cannot create hsr debugfs directory [ 141.829690][ T7248] bridge0: port 2(bridge_slave_1) entered blocking state [ 141.838121][ T7248] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.850215][ T7248] device bridge_slave_1 entered promiscuous mode [ 141.877837][ T7335] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 141.893674][ T6975] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 141.968183][ T7248] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 141.980670][ T7335] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 142.019440][ T2727] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 142.029556][ T2727] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 142.039481][ T2727] bridge0: port 1(bridge_slave_0) entered blocking state [ 142.047279][ T2727] bridge0: port 1(bridge_slave_0) entered forwarding state [ 142.070419][ T7248] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 142.117465][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 142.145468][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 142.154739][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 142.171406][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 142.178694][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 142.190335][ T7335] team0: Port device team_slave_0 added [ 142.201737][ T7335] team0: Port device team_slave_1 added [ 142.220728][ T7248] team0: Port device team_slave_0 added [ 142.229852][ T7248] team0: Port device team_slave_1 added [ 142.241155][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 142.309008][ T7248] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 142.321046][ T7248] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 142.350117][ T7248] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 142.399595][ T7335] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 142.407374][ T7335] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 142.434846][ T7335] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 142.447762][ T7248] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 142.454939][ T7248] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 142.481932][ T7248] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 142.499424][ T2727] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 142.523655][ T7335] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 142.535613][ T7335] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 142.563106][ T7335] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 142.597232][ T2727] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 142.613446][ T2727] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 142.623402][ T2727] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 142.701911][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 142.712648][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 142.722981][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 142.731914][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 142.741826][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 142.750981][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 142.819291][ T7335] device hsr_slave_0 entered promiscuous mode [ 142.876178][ T7335] device hsr_slave_1 entered promiscuous mode [ 142.935481][ T7335] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 142.943056][ T7335] Cannot create hsr debugfs directory [ 143.009557][ T7248] device hsr_slave_0 entered promiscuous mode [ 143.055601][ T7248] device hsr_slave_1 entered promiscuous mode [ 143.106223][ T7248] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 143.113802][ T7248] Cannot create hsr debugfs directory [ 143.148767][ T6845] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 143.190335][ T7138] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 143.288809][ T7138] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 143.330094][ T7138] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 143.416072][ T7138] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 143.541484][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 143.549385][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 143.569802][ T6845] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 143.606118][ T7062] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 143.661256][ T7062] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 143.742106][ T6975] 8021q: adding VLAN 0 to HW filter on device bond0 [ 143.751089][ T7062] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 143.779708][ T7062] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 143.881324][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 143.896610][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 143.904588][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 143.924053][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 143.981873][ T6975] 8021q: adding VLAN 0 to HW filter on device team0 [ 144.010849][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 144.021440][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 144.031421][ T2581] bridge0: port 1(bridge_slave_0) entered blocking state [ 144.038657][ T2581] bridge0: port 1(bridge_slave_0) entered forwarding state [ 144.047734][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 144.057932][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 144.067521][ T2581] bridge0: port 2(bridge_slave_1) entered blocking state [ 144.075475][ T2581] bridge0: port 2(bridge_slave_1) entered forwarding state [ 144.088263][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 144.140416][ T7335] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 144.177849][ T7335] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 144.248766][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 144.258982][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 144.268748][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 144.279603][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 144.292176][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 144.319893][ T7335] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 144.380564][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 144.390603][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 144.415970][ T7335] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 144.480243][ T6845] device veth0_vlan entered promiscuous mode [ 144.500326][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 144.513172][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 144.525821][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 144.534641][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 144.550155][ T7248] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 144.616769][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 144.627021][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 144.634847][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 144.646846][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 144.658446][ T6975] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 144.678524][ T7248] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 144.724677][ T7248] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 144.760652][ T6845] device veth1_vlan entered promiscuous mode [ 144.787158][ T7248] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 144.864078][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 144.873974][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 144.884388][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 144.893001][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 144.972889][ T6975] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 144.983554][ T7138] 8021q: adding VLAN 0 to HW filter on device bond0 [ 144.992771][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 145.002350][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 145.032746][ T6845] device veth0_macvtap entered promiscuous mode [ 145.076560][ T7138] 8021q: adding VLAN 0 to HW filter on device team0 [ 145.100964][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 145.110551][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 145.122116][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 145.138075][ T6845] device veth1_macvtap entered promiscuous mode [ 145.158636][ T7062] 8021q: adding VLAN 0 to HW filter on device bond0 [ 145.179068][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 145.188073][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 145.198827][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 145.208674][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 145.216116][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 145.256052][ T7062] 8021q: adding VLAN 0 to HW filter on device team0 [ 145.264097][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 145.282959][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 145.292996][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 145.302506][ T2499] bridge0: port 2(bridge_slave_1) entered blocking state [ 145.310718][ T2499] bridge0: port 2(bridge_slave_1) entered forwarding state [ 145.320085][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 145.329991][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 145.338849][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 145.370358][ T7335] 8021q: adding VLAN 0 to HW filter on device bond0 [ 145.390143][ T2727] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 145.399095][ T2727] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 145.412030][ T2727] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 145.421599][ T2727] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 145.431422][ T2727] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 145.441341][ T2727] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 145.450937][ T2727] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 145.461983][ T2727] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 145.478060][ T6845] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 145.508645][ T7138] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 145.520132][ T7138] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 145.541117][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 145.551104][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 145.560574][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 145.571886][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 145.581337][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 145.590838][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 145.600431][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 145.609821][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 145.619339][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 145.627382][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 145.637873][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 145.645907][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 145.706750][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 145.717044][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 145.726441][ T2499] bridge0: port 2(bridge_slave_1) entered blocking state [ 145.733703][ T2499] bridge0: port 2(bridge_slave_1) entered forwarding state [ 145.742156][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 145.751411][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 145.761382][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 145.771144][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 145.784818][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 145.798678][ T6845] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 145.821588][ T7335] 8021q: adding VLAN 0 to HW filter on device team0 [ 145.829615][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 145.839893][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 145.848981][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 145.858917][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 145.868788][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 145.878344][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 145.888000][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 145.897914][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 145.911950][ T7248] 8021q: adding VLAN 0 to HW filter on device bond0 [ 145.939770][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 145.949080][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 145.964368][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 145.973901][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 145.997695][ T7138] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 146.006636][ T6975] device veth0_vlan entered promiscuous mode [ 146.033304][ T7062] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 146.047258][ T7062] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 146.058193][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 146.066326][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 146.073989][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 146.083211][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 146.091326][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 146.101051][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 146.109900][ T2581] bridge0: port 1(bridge_slave_0) entered blocking state [ 146.117216][ T2581] bridge0: port 1(bridge_slave_0) entered forwarding state [ 146.124947][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 146.134589][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 146.143474][ T2581] bridge0: port 2(bridge_slave_1) entered blocking state [ 146.150631][ T2581] bridge0: port 2(bridge_slave_1) entered forwarding state [ 146.158972][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 146.167637][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 146.178133][ T7248] 8021q: adding VLAN 0 to HW filter on device team0 [ 146.191521][ T6975] device veth1_vlan entered promiscuous mode [ 146.217903][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 146.228732][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 146.237415][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 146.245820][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 146.340120][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 146.349174][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 146.358148][ T8089] bridge0: port 1(bridge_slave_0) entered blocking state [ 146.365451][ T8089] bridge0: port 1(bridge_slave_0) entered forwarding state [ 146.373110][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 146.382338][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 146.391209][ T8089] bridge0: port 2(bridge_slave_1) entered blocking state [ 146.398385][ T8089] bridge0: port 2(bridge_slave_1) entered forwarding state [ 146.406280][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 146.414869][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 146.423867][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 146.432691][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 146.440290][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 146.448753][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 146.563228][ T7062] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 146.571530][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 146.580995][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 146.591296][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 146.600527][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 146.610367][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 146.620182][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 146.628879][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 146.638587][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 146.647649][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 146.656792][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 146.665887][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 146.674305][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 146.684110][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 146.692860][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 146.713349][ T6975] device veth0_macvtap entered promiscuous mode [ 146.738867][ T6975] device veth1_macvtap entered promiscuous mode [ 146.785146][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 146.793212][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 146.825957][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 146.834502][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 146.844775][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 146.854466][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 146.864732][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 146.939533][ T7335] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 146.961354][ T8101] netlink: 'syz-executor.0': attribute type 1 has an invalid length. [ 146.972643][ T7248] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 146.993132][ T7248] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 147.002593][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 147.011816][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 147.021515][ T2581] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 147.061268][ T7138] device veth0_vlan entered promiscuous mode [ 147.116865][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 147.126309][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 147.164537][ T7138] device veth1_vlan entered promiscuous mode [ 147.193038][ T6975] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 147.206122][ T6975] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 147.218531][ T6975] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 147.236007][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 147.244017][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 147.253158][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 147.261647][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 147.271139][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 147.279576][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 147.289390][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 147.299318][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 147.308533][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 147.339288][ T7335] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 147.361225][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 147.370556][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 147.380080][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 147.422390][ T7248] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 147.430551][ T8101] netlink: 'syz-executor.0': attribute type 1 has an invalid length. [ 147.447091][ T6975] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 147.464004][ T6975] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 147.476220][ T8111] syz-executor.0 (8111) used greatest stack depth: 20424 bytes left [ 147.487614][ T6975] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 147.520223][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 147.534399][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 147.551969][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 147.560984][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 147.579181][ T7138] device veth0_macvtap entered promiscuous mode [ 147.629474][ T7138] device veth1_macvtap entered promiscuous mode [ 147.690333][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 147.699147][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 147.708336][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 147.718011][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 147.726983][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 147.735837][ T7062] device veth0_vlan entered promiscuous mode 19:47:05 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010008506000000000000ff0100000000", @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r3, @ANYRES32], 0x50}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r7 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r7, &(0x7f00000000c0), 0x492492492492627, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x4c}}, 0x0) [ 147.823438][ T7062] device veth1_vlan entered promiscuous mode [ 147.843554][ T7138] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 147.862979][ T7138] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 147.874366][ T7138] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 147.893450][ T7138] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 147.914469][ T7138] batman_adv: batadv0: Interface activated: batadv_slave_0 19:47:05 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010008506000000000000ff0100000000", @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r3, @ANYRES32], 0x50}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r7 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r7, &(0x7f00000000c0), 0x492492492492627, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x4c}}, 0x0) [ 148.045768][ T8152] netlink: 'syz-executor.0': attribute type 1 has an invalid length. [ 148.119235][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 148.129153][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 148.140000][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 148.150432][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 148.162561][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 148.173009][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 148.273237][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 148.293938][ T2499] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 148.304375][ T8167] netlink: 'syz-executor.1': attribute type 1 has an invalid length. [ 148.418823][ T7138] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 148.446488][ T7138] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 148.461309][ T7138] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 148.473524][ T7138] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 148.489488][ T7138] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 148.535187][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 148.546036][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 148.558295][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 148.567150][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 148.589052][ T7248] device veth0_vlan entered promiscuous mode [ 148.604706][ T7062] device veth0_macvtap entered promiscuous mode [ 148.630835][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 148.641834][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 148.651458][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 148.663920][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready 19:47:06 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010008506000000000000ff0100000000", @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r3, @ANYRES32], 0x50}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r7 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r7, &(0x7f00000000c0), 0x492492492492627, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x4c}}, 0x0) [ 148.693414][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 148.703279][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 148.711762][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 148.720541][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 148.729572][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 148.752078][ T7248] device veth1_vlan entered promiscuous mode [ 148.771977][ T7335] device veth0_vlan entered promiscuous mode [ 148.792275][ T7062] device veth1_macvtap entered promiscuous mode 19:47:06 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010008506000000000000ff0100000000", @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r3, @ANYRES32], 0x50}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r7 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r7, &(0x7f00000000c0), 0x492492492492627, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x4c}}, 0x0) [ 148.820014][ T8186] syz-executor.1 (8186) used greatest stack depth: 19856 bytes left [ 148.869978][ T8209] netlink: 'syz-executor.0': attribute type 1 has an invalid length. [ 148.893744][ T7335] device veth1_vlan entered promiscuous mode [ 149.065811][ T8215] netlink: 'syz-executor.1': attribute type 1 has an invalid length. [ 149.083311][ T7062] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 149.095877][ T7062] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 149.108628][ T7062] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 149.119956][ T7062] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 149.130024][ T7062] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 149.140522][ T7062] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 149.152128][ T7062] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 149.306428][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 149.314813][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 149.338175][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 149.346683][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 149.365859][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 149.380714][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 149.393234][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 149.409383][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 149.424382][ T7062] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 149.438909][ T7062] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 149.449622][ T7062] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 149.461151][ T7062] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 149.471843][ T7062] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 149.483029][ T7062] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 149.495853][ T7062] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 149.531317][ T7248] device veth0_macvtap entered promiscuous mode [ 149.549838][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 149.565755][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 149.597349][ T2772] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 19:47:07 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010008506000000000000ff0100000000", @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r3, @ANYRES32], 0x50}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r7 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r7, &(0x7f00000000c0), 0x492492492492627, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x4c}}, 0x0) [ 149.640803][ T7248] device veth1_macvtap entered promiscuous mode 19:47:07 executing program 3: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000002000010000000001000000000200000000000022000000001400030076"], 0x30}}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0xcc, 0x0) 19:47:07 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010008506000000000000ff0100000000", @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r3, @ANYRES32], 0x50}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r7 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r7, &(0x7f00000000c0), 0x492492492492627, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x4c}}, 0x0) [ 149.801918][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 149.820388][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 149.844564][ T8268] netlink: 'syz-executor.0': attribute type 1 has an invalid length. [ 149.933618][ T7248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 149.965292][ T7248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 149.985184][ T7248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 150.007336][ T7248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 150.032988][ T7248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 150.056093][ T7248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 150.080496][ T7248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 150.104600][ T7248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 150.147261][ T7248] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 150.159279][ T7335] device veth0_macvtap entered promiscuous mode [ 150.180481][ T8272] netlink: 'syz-executor.1': attribute type 1 has an invalid length. [ 150.219928][ T8270] team0: Port device veth3 added [ 150.274148][ T8268] team0: Port device veth5 added 19:47:08 executing program 3: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000002000010000000001000000000200000000000022000000001400030076"], 0x30}}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0xcc, 0x0) [ 150.388339][ T8276] team0: Device vlan2 is already an upper device of the team interface [ 150.517527][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 150.526841][ C1] hrtimer: interrupt took 34584 ns [ 150.585754][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 150.640742][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 150.708769][ T7248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 150.751663][ T7248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 150.800523][ T7248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 150.846445][ T7248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 150.882197][ T7248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 150.906427][ T7248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 150.922362][ T7248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 150.941083][ T7248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 150.954495][ T7248] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 151.005207][ T8314] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.2'. [ 151.025098][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 151.033971][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 151.061000][ T7335] device veth1_macvtap entered promiscuous mode [ 151.360493][ T7335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 151.394881][ T7335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 151.443586][ T7335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 151.479520][ T7335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 151.497298][ T7335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 151.514706][ T8281] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 151.530185][ T7335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 151.577964][ T7335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 151.600039][ T7335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 151.616205][ T7335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 151.633089][ T7335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 151.649991][ T7335] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 151.805013][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 151.826876][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 151.998027][ T7335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 152.029495][ T7335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 152.068330][ T7335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 152.124838][ T7335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 152.134696][ T7335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 152.225336][ T7335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 152.260471][ T7335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 152.300379][ T7335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 152.326379][ T7335] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 152.373148][ T7335] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 152.420710][ T7335] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 152.445305][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 152.466241][ T8089] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 19:47:10 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010008506000000000000ff0100000000", @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r3, @ANYRES32], 0x50}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r7 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r7, &(0x7f00000000c0), 0x492492492492627, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x4c}}, 0x0) 19:47:10 executing program 3: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000002000010000000001000000000200000000000022000000001400030076"], 0x30}}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0xcc, 0x0) 19:47:10 executing program 1: open(&(0x7f0000000040)='./file0\x00', 0x200, 0x0) sendmsg$unix(0xffffffffffffffff, 0x0, 0x0) [ 152.510237][ T8335] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.2'. [ 152.520107][ T8314] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 152.610285][ T8340] netlink: 'syz-executor.0': attribute type 1 has an invalid length. [ 152.732124][ T8344] batman_adv: batadv0: Adding interface: veth7 [ 152.745600][ T8344] batman_adv: batadv0: The MTU of interface veth7 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 152.793508][ T8344] batman_adv: batadv0: Not using interface veth7 (retrying later): interface not active [ 152.868892][ T8340] batman_adv: batadv0: Adding interface: veth9 [ 152.893033][ T8340] batman_adv: batadv0: The MTU of interface veth9 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. 19:47:10 executing program 5: io_setup(0x83, &(0x7f00000003c0)=0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) io_submit(r0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x2703000000000000, 0x0, 0x3, 0x1, 0x0, r1, 0x0}]) 19:47:10 executing program 2: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3a0100001900010000000000000000001d0100721e0106000000000000da5a271fc7ff7328777c2b0c8660bce578f1dd5c9d9468bdff0af6a3e28132f3482f627f298e29066287945a9e6fae5a9d62680d172a4e8ee1498c1c0135d5024a33de24c38eae5735fc6c3d74d3988a01e0940a7fd2daa5b551b4aa3befda13212c49f75ba67d55374f8e98ecfc732fb48a3619fbf0d69b1490bc5cf9dba7963307217e8910c11e853fd37f3be706b953fadf01cfd8a58379d1f7251da10aae8834f146ecf9939f0c400b5ec903a3f837a4286b47edb15688f75f6ae2bc221e946b244a5be46e916ccef678d742e76091fc2c2ef57a75f8086a8d9cf206538c6beabab5109f83a2debc5e63df6fc78f97b47caba9def9de6ab0cf320d32db9400e6986935e678c296d097795d64fa28d39c09a53d00001500010000000000000000000d7af5b5df0c482d350000006e1ed311d4ecb6b9f06f1bce41921563eb3ca380e3f1c180829b7faae5a878533771b8420fbec77792d3bd0e5b21b27a90316d719732f8e422fb21cbf7f1e4d7224dc5c6d1a25da88b974ee2922515abd51f3646507b53fa27d399996c613628b1e1d8e050d8a30ee7ea404dfde08d2b93a535e90fce"], 0x14c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000040)={0x5, 0x5, 0xfffffffe, 0x3, 'syz0\x00', 0xffff5625}) socket$inet(0x2, 0x3, 0x19) connect$ax25(r0, &(0x7f0000000000)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0xc0096616, 0x0) recvfrom$unix(r3, &(0x7f0000000080)=""/155, 0x9b, 0x2041, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e23}, 0x6e) 19:47:10 executing program 4: 19:47:10 executing program 1: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3a0100001900010000000000000000001d0100721e0106000000000000da5a271fc7ff7328777c2b0c8660bce578f1dd5c9d9468bdff0af6a3e28132f3482f627f298e29066287945a9e6fae5a9d62680d172a4e8ee1498c1c0135d5024a33de24c38eae5735fc6c3d74d3988a01e0940a7fd2daa5b551b4aa3befda13212c49f75ba67d55374f8e98ecfc732fb48a3619fbf0d69b1490bc5cf9dba7963307217e8910c11e853fd37f3be706b953fadf01cfd8a58379d1f7251da10aae8834f146ecf9939f0c400b5ec903a3f837a4286b47edb15688f75f6ae2bc221e946b244a5be46e916ccef678d742e76091fc2c2ef57a75f8086a8d9cf206538c6beabab5109f83a2debc5e63df6fc78f97b47caba9def9de6ab0cf320d32db9400e6986935e678c296d097795d64fa28d39c09a53d00001500010000000000000000000d7af5b5df0c482d350000006e1ed311d4ecb6b9f06f1bce41921563eb3ca380e3f1c180829b7faae5a878533771b8420fbec77792d3bd0e5b21b27a90316d719732f8e422fb21cbf7f1e4d7224dc5c6d1a25da88b974ee2922515abd51f3646507b53fa27d399996c613628b1e1d8e050d8a30ee7ea404dfde08d2b93a535e90fce"], 0x14c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000040)={0x5, 0x5, 0xfffffffe, 0x3, 'syz0\x00', 0xffff5625}) socket$inet(0x2, 0x3, 0x19) connect$ax25(r0, &(0x7f0000000000)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0xc0096616, 0x0) recvfrom$unix(r3, &(0x7f0000000080)=""/155, 0x9b, 0x2041, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e23}, 0x6e) 19:47:10 executing program 3: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3a0100001900010000000000000000001d0100721e0106000000000000da5a271fc7ff7328777c2b0c8660bce578f1dd5c9d9468bdff0af6a3e28132f3482f627f298e29066287945a9e6fae5a9d62680d172a4e8ee1498c1c0135d5024a33de24c38eae5735fc6c3d74d3988a01e0940a7fd2daa5b551b4aa3befda13212c49f75ba67d55374f8e98ecfc732fb48a3619fbf0d69b1490bc5cf9dba7963307217e8910c11e853fd37f3be706b953fadf01cfd8a58379d1f7251da10aae8834f146ecf9939f0c400b5ec903a3f837a4286b47edb15688f75f6ae2bc221e946b244a5be46e916ccef678d742e76091fc2c2ef57a75f8086a8d9cf206538c6beabab5109f83a2debc5e63df6fc78f97b47caba9def9de6ab0cf320d32db9400e6986935e678c296d097795d64fa28d39c09a53d00001500010000000000000000000d7af5b5df0c482d350000006e1ed311d4ecb6b9f06f1bce41921563eb3ca380e3f1c180829b7faae5a878533771b8420fbec77792d3bd0e5b21b27a90316d719732f8e422fb21cbf7f1e4d7224dc5c6d1a25da88b974ee2922515abd51f3646507b53fa27d399996c613628b1e1d8e050d8a30ee7ea404dfde08d2b93a535e90fce"], 0x14c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000040)={0x5, 0x5, 0xfffffffe, 0x3, 'syz0\x00', 0xffff5625}) socket$inet(0x2, 0x3, 0x19) connect$ax25(r0, &(0x7f0000000000)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0xc0096616, 0x0) recvfrom$unix(r3, &(0x7f0000000080)=""/155, 0x9b, 0x2041, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e23}, 0x6e) [ 152.919661][ T8340] batman_adv: batadv0: Not using interface veth9 (retrying later): interface not active 19:47:10 executing program 4: 19:47:10 executing program 5: io_setup(0x83, &(0x7f00000003c0)=0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) io_submit(r0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x2703000000000000, 0x0, 0x3, 0x1, 0x0, r1, 0x0}]) 19:47:10 executing program 4: 19:47:11 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010008506000000000000ff0100000000", @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r3, @ANYRES32], 0x50}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r7 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r7, &(0x7f00000000c0), 0x492492492492627, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x4c}}, 0x0) 19:47:11 executing program 4: [ 153.356962][ T8379] netlink: 'syz-executor.0': attribute type 1 has an invalid length. 19:47:11 executing program 5: io_setup(0x83, &(0x7f00000003c0)=0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) io_submit(r0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x2703000000000000, 0x0, 0x3, 0x1, 0x0, r1, 0x0}]) 19:47:11 executing program 4: 19:47:11 executing program 4: [ 153.943992][ T8407] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.2'. [ 153.983854][ T8410] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.1'. [ 153.990678][ T8407] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 154.103296][ T8411] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.3'. [ 155.187668][ T8369] ax25_connect(): syz-executor.3 uses autobind, please contact jreuter@yaina.de 19:47:13 executing program 2: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3a0100001900010000000000000000001d0100721e0106000000000000da5a271fc7ff7328777c2b0c8660bce578f1dd5c9d9468bdff0af6a3e28132f3482f627f298e29066287945a9e6fae5a9d62680d172a4e8ee1498c1c0135d5024a33de24c38eae5735fc6c3d74d3988a01e0940a7fd2daa5b551b4aa3befda13212c49f75ba67d55374f8e98ecfc732fb48a3619fbf0d69b1490bc5cf9dba7963307217e8910c11e853fd37f3be706b953fadf01cfd8a58379d1f7251da10aae8834f146ecf9939f0c400b5ec903a3f837a4286b47edb15688f75f6ae2bc221e946b244a5be46e916ccef678d742e76091fc2c2ef57a75f8086a8d9cf206538c6beabab5109f83a2debc5e63df6fc78f97b47caba9def9de6ab0cf320d32db9400e6986935e678c296d097795d64fa28d39c09a53d00001500010000000000000000000d7af5b5df0c482d350000006e1ed311d4ecb6b9f06f1bce41921563eb3ca380e3f1c180829b7faae5a878533771b8420fbec77792d3bd0e5b21b27a90316d719732f8e422fb21cbf7f1e4d7224dc5c6d1a25da88b974ee2922515abd51f3646507b53fa27d399996c613628b1e1d8e050d8a30ee7ea404dfde08d2b93a535e90fce"], 0x14c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000040)={0x5, 0x5, 0xfffffffe, 0x3, 'syz0\x00', 0xffff5625}) socket$inet(0x2, 0x3, 0x19) connect$ax25(r0, &(0x7f0000000000)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0xc0096616, 0x0) recvfrom$unix(r3, &(0x7f0000000080)=""/155, 0x9b, 0x2041, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e23}, 0x6e) 19:47:13 executing program 5: syz_open_pts(0xffffffffffffffff, 0x0) [ 155.414027][ T8370] ax25_connect(): syz-executor.1 uses autobind, please contact jreuter@yaina.de 19:47:13 executing program 1: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3a0100001900010000000000000000001d0100721e0106000000000000da5a271fc7ff7328777c2b0c8660bce578f1dd5c9d9468bdff0af6a3e28132f3482f627f298e29066287945a9e6fae5a9d62680d172a4e8ee1498c1c0135d5024a33de24c38eae5735fc6c3d74d3988a01e0940a7fd2daa5b551b4aa3befda13212c49f75ba67d55374f8e98ecfc732fb48a3619fbf0d69b1490bc5cf9dba7963307217e8910c11e853fd37f3be706b953fadf01cfd8a58379d1f7251da10aae8834f146ecf9939f0c400b5ec903a3f837a4286b47edb15688f75f6ae2bc221e946b244a5be46e916ccef678d742e76091fc2c2ef57a75f8086a8d9cf206538c6beabab5109f83a2debc5e63df6fc78f97b47caba9def9de6ab0cf320d32db9400e6986935e678c296d097795d64fa28d39c09a53d00001500010000000000000000000d7af5b5df0c482d350000006e1ed311d4ecb6b9f06f1bce41921563eb3ca380e3f1c180829b7faae5a878533771b8420fbec77792d3bd0e5b21b27a90316d719732f8e422fb21cbf7f1e4d7224dc5c6d1a25da88b974ee2922515abd51f3646507b53fa27d399996c613628b1e1d8e050d8a30ee7ea404dfde08d2b93a535e90fce"], 0x14c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000040)={0x5, 0x5, 0xfffffffe, 0x3, 'syz0\x00', 0xffff5625}) socket$inet(0x2, 0x3, 0x19) connect$ax25(r0, &(0x7f0000000000)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0xc0096616, 0x0) recvfrom$unix(r3, &(0x7f0000000080)=""/155, 0x9b, 0x2041, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e23}, 0x6e) 19:47:13 executing program 4: 19:47:13 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010008506000000000000ff0100000000", @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r3, @ANYRES32], 0x50}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r7 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r7, &(0x7f00000000c0), 0x492492492492627, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x4c}}, 0x0) 19:47:13 executing program 5: 19:47:13 executing program 3: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3a0100001900010000000000000000001d0100721e0106000000000000da5a271fc7ff7328777c2b0c8660bce578f1dd5c9d9468bdff0af6a3e28132f3482f627f298e29066287945a9e6fae5a9d62680d172a4e8ee1498c1c0135d5024a33de24c38eae5735fc6c3d74d3988a01e0940a7fd2daa5b551b4aa3befda13212c49f75ba67d55374f8e98ecfc732fb48a3619fbf0d69b1490bc5cf9dba7963307217e8910c11e853fd37f3be706b953fadf01cfd8a58379d1f7251da10aae8834f146ecf9939f0c400b5ec903a3f837a4286b47edb15688f75f6ae2bc221e946b244a5be46e916ccef678d742e76091fc2c2ef57a75f8086a8d9cf206538c6beabab5109f83a2debc5e63df6fc78f97b47caba9def9de6ab0cf320d32db9400e6986935e678c296d097795d64fa28d39c09a53d00001500010000000000000000000d7af5b5df0c482d350000006e1ed311d4ecb6b9f06f1bce41921563eb3ca380e3f1c180829b7faae5a878533771b8420fbec77792d3bd0e5b21b27a90316d719732f8e422fb21cbf7f1e4d7224dc5c6d1a25da88b974ee2922515abd51f3646507b53fa27d399996c613628b1e1d8e050d8a30ee7ea404dfde08d2b93a535e90fce"], 0x14c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000040)={0x5, 0x5, 0xfffffffe, 0x3, 'syz0\x00', 0xffff5625}) socket$inet(0x2, 0x3, 0x19) connect$ax25(r0, &(0x7f0000000000)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0xc0096616, 0x0) recvfrom$unix(r3, &(0x7f0000000080)=""/155, 0x9b, 0x2041, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e23}, 0x6e) 19:47:13 executing program 4: 19:47:13 executing program 5: [ 155.633399][ T8430] netlink: 'syz-executor.0': attribute type 1 has an invalid length. 19:47:13 executing program 4: 19:47:13 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:13 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) [ 156.085514][ T29] audit: type=1804 audit(1592164033.833:2): pid=8464 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/10/bus" dev="sda1" ino=15798 res=1 [ 156.188663][ T29] audit: type=1804 audit(1592164033.853:3): pid=8464 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/10/bus" dev="sda1" ino=15798 res=1 [ 156.307362][ T8465] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.2'. [ 156.359449][ T8465] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de [ 156.579083][ T8469] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.3'. [ 156.678902][ T8470] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.1'. [ 156.725543][ T8470] ax25_connect(): syz-executor.1 uses autobind, please contact jreuter@yaina.de [ 156.981751][ T29] audit: type=1804 audit(1592164034.723:4): pid=8466 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/10/bus" dev="sda1" ino=15798 res=1 [ 157.640346][ T29] audit: type=1804 audit(1592164035.383:5): pid=8476 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/10/bus" dev="sda1" ino=15798 res=1 [ 157.792054][ T29] audit: type=1804 audit(1592164035.383:6): pid=8475 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/10/bus" dev="sda1" ino=15798 res=1 [ 158.157640][ T8431] ax25_connect(): syz-executor.3 uses autobind, please contact jreuter@yaina.de 19:47:16 executing program 2: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3a0100001900010000000000000000001d0100721e0106000000000000da5a271fc7ff7328777c2b0c8660bce578f1dd5c9d9468bdff0af6a3e28132f3482f627f298e29066287945a9e6fae5a9d62680d172a4e8ee1498c1c0135d5024a33de24c38eae5735fc6c3d74d3988a01e0940a7fd2daa5b551b4aa3befda13212c49f75ba67d55374f8e98ecfc732fb48a3619fbf0d69b1490bc5cf9dba7963307217e8910c11e853fd37f3be706b953fadf01cfd8a58379d1f7251da10aae8834f146ecf9939f0c400b5ec903a3f837a4286b47edb15688f75f6ae2bc221e946b244a5be46e916ccef678d742e76091fc2c2ef57a75f8086a8d9cf206538c6beabab5109f83a2debc5e63df6fc78f97b47caba9def9de6ab0cf320d32db9400e6986935e678c296d097795d64fa28d39c09a53d00001500010000000000000000000d7af5b5df0c482d350000006e1ed311d4ecb6b9f06f1bce41921563eb3ca380e3f1c180829b7faae5a878533771b8420fbec77792d3bd0e5b21b27a90316d719732f8e422fb21cbf7f1e4d7224dc5c6d1a25da88b974ee2922515abd51f3646507b53fa27d399996c613628b1e1d8e050d8a30ee7ea404dfde08d2b93a535e90fce"], 0x14c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000040)={0x5, 0x5, 0xfffffffe, 0x3, 'syz0\x00', 0xffff5625}) socket$inet(0x2, 0x3, 0x19) connect$ax25(r0, &(0x7f0000000000)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0xc0096616, 0x0) recvfrom$unix(r3, &(0x7f0000000080)=""/155, 0x9b, 0x2041, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e23}, 0x6e) 19:47:16 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000180)={0x13, 0x1}, 0xc) 19:47:16 executing program 1: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3a0100001900010000000000000000001d0100721e0106000000000000da5a271fc7ff7328777c2b0c8660bce578f1dd5c9d9468bdff0af6a3e28132f3482f627f298e29066287945a9e6fae5a9d62680d172a4e8ee1498c1c0135d5024a33de24c38eae5735fc6c3d74d3988a01e0940a7fd2daa5b551b4aa3befda13212c49f75ba67d55374f8e98ecfc732fb48a3619fbf0d69b1490bc5cf9dba7963307217e8910c11e853fd37f3be706b953fadf01cfd8a58379d1f7251da10aae8834f146ecf9939f0c400b5ec903a3f837a4286b47edb15688f75f6ae2bc221e946b244a5be46e916ccef678d742e76091fc2c2ef57a75f8086a8d9cf206538c6beabab5109f83a2debc5e63df6fc78f97b47caba9def9de6ab0cf320d32db9400e6986935e678c296d097795d64fa28d39c09a53d00001500010000000000000000000d7af5b5df0c482d350000006e1ed311d4ecb6b9f06f1bce41921563eb3ca380e3f1c180829b7faae5a878533771b8420fbec77792d3bd0e5b21b27a90316d719732f8e422fb21cbf7f1e4d7224dc5c6d1a25da88b974ee2922515abd51f3646507b53fa27d399996c613628b1e1d8e050d8a30ee7ea404dfde08d2b93a535e90fce"], 0x14c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000040)={0x5, 0x5, 0xfffffffe, 0x3, 'syz0\x00', 0xffff5625}) socket$inet(0x2, 0x3, 0x19) connect$ax25(r0, &(0x7f0000000000)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0xc0096616, 0x0) recvfrom$unix(r3, &(0x7f0000000080)=""/155, 0x9b, 0x2041, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e23}, 0x6e) 19:47:16 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:16 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:47:16 executing program 3: r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3a0100001900010000000000000000001d0100721e0106000000000000da5a271fc7ff7328777c2b0c8660bce578f1dd5c9d9468bdff0af6a3e28132f3482f627f298e29066287945a9e6fae5a9d62680d172a4e8ee1498c1c0135d5024a33de24c38eae5735fc6c3d74d3988a01e0940a7fd2daa5b551b4aa3befda13212c49f75ba67d55374f8e98ecfc732fb48a3619fbf0d69b1490bc5cf9dba7963307217e8910c11e853fd37f3be706b953fadf01cfd8a58379d1f7251da10aae8834f146ecf9939f0c400b5ec903a3f837a4286b47edb15688f75f6ae2bc221e946b244a5be46e916ccef678d742e76091fc2c2ef57a75f8086a8d9cf206538c6beabab5109f83a2debc5e63df6fc78f97b47caba9def9de6ab0cf320d32db9400e6986935e678c296d097795d64fa28d39c09a53d00001500010000000000000000000d7af5b5df0c482d350000006e1ed311d4ecb6b9f06f1bce41921563eb3ca380e3f1c180829b7faae5a878533771b8420fbec77792d3bd0e5b21b27a90316d719732f8e422fb21cbf7f1e4d7224dc5c6d1a25da88b974ee2922515abd51f3646507b53fa27d399996c613628b1e1d8e050d8a30ee7ea404dfde08d2b93a535e90fce"], 0x14c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000040)={0x5, 0x5, 0xfffffffe, 0x3, 'syz0\x00', 0xffff5625}) socket$inet(0x2, 0x3, 0x19) connect$ax25(r0, &(0x7f0000000000)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0xc0096616, 0x0) recvfrom$unix(r3, &(0x7f0000000080)=""/155, 0x9b, 0x2041, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e23}, 0x6e) 19:47:16 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000280)={0x0, 0x7}, 0x8) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) listen(r0, 0x7) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_genetlink_get_family_id$netlbl_unlabel(0x0) close(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000e0c3f49d033499f2b100cb220de8e8d387f05466879ccf7ba2adca001c045c74d50fa4c10e768ab9a8d364f2c22e640a0254c493a27a7d979a385dfb5795838bd2117b0e4cae8683944017e143f58a723e9f2d23b17a466bbb6f9487cc371530232a00d2ed8cfcb2c33724eba9857c5a0f448eac206ab3026143b2514e35d1ff599fbb05c1eeb679db679289f53dfb76c66a19a80dba2a6a1587abff42750c0ebef88824a233a9f0ab316a4b9beb01037d6c98a9fcdb7ba16d3810a8d49824aae4497aa6ed19303699bbe2177083c10281086a0c4f885813e705c69c951d09c8b9cef4b180e0f0ebb946397e9ec150af6a9ca2627ace0000000000000000007f0500000000003e20b3d48ba479593e1dadfa6e82ff1591feb4ea4584024c5178f877014dd6c90e32cab632804c77eb8c2c2e27720b7e7181e1ad1e49ac58e49289862cfba713ec0ee2ac7c2a06c08e5ceb9e9180c10ebedae319cad808ea74ff36ec0ec489fe077b0d6f2627fe51e126a6f2f937f5d0d358341c63571d2e4bb6a7b0aa182fa1f576d54c8f25", @ANYRES32=0x0], &(0x7f000095dffc)=0x8) r2 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') close(r2) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) [ 158.688008][ T29] audit: type=1804 audit(1592164036.433:7): pid=8500 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/11/bus" dev="sda1" ino=15806 res=1 [ 158.817244][ T29] audit: type=1804 audit(1592164036.453:8): pid=8500 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/11/bus" dev="sda1" ino=15806 res=1 [ 159.170971][ T8511] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.2'. [ 159.208194][ T8511] ax25_connect(): syz-executor.2 uses autobind, please contact jreuter@yaina.de 19:47:17 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) [ 159.592985][ T8514] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.1'. [ 159.672225][ T8515] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.3'. 19:47:17 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000280)={0x0, 0x7}, 0x8) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) listen(r0, 0x7) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_genetlink_get_family_id$netlbl_unlabel(0x0) close(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000e0c3f49d033499f2b100cb220de8e8d387f05466879ccf7ba2adca001c045c74d50fa4c10e768ab9a8d364f2c22e640a0254c493a27a7d979a385dfb5795838bd2117b0e4cae8683944017e143f58a723e9f2d23b17a466bbb6f9487cc371530232a00d2ed8cfcb2c33724eba9857c5a0f448eac206ab3026143b2514e35d1ff599fbb05c1eeb679db679289f53dfb76c66a19a80dba2a6a1587abff42750c0ebef88824a233a9f0ab316a4b9beb01037d6c98a9fcdb7ba16d3810a8d49824aae4497aa6ed19303699bbe2177083c10281086a0c4f885813e705c69c951d09c8b9cef4b180e0f0ebb946397e9ec150af6a9ca2627ace0000000000000000007f0500000000003e20b3d48ba479593e1dadfa6e82ff1591feb4ea4584024c5178f877014dd6c90e32cab632804c77eb8c2c2e27720b7e7181e1ad1e49ac58e49289862cfba713ec0ee2ac7c2a06c08e5ceb9e9180c10ebedae319cad808ea74ff36ec0ec489fe077b0d6f2627fe51e126a6f2f937f5d0d358341c63571d2e4bb6a7b0aa182fa1f576d54c8f25", @ANYRES32=0x0], &(0x7f000095dffc)=0x8) r2 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') close(r2) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) 19:47:18 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:47:18 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:18 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6000, 0x1) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f00000002c0)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='hfsplus\x00', 0x0, 0x0) [ 161.213825][ T2425] blk_update_request: I/O error, dev loop1, sector 2 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 161.229934][ T8533] hfsplus: unable to find HFS+ superblock 19:47:19 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6000, 0x1) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f00000002c0)=ANY=[@ANYBLOB='./file0'], &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='hfsplus\x00', 0x0, 0x0) [ 161.250076][ T29] audit: type=1804 audit(1592164038.993:9): pid=8539 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/12/bus" dev="sda1" ino=15808 res=1 19:47:19 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0xd, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x41026, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) listen(r0, 0x7) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_genetlink_get_family_id$netlbl_unlabel(0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, 0x0, 0x4) socket$inet6(0xa, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000e0c3f49d033499f2b100cb220de8e8d387f05466879ccf7ba2adca001c045c74d50fa4c10e768ab9a8d364f2c22e640a0254c493a27a7d979a385dfb5795838bd2117b0e4cae8683944017e143f58a723e9f2d23b17a466bbb6f9487cc371530232a00d2ed8cfcb2c33724eba9857c5a0f448eac206ab3026143b2514e35d1ff599fbb05c1eeb679db679289f53dfb76c66a19a80dba2a6a1587abff42750c0ebef88824a233a9f0ab316a4b9beb01037d6c98a9fcdb7ba16d3810a8d49824aae4497aa6ed19303699bbe2177083c10281086a0c4f885813e705c69c951d09c8b9cef4b180e0f0ebb946397e9ec150af6a9ca2627ace0000000000000000007f0500000000003e20b3d48ba479593e1dadfa6e82ff1591feb4ea4584024c5178f877014dd6c90e32cab632804c77eb8c2c2e27720b7e7181e1ad1e49ac58e49289862cfba713ec0ee2ac7c2a06c08e5ceb9e9180c10ebedae319cad808ea74ff36ec0ec489fe077b0d6f2627fe51e126a6f2f937f5d0d35834"], &(0x7f000095dffc)=0x8) r3 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') close(r3) r4 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000600)="bb8f9f640903127a53527c6fbfe65d43b0e0586f2d40c7e7df58cac83420e83662d6e39bb6d5430622431454eedeeaee423d8f210bc3525fa7927c18d5fbc91ab13c2041136047d8da9375934d00f325499bfe7712208d387d41c31821c2a22d1325b556528e9b790b74053d1ed631c6ec8126d37c87216173138c00cef396868029af5b76bebac5e38b74d8bbc6ae66b6e202b6d505710377710ea7d43edf00e1a4c1c670bb4c263ce777da81abdd5ba5a5c82f67232f9b4d6f21b2e6afa8b38e4642b0daa2acbc0478d89b88e8b2094d4248855e5e81992e60be3afff0f3c3799350615489a901a659abdeca0c615a622ebf64175f990320e0356d4a11ed62eff72b709c23dd65942e8b534d7d775d370c1e435654a2634e6ee3649c4c3bcbe39e866f1eb9972af1a9cef42e701798a53dc92a242aadbac343e1765cf8ea5665e22deda69777e52b1e9e5d3edc022256939e1eee013448294911139d5b9c6241049fecdf9b31f4cdf6cff65d71b5071ef70e1798347c8846aa5b905e83050e3e606986ed3f603d18c5cdeb11cda1ce3abddea9376231af130e19fc7601ec1ab8cb5a7de9e2174547f18225b09a54fc8720dbb91eb69c1be88e601c3c9df4f2758f39a5151951b9c6dbb419ffd783a34c9fad10f201b8724d31865e2fc1fcf48db2be713053b43a0e3943c1e2b08e8a26e946c439d891db2a80b5ffa054bc8d0177d3214056250c61a537d2ec7630fb90395df2cd6aa9c5e573365db580520bdc3f1c6b2be992e1516a4b810a11935dc780699e461d9715f70c6d103ff49bf168f3cff4c0d0d6ba5671fcd2975450b0e1a3474139cb0f2d3476fcd87a8bccbeb2f5f8a821017b879aa5b9d1fafa9f4c429a74cd2da782114d97bf031746a817dd0293c4eddc3a9ecb5afe496f4971474ccd827449409f07cf94dda2e7dbe8520b5afff10a7e3b0b4289a167fc692635b5b7426d9e771b95860b09a3e752c867213c772e48ba30a78feecc7ff26e63e1749c62b52d377ac5cc52db830c965e04ccfcfb24ceacc69cfdc2094124dd27b2d68f699476a2562bab1de117ffc2b0702ee8b0b77f85fecec3a25b37ab7eb06232c9a73b4470f1727c82581d81942abf42d3ea37957927ad3dbd0ebe46678a9f4d25c47acaac83c14210a54b71fed40df017e2be27f01e3e6ea3ea381ca14efd202858e6535ad4f79a8cdf47e385b740a70c14e3651731a45cc0ca4a56f2e903cad0384efcc364caf67e09551d35c682ebc90a9286c4d274ba1b8ced742ede4e55a62db7ef9a96fde2add05b41599fd72a79ba280cc125cb266ef21b7eeafe3ee6aa78eef33fc66454549c3ec298cb683a55a32208cf6ce88b560166159d59e65f30540f62c5437652ea7f2a02f87ca242dd2250f58e75938a9a3ded51ae6598c2aba53287ff5cdaab17be7f4310f8e07e310d52778de79e1c2e4391b254be38910aa1cf6e1ca0e75d24be97d59f7025f16c6fbd549529b74e319c58f50438765ef0e3dc394eeb75dec41b3d80435b17520c97f5cd7ee692fb86d188fb0089fbf737dc1b96b9cc49be23a38a8cd92e5075f349993d7866369dd25eccbe1481477a05fee14e0edd1617921d7fcaa8fdc642e63b64388fa5b63442ff1466b1938d02546750b01ed9c980282ccbe10f204741249aed88c555ed6fdf7f68af9209807a71bbf4f31bef5a4223466da74ba8b034df529aef6ec6610a0d25973961e50e02af22d0ca8be1b9804a5918acbdb536e8f2f441ec9d640ed15133ee747440c86fc4526c9195954528673d25c8390170f3c19cb0b0c30b9e634c7ebae96946ae97c19eabca92226da925d22be37abbe0740938ea899ec42fd529a3b1063981e4c154219df5cf5af60a29b5a8ee530905725a14b28900eae937e705401ba8f632a7bca00d9724a992afdc9ed14aac71b8e3a7ee5ca095888feb195b4e083c3b611a1c2f8d092febe3b9f5f0df61e8d3c31a643c935b76bc1ad4265164e755484beb06610510bc51e8c6da8d71123bbe83a5e4128f41cf5c486d6a60496c300c406f990bee485cbdef794f2663ee66d2b18d8e55210c25c04b1a0c6d9c5f904e72806d2d4f5e5439bcdf146343cdffe4d0d70d42a9959cff9bd50c37cd478b0b0add16aae4dc839b46bca2ac7547144b6a422aed5e2db661bcb31a82bc0fc678e71a6cb090ef772860f3008b4152b5d281033be4a77b367baec3ab8ce7c83c601b11c8199bafcd15161a5454a6a982dbc3c2e3a5172b6a63e4904817075754eccbb0188c9cb2e5da9600f567485014887463b40f189b7ec3c5c0f36d502509e402c285765c78417ce6b3aab130ee79622dcd8ada842233e73a14554ee5e4995e32b3fe4075e247eb9bdeef64d1a7436c9b5782fb2f84f74e4c6e976289729c37b5bb8200a9480d181a6b11f5ec229b818134b8334967ae935ac1d81be4776fae4cb68b6fa330e93bd8de388b38455d569159bcd166df030a6dfedf28caf4608de7243f5df2c76f6680c301d819dc67d24d", 0x700) sendfile(0xffffffffffffffff, r4, 0x0, 0x12000) [ 161.383362][ T29] audit: type=1804 audit(1592164039.033:10): pid=8537 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/12/bus" dev="sda1" ino=15808 res=1 [ 161.384199][ T8501] ax25_connect(): syz-executor.1 uses autobind, please contact jreuter@yaina.de [ 161.445879][ T2425] blk_update_request: I/O error, dev loop1, sector 2 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 161.459550][ T8541] hfsplus: unable to find HFS+ superblock 19:47:19 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:47:19 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000001580)='/dev/bsg\x00', 0xf40, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:47:19 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000240)={0x0, 0x8000}, 0x4) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x5}, @mpls={[], @ipv4=@icmp={{0x8, 0x4, 0x0, 0x0, 0x24, 0x0, 0x6000, 0x0, 0x88, 0x0, @dev, @remote}, @timestamp}}}, 0x100c) 19:47:20 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:47:20 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:47:20 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0xd, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x41026, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) listen(r0, 0x7) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_genetlink_get_family_id$netlbl_unlabel(0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, 0x0, 0x4) socket$inet6(0xa, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000e0c3f49d033499f2b100cb220de8e8d387f05466879ccf7ba2adca001c045c74d50fa4c10e768ab9a8d364f2c22e640a0254c493a27a7d979a385dfb5795838bd2117b0e4cae8683944017e143f58a723e9f2d23b17a466bbb6f9487cc371530232a00d2ed8cfcb2c33724eba9857c5a0f448eac206ab3026143b2514e35d1ff599fbb05c1eeb679db679289f53dfb76c66a19a80dba2a6a1587abff42750c0ebef88824a233a9f0ab316a4b9beb01037d6c98a9fcdb7ba16d3810a8d49824aae4497aa6ed19303699bbe2177083c10281086a0c4f885813e705c69c951d09c8b9cef4b180e0f0ebb946397e9ec150af6a9ca2627ace0000000000000000007f0500000000003e20b3d48ba479593e1dadfa6e82ff1591feb4ea4584024c5178f877014dd6c90e32cab632804c77eb8c2c2e27720b7e7181e1ad1e49ac58e49289862cfba713ec0ee2ac7c2a06c08e5ceb9e9180c10ebedae319cad808ea74ff36ec0ec489fe077b0d6f2627fe51e126a6f2f937f5d0d35834"], &(0x7f000095dffc)=0x8) r3 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') close(r3) r4 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000600)="bb8f9f640903127a53527c6fbfe65d43b0e0586f2d40c7e7df58cac83420e83662d6e39bb6d5430622431454eedeeaee423d8f210bc3525fa7927c18d5fbc91ab13c2041136047d8da9375934d00f325499bfe7712208d387d41c31821c2a22d1325b556528e9b790b74053d1ed631c6ec8126d37c87216173138c00cef396868029af5b76bebac5e38b74d8bbc6ae66b6e202b6d505710377710ea7d43edf00e1a4c1c670bb4c263ce777da81abdd5ba5a5c82f67232f9b4d6f21b2e6afa8b38e4642b0daa2acbc0478d89b88e8b2094d4248855e5e81992e60be3afff0f3c3799350615489a901a659abdeca0c615a622ebf64175f990320e0356d4a11ed62eff72b709c23dd65942e8b534d7d775d370c1e435654a2634e6ee3649c4c3bcbe39e866f1eb9972af1a9cef42e701798a53dc92a242aadbac343e1765cf8ea5665e22deda69777e52b1e9e5d3edc022256939e1eee013448294911139d5b9c6241049fecdf9b31f4cdf6cff65d71b5071ef70e1798347c8846aa5b905e83050e3e606986ed3f603d18c5cdeb11cda1ce3abddea9376231af130e19fc7601ec1ab8cb5a7de9e2174547f18225b09a54fc8720dbb91eb69c1be88e601c3c9df4f2758f39a5151951b9c6dbb419ffd783a34c9fad10f201b8724d31865e2fc1fcf48db2be713053b43a0e3943c1e2b08e8a26e946c439d891db2a80b5ffa054bc8d0177d3214056250c61a537d2ec7630fb90395df2cd6aa9c5e573365db580520bdc3f1c6b2be992e1516a4b810a11935dc780699e461d9715f70c6d103ff49bf168f3cff4c0d0d6ba5671fcd2975450b0e1a3474139cb0f2d3476fcd87a8bccbeb2f5f8a821017b879aa5b9d1fafa9f4c429a74cd2da782114d97bf031746a817dd0293c4eddc3a9ecb5afe496f4971474ccd827449409f07cf94dda2e7dbe8520b5afff10a7e3b0b4289a167fc692635b5b7426d9e771b95860b09a3e752c867213c772e48ba30a78feecc7ff26e63e1749c62b52d377ac5cc52db830c965e04ccfcfb24ceacc69cfdc2094124dd27b2d68f699476a2562bab1de117ffc2b0702ee8b0b77f85fecec3a25b37ab7eb06232c9a73b4470f1727c82581d81942abf42d3ea37957927ad3dbd0ebe46678a9f4d25c47acaac83c14210a54b71fed40df017e2be27f01e3e6ea3ea381ca14efd202858e6535ad4f79a8cdf47e385b740a70c14e3651731a45cc0ca4a56f2e903cad0384efcc364caf67e09551d35c682ebc90a9286c4d274ba1b8ced742ede4e55a62db7ef9a96fde2add05b41599fd72a79ba280cc125cb266ef21b7eeafe3ee6aa78eef33fc66454549c3ec298cb683a55a32208cf6ce88b560166159d59e65f30540f62c5437652ea7f2a02f87ca242dd2250f58e75938a9a3ded51ae6598c2aba53287ff5cdaab17be7f4310f8e07e310d52778de79e1c2e4391b254be38910aa1cf6e1ca0e75d24be97d59f7025f16c6fbd549529b74e319c58f50438765ef0e3dc394eeb75dec41b3d80435b17520c97f5cd7ee692fb86d188fb0089fbf737dc1b96b9cc49be23a38a8cd92e5075f349993d7866369dd25eccbe1481477a05fee14e0edd1617921d7fcaa8fdc642e63b64388fa5b63442ff1466b1938d02546750b01ed9c980282ccbe10f204741249aed88c555ed6fdf7f68af9209807a71bbf4f31bef5a4223466da74ba8b034df529aef6ec6610a0d25973961e50e02af22d0ca8be1b9804a5918acbdb536e8f2f441ec9d640ed15133ee747440c86fc4526c9195954528673d25c8390170f3c19cb0b0c30b9e634c7ebae96946ae97c19eabca92226da925d22be37abbe0740938ea899ec42fd529a3b1063981e4c154219df5cf5af60a29b5a8ee530905725a14b28900eae937e705401ba8f632a7bca00d9724a992afdc9ed14aac71b8e3a7ee5ca095888feb195b4e083c3b611a1c2f8d092febe3b9f5f0df61e8d3c31a643c935b76bc1ad4265164e755484beb06610510bc51e8c6da8d71123bbe83a5e4128f41cf5c486d6a60496c300c406f990bee485cbdef794f2663ee66d2b18d8e55210c25c04b1a0c6d9c5f904e72806d2d4f5e5439bcdf146343cdffe4d0d70d42a9959cff9bd50c37cd478b0b0add16aae4dc839b46bca2ac7547144b6a422aed5e2db661bcb31a82bc0fc678e71a6cb090ef772860f3008b4152b5d281033be4a77b367baec3ab8ce7c83c601b11c8199bafcd15161a5454a6a982dbc3c2e3a5172b6a63e4904817075754eccbb0188c9cb2e5da9600f567485014887463b40f189b7ec3c5c0f36d502509e402c285765c78417ce6b3aab130ee79622dcd8ada842233e73a14554ee5e4995e32b3fe4075e247eb9bdeef64d1a7436c9b5782fb2f84f74e4c6e976289729c37b5bb8200a9480d181a6b11f5ec229b818134b8334967ae935ac1d81be4776fae4cb68b6fa330e93bd8de388b38455d569159bcd166df030a6dfedf28caf4608de7243f5df2c76f6680c301d819dc67d24d", 0x700) sendfile(0xffffffffffffffff, r4, 0x0, 0x12000) [ 162.572973][ T8577] llc_conn_state_process: llc_conn_service failed 19:47:20 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) [ 162.764089][ T8588] llc_conn_state_process: llc_conn_service failed 19:47:20 executing program 5: bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) sendfile(r0, 0xffffffffffffffff, 0x0, 0x80040006) 19:47:20 executing program 5: bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) [ 163.066814][ T29] audit: type=1804 audit(1592164040.813:11): pid=8600 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/13/bus" dev="sda1" ino=15803 res=1 [ 163.113062][ T29] audit: type=1804 audit(1592164040.823:12): pid=8600 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/13/bus" dev="sda1" ino=15803 res=1 19:47:21 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000001580)='/dev/bsg\x00', 0xf40, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:21 executing program 5: bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:21 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000240)={0x0, 0x8000}, 0x4) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x5}, @mpls={[], @ipv4=@icmp={{0x8, 0x4, 0x0, 0x0, 0x24, 0x0, 0x6000, 0x0, 0x88, 0x0, @dev, @remote}, @timestamp}}}, 0x100c) 19:47:21 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) sendfile(r0, 0xffffffffffffffff, 0x0, 0x80040006) 19:47:21 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0xd, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x41026, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) listen(r0, 0x7) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_genetlink_get_family_id$netlbl_unlabel(0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, 0x0, 0x4) socket$inet6(0xa, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000e0c3f49d033499f2b100cb220de8e8d387f05466879ccf7ba2adca001c045c74d50fa4c10e768ab9a8d364f2c22e640a0254c493a27a7d979a385dfb5795838bd2117b0e4cae8683944017e143f58a723e9f2d23b17a466bbb6f9487cc371530232a00d2ed8cfcb2c33724eba9857c5a0f448eac206ab3026143b2514e35d1ff599fbb05c1eeb679db679289f53dfb76c66a19a80dba2a6a1587abff42750c0ebef88824a233a9f0ab316a4b9beb01037d6c98a9fcdb7ba16d3810a8d49824aae4497aa6ed19303699bbe2177083c10281086a0c4f885813e705c69c951d09c8b9cef4b180e0f0ebb946397e9ec150af6a9ca2627ace0000000000000000007f0500000000003e20b3d48ba479593e1dadfa6e82ff1591feb4ea4584024c5178f877014dd6c90e32cab632804c77eb8c2c2e27720b7e7181e1ad1e49ac58e49289862cfba713ec0ee2ac7c2a06c08e5ceb9e9180c10ebedae319cad808ea74ff36ec0ec489fe077b0d6f2627fe51e126a6f2f937f5d0d35834"], &(0x7f000095dffc)=0x8) r3 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) syz_genetlink_get_family_id$ipvs(&(0x7f0000000380)='IPVS\x00') close(r3) r4 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000600)="bb8f9f640903127a53527c6fbfe65d43b0e0586f2d40c7e7df58cac83420e83662d6e39bb6d5430622431454eedeeaee423d8f210bc3525fa7927c18d5fbc91ab13c2041136047d8da9375934d00f325499bfe7712208d387d41c31821c2a22d1325b556528e9b790b74053d1ed631c6ec8126d37c87216173138c00cef396868029af5b76bebac5e38b74d8bbc6ae66b6e202b6d505710377710ea7d43edf00e1a4c1c670bb4c263ce777da81abdd5ba5a5c82f67232f9b4d6f21b2e6afa8b38e4642b0daa2acbc0478d89b88e8b2094d4248855e5e81992e60be3afff0f3c3799350615489a901a659abdeca0c615a622ebf64175f990320e0356d4a11ed62eff72b709c23dd65942e8b534d7d775d370c1e435654a2634e6ee3649c4c3bcbe39e866f1eb9972af1a9cef42e701798a53dc92a242aadbac343e1765cf8ea5665e22deda69777e52b1e9e5d3edc022256939e1eee013448294911139d5b9c6241049fecdf9b31f4cdf6cff65d71b5071ef70e1798347c8846aa5b905e83050e3e606986ed3f603d18c5cdeb11cda1ce3abddea9376231af130e19fc7601ec1ab8cb5a7de9e2174547f18225b09a54fc8720dbb91eb69c1be88e601c3c9df4f2758f39a5151951b9c6dbb419ffd783a34c9fad10f201b8724d31865e2fc1fcf48db2be713053b43a0e3943c1e2b08e8a26e946c439d891db2a80b5ffa054bc8d0177d3214056250c61a537d2ec7630fb90395df2cd6aa9c5e573365db580520bdc3f1c6b2be992e1516a4b810a11935dc780699e461d9715f70c6d103ff49bf168f3cff4c0d0d6ba5671fcd2975450b0e1a3474139cb0f2d3476fcd87a8bccbeb2f5f8a821017b879aa5b9d1fafa9f4c429a74cd2da782114d97bf031746a817dd0293c4eddc3a9ecb5afe496f4971474ccd827449409f07cf94dda2e7dbe8520b5afff10a7e3b0b4289a167fc692635b5b7426d9e771b95860b09a3e752c867213c772e48ba30a78feecc7ff26e63e1749c62b52d377ac5cc52db830c965e04ccfcfb24ceacc69cfdc2094124dd27b2d68f699476a2562bab1de117ffc2b0702ee8b0b77f85fecec3a25b37ab7eb06232c9a73b4470f1727c82581d81942abf42d3ea37957927ad3dbd0ebe46678a9f4d25c47acaac83c14210a54b71fed40df017e2be27f01e3e6ea3ea381ca14efd202858e6535ad4f79a8cdf47e385b740a70c14e3651731a45cc0ca4a56f2e903cad0384efcc364caf67e09551d35c682ebc90a9286c4d274ba1b8ced742ede4e55a62db7ef9a96fde2add05b41599fd72a79ba280cc125cb266ef21b7eeafe3ee6aa78eef33fc66454549c3ec298cb683a55a32208cf6ce88b560166159d59e65f30540f62c5437652ea7f2a02f87ca242dd2250f58e75938a9a3ded51ae6598c2aba53287ff5cdaab17be7f4310f8e07e310d52778de79e1c2e4391b254be38910aa1cf6e1ca0e75d24be97d59f7025f16c6fbd549529b74e319c58f50438765ef0e3dc394eeb75dec41b3d80435b17520c97f5cd7ee692fb86d188fb0089fbf737dc1b96b9cc49be23a38a8cd92e5075f349993d7866369dd25eccbe1481477a05fee14e0edd1617921d7fcaa8fdc642e63b64388fa5b63442ff1466b1938d02546750b01ed9c980282ccbe10f204741249aed88c555ed6fdf7f68af9209807a71bbf4f31bef5a4223466da74ba8b034df529aef6ec6610a0d25973961e50e02af22d0ca8be1b9804a5918acbdb536e8f2f441ec9d640ed15133ee747440c86fc4526c9195954528673d25c8390170f3c19cb0b0c30b9e634c7ebae96946ae97c19eabca92226da925d22be37abbe0740938ea899ec42fd529a3b1063981e4c154219df5cf5af60a29b5a8ee530905725a14b28900eae937e705401ba8f632a7bca00d9724a992afdc9ed14aac71b8e3a7ee5ca095888feb195b4e083c3b611a1c2f8d092febe3b9f5f0df61e8d3c31a643c935b76bc1ad4265164e755484beb06610510bc51e8c6da8d71123bbe83a5e4128f41cf5c486d6a60496c300c406f990bee485cbdef794f2663ee66d2b18d8e55210c25c04b1a0c6d9c5f904e72806d2d4f5e5439bcdf146343cdffe4d0d70d42a9959cff9bd50c37cd478b0b0add16aae4dc839b46bca2ac7547144b6a422aed5e2db661bcb31a82bc0fc678e71a6cb090ef772860f3008b4152b5d281033be4a77b367baec3ab8ce7c83c601b11c8199bafcd15161a5454a6a982dbc3c2e3a5172b6a63e4904817075754eccbb0188c9cb2e5da9600f567485014887463b40f189b7ec3c5c0f36d502509e402c285765c78417ce6b3aab130ee79622dcd8ada842233e73a14554ee5e4995e32b3fe4075e247eb9bdeef64d1a7436c9b5782fb2f84f74e4c6e976289729c37b5bb8200a9480d181a6b11f5ec229b818134b8334967ae935ac1d81be4776fae4cb68b6fa330e93bd8de388b38455d569159bcd166df030a6dfedf28caf4608de7243f5df2c76f6680c301d819dc67d24d", 0x700) sendfile(0xffffffffffffffff, r4, 0x0, 0x12000) 19:47:22 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:47:22 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) sendfile(r0, 0xffffffffffffffff, 0x0, 0x80040006) 19:47:22 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000001580)='/dev/bsg\x00', 0xf40, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:22 executing program 2: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000001580)='/dev/bsg\x00', 0xf40, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:47:22 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:22 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000001580)='/dev/bsg\x00', 0xf40, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:47:22 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:47:22 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) [ 164.998563][ T29] audit: type=1804 audit(1592164042.743:13): pid=8668 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/14/bus" dev="sda1" ino=15822 res=1 [ 165.059936][ T8670] llc_conn_state_process: llc_conn_service failed [ 165.128640][ T29] audit: type=1804 audit(1592164042.793:14): pid=8671 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/14/bus" dev="sda1" ino=15822 res=1 19:47:23 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:47:23 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:23 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000001580)='/dev/bsg\x00', 0xf40, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:23 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000001580)='/dev/bsg\x00', 0xf40, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:23 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:47:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:47:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) [ 166.067209][ T8692] llc_conn_state_process: llc_conn_service failed 19:47:23 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:24 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) [ 166.218036][ T29] audit: type=1804 audit(1592164043.963:15): pid=8701 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/15/bus" dev="sda1" ino=15827 res=1 [ 166.251923][ T8703] llc_conn_state_process: llc_conn_service failed [ 166.325458][ T29] audit: type=1804 audit(1592164043.993:16): pid=8701 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/15/bus" dev="sda1" ino=15827 res=1 19:47:24 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, 0x0, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:24 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r1, 0x0, 0x80040006) 19:47:24 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, 0x0, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) [ 166.681822][ T8710] llc_conn_state_process: llc_conn_service failed [ 166.825970][ T8716] llc_conn_state_process: llc_conn_service failed 19:47:24 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:47:24 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, 0x0, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:24 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000001580)='/dev/bsg\x00', 0xf40, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:24 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) [ 167.288095][ T8727] llc_conn_state_process: llc_conn_service failed [ 167.464318][ T29] audit: type=1804 audit(1592164045.203:17): pid=8734 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/16/bus" dev="sda1" ino=15835 res=1 [ 167.545626][ T29] audit: type=1804 audit(1592164045.233:18): pid=8734 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/16/bus" dev="sda1" ino=15835 res=1 19:47:26 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:47:26 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:26 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r1, 0x0, 0x80040006) 19:47:26 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:26 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000001580)='/dev/bsg\x00', 0xf40, 0x0) 19:47:26 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:47:26 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) [ 169.027726][ T8750] llc_conn_state_process: llc_conn_service failed [ 169.059744][ T29] audit: type=1804 audit(1592164046.803:19): pid=8754 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/17/bus" dev="sda1" ino=15835 res=1 [ 169.126793][ T8760] llc_conn_state_process: llc_conn_service failed [ 169.164297][ T29] audit: type=1804 audit(1592164046.843:20): pid=8754 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/17/bus" dev="sda1" ino=15835 res=1 19:47:27 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) [ 169.358773][ T8770] llc_conn_state_process: llc_conn_service failed 19:47:27 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:27 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:47:27 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r1, 0x0, 0x80040006) 19:47:27 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:29 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:47:29 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:47:29 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:29 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) 19:47:29 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:29 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(0xffffffffffffffff, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r1, 0x0, 0x80040006) [ 172.149128][ T29] audit: type=1804 audit(1592164049.893:21): pid=8807 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/18/bus" dev="sda1" ino=15861 res=1 19:47:30 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) [ 172.256727][ T29] audit: type=1804 audit(1592164049.893:22): pid=8807 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/18/bus" dev="sda1" ino=15861 res=1 19:47:30 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) 19:47:30 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1}, 0x10) connect$llc(r0, 0x0, 0x0) 19:47:30 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1}, 0x10) connect$llc(r0, 0x0, 0x0) 19:47:30 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:47:30 executing program 5: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1}, 0x10) connect$llc(r0, 0x0, 0x0) [ 173.107354][ T29] audit: type=1804 audit(1592164050.853:23): pid=8836 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/19/bus" dev="sda1" ino=15854 res=1 [ 173.161195][ T29] audit: type=1804 audit(1592164050.853:24): pid=8836 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/19/bus" dev="sda1" ino=15854 res=1 19:47:32 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:47:32 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:32 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) 19:47:32 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(0xffffffffffffffff, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r1, 0x0, 0x80040006) 19:47:32 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) [ 175.235251][ T8853] binder: BINDER_SET_CONTEXT_MGR already set [ 175.249225][ T29] audit: type=1804 audit(1592164052.993:25): pid=8856 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/20/bus" dev="sda1" ino=15882 res=1 [ 175.260010][ T8853] binder: 8849:8853 ioctl 40046207 0 returned -16 [ 175.280742][ T8860] binder: BINDER_SET_CONTEXT_MGR already set [ 175.300616][ T8860] binder: 8849:8860 ioctl 40046207 0 returned -16 [ 175.305456][ T29] audit: type=1804 audit(1592164052.993:26): pid=8856 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/20/bus" dev="sda1" ino=15882 res=1 19:47:33 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:33 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:33 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:33 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:33 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:33 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:36 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$cont(0x7, r0, 0x0, 0x0) 19:47:36 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:36 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x1ff, 0xf801}, 0x8) 19:47:36 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:36 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(0xffffffffffffffff, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r1, 0x0, 0x80040006) 19:47:36 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) [ 178.273060][ T29] audit: type=1804 audit(1592164056.013:27): pid=8896 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/21/bus" dev="sda1" ino=15889 res=1 [ 178.338520][ T29] audit: type=1804 audit(1592164056.043:28): pid=8896 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/21/bus" dev="sda1" ino=15889 res=1 19:47:36 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:36 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:36 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:36 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 178.841848][ T8921] binder_alloc: 8920: binder_alloc_buf, no vma 19:47:36 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 178.961466][ T8924] binder_alloc: 8923: binder_alloc_buf, no vma 19:47:36 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 179.030784][ T8926] binder_alloc: 8925: binder_alloc_buf, no vma 19:47:39 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$cont(0x7, r0, 0x0, 0x0) 19:47:39 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f00000000c0)=0x9c) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:47:39 executing program 0: r0 = socket(0xa, 0x2, 0x0) dup2(r0, 0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(0xffffffffffffffff, r1, 0x0, 0x80040006) 19:47:39 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:39 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:39 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) [ 181.421374][ T29] audit: type=1804 audit(1592164059.163:29): pid=8940 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/22/bus" dev="sda1" ino=15905 res=1 19:47:39 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:39 executing program 0: r0 = socket(0xa, 0x2, 0x0) dup2(r0, 0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(0xffffffffffffffff, r1, 0x0, 0x80040006) [ 181.484917][ T29] audit: type=1804 audit(1592164059.193:30): pid=8940 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/22/bus" dev="sda1" ino=15905 res=1 19:47:39 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:39 executing program 0: r0 = socket(0xa, 0x2, 0x0) dup2(r0, 0xffffffffffffffff) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(0xffffffffffffffff, r1, 0x0, 0x80040006) 19:47:39 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:39 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x0, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:47:42 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$cont(0x7, r0, 0x0, 0x0) 19:47:42 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:42 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:42 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(0xffffffffffffffff, 0x84, 0x6e, &(0x7f0000000180)=[@in6={0xa, 0x0, 0x0, @dev, 0xc}], 0x1c) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:47:42 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:47:42 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x0, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:47:42 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 184.558342][ T29] audit: type=1804 audit(1592164062.304:31): pid=8987 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/23/bus" dev="sda1" ino=15931 res=1 [ 184.600722][ T29] audit: type=1804 audit(1592164062.334:32): pid=8987 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/23/bus" dev="sda1" ino=15931 res=1 19:47:42 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) [ 184.766174][ T29] audit: type=1804 audit(1592164062.514:33): pid=9002 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/24/bus" dev="sda1" ino=15931 res=1 19:47:42 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:42 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) [ 184.862118][ T29] audit: type=1804 audit(1592164062.544:34): pid=9002 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/24/bus" dev="sda1" ino=15931 res=1 19:47:42 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 184.982576][ T29] audit: type=1804 audit(1592164062.724:35): pid=9007 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/25/bus" dev="sda1" ino=15931 res=1 19:47:42 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) [ 185.081591][ T29] audit: type=1804 audit(1592164062.764:36): pid=9007 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/25/bus" dev="sda1" ino=15931 res=1 [ 185.179461][ T29] audit: type=1804 audit(1592164062.924:37): pid=9013 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/26/bus" dev="sda1" ino=15931 res=1 19:47:45 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:47:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:45 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:47:45 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x0, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:47:45 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:45 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:47:45 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) [ 187.620389][ T29] audit: type=1804 audit(1592164065.364:38): pid=9032 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/27/bus" dev="sda1" ino=15946 res=1 19:47:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 187.778975][ T29] audit: type=1804 audit(1592164065.524:39): pid=9043 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/28/bus" dev="sda1" ino=15949 res=1 19:47:45 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, 0xffffffffffffffff, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:47:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:45 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:45 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:48 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:47:48 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:48 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:48 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x0, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:47:48 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:47:48 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, 0xffffffffffffffff, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) [ 190.736258][ T9075] llc_conn_state_process: llc_conn_service failed 19:47:48 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:48 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:48 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:48 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 191.059986][ T9094] llc_conn_state_process: llc_conn_service failed 19:47:48 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:49 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:51 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:47:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:51 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:47:51 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x0, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:47:51 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, 0xffffffffffffffff, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:47:51 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) [ 193.830281][ T9121] llc_conn_state_process: llc_conn_service failed 19:47:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 193.874622][ T9127] llc_conn_state_process: llc_conn_service failed 19:47:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:52 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:52 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 194.519762][ T9148] binder: 9147:9148 ioctl c0306201 0 returned -14 19:47:52 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 194.673106][ T9151] binder: 9150:9151 ioctl c0306201 0 returned -14 19:47:54 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:54 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x0, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:47:54 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:47:54 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:47:54 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:54 executing program 4: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) [ 196.907211][ T9167] binder: 9161:9167 ioctl c0306201 0 returned -14 [ 196.938938][ T9170] llc_conn_state_process: llc_conn_service failed 19:47:54 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 196.964519][ T9171] llc_conn_state_process: llc_conn_service failed [ 197.059771][ T9181] binder: 9179:9181 ioctl c0306201 20000200 returned -14 19:47:54 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:54 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 197.179206][ T9185] binder: 9184:9185 ioctl c0306201 20000200 returned -14 [ 197.285238][ T9189] binder: 9186:9189 ioctl c0306201 20000200 returned -14 19:47:55 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 197.387654][ T9191] binder: 9190:9191 unknown command 0 [ 197.393926][ T9191] binder: 9190:9191 ioctl c0306201 20000200 returned -22 19:47:55 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:55 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 197.577644][ T9195] binder: 9193:9195 unknown command 0 [ 197.589908][ T9195] binder: 9193:9195 ioctl c0306201 20000200 returned -22 [ 197.692805][ T9197] binder: 9196:9197 unknown command 0 [ 197.730380][ T9197] binder: 9196:9197 ioctl c0306201 20000200 returned -22 19:47:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket(0xa, 0x2, 0x0) dup2(0xffffffffffffffff, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r1, 0x0, 0x80040006) 19:47:55 executing program 3: bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:47:57 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:47:57 executing program 1: bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:57 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:57 executing program 3: bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:47:57 executing program 4: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:47:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket(0xa, 0x2, 0x0) dup2(0xffffffffffffffff, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r1, 0x0, 0x80040006) 19:47:57 executing program 3: bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:47:57 executing program 1: bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) [ 200.044883][ T9223] binder: 9216:9223 unknown command 0 [ 200.072096][ T9223] binder: 9216:9223 ioctl c0306201 20000200 returned -22 19:47:57 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:47:57 executing program 1: bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:47:58 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) [ 200.265957][ T9237] binder: 9235:9237 unknown command 0 [ 200.279338][ T9237] binder: 9235:9237 ioctl c0306201 20000200 returned -22 19:47:58 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 200.456748][ T9244] binder: 9243:9244 unknown command 0 [ 200.469165][ T9244] binder: 9243:9244 ioctl c0306201 20000200 returned -22 19:48:00 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:00 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:00 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:00 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket(0xa, 0x2, 0x0) dup2(0xffffffffffffffff, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r1, 0x0, 0x80040006) 19:48:00 executing program 4: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:00 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:00 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) [ 203.137717][ T9261] binder: 9259:9261 unknown command 25349 [ 203.167282][ T9261] binder: 9259:9261 ioctl c0306201 20000200 returned -22 19:48:01 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:01 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:01 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x0, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) [ 203.361553][ T9278] binder: 9276:9278 unknown command 25349 [ 203.395983][ T9278] binder: 9276:9278 ioctl c0306201 20000200 returned -22 19:48:01 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 203.447414][ T9283] llc_conn_state_process: llc_conn_service failed [ 203.582093][ T9288] binder: 9287:9288 unknown command 25349 [ 203.605581][ T9288] binder: 9287:9288 ioctl c0306201 20000200 returned -22 19:48:03 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:03 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:03 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:03 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:48:03 executing program 4: creat(0x0, 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:03 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:04 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) [ 206.197872][ T9306] binder: 9301:9306 unknown command 287493 [ 206.220006][ T9306] binder: 9301:9306 ioctl c0306201 20000200 returned -22 19:48:04 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:04 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:04 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) [ 206.369282][ T9321] binder: 9318:9321 unknown command 287493 [ 206.399996][ T9321] binder: 9318:9321 ioctl c0306201 20000200 returned -22 19:48:04 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:04 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, 0x0, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) [ 206.548294][ T9329] binder: 9326:9329 unknown command 287493 [ 206.578039][ T9329] binder: 9326:9329 ioctl c0306201 20000200 returned -22 19:48:07 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:07 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, 0x0, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:07 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, 0x0, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:07 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:48:07 executing program 4: creat(0x0, 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:07 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:07 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, 0x0, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:07 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, 0x0, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:07 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:07 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, 0x0, 0x0) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:07 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:10 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:10 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:10 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:10 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, 0xffffffffffffffff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:48:10 executing program 4: creat(0x0, 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:10 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:10 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:10 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:10 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:10 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:10 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:13 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:13 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:13 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:13 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:48:13 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(0x0, 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:13 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 215.507055][ T9424] binder_alloc: 9423: binder_alloc_buf, no vma 19:48:13 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:13 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:48:13 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:13 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 215.680145][ T9436] binder_alloc: 9432: binder_alloc_buf, no vma 19:48:13 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:13 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:48:13 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:13 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 215.875040][ T9451] binder_alloc: 9447: binder_alloc_buf, no vma 19:48:14 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(0x0, 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:14 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:14 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, 0x0, 0x0) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:48:14 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:14 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:14 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, 0x0, 0x0) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:48:14 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, 0x0, 0x0) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:48:14 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:16 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:16 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:16 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:16 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:48:16 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(0x0, 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:16 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:48:16 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:16 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:16 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:48:19 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:19 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:19 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:19 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:48:19 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(0x0, 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:19 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) [ 222.119061][ T29] audit: type=1804 audit(1592164099.865:40): pid=9539 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/41/bus" dev="sda1" ino=16139 res=1 [ 222.145154][ T9542] binder: 9537:9542 ioctl c0306201 0 returned -14 19:48:19 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:19 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(0x0, 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x80040006) 19:48:20 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:20 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) [ 222.341669][ T29] audit: type=1804 audit(1592164100.085:41): pid=9554 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/42/bus" dev="sda1" ino=15686 res=1 [ 222.461402][ T9557] binder: 9553:9557 ioctl c0306201 0 returned -14 19:48:22 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:22 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(0x0, 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, 0x0) sendfile(r0, r2, 0x0, 0x80040006) 19:48:22 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:22 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 19:48:22 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) [ 225.230461][ T9579] binder: 9576:9579 ioctl c0306201 0 returned -14 [ 225.260567][ T29] audit: type=1804 audit(1592164103.006:42): pid=9583 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/43/bus" dev="sda1" ino=16163 res=1 19:48:23 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:23 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:23 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, 0x0) sendfile(r0, r2, 0x0, 0x80040006) 19:48:23 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:23 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, 0x0, 0x0, 0x0) 19:48:23 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, 0x0) sendfile(r0, r2, 0x0, 0x80040006) [ 225.447002][ T29] audit: type=1804 audit(1592164103.196:43): pid=9591 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/44/bus" dev="sda1" ino=16159 res=1 19:48:23 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(0x0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) [ 225.522408][ T9601] binder: 9593:9601 ioctl c0306201 20000280 returned -14 19:48:23 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:23 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) [ 225.569434][ T29] audit: type=1804 audit(1592164103.216:44): pid=9591 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/44/bus" dev="sda1" ino=16159 res=1 19:48:23 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:23 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(0x0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 19:48:23 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, 0x0, 0x0, 0x0) 19:48:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0x80040006) 19:48:23 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:23 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(0x0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) [ 225.735671][ T9616] binder: 9613:9616 ioctl c0306201 20000280 returned -14 [ 225.759967][ T29] audit: type=1804 audit(1592164103.506:45): pid=9618 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/45/bus" dev="sda1" ino=15751 res=1 19:48:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0x80040006) 19:48:23 executing program 3: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, 0x0, 0x0, 0x0) 19:48:23 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:23 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 225.873465][ T29] audit: type=1804 audit(1592164103.536:46): pid=9618 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/45/bus" dev="sda1" ino=15751 res=1 19:48:23 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:23 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0x80040006) [ 226.014222][ T29] audit: type=1804 audit(1592164103.746:47): pid=9634 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/46/bus" dev="sda1" ino=16164 res=1 [ 226.048874][ T9638] binder: 9635:9638 ioctl c0306201 20000280 returned -14 19:48:23 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:23 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:23 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:23 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:23 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 226.172405][ T29] audit: type=1804 audit(1592164103.746:48): pid=9634 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/46/bus" dev="sda1" ino=16164 res=1 19:48:24 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, 0xffffffffffffffff, 0x0, 0x80040006) 19:48:24 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) [ 226.303564][ T29] audit: type=1804 audit(1592164103.996:49): pid=9650 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/47/bus" dev="sda1" ino=16159 res=1 19:48:24 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:24 executing program 3: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000080)="ac6e2e77fb8e6a66ce536360a7e1") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 19:48:24 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 226.344854][ T9656] binder: 9652:9656 unknown command 0 [ 226.383771][ T9656] binder: 9652:9656 ioctl c0306201 20000280 returned -22 19:48:24 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:24 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, 0xffffffffffffffff, 0x0, 0x80040006) 19:48:24 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000900), 0x4000000000001db, 0x2003, 0x0) 19:48:24 executing program 3: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000080)="ac6e2e77fb8e6a66ce536360a7e1") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 19:48:24 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) [ 226.655609][ T9674] binder: 9670:9674 unknown command 0 [ 226.661019][ T9674] binder: 9670:9674 ioctl c0306201 20000280 returned -22 19:48:24 executing program 2: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:24 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:24 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, 0xffffffffffffffff, 0x0, 0x80040006) 19:48:24 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 227.037552][ T9688] binder: 9683:9688 unknown command 0 [ 227.043046][ T9688] binder: 9683:9688 ioctl c0306201 20000280 returned -22 19:48:24 executing program 3: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000080)="ac6e2e77fb8e6a66ce536360a7e1") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 19:48:24 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2003, 0x0) [ 227.144215][ T9692] ptrace attach of "/root/syz-executor.2"[9690] was attempted by "/root/syz-executor.2"[9692] [ 227.177845][ T9693] binder: 9689:9693 unknown command 0 [ 227.183335][ T9693] binder: 9689:9693 ioctl c0306201 20000280 returned -22 19:48:24 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:25 executing program 2: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:25 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:25 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x0) 19:48:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 227.555982][ T9706] binder: 9700:9706 unknown command 0 [ 227.561496][ T9706] binder: 9700:9706 ioctl c0306201 20000280 returned -22 19:48:25 executing program 3: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000080)="ac6e2e77fb8e6a66ce536360a7e1") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 19:48:26 executing program 2: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:26 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2003, 0x0) 19:48:26 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x0) [ 228.326496][ T29] kauditd_printk_skb: 3 callbacks suppressed [ 228.326509][ T29] audit: type=1804 audit(1592164106.076:53): pid=9712 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/50/bus" dev="sda1" ino=15735 res=1 [ 228.599231][ T9717] binder: 9715:9717 unknown command 0 [ 229.059650][ T9722] ptrace attach of "/root/syz-executor.2"[9720] was attempted by "/root/syz-executor.2"[9722] 19:48:26 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:26 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:26 executing program 3: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000080)="ac6e2e77fb8e6a66ce536360a7e1") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 229.245102][ T9717] binder: 9715:9717 ioctl c0306201 20000280 returned -22 [ 229.330345][ T29] audit: type=1804 audit(1592164106.086:54): pid=9712 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/50/bus" dev="sda1" ino=15735 res=1 19:48:27 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2003, 0x0) 19:48:27 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x5}, 0x1c) timer_create(0x0, 0x0, &(0x7f0000044000)) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='timers\x00') sendfile(r0, r2, 0x0, 0x0) 19:48:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:27 executing program 3: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000080)="ac6e2e77fb8e6a66ce536360a7e1") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 229.634000][ T29] audit: type=1804 audit(1592164107.266:55): pid=9734 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/51/bus" dev="sda1" ino=16140 res=1 19:48:27 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:27 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:27 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x0, 0x0) [ 229.918187][ T9748] binder: 9744:9748 unknown command 25349 [ 229.956318][ T29] audit: type=1804 audit(1592164107.266:56): pid=9732 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/51/bus" dev="sda1" ino=16140 res=1 [ 230.032348][ T9748] binder: 9744:9748 ioctl c0306201 20000280 returned -22 19:48:27 executing program 0: 19:48:28 executing program 3: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000080)="ac6e2e77fb8e6a66ce536360a7e1") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 19:48:28 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:28 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x0, 0x0) 19:48:28 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:28 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:28 executing program 0: 19:48:28 executing program 3: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000080)="ac6e2e77fb8e6a66ce536360a7e1") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, &(0x7f0000000000)='0', 0xfffffd2c) [ 230.740673][ T9773] binder: 9766:9773 unknown command 25349 19:48:28 executing program 1: r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x1f}, 0x10) connect$llc(r0, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x10) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) recvmmsg(r0, &(0x7f0000000900), 0x4000000000001db, 0x0, 0x0) [ 230.822796][ T9773] binder: 9766:9773 ioctl c0306201 20000280 returned -22 19:48:28 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:28 executing program 0: 19:48:28 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:28 executing program 3: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000080)="ac6e2e77fb8e6a66ce536360a7e1") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, &(0x7f0000000000)='0', 0xfffffd2c) 19:48:29 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:29 executing program 3: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000080)="ac6e2e77fb8e6a66ce536360a7e1") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, &(0x7f0000000000)='0', 0xfffffd2c) 19:48:29 executing program 0: 19:48:29 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:29 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:29 executing program 3: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000080)="ac6e2e77fb8e6a66ce536360a7e1") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 19:48:29 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:29 executing program 0: 19:48:29 executing program 1: [ 232.100124][ T9809] binder: 9807:9809 unknown command 287493 19:48:29 executing program 1: 19:48:29 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:30 executing program 3: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000080)="ac6e2e77fb8e6a66ce536360a7e1") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 19:48:30 executing program 0: [ 232.919326][ T9809] binder: 9807:9809 ioctl c0306201 20000280 returned -22 19:48:30 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:30 executing program 1: [ 233.075796][ T29] audit: type=1804 audit(1592164110.827:57): pid=9825 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/54/bus" dev="sda1" ino=16216 res=1 [ 233.338805][ T29] audit: type=1804 audit(1592164110.927:58): pid=9828 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/54/bus" dev="sda1" ino=16216 res=1 19:48:31 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x12, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:31 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:31 executing program 0: 19:48:31 executing program 3: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000080)="ac6e2e77fb8e6a66ce536360a7e1") openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) [ 234.121194][ T9835] binder: 9833:9835 unknown command 287493 19:48:31 executing program 1: [ 234.181632][ T9835] binder: 9833:9835 ioctl c0306201 20000280 returned -22 19:48:32 executing program 0: [ 234.370170][ T29] audit: type=1804 audit(1592164112.107:59): pid=9842 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/55/bus" dev="sda1" ino=16226 res=1 19:48:32 executing program 1: 19:48:32 executing program 3: ioctl$PIO_FONT(0xffffffffffffffff, 0x4b61, &(0x7f0000000080)="ac6e2e77fb8e6a66ce536360a7e1") clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 19:48:32 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 235.216872][ T29] audit: type=1804 audit(1592164112.107:60): pid=9842 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/55/bus" dev="sda1" ino=16226 res=1 [ 235.329277][ T9851] binder: 9850:9851 unknown command 287493 [ 235.335839][ T9851] binder: 9850:9851 ioctl c0306201 20000280 returned -22 19:48:33 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 19:48:34 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:34 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:34 executing program 3: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 19:48:34 executing program 1: 19:48:34 executing program 0: 19:48:34 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x10, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) [ 236.487349][ T29] audit: type=1804 audit(1592164114.237:61): pid=9865 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/56/bus" dev="sda1" ino=16245 res=1 19:48:34 executing program 0: 19:48:34 executing program 1: 19:48:35 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) 19:48:35 executing program 3: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) [ 237.341607][ T29] audit: type=1804 audit(1592164114.287:62): pid=9862 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/56/bus" dev="sda1" ino=16245 res=1 19:48:35 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:35 executing program 0: 19:48:35 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000001440)={0x8, {"0000051a00"}}, 0xfffffc41) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x10, r0, 0x0) mlock2(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) mlock(&(0x7f0000005000/0x1000)=nil, 0x1000) mlock(&(0x7f0000003000/0x3000)=nil, 0x3000) 19:48:35 executing program 1: 19:48:35 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x1000000, 0x0}) [ 237.776542][ T29] audit: type=1804 audit(1592164115.518:63): pid=9883 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/57/bus" dev="sda1" ino=16240 res=1 19:48:36 executing program 3: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 19:48:36 executing program 1: [ 238.415880][ T29] audit: type=1804 audit(1592164115.518:64): pid=9883 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir052362319/syzkaller.F4IaoV/57/bus" dev="sda1" ino=16240 res=1 19:48:37 executing program 0: 19:48:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141001) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) 19:48:37 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 19:48:37 executing program 1: 19:48:37 executing program 3: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x141001) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) [ 239.718736][ T9901] binder: 9897:9901 ioctl c0306201 0 returned -14 19:48:38 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000193c0)=""/102396, 0xffffffffffffffed}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @ext={0x149, &(0x7f0000000240)="f7f249b97e0c9e57f43d26a700000078008a58480aa4cefd3b79e77d0076cc03592a160500000032a56f72590900249950f34c82a1cef20d94c30e478947c990ab9493646d6c0b004d9246a8f6542604f2f03f76a9084f69d06e07d3d82ce0db72a147aed99f6c57597080fe26fa9fcc1fe364a951fc9d4924ccde5d7841310a81aa0839b0c9e7b6e791484f831df7af25accd85a1e13e414bd533dd0a896113ed4fd2a464cf7f547493a411599a09a350bb94354b5efc0190d0d97fda83f2ee9a8bfc98faa9ddc095f4a48b4446f1f488fe9e63f00d98067669966ce71731b24b3ba5392a705a82a4c7bc06b3db3673bd5f02b06b4a401def035962f694be9f0ad2d278bf5504643d46b2c469baee866c37a9ea6cfaff513dccf6e161faf8122cde9e70d3f10a67e676015fe0d0defc1574ddf402a5c25051e55f7094713d7b4c3955f99638c4477f"}}], 0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 19:48:38 executing program 0: [ 391.268439][ T1146] INFO: task syz-executor.4:9883 can't die for more than 143 seconds. [ 391.276819][ T1146] syz-executor.4 D23992 9883 7248 0x00004004 [ 391.327225][ T1146] Call Trace: [ 391.330791][ T1146] __schedule+0x8f3/0x1f80 [ 391.335238][ T1146] ? firmware_map_remove+0x19e/0x19e [ 391.340726][ T1146] ? prepare_to_wait_event+0x129/0x650 [ 391.347216][ T1146] schedule+0xd0/0x2a0 [ 391.351568][ T1146] synchronize_rcu_expedited+0x45a/0x620 [ 391.357217][ T1146] ? rcu_exp_wait_wake+0x480/0x480 [ 391.364780][ T1146] ? lock_downgrade+0x840/0x840 [ 391.372778][ T1146] ? finish_wait+0x260/0x260 [ 391.377503][ T1146] ? notify_mount+0x767/0xa10 [ 391.384566][ T1146] ? cond_synchronize_rcu+0x20/0x20 [ 391.392176][ T1146] ? lock_downgrade+0x840/0x840 [ 391.397296][ T1146] ? release_mount_watch+0x40/0x40 [ 391.405018][ T1146] ? shrink_dentry_list+0x16/0x480 [ 391.412302][ T1146] ? up_write+0x148/0x470 [ 391.416733][ T1146] namespace_unlock+0x1c8/0x4f0 [ 391.423965][ T1146] ? lock_downgrade+0x840/0x840 [ 391.433210][ T1146] ? __cleanup_mnt+0x20/0x20 [ 391.437879][ T1146] ? do_raw_spin_unlock+0x171/0x260 [ 391.468422][ T1146] put_mnt_ns+0x5f/0x80 [ 391.472760][ T1146] free_nsproxy+0x43/0x4a0 [ 391.477209][ T1146] switch_task_namespaces+0xaa/0xc0 [ 391.508285][ T1146] do_exit+0xb59/0x2e00 [ 391.512648][ T1146] ? find_held_lock+0x2d/0x110 [ 391.517418][ T1146] ? mm_update_next_owner+0x7a0/0x7a0 [ 391.549823][ T1146] ? lock_downgrade+0x840/0x840 [ 391.560239][ T1146] do_group_exit+0x125/0x340 [ 391.564911][ T1146] get_signal+0x47b/0x24f0 [ 391.598264][ T1146] ? ksys_write+0x212/0x250 [ 391.618764][ T1146] do_signal+0x81/0x2240 [ 391.630306][ T1146] ? copy_siginfo_to_user32+0xa0/0xa0 [ 391.635785][ T1146] ? kick_process+0xce/0x150 [ 391.668244][ T1146] ? task_work_add+0x97/0x120 [ 391.673009][ T1146] ? fput_many+0xf6/0x1a0 [ 391.677388][ T1146] ? __prepare_exit_to_usermode+0xe7/0x220 [ 391.705972][ T1146] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 391.729828][ T1146] __prepare_exit_to_usermode+0x175/0x220 [ 391.735754][ T1146] do_syscall_64+0x6c/0xe0 [ 391.748212][ T1146] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 391.754185][ T1146] RIP: 0033:0x45ca69 [ 391.768190][ T1146] Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 391.804311][ T1146] RSP: 002b:00007f43eaf63c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 391.817412][ T1146] RAX: 00000000002a1000 RBX: 000000000050d1c0 RCX: 000000000045ca69 [ 391.833630][ T1146] RDX: 00000000fffffc41 RSI: 0000000020001440 RDI: 0000000000000005 [ 391.844171][ T1146] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 391.865154][ T1146] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 391.886311][ T1146] R13: 0000000000000cff R14: 00000000004cf567 R15: 00007f43eaf646d4 [ 391.924179][ T1146] [ 391.924179][ T1146] Showing all locks held in the system: [ 391.956713][ T1146] 2 locks held by kworker/1:1/23: [ 391.975931][ T1146] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x844/0x1690 [ 392.002856][ T1146] #1: ffffc90000df7dc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x878/0x1690 [ 392.025132][ T1146] 1 lock held by khungtaskd/1146: [ 392.032595][ T1146] #0: ffffffff89bbde00 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 [ 392.053567][ T1146] 6 locks held by kworker/0:1H/2426: [ 392.063482][ T1146] 2 locks held by kworker/1:3/2695: [ 392.073414][ T1146] #0: ffff8880aa036538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x844/0x1690 [ 392.093612][ T1146] #1: ffffc90008a4fdc0 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x878/0x1690 [ 392.116470][ T1146] 1 lock held by in:imklog/6512: [ 392.124473][ T1146] #0: ffff888093b4b5f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 [ 392.157605][ T1146] 2 locks held by syz-executor.4/9883: [ 392.175149][ T1146] #0: ffffffff8a7b06e8 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3a/0x180 [ 392.197604][ T1146] #1: ffffffff89bc2420 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x501/0x620 [ 392.258284][ T1146] [ 392.260704][ T1146] ============================================= [ 392.260704][ T1146] [ 392.288444][ T1146] Kernel panic - not syncing: hung_task: blocked tasks [ 392.295533][ T1146] CPU: 1 PID: 1146 Comm: khungtaskd Not tainted 5.7.0-rc7-next-20200529-syzkaller #0 [ 392.305190][ T1146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 392.315350][ T1146] Call Trace: [ 392.318733][ T1146] dump_stack+0x18f/0x20d [ 392.323115][ T1146] panic+0x2e3/0x75c [ 392.326993][ T1146] ? __warn_printk+0xf3/0xf3 [ 392.331568][ T1146] ? _raw_spin_unlock_irqrestore+0xb2/0xe0 [ 392.337394][ T1146] ? watchdog.cold+0x10b/0x28b [ 392.342151][ T1146] ? watchdog+0xde5/0x14e0 [ 392.346677][ T1146] watchdog.cold+0x11c/0x28b [ 392.351265][ T1146] ? reset_hung_task_detector+0x30/0x30 [ 392.356813][ T1146] kthread+0x3b5/0x4a0 [ 392.360879][ T1146] ? kthread_mod_delayed_work+0x1a0/0x1a0 [ 392.366572][ T1146] ? kthread_mod_delayed_work+0x1a0/0x1a0 [ 392.372277][ T1146] ret_from_fork+0x1f/0x30 [ 392.378429][ T1146] Kernel Offset: disabled [ 392.382764][ T1146] Rebooting in 86400 seconds..