[ 45.999286][ T26] audit: type=1800 audit(1576074913.653:30): pid=7498 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2456 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.14' (ECDSA) to the list of known hosts. 2019/12/11 14:35:20 fuzzer started 2019/12/11 14:35:22 dialing manager at 10.128.0.105:44805 2019/12/11 14:35:23 syscalls: 2689 2019/12/11 14:35:23 code coverage: enabled 2019/12/11 14:35:23 comparison tracing: enabled 2019/12/11 14:35:23 extra coverage: extra coverage is not supported by the kernel 2019/12/11 14:35:23 setuid sandbox: enabled 2019/12/11 14:35:23 namespace sandbox: enabled 2019/12/11 14:35:23 Android sandbox: /sys/fs/selinux/policy does not exist 2019/12/11 14:35:23 fault injection: enabled 2019/12/11 14:35:23 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/12/11 14:35:23 net packet injection: enabled 2019/12/11 14:35:23 net device setup: enabled 2019/12/11 14:35:23 concurrency sanitizer: enabled 2019/12/11 14:35:23 devlink PCI setup: PCI device 0000:00:10.0 is not available syzkaller login: [ 57.619675][ T7668] KCSAN: could not find function: 'poll_schedule_timeout' 2019/12/11 14:35:27 adding functions to KCSAN blacklist: 'find_next_bit' 'blk_mq_dispatch_rq_list' 'vm_area_dup' 'xas_clear_mark' 'copy_process' 'tcp_add_backlog' 'find_get_pages_range_tag' 'tick_do_update_jiffies64' 'ext4_free_inodes_count' 'generic_write_end' 'poll_schedule_timeout' 'do_nanosleep' '__hrtimer_run_queues' 'tomoyo_supervisor' 'pipe_poll' 'pid_update_inode' 'echo_char' 'do_exit' 'wbt_done' 'tick_sched_do_timer' 'pipe_wait' 'run_timer_softirq' 'tick_nohz_next_event' 'rcu_gp_fqs_check_wake' 'mod_timer' '__ext4_new_inode' 'ep_poll' 14:35:40 executing program 0: r0 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000440)={0xb, @win={{}, 0x0, 0x0, 0x0, 0x0, 0x0}}) 14:35:40 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000940)='tmpfs\x00', 0x0, 0x0) chdir(&(0x7f0000000300)='./file0\x00') r0 = memfd_create(&(0x7f00000002c0)='system.snckprotoname\x00', 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="34c775ccefbbc44b0a03a9e45afc4ef1dc671403ff6aa640797ea9ed66a4f8fdeaef1cd9dfbe93fc6bccc58a45983021e94740c305368b8d23d36b64dd8165ebea25878bfddcb23aff02a78a8da2560890b8f323579e28943ebc6c05f442ec35dc9be3a5688ab4712567e605d021fdf6b8ff3137a52dc78b4725f6642a76c7ed"], 0x80) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') creat(&(0x7f0000000040)='./file0\x00', 0x0) mount(&(0x7f0000000140)=@loop={'/dev/loop', 0x0}, &(0x7f00000001c0)='./file0\x00', 0x0, 0x103040, 0x0) [ 72.738275][ T7672] IPVS: ftp: loaded support on port[0] = 21 [ 72.805947][ T7672] chnl_net:caif_netlink_parms(): no params data found [ 72.833778][ T7672] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.840855][ T7672] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.849191][ T7672] device bridge_slave_0 entered promiscuous mode [ 72.857473][ T7672] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.864714][ T7672] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.873141][ T7672] device bridge_slave_1 entered promiscuous mode [ 72.891000][ T7672] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.912821][ T7672] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.943830][ T7675] IPVS: ftp: loaded support on port[0] = 21 [ 72.956727][ T7672] team0: Port device team_slave_0 added [ 72.965490][ T7672] team0: Port device team_slave_1 added 14:35:40 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4223, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r4, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xfcc8) [ 73.063761][ T7672] device hsr_slave_0 entered promiscuous mode [ 73.132789][ T7672] device hsr_slave_1 entered promiscuous mode 14:35:41 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000140)={@remote={0xfe, 0x80, [], 0xffffffffffffffff}}, 0x426) mkdirat(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r1, &(0x7f00000017c0), 0x3a8, 0x7a) [ 73.305735][ T7677] IPVS: ftp: loaded support on port[0] = 21 [ 73.315270][ T7672] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.322336][ T7672] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.329583][ T7672] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.336714][ T7672] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.539941][ T7675] chnl_net:caif_netlink_parms(): no params data found [ 73.607357][ T7672] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.660679][ T7677] chnl_net:caif_netlink_parms(): no params data found [ 73.702300][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 73.705325][ T7705] IPVS: ftp: loaded support on port[0] = 21 [ 73.721570][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.751718][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.773968][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 73.815290][ T7672] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.831773][ T7675] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.838835][ T7675] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.872136][ T7675] device bridge_slave_0 entered promiscuous mode [ 73.929710][ T7675] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.941390][ T7675] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.972734][ T7675] device bridge_slave_1 entered promiscuous mode [ 74.001744][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 74.010307][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 74.061791][ T7702] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.068864][ T7702] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.112155][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 74.120712][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 74.171766][ T7702] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.178824][ T7702] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.211953][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 74.221062][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 14:35:42 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) r2 = open(0x0, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_tcp_buf(r2, 0x6, 0x0, &(0x7f0000000b00)=""/74, &(0x7f0000000200)=0x4a) r4 = getpid() sched_setscheduler(r4, 0x5, &(0x7f00000002c0)) process_vm_readv(r4, &(0x7f0000000780)=[{&(0x7f0000000340)=""/200, 0xc8}, {&(0x7f0000000440)=""/248, 0xf8}, {&(0x7f0000000540)=""/202, 0xca}, {&(0x7f0000000640)=""/216, 0xd8}, {&(0x7f0000000740)=""/6, 0x6}], 0x5, &(0x7f00000009c0)=[{&(0x7f0000000800)=""/206, 0xce}, {&(0x7f0000000940)=""/106, 0x6a}], 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000074000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r3, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}, @empty, @loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40840100}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000002c0)) pread64(r2, 0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000a40)={0xffffffffffffffff, r0, 0x0, 0xa, &(0x7f0000000a00)='/dev/cec#\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000a80)={r5}, 0xc) accept$unix(r2, &(0x7f0000000180), &(0x7f0000000ac0)=0x6e) syz_open_procfs(0x0, &(0x7f0000000140)='net/netstat\x00') ioctl$DRM_IOCTL_SET_UNIQUE(0xffffffffffffffff, 0x40106410, &(0x7f0000000100)={0x3c, &(0x7f0000000000)="a12dcf19150a4d55c8b9cc1da866729bbcf752c788a6e7a80d7cc9e8764e97f7c6a4e22dc5b6c5742969e4e765ed744582ce7ae32e8a96887e217e47"}) syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x1, 0x2) [ 74.272572][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 74.301518][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 74.345389][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 74.361146][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 74.402456][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 74.433541][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 74.463792][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 74.502096][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 74.533404][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 74.589140][ T7675] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.640790][ T7672] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 74.683850][ T7675] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.714212][ T7677] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.721273][ T7677] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.756437][ T7677] device bridge_slave_0 entered promiscuous mode [ 74.796818][ T7677] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.809353][ T7677] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.842254][ T7677] device bridge_slave_1 entered promiscuous mode [ 74.866698][ T7709] IPVS: ftp: loaded support on port[0] = 21 [ 74.879297][ T7675] team0: Port device team_slave_0 added [ 74.892712][ T7675] team0: Port device team_slave_1 added [ 74.983152][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 74.990571][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 75.020590][ T7672] 8021q: adding VLAN 0 to HW filter on device batadv0 14:35:42 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'all\x00\x19\x00\x00!C\x19\xb2d\xb4\xa0$v', 0x420000015001}) [ 75.030667][ T7677] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.049544][ T7705] chnl_net:caif_netlink_parms(): no params data found [ 75.123545][ T7675] device hsr_slave_0 entered promiscuous mode [ 75.161689][ T7675] device hsr_slave_1 entered promiscuous mode [ 75.201489][ T7675] debugfs: Directory 'hsr0' with parent '/' already present! [ 75.212127][ T7677] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.259538][ T7722] IPVS: ftp: loaded support on port[0] = 21 [ 75.307370][ T7677] team0: Port device team_slave_0 added [ 75.325972][ T7705] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.335672][ T7705] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.360559][ T7705] device bridge_slave_0 entered promiscuous mode [ 75.399046][ T7677] team0: Port device team_slave_1 added [ 75.413735][ T7705] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.421491][ T7705] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.441970][ T7705] device bridge_slave_1 entered promiscuous mode [ 75.588157][ T7709] chnl_net:caif_netlink_parms(): no params data found [ 75.645856][ T7677] device hsr_slave_0 entered promiscuous mode 14:35:43 executing program 0: r0 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000440)={0xb, @win={{}, 0x0, 0x0, 0x0, 0x0, 0x0}}) [ 75.703801][ T7677] device hsr_slave_1 entered promiscuous mode [ 75.724176][ T7677] debugfs: Directory 'hsr0' with parent '/' already present! [ 75.744513][ T7705] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.778233][ T7675] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.838423][ T7705] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.859427][ T7675] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.895851][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 75.922187][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 14:35:43 executing program 0: r0 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000440)={0xb, @win={{}, 0x0, 0x0, 0x0, 0x0, 0x0}}) [ 76.004733][ T7722] chnl_net:caif_netlink_parms(): no params data found [ 76.023717][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 76.049746][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 76.111753][ T2893] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.118966][ T2893] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.212028][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 76.238477][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 76.280812][ T2893] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.287916][ T2893] bridge0: port 2(bridge_slave_1) entered forwarding state 14:35:44 executing program 0: r0 = syz_open_dev$swradio(&(0x7f00000000c0)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000440)={0xb, @win={{}, 0x0, 0x0, 0x0, 0x0, 0x0}}) [ 76.401965][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 76.410729][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 76.482463][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 76.534466][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 76.556316][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready 14:35:44 executing program 0: r0 = socket$inet(0x2b, 0x801, 0x0) connect$inet(r0, &(0x7f0000000040), 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20000004ffe0, 0x0) [ 76.609761][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 76.698466][ T7705] team0: Port device team_slave_0 added [ 76.772570][ T7709] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.779706][ T7709] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.831836][ T7709] device bridge_slave_0 entered promiscuous mode [ 76.864066][ T7675] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 76.894700][ T7675] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network 14:35:44 executing program 0: r0 = socket$inet(0x2b, 0x801, 0x0) connect$inet(r0, &(0x7f0000000040), 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20000004ffe0, 0x0) [ 76.974851][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 76.996436][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 77.055929][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 77.112087][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 77.120752][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 77.182260][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 77.226918][ T7705] team0: Port device team_slave_1 added 14:35:45 executing program 0: r0 = socket$inet(0x2b, 0x801, 0x0) connect$inet(r0, &(0x7f0000000040), 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20000004ffe0, 0x0) [ 77.291653][ T7709] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.298778][ T7709] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.317632][ T7709] device bridge_slave_1 entered promiscuous mode [ 77.395180][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 77.446543][ T7677] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.541948][ T7675] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.557734][ T7722] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.594376][ T7722] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.622152][ T7722] device bridge_slave_0 entered promiscuous mode 14:35:45 executing program 0: r0 = socket$inet(0x2b, 0x801, 0x0) connect$inet(r0, &(0x7f0000000040), 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20000004ffe0, 0x0) [ 77.693604][ T7705] device hsr_slave_0 entered promiscuous mode [ 77.731809][ T7705] device hsr_slave_1 entered promiscuous mode [ 77.781426][ T7705] debugfs: Directory 'hsr0' with parent '/' already present! [ 77.788995][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 77.815828][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 77.858930][ T7722] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.883556][ T7722] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.912660][ T7722] device bridge_slave_1 entered promiscuous mode [ 77.964937][ T7709] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.986898][ T7677] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.002477][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 78.010227][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 78.053662][ T7709] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.102155][ T7782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 78.115611][ T7782] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 78.174837][ T7782] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.182100][ T7782] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.244732][ T7782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 78.281949][ T7782] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 78.290372][ T7782] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.297449][ T7782] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.421206][ T7722] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.448958][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 78.459882][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 78.493332][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 78.525480][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 78.546219][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 78.565257][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 78.592496][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 78.622976][ T7709] team0: Port device team_slave_0 added [ 78.630033][ T7709] team0: Port device team_slave_1 added [ 78.666091][ T7677] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 78.705459][ T7677] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 78.772952][ T7722] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.823144][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 78.831207][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready 14:35:46 executing program 0: r0 = socket$inet(0x2b, 0x801, 0x0) connect$inet(r0, &(0x7f0000000040), 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20000004ffe0, 0x0) [ 78.870687][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 78.895412][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 78.925374][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 79.004855][ T7677] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.029944][ T7722] team0: Port device team_slave_0 added [ 79.066033][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 79.092001][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 79.099550][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 79.206747][ T7709] device hsr_slave_0 entered promiscuous mode [ 79.271874][ T7709] device hsr_slave_1 entered promiscuous mode [ 79.311790][ T7709] debugfs: Directory 'hsr0' with parent '/' already present! [ 79.320211][ T7722] team0: Port device team_slave_1 added [ 79.413933][ T7705] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.526791][ T7722] device hsr_slave_0 entered promiscuous mode [ 79.571816][ T7722] device hsr_slave_1 entered promiscuous mode [ 79.611561][ T7722] debugfs: Directory 'hsr0' with parent '/' already present! [ 79.671423][ T7782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 79.712178][ T7782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 79.813127][ T7705] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.907483][ T7782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.952164][ T7782] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.960504][ T7782] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.967558][ T7782] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.251816][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 80.260027][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 80.346272][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 80.408399][ T7683] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.415488][ T7683] bridge0: port 2(bridge_slave_1) entered forwarding state 14:35:48 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4223, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r4, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xfcc8) [ 80.524626][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 80.595520][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 80.652485][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 80.687819][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 80.735049][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 80.778181][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 80.832457][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 80.875715][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 80.933230][ T7705] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 80.976901][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 81.032992][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 81.054798][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 81.106637][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 81.245086][ T7709] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.289930][ T7705] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.368566][ T7722] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.400901][ T7709] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.444421][ T7782] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 81.453048][ T7782] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 81.460508][ T7782] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.542001][ T7782] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.600379][ T7722] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.641743][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.649405][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.712009][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 81.744545][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 81.784374][ T7683] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.791525][ T7683] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.865454][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 81.924552][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 81.971771][ T7683] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.978836][ T7683] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.032562][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 82.078071][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 82.129609][ T7709] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 82.179609][ T7709] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 82.261683][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.275516][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 82.302905][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 82.322675][ T7827] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.329728][ T7827] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.385172][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.402037][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 82.440583][ T7827] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.447679][ T7827] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.482094][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 82.491248][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 82.504400][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 82.513482][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 82.522267][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 82.531154][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 82.539766][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 82.548630][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 82.556833][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 82.565169][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 82.574061][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 82.582650][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 82.591406][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 82.599854][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 82.608544][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 82.617013][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 82.625683][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.633726][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 82.642080][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 82.650264][ T7827] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 82.671535][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 82.678976][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 82.692688][ T7722] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 82.703944][ T7722] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 82.712330][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 82.720571][ T7702] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 82.731176][ T7709] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.750226][ T7722] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.774948][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 82.794931][ T7683] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 14:35:50 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000140)={@remote={0xfe, 0x80, [], 0xffffffffffffffff}}, 0x426) mkdirat(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r1, &(0x7f00000017c0), 0x3a8, 0x7a) [ 82.983185][ C1] hrtimer: interrupt took 25575 ns 14:35:50 executing program 0: r0 = socket$inet(0x2b, 0x801, 0x0) connect$inet(r0, &(0x7f0000000040), 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20000004ffe0, 0x0) 14:35:50 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000940)='tmpfs\x00', 0x0, 0x0) chdir(&(0x7f0000000300)='./file0\x00') r0 = memfd_create(&(0x7f00000002c0)='system.snckprotoname\x00', 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="34c775ccefbbc44b0a03a9e45afc4ef1dc671403ff6aa640797ea9ed66a4f8fdeaef1cd9dfbe93fc6bccc58a45983021e94740c305368b8d23d36b64dd8165ebea25878bfddcb23aff02a78a8da2560890b8f323579e28943ebc6c05f442ec35dc9be3a5688ab4712567e605d021fdf6b8ff3137a52dc78b4725f6642a76c7ed"], 0x80) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') creat(&(0x7f0000000040)='./file0\x00', 0x0) mount(&(0x7f0000000140)=@loop={'/dev/loop', 0x0}, &(0x7f00000001c0)='./file0\x00', 0x0, 0x103040, 0x0) 14:35:50 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4223, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r4, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xfcc8) 14:35:50 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000140)={@remote={0xfe, 0x80, [], 0xffffffffffffffff}}, 0x426) mkdirat(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r1, &(0x7f00000017c0), 0x3a8, 0x7a) 14:35:50 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) r2 = open(0x0, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_tcp_buf(r2, 0x6, 0x0, &(0x7f0000000b00)=""/74, &(0x7f0000000200)=0x4a) r4 = getpid() sched_setscheduler(r4, 0x5, &(0x7f00000002c0)) process_vm_readv(r4, &(0x7f0000000780)=[{&(0x7f0000000340)=""/200, 0xc8}, {&(0x7f0000000440)=""/248, 0xf8}, {&(0x7f0000000540)=""/202, 0xca}, {&(0x7f0000000640)=""/216, 0xd8}, {&(0x7f0000000740)=""/6, 0x6}], 0x5, &(0x7f00000009c0)=[{&(0x7f0000000800)=""/206, 0xce}, {&(0x7f0000000940)=""/106, 0x6a}], 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000074000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r3, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}, @empty, @loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40840100}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000002c0)) pread64(r2, 0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000a40)={0xffffffffffffffff, r0, 0x0, 0xa, &(0x7f0000000a00)='/dev/cec#\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000a80)={r5}, 0xc) accept$unix(r2, &(0x7f0000000180), &(0x7f0000000ac0)=0x6e) syz_open_procfs(0x0, &(0x7f0000000140)='net/netstat\x00') ioctl$DRM_IOCTL_SET_UNIQUE(0xffffffffffffffff, 0x40106410, &(0x7f0000000100)={0x3c, &(0x7f0000000000)="a12dcf19150a4d55c8b9cc1da866729bbcf752c788a6e7a80d7cc9e8764e97f7c6a4e22dc5b6c5742969e4e765ed744582ce7ae32e8a96887e217e47"}) syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x1, 0x2) 14:35:51 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'all\x00\x19\x00\x00!C\x19\xb2d\xb4\xa0$v', 0x420000015001}) 14:35:51 executing program 0: r0 = socket$inet(0x2b, 0x801, 0x0) connect$inet(r0, &(0x7f0000000040), 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r1, 0x0, 0x20000004ffe0, 0x0) 14:35:51 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000940)='tmpfs\x00', 0x0, 0x0) chdir(&(0x7f0000000300)='./file0\x00') r0 = memfd_create(&(0x7f00000002c0)='system.snckprotoname\x00', 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="34c775ccefbbc44b0a03a9e45afc4ef1dc671403ff6aa640797ea9ed66a4f8fdeaef1cd9dfbe93fc6bccc58a45983021e94740c305368b8d23d36b64dd8165ebea25878bfddcb23aff02a78a8da2560890b8f323579e28943ebc6c05f442ec35dc9be3a5688ab4712567e605d021fdf6b8ff3137a52dc78b4725f6642a76c7ed"], 0x80) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') creat(&(0x7f0000000040)='./file0\x00', 0x0) mount(&(0x7f0000000140)=@loop={'/dev/loop', 0x0}, &(0x7f00000001c0)='./file0\x00', 0x0, 0x103040, 0x0) 14:35:51 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000140)={@remote={0xfe, 0x80, [], 0xffffffffffffffff}}, 0x426) mkdirat(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r1, &(0x7f00000017c0), 0x3a8, 0x7a) 14:35:51 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'all\x00\x19\x00\x00!C\x19\xb2d\xb4\xa0$v', 0x420000015001}) 14:35:51 executing program 2: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4223, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00'}) write$sndseq(r4, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xfcc8) 14:35:51 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) r2 = open(0x0, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_tcp_buf(r2, 0x6, 0x0, &(0x7f0000000b00)=""/74, &(0x7f0000000200)=0x4a) r4 = getpid() sched_setscheduler(r4, 0x5, &(0x7f00000002c0)) process_vm_readv(r4, &(0x7f0000000780)=[{&(0x7f0000000340)=""/200, 0xc8}, {&(0x7f0000000440)=""/248, 0xf8}, {&(0x7f0000000540)=""/202, 0xca}, {&(0x7f0000000640)=""/216, 0xd8}, {&(0x7f0000000740)=""/6, 0x6}], 0x5, &(0x7f00000009c0)=[{&(0x7f0000000800)=""/206, 0xce}, {&(0x7f0000000940)=""/106, 0x6a}], 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000074000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r3, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}, @empty, @loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40840100}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000002c0)) pread64(r2, 0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000a40)={0xffffffffffffffff, r0, 0x0, 0xa, &(0x7f0000000a00)='/dev/cec#\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000a80)={r5}, 0xc) accept$unix(r2, &(0x7f0000000180), &(0x7f0000000ac0)=0x6e) syz_open_procfs(0x0, &(0x7f0000000140)='net/netstat\x00') ioctl$DRM_IOCTL_SET_UNIQUE(0xffffffffffffffff, 0x40106410, &(0x7f0000000100)={0x3c, &(0x7f0000000000)="a12dcf19150a4d55c8b9cc1da866729bbcf752c788a6e7a80d7cc9e8764e97f7c6a4e22dc5b6c5742969e4e765ed744582ce7ae32e8a96887e217e47"}) syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x1, 0x2) 14:35:51 executing program 0: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) r2 = open(0x0, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_tcp_buf(r2, 0x6, 0x0, &(0x7f0000000b00)=""/74, &(0x7f0000000200)=0x4a) r4 = getpid() sched_setscheduler(r4, 0x5, &(0x7f00000002c0)) process_vm_readv(r4, &(0x7f0000000780)=[{&(0x7f0000000340)=""/200, 0xc8}, {&(0x7f0000000440)=""/248, 0xf8}, {&(0x7f0000000540)=""/202, 0xca}, {&(0x7f0000000640)=""/216, 0xd8}, {&(0x7f0000000740)=""/6, 0x6}], 0x5, &(0x7f00000009c0)=[{&(0x7f0000000800)=""/206, 0xce}, {&(0x7f0000000940)=""/106, 0x6a}], 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000074000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r3, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}, @empty, @loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40840100}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000002c0)) pread64(r2, 0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000a40)={0xffffffffffffffff, r0, 0x0, 0xa, &(0x7f0000000a00)='/dev/cec#\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000a80)={r5}, 0xc) accept$unix(r2, &(0x7f0000000180), &(0x7f0000000ac0)=0x6e) syz_open_procfs(0x0, &(0x7f0000000140)='net/netstat\x00') ioctl$DRM_IOCTL_SET_UNIQUE(0xffffffffffffffff, 0x40106410, &(0x7f0000000100)={0x3c, &(0x7f0000000000)="a12dcf19150a4d55c8b9cc1da866729bbcf752c788a6e7a80d7cc9e8764e97f7c6a4e22dc5b6c5742969e4e765ed744582ce7ae32e8a96887e217e47"}) syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x1, 0x2) 14:35:51 executing program 1: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000940)='tmpfs\x00', 0x0, 0x0) chdir(&(0x7f0000000300)='./file0\x00') r0 = memfd_create(&(0x7f00000002c0)='system.snckprotoname\x00', 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="34c775ccefbbc44b0a03a9e45afc4ef1dc671403ff6aa640797ea9ed66a4f8fdeaef1cd9dfbe93fc6bccc58a45983021e94740c305368b8d23d36b64dd8165ebea25878bfddcb23aff02a78a8da2560890b8f323579e28943ebc6c05f442ec35dc9be3a5688ab4712567e605d021fdf6b8ff3137a52dc78b4725f6642a76c7ed"], 0x80) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') creat(&(0x7f0000000040)='./file0\x00', 0x0) mount(&(0x7f0000000140)=@loop={'/dev/loop', 0x0}, &(0x7f00000001c0)='./file0\x00', 0x0, 0x103040, 0x0) 14:35:51 executing program 3: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) r2 = open(0x0, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_tcp_buf(r2, 0x6, 0x0, &(0x7f0000000b00)=""/74, &(0x7f0000000200)=0x4a) r4 = getpid() sched_setscheduler(r4, 0x5, &(0x7f00000002c0)) process_vm_readv(r4, &(0x7f0000000780)=[{&(0x7f0000000340)=""/200, 0xc8}, {&(0x7f0000000440)=""/248, 0xf8}, {&(0x7f0000000540)=""/202, 0xca}, {&(0x7f0000000640)=""/216, 0xd8}, {&(0x7f0000000740)=""/6, 0x6}], 0x5, &(0x7f00000009c0)=[{&(0x7f0000000800)=""/206, 0xce}, {&(0x7f0000000940)=""/106, 0x6a}], 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000074000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r3, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}, @empty, @loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40840100}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000002c0)) pread64(r2, 0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000a40)={0xffffffffffffffff, r0, 0x0, 0xa, &(0x7f0000000a00)='/dev/cec#\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000a80)={r5}, 0xc) accept$unix(r2, &(0x7f0000000180), &(0x7f0000000ac0)=0x6e) syz_open_procfs(0x0, &(0x7f0000000140)='net/netstat\x00') ioctl$DRM_IOCTL_SET_UNIQUE(0xffffffffffffffff, 0x40106410, &(0x7f0000000100)={0x3c, &(0x7f0000000000)="a12dcf19150a4d55c8b9cc1da866729bbcf752c788a6e7a80d7cc9e8764e97f7c6a4e22dc5b6c5742969e4e765ed744582ce7ae32e8a96887e217e47"}) syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x1, 0x2) 14:35:51 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'all\x00\x19\x00\x00!C\x19\xb2d\xb4\xa0$v', 0x420000015001}) [ 84.035845][ T8004] ================================================================== [ 84.043995][ T8004] BUG: KCSAN: data-race in queue_access_lock / snd_seq_check_queue [ 84.051871][ T8004] [ 84.054203][ T8004] read to 0xffff888101e5da24 of 1 bytes by interrupt on cpu 0: [ 84.061752][ T8004] snd_seq_check_queue+0x59/0x200 [ 84.066784][ T8004] snd_seq_timer_interrupt+0x243/0x280 [ 84.072243][ T8004] snd_timer_process_callbacks+0x1e4/0x220 [ 84.078050][ T8004] snd_timer_interrupt+0x483/0x930 [ 84.083165][ T8004] snd_hrtimer_callback+0x18f/0x260 [ 84.088366][ T8004] __hrtimer_run_queues+0x274/0x5f0 [ 84.093592][ T8004] hrtimer_interrupt+0x22a/0x480 [ 84.098547][ T8004] smp_apic_timer_interrupt+0xdc/0x280 [ 84.104134][ T8004] apic_timer_interrupt+0xf/0x20 [ 84.109080][ T8004] __sanitizer_cov_trace_pc+0x0/0x50 [ 84.114373][ T8004] tomoyo_supervisor+0x22b/0xd20 [ 84.119320][ T8004] tomoyo_path_permission+0x121/0x160 [ 84.124701][ T8004] tomoyo_path_perm+0x23e/0x390 [ 84.129547][ T8004] tomoyo_inode_getattr+0x26/0x40 14:35:51 executing program 1: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) r2 = open(0x0, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_tcp_buf(r2, 0x6, 0x0, &(0x7f0000000b00)=""/74, &(0x7f0000000200)=0x4a) r4 = getpid() sched_setscheduler(r4, 0x5, &(0x7f00000002c0)) process_vm_readv(r4, &(0x7f0000000780)=[{&(0x7f0000000340)=""/200, 0xc8}, {&(0x7f0000000440)=""/248, 0xf8}, {&(0x7f0000000540)=""/202, 0xca}, {&(0x7f0000000640)=""/216, 0xd8}, {&(0x7f0000000740)=""/6, 0x6}], 0x5, &(0x7f00000009c0)=[{&(0x7f0000000800)=""/206, 0xce}, {&(0x7f0000000940)=""/106, 0x6a}], 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000074000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) ioctl$sock_inet6_SIOCADDRT(r3, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c]}, @empty, @loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40840100}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000002c0)) pread64(r2, 0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000a40)={0xffffffffffffffff, r0, 0x0, 0xa, &(0x7f0000000a00)='/dev/cec#\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000a80)={r5}, 0xc) accept$unix(r2, &(0x7f0000000180), &(0x7f0000000ac0)=0x6e) syz_open_procfs(0x0, &(0x7f0000000140)='net/netstat\x00') ioctl$DRM_IOCTL_SET_UNIQUE(0xffffffffffffffff, 0x40106410, &(0x7f0000000100)={0x3c, &(0x7f0000000000)="a12dcf19150a4d55c8b9cc1da866729bbcf752c788a6e7a80d7cc9e8764e97f7c6a4e22dc5b6c5742969e4e765ed744582ce7ae32e8a96887e217e47"}) syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x1, 0x2) [ 84.134572][ T8004] security_inode_getattr+0x9b/0xd0 [ 84.140728][ T8004] vfs_getattr+0x2e/0x70 [ 84.144976][ T8004] vfs_statx+0x102/0x190 [ 84.149243][ T8004] __do_sys_newstat+0x51/0xb0 [ 84.153918][ T8004] __x64_sys_newstat+0x3a/0x50 [ 84.158698][ T8004] do_syscall_64+0xcc/0x370 [ 84.163210][ T8004] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 84.169090][ T8004] [ 84.171421][ T8004] write to 0xffff888101e5da24 of 1 bytes by task 8004 on cpu 1: [ 84.179060][ T8004] queue_access_lock+0x89/0xc0 [ 84.183828][ T8004] snd_seq_control_queue+0x77/0x350 [ 84.189047][ T8004] event_input_timer+0x2f/0x50 [ 84.193806][ T8004] snd_seq_deliver_single_event.constprop.0+0x3e8/0x4d0 [ 84.200726][ T8004] snd_seq_deliver_event+0x2e9/0x4c0 [ 84.206005][ T8004] snd_seq_dispatch_event+0xa1/0x340 [ 84.211282][ T8004] snd_seq_check_queue+0xeb/0x200 [ 84.216349][ T8004] snd_seq_enqueue_event+0x163/0x2b0 [ 84.221622][ T8004] snd_seq_client_enqueue_event.constprop.0+0x187/0x2a0 [ 84.228539][ T8004] snd_seq_write+0x23f/0x4d0 [ 84.233113][ T8004] __vfs_write+0x67/0xc0 [ 84.237342][ T8004] vfs_write+0x18a/0x390 [ 84.241580][ T8004] ksys_write+0x17b/0x1b0 [ 84.245892][ T8004] __x64_sys_write+0x4c/0x60 [ 84.250468][ T8004] do_syscall_64+0xcc/0x370 [ 84.254956][ T8004] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 84.260821][ T8004] [ 84.263129][ T8004] Reported by Kernel Concurrency Sanitizer on: [ 84.269300][ T8004] CPU: 1 PID: 8004 Comm: syz-executor.2 Not tainted 5.4.0-syzkaller #0 [ 84.277525][ T8004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 84.287575][ T8004] ================================================================== [ 84.295620][ T8004] Kernel panic - not syncing: panic_on_warn set ... [ 84.302192][ T8004] CPU: 1 PID: 8004 Comm: syz-executor.2 Not tainted 5.4.0-syzkaller #0 [ 84.310513][ T8004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 84.320548][ T8004] Call Trace: [ 84.323826][ T8004] dump_stack+0x11d/0x181 [ 84.328140][ T8004] panic+0x210/0x640 [ 84.332107][ T8004] ? vprintk_func+0x8d/0x140 [ 84.336694][ T8004] kcsan_report.cold+0xc/0xd [ 84.341271][ T8004] kcsan_setup_watchpoint+0x3fe/0x460 [ 84.346706][ T8004] __tsan_unaligned_write1+0xc0/0x100 [ 84.352077][ T8004] queue_access_lock+0x89/0xc0 [ 84.356833][ T8004] snd_seq_control_queue+0x77/0x350 [ 84.362040][ T8004] ? preempt_count_add+0x6f/0xb0 [ 84.366961][ T8004] event_input_timer+0x2f/0x50 [ 84.371717][ T8004] snd_seq_deliver_single_event.constprop.0+0x3e8/0x4d0 [ 84.378642][ T8004] ? snd_seq_timer_open.cold+0x20/0x20 [ 84.384198][ T8004] snd_seq_deliver_event+0x2e9/0x4c0 [ 84.389475][ T8004] ? __const_udelay+0x36/0x40 [ 84.394137][ T8004] ? preempt_count_add+0x6f/0xb0 [ 84.399078][ T8004] ? snd_seq_client_use_ptr+0x93/0x2f0 [ 84.404524][ T8004] snd_seq_dispatch_event+0xa1/0x340 [ 84.409795][ T8004] ? _raw_spin_unlock_irqrestore+0x70/0x80 [ 84.415585][ T8004] ? snd_seq_prioq_cell_out+0x163/0x210 [ 84.421125][ T8004] snd_seq_check_queue+0xeb/0x200 [ 84.426138][ T8004] snd_seq_enqueue_event+0x163/0x2b0 [ 84.431420][ T8004] snd_seq_client_enqueue_event.constprop.0+0x187/0x2a0 [ 84.438348][ T8004] snd_seq_write+0x23f/0x4d0 [ 84.442925][ T8004] __vfs_write+0x67/0xc0 [ 84.447154][ T8004] ? snd_seq_kernel_client_enqueue+0x160/0x160 [ 84.453298][ T8004] vfs_write+0x18a/0x390 [ 84.457524][ T8004] ksys_write+0x17b/0x1b0 [ 84.461855][ T8004] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 84.468082][ T8004] __x64_sys_write+0x4c/0x60 [ 84.472672][ T8004] do_syscall_64+0xcc/0x370 [ 84.477176][ T8004] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 84.483068][ T8004] RIP: 0033:0x45a849 [ 84.486984][ T8004] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 84.506831][ T8004] RSP: 002b:00007fe56d5dec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 84.515265][ T8004] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a849 [ 84.523215][ T8004] RDX: 000000000000fcc8 RSI: 0000000020000000 RDI: 0000000000000003 [ 84.531172][ T8004] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 84.539127][ T8004] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe56d5df6d4 [ 84.547086][ T8004] R13: 00000000004cbfe1 R14: 00000000004e5d98 R15: 00000000ffffffff [ 84.556527][ T8004] Kernel Offset: disabled [ 84.560934][ T8004] Rebooting in 86400 seconds..