[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 36.716262] random: sshd: uninitialized urandom read (32 bytes read) [ 36.954975] kauditd_printk_skb: 9 callbacks suppressed [ 36.954982] audit: type=1400 audit(1569001784.237:35): avc: denied { map } for pid=6642 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 37.002983] random: sshd: uninitialized urandom read (32 bytes read) [ 37.571621] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.63' (ECDSA) to the list of known hosts. [ 43.136787] random: sshd: uninitialized urandom read (32 bytes read) 2019/09/20 17:49:50 fuzzer started [ 43.319519] audit: type=1400 audit(1569001790.597:36): avc: denied { map } for pid=6651 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=16480 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 [ 44.099212] random: cc1: uninitialized urandom read (8 bytes read) 2019/09/20 17:49:52 dialing manager at 10.128.0.105:35365 2019/09/20 17:49:52 syscalls: 2472 2019/09/20 17:49:52 code coverage: enabled 2019/09/20 17:49:52 comparison tracing: ioctl(KCOV_TRACE_CMP) failed: invalid argument 2019/09/20 17:49:52 extra coverage: extra coverage is not supported by the kernel 2019/09/20 17:49:52 setuid sandbox: enabled 2019/09/20 17:49:52 namespace sandbox: enabled 2019/09/20 17:49:52 Android sandbox: /sys/fs/selinux/policy does not exist 2019/09/20 17:49:52 fault injection: enabled 2019/09/20 17:49:52 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/09/20 17:49:52 net packet injection: enabled 2019/09/20 17:49:52 net device setup: enabled [ 45.608732] random: crng init done 17:51:17 executing program 0: perf_event_open(&(0x7f0000000980)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) sendmmsg(r0, &(0x7f0000001340), 0x247, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) ioctl$FICLONERANGE(0xffffffffffffffff, 0x4020940d, 0x0) 17:51:17 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0x3c, r2, 0x31, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'lo\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}]}, 0x3c}}, 0x0) 17:51:17 executing program 3: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='lotrusted\x1a\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f00000003c0)='/dev/snd/seq\x00', 0x0, 0x1) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5334, &(0x7f00000001c0)={0xf48b, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r0, &(0x7f0000000000)=[{0x0, 0x23, 0x0, 0x0, @tick, {}, {}, @connect}], 0xffffff76) 17:51:17 executing program 4: r0 = socket(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'syz_tun\x00'}) read(0xffffffffffffffff, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) exit(0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000500)='./file0\x00', &(0x7f0000000400)='ramfs\x00\x9b\x95\x84\x10D\xfb\x9b\x81R#\x10O\xd3\xb4\xe8\xa3\x1f\x00\r\xf6\xd9\xbbt\x95f\x9e\x02\x06\xf946\\{(\xc8\xa7s\xd2>\x81\x88l\x0e\xc5%\x99\x00\x02\x9d\x85\xfc\xa9\\\x99:\xe4\x9c\xf9z>w\xe7\xa9\xa8=\xe9o\x9f\xfbKE\xd7\x9a\x1b\xf8\x86@\x8e\xe6\x9em\x89\xab\x19\xea1\x8e\xa1\xb5\xd7\xc6\xc62\x05\xc7\xe5\xd2m\xeczV\x1d\x84\xcd\xc0\xdf', 0x0, 0x0) chdir(&(0x7f00000003c0)='./file0\x00') symlink(&(0x7f0000000140)='..', &(0x7f00000000c0)='./file0\x00') umount2(&(0x7f0000000040)='../file0\x00', 0x2) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) utimensat(r1, 0x0, &(0x7f0000000180), 0x0) 17:51:17 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x802102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0x2b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 17:51:17 executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)={0x200000001, 0x3, 0x2000000000000009, 0x2, 0x0, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f0000000080), &(0x7f0000000140)}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000140)={r0, &(0x7f0000000080)}, 0x20) [ 129.800074] audit: type=1400 audit(1569001877.077:37): avc: denied { map } for pid=6669 comm="syz-executor.3" path="/sys/kernel/debug/kcov" dev="debugfs" ino=32 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 130.031598] IPVS: ftp: loaded support on port[0] = 21 [ 130.774920] chnl_net:caif_netlink_parms(): no params data found [ 130.801366] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.807937] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.814830] device bridge_slave_0 entered promiscuous mode [ 130.821595] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.827940] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.834823] device bridge_slave_1 entered promiscuous mode [ 130.841585] IPVS: ftp: loaded support on port[0] = 21 [ 130.859783] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 130.869661] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 130.893931] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 130.901200] team0: Port device team_slave_0 added [ 130.907994] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 130.915167] team0: Port device team_slave_1 added [ 130.920354] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 130.930083] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 130.946707] IPVS: ftp: loaded support on port[0] = 21 [ 131.001904] device hsr_slave_0 entered promiscuous mode [ 131.040329] device hsr_slave_1 entered promiscuous mode [ 131.086625] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 131.095282] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 131.147559] chnl_net:caif_netlink_parms(): no params data found [ 131.169780] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.176201] bridge0: port 2(bridge_slave_1) entered forwarding state [ 131.182969] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.189287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 131.202972] IPVS: ftp: loaded support on port[0] = 21 [ 131.234196] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.240794] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.247549] device bridge_slave_0 entered promiscuous mode [ 131.254244] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.260681] bridge0: port 2(bridge_slave_1) entered disabled state [ 131.267463] device bridge_slave_1 entered promiscuous mode [ 131.303758] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 131.312710] IPVS: ftp: loaded support on port[0] = 21 [ 131.366930] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 131.406055] chnl_net:caif_netlink_parms(): no params data found [ 131.425374] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 131.432430] team0: Port device team_slave_0 added [ 131.437389] chnl_net:caif_netlink_parms(): no params data found [ 131.456555] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 131.463744] team0: Port device team_slave_1 added [ 131.486085] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 131.493537] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 131.571609] device hsr_slave_0 entered promiscuous mode [ 131.630211] device hsr_slave_1 entered promiscuous mode [ 131.672344] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 131.679186] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 131.691942] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.698347] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.705241] device bridge_slave_0 entered promiscuous mode [ 131.717775] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.724120] bridge0: port 2(bridge_slave_1) entered disabled state [ 131.731927] device bridge_slave_1 entered promiscuous mode [ 131.757814] IPVS: ftp: loaded support on port[0] = 21 [ 131.764072] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.770486] bridge0: port 2(bridge_slave_1) entered forwarding state [ 131.777088] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.783461] bridge0: port 1(bridge_slave_0) entered forwarding state [ 131.801889] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 131.814132] bridge0: port 1(bridge_slave_0) entered blocking state [ 131.821421] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.828358] device bridge_slave_0 entered promiscuous mode [ 131.835328] bridge0: port 2(bridge_slave_1) entered blocking state [ 131.841829] bridge0: port 2(bridge_slave_1) entered disabled state [ 131.848566] device bridge_slave_1 entered promiscuous mode [ 131.856740] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 131.872304] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.879179] bridge0: port 2(bridge_slave_1) entered disabled state [ 131.887088] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.893646] bridge0: port 2(bridge_slave_1) entered disabled state [ 131.911107] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 131.919571] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 131.939416] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 131.947010] team0: Port device team_slave_0 added [ 131.954029] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 131.961519] team0: Port device team_slave_1 added [ 131.972486] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 131.979449] team0: Port device team_slave_0 added [ 131.988430] 8021q: adding VLAN 0 to HW filter on device bond0 [ 131.997033] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 132.004585] team0: Port device team_slave_1 added [ 132.009673] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 132.017074] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 132.036704] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 132.045434] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 132.052893] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 132.093441] device hsr_slave_0 entered promiscuous mode [ 132.131649] device hsr_slave_1 entered promiscuous mode [ 132.201031] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 132.211099] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 132.249833] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 132.257676] 8021q: adding VLAN 0 to HW filter on device team0 [ 132.266155] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 132.274081] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 132.281348] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 132.292785] chnl_net:caif_netlink_parms(): no params data found [ 132.352188] device hsr_slave_0 entered promiscuous mode [ 132.400367] device hsr_slave_1 entered promiscuous mode [ 132.440860] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 132.448133] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 132.459473] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 132.469564] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 132.488317] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 132.496470] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 132.504200] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.510561] bridge0: port 1(bridge_slave_0) entered forwarding state [ 132.517249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 132.526530] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 132.534086] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.540416] bridge0: port 2(bridge_slave_1) entered forwarding state [ 132.549342] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 132.573208] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 132.585942] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 132.594006] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 132.603168] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 132.612336] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.618655] bridge0: port 1(bridge_slave_0) entered disabled state [ 132.626145] device bridge_slave_0 entered promiscuous mode [ 132.632947] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 132.641415] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.647765] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.656167] device bridge_slave_1 entered promiscuous mode [ 132.665477] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 132.680929] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 132.688531] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 132.696165] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 132.710013] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 132.726342] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 132.734647] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 132.755788] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 132.764357] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 132.776443] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 132.807990] 8021q: adding VLAN 0 to HW filter on device bond0 [ 132.814557] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 132.822407] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 132.832032] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 132.839879] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 132.850083] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 132.856055] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 132.867438] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 132.874832] team0: Port device team_slave_0 added [ 132.884125] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 132.891494] team0: Port device team_slave_1 added [ 132.896951] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 132.904627] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 132.915397] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 132.923158] chnl_net:caif_netlink_parms(): no params data found [ 132.935167] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 132.942655] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 132.951458] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 132.965455] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 132.980757] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 132.987522] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 132.995356] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 133.001966] 8021q: adding VLAN 0 to HW filter on device team0 [ 133.011317] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 133.025648] 8021q: adding VLAN 0 to HW filter on device bond0 [ 133.044716] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 133.058892] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.065845] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.073170] device bridge_slave_0 entered promiscuous mode [ 133.085180] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 133.094236] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 133.101592] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.107973] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.115359] device bridge_slave_1 entered promiscuous mode [ 133.164080] device hsr_slave_0 entered promiscuous mode [ 133.220398] device hsr_slave_1 entered promiscuous mode [ 133.260352] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 133.267969] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 133.277906] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.284248] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.291295] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 133.297987] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 133.307964] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 133.316292] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 133.322848] 8021q: adding VLAN 0 to HW filter on device team0 [ 133.334506] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 133.342159] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 133.350584] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 133.358144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 133.365676] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.372029] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.380338] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 133.388902] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 133.399966] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 133.409207] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 133.422583] 8021q: adding VLAN 0 to HW filter on device bond0 [ 133.432936] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 133.440909] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 133.449909] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 133.460380] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 133.480721] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 133.487174] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 133.496405] team0: Port device team_slave_0 added [ 133.502140] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 133.509578] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 133.522362] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 133.530465] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 133.537997] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.544358] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.554957] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 133.563822] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 133.571996] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 133.578636] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 133.585726] team0: Port device team_slave_1 added [ 133.591295] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 133.603563] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 133.613136] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 133.622511] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 133.629814] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 133.637745] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 133.649440] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 133.657448] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 133.668847] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.675243] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.689183] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 133.698974] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready 17:51:21 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo\x00\x13\xc2\xf9\x9b2=\xcf\xcc%\xe7\x8ct\x14\xd9\xf0\xb0En\f=6\xcc\x83\xbc\xb84}4Y\xf6}\x10\xa7\xea\xb2\x13\x15b\xfa0%\x85\xf9&\x95\xc5=lU\xa1m\xaa!Qx\x02J\x97\x92\xc6U\a!o\xde\x15:\xe9^9\x7f8\xb0tN\xa6\xd9$u\x8f\xe01\xa7\xef\xd3\'\x86\x16\x1c\xbc\xf5\xec\x9e\xc6\xa6\x831\x05T_Q\xf9\xe1\xcbG\xdemy\xf3\xe4\xae[\x8e\x9dX+\xd3\x82\a\x81l\xff\x04Y\xb4V\x8e\fWq{\x9e<\xa2\xea\xe1\v\x04\x05\xffu-\xe1-\x19pPU\x88Z\x91i\x11\x87\x81i24\xd0\x10\xd3\x98\x16\xf8=\xdc\xeb\x8a\xac\xaa\x03gr\x7f!hi\xf0,}.A\x1c\xa0k\x96\xbe\xfa$\xbf\x05\xa8\x8e\x90N\xf1\x81') unlinkat(r0, &(0x7f00000009c0)='./file0\x00', 0x200) 17:51:21 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00\xc7\xec\xac\xd9&{\x0f\x96\xad\xd1\x8fl![\x8f\xb9\f\xca\x1d\xc2{\xee\xb7\x03K\x0f\xa6\xaa;\xf6\x89\xf7b^\xa5\xafI\r\xc4\x9f\v\xf2\x1c\xdc\xddp2\xb7\xbb\x1b\xfev\xea\xed\xe0\xaa\xe8\xceR`\xbb\xf2\xed;pC\x19\xbfn\x16\xaa\x199\xfe.Q\xebvB\xd2\x19&l?\x87\x17H\x1f.\xdbA\x1b\xafz\xe3\xdc};*\xec\xfe\xfa\xfb/\x18g\x80y\xfe\x89', 0x26e1, 0x0) close(r0) close(r1) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000040)) write$cgroup_type(r1, &(0x7f0000000080)='threaded\x00', 0xfffffc61) gettid() perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmsg(r0, &(0x7f0000000140)={0x0, 0x1d, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/110, 0x2000012e}], 0x1, 0x0, 0xd01}, 0x3f00) [ 133.724049] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 133.735459] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 133.747513] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 133.755542] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 133.823241] device hsr_slave_0 entered promiscuous mode [ 133.863412] device hsr_slave_1 entered promiscuous mode [ 133.904183] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 133.913548] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 133.919616] 8021q: adding VLAN 0 to HW filter on device team0 [ 133.930889] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 133.938228] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 133.946732] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 133.957528] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 133.973083] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 133.989924] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 133.998263] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 134.007114] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 134.014547] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 134.022274] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 134.029835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 134.037633] bridge0: port 1(bridge_slave_0) entered blocking state [ 134.043990] bridge0: port 1(bridge_slave_0) entered forwarding state [ 134.050990] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 134.059712] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 134.073751] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 134.081332] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 134.088845] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 134.096654] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 134.105201] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 134.113213] bridge0: port 2(bridge_slave_1) entered blocking state [ 134.119539] bridge0: port 2(bridge_slave_1) entered forwarding state [ 134.126382] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 134.135920] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 134.145476] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 134.151727] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 134.163633] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 134.171913] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 134.181428] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 134.195259] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 134.202307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 134.209805] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 134.217347] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 134.226265] 8021q: adding VLAN 0 to HW filter on device bond0 [ 134.234082] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 134.241374] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 134.250606] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 134.258347] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 134.265621] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 134.273661] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 134.281360] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 134.291636] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 134.298720] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 134.308771] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 134.314907] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 134.322226] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 134.331848] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 134.339259] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 134.347423] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 134.356633] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 134.368538] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 134.380192] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 134.387070] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 134.397596] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 134.405261] 8021q: adding VLAN 0 to HW filter on device team0 [ 134.412396] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 134.420378] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 134.446586] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 134.456091] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 134.465760] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 134.475224] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 134.482919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 134.491363] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 134.498891] bridge0: port 1(bridge_slave_0) entered blocking state [ 134.505236] bridge0: port 1(bridge_slave_0) entered forwarding state [ 134.512302] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 134.519869] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 134.527505] bridge0: port 2(bridge_slave_1) entered blocking state [ 134.533850] bridge0: port 2(bridge_slave_1) entered forwarding state [ 134.540835] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 134.558088] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 134.572819] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 134.586790] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 134.598379] 8021q: adding VLAN 0 to HW filter on device bond0 [ 134.605332] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 134.613012] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 134.622271] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 134.631601] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 134.640956] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 134.648921] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 134.662748] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 17:51:22 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo\x00\x13\xc2\xf9\x9b2=\xcf\xcc%\xe7\x8ct\x14\xd9\xf0\xb0En\f=6\xcc\x83\xbc\xb84}4Y\xf6}\x10\xa7\xea\xb2\x13\x15b\xfa0%\x85\xf9&\x95\xc5=lU\xa1m\xaa!Qx\x02J\x97\x92\xc6U\a!o\xde\x15:\xe9^9\x7f8\xb0tN\xa6\xd9$u\x8f\xe01\xa7\xef\xd3\'\x86\x16\x1c\xbc\xf5\xec\x9e\xc6\xa6\x831\x05T_Q\xf9\xe1\xcbG\xdemy\xf3\xe4\xae[\x8e\x9dX+\xd3\x82\a\x81l\xff\x04Y\xb4V\x8e\fWq{\x9e<\xa2\xea\xe1\v\x04\x05\xffu-\xe1-\x19pPU\x88Z\x91i\x11\x87\x81i24\xd0\x10\xd3\x98\x16\xf8=\xdc\xeb\x8a\xac\xaa\x03gr\x7f!hi\xf0,}.A\x1c\xa0k\x96\xbe\xfa$\xbf\x05\xa8\x8e\x90N\xf1\x81') unlinkat(r0, &(0x7f00000009c0)='./file0\x00', 0x0) [ 134.672613] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 134.685790] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 134.693506] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 134.706865] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 134.713703] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 134.743190] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 134.760361] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 134.784136] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 134.797205] audit: type=1400 audit(1569001882.077:38): avc: denied { create } for pid=6728 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 134.798004] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready 17:51:22 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000012c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xedX#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') r1 = openat$cgroup_ro(r0, &(0x7f00000000c0)='mem\x00\x01y7SwaS.\x06\x95r\x89\xc9B\xab\xe3\xfarent\x00\xaa\x1a\xfd\xae\v\xbf\xd8d\xbb\xaf9Q\xde\xfb\x1fY\x8do\xd1\x16\xce(\x82\xf1\xbf{5Z\x13\x15\x14\xd7\xb8\xce\xf20\x1e\xc0\xc2\xed0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newqdisc={0x60, 0x24, 0x507, 0x0, 0x0, {0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7, 0x1, 'fq\x00'}, {0x34, 0x2, [@TCA_FQ_RATE_ENABLE={0x8}, @TCA_FQ_FLOW_DEFAULT_RATE={0x8}, @TCA_FQ_FLOW_PLIMIT={0x8}, @TCA_FQ_BUCKETS_LOG={0x8, 0x3}, @TCA_FQ_PLIMIT={0x8}, @TCA_FQ_INITIAL_QUANTUM={0x8}]}}]}, 0x60}}, 0x0) [ 134.828380] audit: type=1400 audit(1569001882.107:39): avc: denied { write } for pid=6728 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 134.830649] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 134.863853] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 134.895095] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 134.913978] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 0, id = 0 [ 134.919117] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 134.938118] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready 17:51:22 executing program 3: r0 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r0, &(0x7f0000000200)={{0x3, @netrom, 0x1}, [@null, @bcast, @bcast, @null, @bcast, @rose, @remote, @default]}, 0x48) close(r0) 17:51:22 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000500)='./file0\x00', 0x0, 0x0, 0x0) chdir(&(0x7f00000003c0)='./file0\x00') symlink(&(0x7f0000000140)='..', &(0x7f00000000c0)='./file0\x00') umount2(0x0, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) [ 134.944342] audit: type=1400 audit(1569001882.107:40): avc: denied { read } for pid=6728 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 134.945372] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 134.984868] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 135.003838] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 135.016695] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 135.025230] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 135.038928] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 135.047856] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready 17:51:22 executing program 5: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00\f\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000e00)=@newtfilter={0x34, 0x2c, 0x701, 0x0, 0x0, {0x0, r1, {}, {}, {0xe}}, [@filter_kind_options=@f_route={{0x9, 0x1, 'route\x00'}, {0x4}}]}, 0x34}}, 0x0) r2 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r2, &(0x7f0000000140), 0x332, 0x0) [ 135.054122] 8021q: adding VLAN 0 to HW filter on device team0 [ 135.066710] sch_fq: defrate 0 ignored. [ 135.081811] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 135.088723] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 135.106916] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 135.122467] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 135.130210] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 135.139005] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 135.152697] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 135.163116] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 135.171131] bridge0: port 1(bridge_slave_0) entered blocking state [ 135.177445] bridge0: port 1(bridge_slave_0) entered forwarding state [ 135.184305] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 135.192050] protocol 88fb is buggy, dev hsr_slave_0 [ 135.192083] protocol 88fb is buggy, dev hsr_slave_1 [ 135.202696] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 135.210243] bridge0: port 2(bridge_slave_1) entered blocking state [ 135.216567] bridge0: port 2(bridge_slave_1) entered forwarding state [ 135.228845] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 135.237024] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 135.253811] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 135.261840] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 135.277084] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 135.291185] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 135.305544] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 135.314974] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 135.327602] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 135.335371] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 135.343234] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 135.351213] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 135.360284] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 135.372550] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 135.379460] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 135.386641] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 135.394287] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 135.401746] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 135.409038] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 135.418790] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 135.427763] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 135.456743] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 135.469857] 8021q: adding VLAN 0 to HW filter on device batadv0 17:51:25 executing program 2: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) r1 = syz_open_dev$mice(&(0x7f00000001c0)='/dev/input/mice\x00', 0x0, 0x0) dup3(r0, r1, 0x0) ioctl$UI_END_FF_ERASE(r1, 0x400c55cb, &(0x7f0000000180)={0x10}) 17:51:25 executing program 3: clone(0x7fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) perf_event_open$cgroup(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="cd80"], 0x2}}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYRES16=0x0, @ANYPTR64, @ANYRESHEX, @ANYBLOB="e0c55c5d9eb82ee4d00100010029a741efca44f937d049248204007296d961244e2e0c734057548c402dc43b3897cc275fd87f333c9631b8c40dd887fc8dd4"], 0x0, 0x5b}, 0x20) tkill(r0, 0x39) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 17:51:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) sendmmsg$inet(r0, &(0x7f0000000840)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, 0x0}}, {{&(0x7f0000000340)={0x2, 0x4e20, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000800)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @loopback}}}], 0x20}}], 0x2, 0x0) 17:51:25 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/netstat\x00') preadv(r0, &(0x7f0000001180)=[{&(0x7f0000000000)=""/120, 0x78}], 0x1, 0x5e) 17:51:25 executing program 4: unshare(0x8020000) msgsnd(0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/mnt\x00') setns(r0, 0x0) clone(0x10062101, 0x0, 0x0, 0x0, 0x0) 17:51:25 executing program 1: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000280)={0x38, 0x3, 0x0, {0x0, 0xffffffffffffff4d, 0x0, 'trusted.overlay.opaque\x00'}}, 0x38) 17:51:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000080)=[@free_buffer], 0xfffffffffffffd57, 0x0, 0x0}) 17:51:25 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0800a1695e1dcfe87b1071") ioctl$sock_ifreq(r0, 0x8971, &(0x7f0000000000)={'bond_slave_1\x00', @ifru_map}) 17:51:25 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)="2e0000001c008105e00f80ecdb4cb9f207c804a01a000000880367fb0a000200400ada1b40d805000300c50083b8", 0x2e}], 0x1}, 0x0) [ 138.516672] ptrace attach of "/root/syz-executor.3"[6816] was attempted by "/root/syz-executor.3"[6818] 17:51:25 executing program 1: r0 = socket(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'syz_tun\x00'}) read(r0, &(0x7f0000000280)=""/144, 0x90) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x247ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit(0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000500)='./file0\x00', &(0x7f0000000400)='ramfs\x00\x9b\x95\x84\x10D\xfb\x9b\x81R#\x10O\xd3\xb4\xe8\xa3\x1f\x00\r\xf6\xd9\xbbt\x95f\x9e\x02\x06\xf946\\{(\xc8\xa7s\xd2>\x81\x88l\x0e\xc5%\x99\x00\x02\x9d\x85\xfc\xa9\\\x99:\xe4\x9c\xf9z>w\xe7\xa9\xa8=\xe9o\x9f\xfbKE\xd7\x9a\x1b\xf8\x86@\x8e\xe6\x9em\x89\xab\x19\xea1\x8e\xa1\xb5\xd7\xc6\xc62\x05\xc7\xe5\xd2m\xeczV\x1d\x84\xcd\xc0\xdf', 0x0, 0x0) chdir(&(0x7f00000003c0)='./file0\x00') symlink(&(0x7f0000000140)='..', &(0x7f00000000c0)='./file0\x00') umount2(&(0x7f0000000040)='../file0\x00', 0x2) gettid() r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) flock(r1, 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) utimensat(r1, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180)={{0x0, r2/1000+10000}}, 0x0) open$dir(&(0x7f0000000100)='./file0/file0/../file0\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0x1) setns(0xffffffffffffffff, 0x0) close(0xffffffffffffffff) [ 138.579137] binder: 6824:6829 unknown command 2009188586 [ 138.590051] hrtimer: interrupt took 46251 ns [ 138.590235] audit: type=1400 audit(1569001885.867:41): avc: denied { sys_admin } for pid=6809 comm="syz-executor.4" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 [ 138.619900] netlink: 6 bytes leftover after parsing attributes in process `syz-executor.5'. 17:51:25 executing program 0: socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000280)=""/55, 0x37}], 0x1, &(0x7f0000001680)=""/36, 0x24}, 0x0) sendmsg$sock(r0, &(0x7f0000000180)={0x0, 0xffb3, &(0x7f0000000140)=[{&(0x7f0000000040)='E', 0x1}], 0x1}, 0x0) 17:51:25 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) syz_open_pts(0xffffffffffffffff, 0x0) [ 138.631247] binder: 6824:6829 ioctl c0306201 200000c0 returned -22 [ 138.655601] binder: 6824:6836 unknown command 2009188586 [ 138.664873] binder: 6824:6836 ioctl c0306201 200000c0 returned -22 17:51:26 executing program 2: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x0, r1}) r2 = eventfd(0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000000)={0x0, r2}) 17:51:26 executing program 4: unshare(0x8020000) msgsnd(0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/mnt\x00') setns(r0, 0x0) clone(0x10062101, 0x0, 0x0, 0x0, 0x0) 17:51:26 executing program 3: r0 = openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0xc19de3d40e88b468, 0x0) close(r0) 17:51:26 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x400000000084, &(0x7f0000000280)=0x0) io_submit(r2, 0x30b, &(0x7f0000001700)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000080), 0x10}]) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r4, &(0x7f0000000300)=[{&(0x7f0000000140)='\'', 0x1}], 0x1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x2, 0x31, 0xffffffffffffffff, 0x0) tee(r3, r1, 0x1000, 0x0) 17:51:26 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x2000000000000074, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10a86}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000140), &(0x7f00000004c0)=0x4) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bind$packet(0xffffffffffffffff, 0x0, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x147, 0x200007fd, &(0x7f00000000c0)={0x2, 0x4e23, @local}, 0x10) getsockname(r0, &(0x7f0000000340)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, &(0x7f0000000500)=0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000005c0)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000680)={&(0x7f0000000c80)=ANY=[@ANYBLOB="4c000000e7a40800fbdb", @ANYRES32=r2, @ANYBLOB="0c001000ff0200fc000a0004000a0004000a0004000a0004000a0004000a0004000a0004000a0004000a0004000a00000000000098de7af4a4887ed8d9dad6ef2bde85737356393bed45afe8f0184d1f269ae303e33fd2a6689cbc984f030f30d9c4f50173d5e52e4c65f6e9ecd796b69f5cd148f1bdde027935f1f9666f82c2ffd94073954f6031e8035448520ae411cbe3a45be16d2eced354d370ddb5ebac8ec5b855c8da8665f50fc0a11c69fdf9fc3795032e"], 0x3}, 0x1, 0x0, 0x0, 0x60082045}, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='bbr\x00', 0x3) pipe(&(0x7f0000000640)={0xffffffffffffffff}) symlinkat(&(0x7f0000000300)='./file0\x00', r3, &(0x7f0000000780)='./file0\x00') r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='memory.current\x00', 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) sendto$inet(r0, &(0x7f00000012c0)="20268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf922157511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, 0x0, 0x0) sendmsg$TIPC_NL_SOCK_GET(r4, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80040}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000054}, 0x4080) 17:51:26 executing program 4: r0 = socket$inet6(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="5500000018007f5300fe01b2a4a280930a58000000a8430891ed0000390009000a000c00060000001900a30700000000000000dc1338d54400009b841338caaee86ef75afba3de448daa7227c43ab8220000060c00", 0x55}], 0x1}, 0x0) 17:51:26 executing program 2: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x0, r1}) r2 = eventfd(0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000000)={0x0, r2}) 17:51:26 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(gcm_base(ctr(aes-aesni),ghash-generic))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000012c0)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000005900)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) readv(r1, &(0x7f0000000740)=[{&(0x7f0000002480)=""/4096, 0x1000}], 0x1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x10, 0xffffffffffffffff, 0x0) [ 138.875075] IPv6: Can't replace route, no match found 17:51:26 executing program 4: munmap(&(0x7f00007fa000/0x2000)=nil, 0x2000) r0 = syz_open_procfs(0x0, &(0x7f00000012c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xedX#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') openat$cgroup_ro(r0, &(0x7f00000000c0)='mem\x00\x01y7SwaS.\x06\x95r\x89\xc9B\xab\xe3\xfarent\x00\xaa\x1a\xfd\xae\v\xbf\xd8d\xbb\xaf9Q\xde\xfb\x1fY\x8do\xd1\x16\xce(\x82\xf1\xbf{5Z\x13\x15\x14\xd7\xb8\xce\xf20\x1e\xc0\xc2\xed\x81\x88l\x0e\xc5%\x99\x00\x02\x9d\x85\xfc\xa9\\\x99:\xe4\x9c\xf9z>w\xe7\xa9\xa8=\xe9o\x9f\xfbKE\xd7\x9a\x1b\xf8\x86@\x8e\xe6\x9em\x89\xab\x19\xea1\x8e\xa1\xb5\xd7\xc6\xc62\x05\xc7\xe5\xd2m\xeczV\x1d\x84\xcd\xc0\xdf', 0x0, 0x0) chdir(&(0x7f00000003c0)='./file0\x00') symlink(&(0x7f0000000140)='..', &(0x7f00000000c0)='./file0\x00') umount2(&(0x7f0000000040)='../file0\x00', 0x2) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) clock_gettime(0x0, 0x0) open$dir(&(0x7f0000000100)='./file0/file0/../file0\x00', 0x0, 0x0) setns(0xffffffffffffffff, 0x0) close(0xffffffffffffffff) 17:51:26 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="f153f533ae0b36e470f070") syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0xf2fb1c293d92a863) 17:51:26 executing program 2: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x0, r1}) r2 = eventfd(0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000000)={0x0, r2}) 17:51:26 executing program 1: munmap(&(0x7f000050e000/0x4000)=nil, 0x4000) r0 = syz_open_procfs(0x0, &(0x7f00000012c0)='\x00\x00\x00\x00\x00egy\xc5\x8e\xcb\x1c\xf8\x8f\xca;\xa3?\xad\xae\x0f\xb5\x97ao3\xab\xcdY\x9a\xe3\xe5\xe1\xf4\x87\xac\xad\x80\xa3P\x8c\xea\x9c\xc7\x00\xeb\xedX#\xe34\x80O]\x87\xdd\x894\xdal;w\xf8\xf8\v?v\xf0\xb8\xda=|\xa4\xba\xbbiq!\xd8g\xb7I\x12\x80') openat$cgroup_ro(r0, &(0x7f00000000c0)='mem\x00\x01y7SwaS.\x06\x95r\x89\xc9B\xab\xe3\xfarent\x00\xaa\x1a\xfd\xae\v\xbf\xd8d\xbb\xaf9Q\xde\xfb\x1fY\x8do\xd1\x16\xce(\x82\xf1\xbf{5Z\x13\x15\x14\xd7\xb8\xce\xf20\x1e\xc0\xc2\xed0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r4, &(0x7f00000000c0), 0xfffffdda, 0xd8, 0x0, 0x0) 17:51:26 executing program 2: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x0, r1}) r2 = eventfd(0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000000)={0x0, r2}) 17:51:26 executing program 0: syz_open_procfs(0x0, &(0x7f0000000200)='net/netstat\x00') 17:51:26 executing program 1: connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_GET_MSRS(r2, 0xc008ae88, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001180), 0x0, 0x0) 17:51:26 executing program 3: mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0) chdir(&(0x7f0000000040)='./file0\x00') socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='mem\x00\x00\x00\x00\x00\x00\a\x13', 0x275a, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x80000) 17:51:26 executing program 0: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x14363, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0xfefd, 0x0, 0x0, 0xfffffffffffffd9c) [ 139.602395] kasan: CONFIG_KASAN_INLINE enabled [ 139.607196] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 139.625873] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 139.630799] audit: type=1400 audit(1569001886.917:42): avc: denied { map } for pid=6934 comm="syz-executor.3" path="/root/syzkaller-testdir372236881/syzkaller.UrQ65E/12/file0/mem" dev="devtmpfs" ino=13680 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:memory_device_t:s0 tclass=chr_file permissive=1 [ 139.632108] Modules linked in: [ 139.632122] CPU: 0 PID: 6926 Comm: syz-executor.4 Not tainted 4.14.145 #0 [ 139.632130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 139.670083] protocol 88fb is buggy, dev hsr_slave_0 [ 139.672020] task: ffff88808e55e3c0 task.stack: ffff88808dc30000 [ 139.681391] protocol 88fb is buggy, dev hsr_slave_1 [ 139.686346] RIP: 0010:tcp_sendmsg_locked+0x50e/0x3200 [ 139.702511] RSP: 0018:ffff88808dc379b0 EFLAGS: 00010206 [ 139.707845] RAX: 0000000000000012 RBX: 0000000000000000 RCX: ffffc9000984a000 [ 139.715194] RDX: 000000000000011c RSI: ffffffff85240e44 RDI: 0000000000000090 [ 139.722436] RBP: ffff88808dc37b48 R08: ffff88808e55e3c0 R09: 0000000000000001 [ 139.729676] R10: 0000000000000000 R11: ffff88808e55e3c0 R12: dffffc0000000000 [ 139.736938] R13: ffff888096982800 R14: ffff88808dc37c28 R15: ffff8880a925c040 [ 139.744182] FS: 00007fad3d4bf700(0000) GS:ffff8880aee00000(0000) knlGS:0000000000000000 [ 139.752383] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 139.758342] CR2: 00007ffdf149b6e0 CR3: 00000000a8d41000 CR4: 00000000001406f0 [ 139.765591] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 139.772840] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 139.780083] Call Trace: [ 139.782650] ? trace_hardirqs_on+0x10/0x10 [ 139.786871] ? lock_sock_nested+0x9e/0x110 [ 139.791165] ? find_held_lock+0x35/0x130 [ 139.795202] ? tcp_sendpage+0x60/0x60 [ 139.798977] ? trace_hardirqs_on_caller+0x400/0x590 [ 139.803963] ? trace_hardirqs_on+0xd/0x10 [ 139.808085] tcp_sendmsg+0x30/0x50 [ 139.811617] inet_sendmsg+0x122/0x500 [ 139.815412] ? inet_recvmsg+0x500/0x500 [ 139.819367] sock_sendmsg+0xce/0x110 [ 139.823054] sock_write_iter+0x21d/0x390 [ 139.827091] ? sock_sendmsg+0x110/0x110 [ 139.831042] ? iov_iter_init+0xaf/0x1d0 [ 139.834990] __vfs_write+0x4a7/0x6b0 [ 139.838702] ? selinux_file_open+0x420/0x420 [ 139.843088] ? kernel_read+0x120/0x120 [ 139.846951] ? rw_verify_area+0xea/0x2b0 [ 139.850988] vfs_write+0x198/0x500 [ 139.854504] SyS_write+0xfd/0x230 [ 139.857928] ? SyS_read+0x230/0x230 [ 139.861528] ? do_syscall_64+0x53/0x640 [ 139.865477] ? SyS_read+0x230/0x230 [ 139.869090] do_syscall_64+0x1e8/0x640 [ 139.872967] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 139.877787] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 139.882948] RIP: 0033:0x459a09 [ 139.886113] RSP: 002b:00007fad3d4bec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 139.893797] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459a09 [ 139.901044] RDX: 0000000000000001 RSI: 0000000020000140 RDI: 0000000000000004 [ 139.908290] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 139.915537] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fad3d4bf6d4 [ 139.922780] R13: 00000000004c5f88 R14: 00000000004e0610 R15: 00000000ffffffff [ 139.930030] Code: d4 38 fc 4d 85 ed 0f 84 40 08 00 00 e8 ac d4 38 fc 8b 85 78 ff ff ff 48 8d bb 90 00 00 00 89 85 50 ff ff ff 48 89 f8 48 c1 e8 03 <42> 0f b6 04 20 84 c0 74 06 0f 8e 4a 25 00 00 f6 83 90 00 00 00 [ 139.949135] RIP: tcp_sendmsg_locked+0x50e/0x3200 RSP: ffff88808dc379b0 [ 139.966555] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 139.981937] ---[ end trace ef907ad3216e346f ]--- [ 139.986927] Kernel panic - not syncing: Fatal exception [ 139.993465] Kernel Offset: disabled [ 139.997078] Rebooting in 86400 seconds..