Warning: Permanently added '10.128.0.162' (ECDSA) to the list of known hosts. 2019/12/20 07:57:06 fuzzer started 2019/12/20 07:57:08 dialing manager at 10.128.0.26:35875 2019/12/20 07:57:08 syscalls: 2683 2019/12/20 07:57:08 code coverage: enabled 2019/12/20 07:57:08 comparison tracing: enabled 2019/12/20 07:57:08 extra coverage: enabled 2019/12/20 07:57:08 setuid sandbox: enabled 2019/12/20 07:57:08 namespace sandbox: enabled 2019/12/20 07:57:08 Android sandbox: /sys/fs/selinux/policy does not exist 2019/12/20 07:57:08 fault injection: enabled 2019/12/20 07:57:08 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/12/20 07:57:08 net packet injection: enabled 2019/12/20 07:57:08 net device setup: enabled 2019/12/20 07:57:08 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2019/12/20 07:57:08 devlink PCI setup: PCI device 0000:00:10.0 is not available 07:59:21 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000000440)=[{&(0x7f0000000000)=""/161, 0xa1}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xfd1d, 0x0, 0x0, 0x800e007d9) shutdown(r0, 0x0) mprotect(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x5) r2 = socket$inet6_sctp(0x1c, 0x5, 0x84) recvmsg(r2, &(0x7f0000002700)={0x0, 0x0, 0x0}, 0x0) shutdown(r1, 0x0) 07:59:21 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="2e0000002f00815be00f80ecdb4cb9040c486516080003002300000012000014c2ed3c001500cd5edc2976d153b4", 0x2e}], 0x1}, 0x0) [ 210.725064][ T9255] IPVS: ftp: loaded support on port[0] = 21 07:59:21 executing program 2: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="140000002f00815be00f80ecdb4cb9040c486516", 0x14}], 0x1}, 0x0) [ 210.938151][ T9255] chnl_net:caif_netlink_parms(): no params data found [ 210.942859][ T9258] IPVS: ftp: loaded support on port[0] = 21 [ 211.064948][ T9255] bridge0: port 1(bridge_slave_0) entered blocking state [ 211.073951][ T9255] bridge0: port 1(bridge_slave_0) entered disabled state [ 211.093592][ T9255] device bridge_slave_0 entered promiscuous mode 07:59:22 executing program 3: setrlimit(0x0, &(0x7f0000000000)={0x10000000000b35d}) r0 = semget$private(0x0, 0x1, 0x0) setgroups(0x2af, &(0x7f0000000000)) setuid(0xee01) semop(r0, 0x0, 0x0) [ 211.133966][ T9255] bridge0: port 2(bridge_slave_1) entered blocking state [ 211.141075][ T9255] bridge0: port 2(bridge_slave_1) entered disabled state [ 211.175772][ T9255] device bridge_slave_1 entered promiscuous mode [ 211.259657][ T9255] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 211.297233][ T9261] IPVS: ftp: loaded support on port[0] = 21 [ 211.304883][ T9255] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 211.325764][ T9258] chnl_net:caif_netlink_parms(): no params data found [ 211.381269][ T9255] team0: Port device team_slave_0 added [ 211.420205][ T9255] team0: Port device team_slave_1 added [ 211.474041][ T9258] bridge0: port 1(bridge_slave_0) entered blocking state [ 211.481223][ T9258] bridge0: port 1(bridge_slave_0) entered disabled state [ 211.490170][ T9258] device bridge_slave_0 entered promiscuous mode [ 211.506627][ T9263] IPVS: ftp: loaded support on port[0] = 21 [ 211.516145][ T9258] bridge0: port 2(bridge_slave_1) entered blocking state 07:59:22 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2842, 0x0) io_submit(0x0, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(0xffffffffffffffff, 0xc02c5341, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000380)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x0, 0x0, @loopback}}}, 0x90) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) [ 211.523714][ T9258] bridge0: port 2(bridge_slave_1) entered disabled state [ 211.531675][ T9258] device bridge_slave_1 entered promiscuous mode [ 211.587871][ T9255] device hsr_slave_0 entered promiscuous mode [ 211.682773][ T9255] device hsr_slave_1 entered promiscuous mode [ 211.749654][ T9258] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link 07:59:22 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x6, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132}) write$cgroup_subtree(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="0003a0a10494245ca5f971b9ec8a51a3f2f678d50a08eb09000000e6d28d93dc602e8b997311195f652d7c4727fbc356e4b6481754f63c4c73e3a16bb6e6ea1bf57caf25775d5c04d733014acfe25024a4566f86b1c46bb43b2a98000000000000000000808c0c5d0dd33c2363e53c46d3119a5adc6b21c67734bc00"], 0xfdef) [ 211.794765][ T9258] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 211.808838][ T9265] IPVS: ftp: loaded support on port[0] = 21 [ 211.948344][ T9261] chnl_net:caif_netlink_parms(): no params data found [ 211.986687][ T9255] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 212.046067][ T9258] team0: Port device team_slave_0 added [ 212.051929][ T9255] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 212.123477][ T9258] team0: Port device team_slave_1 added [ 212.130359][ T9255] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 212.140008][ T9268] IPVS: ftp: loaded support on port[0] = 21 [ 212.176842][ T9255] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 212.325959][ T9258] device hsr_slave_0 entered promiscuous mode [ 212.382925][ T9258] device hsr_slave_1 entered promiscuous mode [ 212.452558][ T9258] debugfs: Directory 'hsr0' with parent '/' already present! [ 212.509966][ T9261] bridge0: port 1(bridge_slave_0) entered blocking state [ 212.517197][ T9261] bridge0: port 1(bridge_slave_0) entered disabled state [ 212.525407][ T9261] device bridge_slave_0 entered promiscuous mode [ 212.558566][ T9261] bridge0: port 2(bridge_slave_1) entered blocking state [ 212.566600][ T9261] bridge0: port 2(bridge_slave_1) entered disabled state [ 212.574570][ T9261] device bridge_slave_1 entered promiscuous mode [ 212.642945][ T9261] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 212.655461][ T9258] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 212.736017][ T9261] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 212.745431][ T9258] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 212.784190][ T9258] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 212.829772][ T9258] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 212.911785][ T9261] team0: Port device team_slave_0 added [ 212.921693][ T9261] team0: Port device team_slave_1 added [ 212.936827][ T9265] chnl_net:caif_netlink_parms(): no params data found [ 212.976875][ T9263] chnl_net:caif_netlink_parms(): no params data found [ 213.115950][ T9261] device hsr_slave_0 entered promiscuous mode [ 213.143772][ T9261] device hsr_slave_1 entered promiscuous mode [ 213.212591][ T9261] debugfs: Directory 'hsr0' with parent '/' already present! [ 213.258990][ T9265] bridge0: port 1(bridge_slave_0) entered blocking state [ 213.266291][ T9265] bridge0: port 1(bridge_slave_0) entered disabled state [ 213.274658][ T9265] device bridge_slave_0 entered promiscuous mode [ 213.288733][ T9263] bridge0: port 1(bridge_slave_0) entered blocking state [ 213.295909][ T9263] bridge0: port 1(bridge_slave_0) entered disabled state [ 213.306729][ T9263] device bridge_slave_0 entered promiscuous mode [ 213.315615][ T9263] bridge0: port 2(bridge_slave_1) entered blocking state [ 213.322983][ T9263] bridge0: port 2(bridge_slave_1) entered disabled state [ 213.330851][ T9263] device bridge_slave_1 entered promiscuous mode [ 213.344225][ T9255] 8021q: adding VLAN 0 to HW filter on device bond0 [ 213.351345][ T9265] bridge0: port 2(bridge_slave_1) entered blocking state [ 213.358880][ T9265] bridge0: port 2(bridge_slave_1) entered disabled state [ 213.366814][ T9265] device bridge_slave_1 entered promiscuous mode [ 213.390609][ T9265] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 213.418311][ T9263] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 213.430458][ T9268] chnl_net:caif_netlink_parms(): no params data found [ 213.447850][ T9265] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 213.469265][ T9263] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 213.515649][ T9265] team0: Port device team_slave_0 added [ 213.526825][ T9255] 8021q: adding VLAN 0 to HW filter on device team0 [ 213.561503][ T9263] team0: Port device team_slave_0 added [ 213.574512][ T9265] team0: Port device team_slave_1 added [ 213.584777][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 213.595211][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 213.604061][ T9261] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 213.649522][ T9261] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 213.696085][ T9263] team0: Port device team_slave_1 added [ 213.701964][ T9261] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 213.770505][ T9268] bridge0: port 1(bridge_slave_0) entered blocking state [ 213.778186][ T9268] bridge0: port 1(bridge_slave_0) entered disabled state [ 213.786532][ T9268] device bridge_slave_0 entered promiscuous mode [ 213.795678][ T9268] bridge0: port 2(bridge_slave_1) entered blocking state [ 213.802873][ T9268] bridge0: port 2(bridge_slave_1) entered disabled state [ 213.810553][ T9268] device bridge_slave_1 entered promiscuous mode [ 213.819524][ T9261] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 213.918142][ T9265] device hsr_slave_0 entered promiscuous mode [ 213.962933][ T9265] device hsr_slave_1 entered promiscuous mode [ 214.012565][ T9265] debugfs: Directory 'hsr0' with parent '/' already present! [ 214.046976][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 214.056029][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 214.064903][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 214.072119][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 214.080329][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 214.089808][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 214.098421][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 214.105522][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 214.113211][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 214.123029][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 214.152120][ T9268] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 214.215425][ T9263] device hsr_slave_0 entered promiscuous mode [ 214.282911][ T9263] device hsr_slave_1 entered promiscuous mode [ 214.332920][ T9263] debugfs: Directory 'hsr0' with parent '/' already present! [ 214.340621][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 214.349797][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 214.358983][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 214.369533][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 214.378377][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 214.387037][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 214.395457][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 214.403910][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 214.412169][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 214.422742][ T9268] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 214.454537][ T9265] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 214.512016][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 214.536717][ T9255] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 214.546287][ T9265] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 214.620655][ T9265] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 214.692679][ T9268] team0: Port device team_slave_0 added [ 214.698726][ T9265] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 214.786839][ T9268] team0: Port device team_slave_1 added [ 214.796716][ T9263] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 214.926032][ T9268] device hsr_slave_0 entered promiscuous mode [ 214.962874][ T9268] device hsr_slave_1 entered promiscuous mode [ 215.002637][ T9268] debugfs: Directory 'hsr0' with parent '/' already present! [ 215.010240][ T9263] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 215.054536][ T9263] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 215.109841][ T9263] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 215.181791][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 215.189415][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 215.204868][ T9258] 8021q: adding VLAN 0 to HW filter on device bond0 [ 215.227760][ T9255] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 215.252150][ T9258] 8021q: adding VLAN 0 to HW filter on device team0 [ 215.278670][ T3427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 215.288621][ T3427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 215.302613][ T9268] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 215.375924][ T9268] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 215.447694][ T9268] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 215.505631][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 215.516656][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 215.525668][ T1104] bridge0: port 1(bridge_slave_0) entered blocking state [ 215.532752][ T1104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 215.543936][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 215.566858][ T9261] 8021q: adding VLAN 0 to HW filter on device bond0 [ 215.594989][ T9268] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 215.637362][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 215.647065][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 215.656149][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 215.664406][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 215.672096][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 215.681392][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 215.697939][ T9261] 8021q: adding VLAN 0 to HW filter on device team0 [ 215.716938][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 215.725825][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 215.733859][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 215.744250][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready 07:59:26 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xda, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000100)={{}, {}, 0x8, {0x2, 0x0, @local}, 'veth0_to_bond\x00'}) [ 215.804563][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 215.813288][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 215.824620][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 215.834566][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 215.843652][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 215.852864][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 215.861544][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 215.870969][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 215.878119][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 215.886329][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 215.889885][ C1] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1 [ 215.911301][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 215.920169][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 215.927333][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 215.935504][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 215.948318][ T9258] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 215.961058][ T9258] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 215.990801][ T9265] 8021q: adding VLAN 0 to HW filter on device bond0 [ 216.002477][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 216.012019][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 216.020984][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 216.029644][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 216.039251][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 216.048422][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 216.070103][ T9265] 8021q: adding VLAN 0 to HW filter on device team0 [ 216.085422][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 216.093835][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 216.104213][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 216.111884][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 216.121804][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 216.143945][ T9263] 8021q: adding VLAN 0 to HW filter on device bond0 [ 216.151124][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 216.159918][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 216.168807][ T1104] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.175948][ T1104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 216.184750][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 216.193602][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 216.202002][ T1104] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.209108][ T1104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 216.217009][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 216.239706][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 216.247660][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready 07:59:27 executing program 0: wait4(0x0, 0x0, 0x0, 0x0) getgid() socket(0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$BLKBSZGET(0xffffffffffffffff, 0x80041270, 0x0) r0 = socket$inet6(0x10, 0x100000000000003, 0x0) sendmsg(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000180)="5500000018007fafb72d1cb2a4a2809302062c0000a84309c025244d2500080008000a00492c2095d13936af28f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0xb8}], 0x1}, 0x0) [ 216.258515][ T9272] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 216.278447][ T9261] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 216.291536][ T9261] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 216.334727][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 216.345205][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 216.354597][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 216.364023][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 216.379184][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 216.388163][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 216.400513][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 216.409259][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 216.418215][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 216.426537][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 216.435137][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 216.443655][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 216.451383][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 216.469841][ T9258] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 216.481096][ T9265] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 216.491481][ T9263] 8021q: adding VLAN 0 to HW filter on device team0 [ 216.500475][ T9287] netlink: 17 bytes leftover after parsing attributes in process `syz-executor.0'. [ 216.512713][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 216.526522][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 07:59:27 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() tkill(0x0, 0x0) r1 = socket$inet6(0x10, 0x100000000000003, 0x0) sendmsg(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000180)="5500000018007fafb72d1cb2a4a2809302062c0000a84309c025244d2500080008000a00492c2095d13936af28f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0xb8}], 0x1}, 0x0) [ 216.539589][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 216.602708][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 216.611346][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 216.672377][ C1] hrtimer: interrupt took 51609 ns [ 216.677942][ T1104] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.685054][ T1104] bridge0: port 1(bridge_slave_0) entered forwarding state 07:59:27 executing program 1: getpid() getgid() sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$BLKBSZGET(0xffffffffffffffff, 0x80041270, 0x0) r0 = socket$inet6(0x10, 0x100000000000003, 0x0) sendmsg(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000180)="5500000018007fafb72d1cb2a4a2809302062c0000a84309c025244d2500080008000a00492c2095d13936af28f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0xb8}], 0x1}, 0x0) open(0x0, 0x0, 0x0) [ 216.722295][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 216.732116][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 216.778080][ T1104] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.785242][ T1104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 216.808889][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 216.824785][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 216.860542][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 216.883439][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 216.890977][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 216.898902][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 216.907017][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 216.914633][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 216.924042][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 216.934957][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 216.945848][ T9261] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 216.955663][ T9299] netlink: 17 bytes leftover after parsing attributes in process `syz-executor.1'. [ 216.967532][ T9293] netlink: 17 bytes leftover after parsing attributes in process `syz-executor.0'. [ 216.989236][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 217.002301][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 217.068567][ T9268] 8021q: adding VLAN 0 to HW filter on device bond0 [ 217.086735][ T9299] netlink: 17 bytes leftover after parsing attributes in process `syz-executor.1'. [ 217.105591][ T9265] 8021q: adding VLAN 0 to HW filter on device batadv0 07:59:28 executing program 1: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000200)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$TIOCSSERIAL(r0, 0x541e, 0x0) [ 217.132917][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 217.216770][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 217.225384][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 217.233912][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 217.246403][ T9263] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 217.339199][ T9268] 8021q: adding VLAN 0 to HW filter on device team0 [ 217.390391][ T9263] 8021q: adding VLAN 0 to HW filter on device batadv0 07:59:28 executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSSERIAL(r0, 0x541e, 0x0) 07:59:28 executing program 1: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000140)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x50000}]}) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(0xffffffffffffffff, 0xc0406619, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0xffffffffffffffff, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) getsockname(r0, 0x0, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) ioctl$int_out(r1, 0x0, 0x0) dup(0xffffffffffffffff) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PIO_CMAP(0xffffffffffffffff, 0x4b71, 0x0) request_key(0x0, 0x0, 0x0, 0xfffffffffffffff8) add_key(0x0, 0x0, 0x0, 0x0, 0x0) keyctl$negate(0xd, 0x0, 0x0, 0x0) mount$9p_unix(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TIOCSSERIAL(0xffffffffffffffff, 0x541e, 0x0) [ 217.433279][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 217.441194][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 217.467044][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 07:59:28 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x1) write(r1, &(0x7f0000000000)="d5", 0xfffffedf) dup3(r1, r0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x2000002) [ 217.533153][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 217.603578][ T3424] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 217.637595][ T3424] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 217.666572][ T3424] bridge0: port 1(bridge_slave_0) entered blocking state [ 217.673765][ T3424] bridge0: port 1(bridge_slave_0) entered forwarding state 07:59:28 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = eventfd2(0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000000c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x153}) ptrace$setopts(0x4206, r3, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0, 0xfffffffffffffe9c}, {&(0x7f0000000140)=""/64, 0xfffffffffffffdbe}], 0x3, 0x0, 0x0, 0x0) tkill(r3, 0x3c) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r3, 0x0, 0x0) [ 217.711557][ T3424] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 217.740517][ T3424] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 217.758336][ T3424] bridge0: port 2(bridge_slave_1) entered blocking state [ 217.765513][ T3424] bridge0: port 2(bridge_slave_1) entered forwarding state [ 217.807498][ T3424] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 217.827438][ T3424] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 217.880146][ T3427] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 217.899498][ T3427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 217.919107][ T3427] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready 07:59:28 executing program 3: syz_emit_ethernet(0x76, &(0x7f00000002c0)={@broadcast, @random="708a1c045afe", [], {@ipv6={0x86dd, {0x0, 0x6, "4c000f", 0x40, 0x3a, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x2c]}, @mcast2, {[], @icmpv6=@dest_unreach={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, '\x00', 0x0, 0x0, 0x0, @empty, @remote, [@hopopts={0x2f}], "020022ebffff00fc"}}}}}}}, 0x0) [ 217.938519][ T3427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 217.953002][ T3427] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 217.976368][ T3427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 217.997320][ T3427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 218.047876][ T9268] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 218.077708][ T9268] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 218.100485][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 218.110312][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 218.137282][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 218.181289][ T9268] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 218.190857][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 218.213596][ T1104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 07:59:29 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2842, 0x0) io_submit(0x0, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(0xffffffffffffffff, 0xc02c5341, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000380)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x0, 0x0, @loopback}}}, 0x90) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) 07:59:29 executing program 5: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2842, 0x0) io_submit(0x0, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(0xffffffffffffffff, 0xc02c5341, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000380)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x0, 0x0, @loopback}}}, 0x90) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) 07:59:29 executing program 0: syz_emit_ethernet(0x66, &(0x7f00000002c0)={@broadcast, @random="708a1c045afe", [], {@ipv6={0x86dd, {0x0, 0x6, "4c000f", 0x30, 0x3a, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x2c]}, @mcast2, {[], @icmpv6=@dest_unreach={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, '\x00', 0x0, 0x60, 0x0, @empty, @remote}}}}}}}, 0x0) 07:59:29 executing program 1: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ipv6_route\x00') sendfile(r0, r1, 0x0, 0x80000005) syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') fchdir(0xffffffffffffffff) 07:59:29 executing program 3: syz_emit_ethernet(0x76, &(0x7f00000002c0)={@broadcast, @random="708a1c045afe", [], {@ipv6={0x86dd, {0x0, 0x6, "4c000f", 0x40, 0x3a, 0x0, @dev={0xfe, 0x80, [0x0, 0x0, 0x2c]}, @mcast2, {[], @icmpv6=@dest_unreach={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, '\x00', 0x0, 0x0, 0x0, @empty, @remote, [@hopopts={0x2f}], "020088beffff00fc"}}}}}}}, 0x0) 07:59:29 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = eventfd2(0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000000c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x153}) ptrace$setopts(0x4206, r3, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0, 0xfffffffffffffe9c}, {&(0x7f0000000140)=""/64, 0xfffffffffffffdbe}], 0x3, 0x0, 0x0, 0x0) tkill(r3, 0x3c) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r3, 0x0, 0x0) 07:59:29 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2842, 0x0) io_submit(0x0, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(0xffffffffffffffff, 0xc02c5341, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000380)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x0, 0x0, @loopback}}}, 0x90) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) 07:59:29 executing program 3: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2842, 0x0) io_submit(0x0, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(0xffffffffffffffff, 0xc02c5341, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000380)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x0, 0x0, @loopback}}}, 0x90) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) 07:59:30 executing program 0: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="2e0000002f00815be00f80ecdb4cb90409486516080003002300000012000014c2ed3c001500cd5edc2976d153b4", 0x2e}], 0x1}, 0x0) 07:59:30 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = eventfd2(0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000000c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x153}) ptrace$setopts(0x4206, r3, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0, 0xfffffffffffffe9c}, {&(0x7f0000000140)=""/64, 0xfffffffffffffdbe}], 0x3, 0x0, 0x0, 0x0) tkill(r3, 0x3c) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r3, 0x0, 0x0) 07:59:30 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2842, 0x0) io_submit(0x0, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(0xffffffffffffffff, 0xc02c5341, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000380)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x0, 0x0, @loopback}}}, 0x90) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) 07:59:30 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x5}) ioctl$TIOCL_PASTESEL(r0, 0x541c, &(0x7f0000000140)) 07:59:30 executing program 5: socket$inet(0x10, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept4$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000280)=0x1c, 0x100400) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80000000) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(0xffffffffffffffff, 0x0, 0x483, &(0x7f0000000380), &(0x7f0000000400)=0x68) lsetxattr$security_ima(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='security.ima\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="030400000000000000000081000000"], 0x1, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = socket(0x11, 0x2, 0xfe) getsockopt$sock_cred(r3, 0x1, 0x11, 0x0, 0xfffffffffffffffd) bind$packet(r3, &(0x7f0000000100)={0x11, 0x1c, r2, 0x1, 0x0, 0x6, @local}, 0x14) r4 = socket$inet(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0xffffff69, &(0x7f000000d000)=[{&(0x7f0000000000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0xfffffffffffffe09, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x8000}}, 0xfffffd65}, 0x1, 0x0, 0x0, 0x10}, 0x4060010) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000340)='hugetlb.2MB.failcnt\x00', 0x2, 0x0) 07:59:30 executing program 0: socket$inet(0x10, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept4$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000280)=0x1c, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x5b, &(0x7f00000002c0)=ANY=[@ANYBLOB="3b06040300000000fe8000000000ff010008000000000000e0ffffffff0000000000000000000000ffffac1414aa"], 0x38) mkdir(0x0, 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80000000) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(0xffffffffffffffff, 0x0, 0x483, &(0x7f0000000380), &(0x7f0000000400)=0x68) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0xfffffffffffffffd) bind$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x1c, r2, 0x1, 0x0, 0x6, @local}, 0x14) r3 = socket$inet(0x10, 0x3, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0xffffff69, &(0x7f000000d000)=[{&(0x7f0000000000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0xfffffffffffffe09, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}}, 0xfffffd65}, 0x1, 0x0, 0x0, 0x10}, 0x4060010) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000340)='hugetlb.2MB.failcnt\x00', 0x2, 0x0) 07:59:30 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f00000001c0)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r0, 0xc0bc5310, &(0x7f00000002c0)) [ 219.581958][ T9408] netlink: 'syz-executor.0': attribute type 29 has an invalid length. 07:59:30 executing program 3: creat(0x0, 0x0) r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, r2) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) dup2(0xffffffffffffffff, 0xffffffffffffffff) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) futimesat(r3, &(0x7f0000000480)='./file0\x00', 0x0) ioctl$TUNSETOWNER(r1, 0x400454cc, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='\x00\x00\x00\x00\x00\xdfbO\xe2\x1d(@o', 0x0, 0x0) creat(0x0, 0xe1) ioctl$TUNSETOWNER(0xffffffffffffffff, 0x400454cc, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) r4 = open(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r4, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(r4, 0x8905, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$revoke(0x3, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r5, 0x1, 0x6, &(0x7f0000000140)=0x32, 0xfe51) connect$inet(r5, &(0x7f0000000440)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r5, &(0x7f0000007fc0), 0x40000000000002f, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000ac0)='/dev/uinput\x00', 0x0, 0x0) 07:59:30 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2842, 0x0) io_submit(0x0, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(0xffffffffffffffff, 0xc02c5341, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000380)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x0, 0x0, @loopback}}}, 0x90) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) [ 219.584483][ T9408] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 219.600181][ T9408] netlink: 'syz-executor.0': attribute type 29 has an invalid length. [ 219.600258][ T9408] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 219.694531][ T9412] netlink: 'syz-executor.0': attribute type 29 has an invalid length. [ 219.694659][ T9412] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 219.697615][ T9410] netlink: 'syz-executor.5': attribute type 29 has an invalid length. [ 219.697945][ T9410] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 219.698262][ T9412] netlink: 'syz-executor.0': attribute type 29 has an invalid length. [ 219.698294][ T9412] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 219.704330][ T9410] netlink: 'syz-executor.5': attribute type 29 has an invalid length. [ 219.704408][ T9410] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 219.806739][ T9419] netlink: 'syz-executor.5': attribute type 29 has an invalid length. [ 219.806964][ T9419] netlink: 'syz-executor.5': attribute type 29 has an invalid length. 07:59:30 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2842, 0x0) io_submit(0x0, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(0xffffffffffffffff, 0xc02c5341, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000380)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x0, 0x0, @loopback}}}, 0x90) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) 07:59:30 executing program 3: creat(0x0, 0x0) r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, r2) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) dup2(0xffffffffffffffff, 0xffffffffffffffff) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) futimesat(r3, &(0x7f0000000480)='./file0\x00', 0x0) ioctl$TUNSETOWNER(r1, 0x400454cc, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='\x00\x00\x00\x00\x00\xdfbO\xe2\x1d(@o', 0x0, 0x0) creat(0x0, 0xe1) ioctl$TUNSETOWNER(0xffffffffffffffff, 0x400454cc, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(0x0, 0x0, 0x0) r4 = open(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r4, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(r4, 0x8905, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$revoke(0x3, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r5, 0x1, 0x6, &(0x7f0000000140)=0x32, 0xfe51) connect$inet(r5, &(0x7f0000000440)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r5, &(0x7f0000007fc0), 0x40000000000002f, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000ac0)='/dev/uinput\x00', 0x0, 0x0) 07:59:30 executing program 0: socket$inet(0x10, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept4$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000280)=0x1c, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x5b, &(0x7f00000002c0)=ANY=[@ANYBLOB="3b06040300000000fe8000000000ff010008000000000000e0ffffffff0000000000000000000000ffffac1414aa"], 0x38) mkdir(0x0, 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80000000) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(0xffffffffffffffff, 0x0, 0x483, &(0x7f0000000380), &(0x7f0000000400)=0x68) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0xfffffffffffffffd) bind$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x1c, r2, 0x1, 0x0, 0x6, @local}, 0x14) r3 = socket$inet(0x10, 0x3, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0xffffff69, &(0x7f000000d000)=[{&(0x7f0000000000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0xfffffffffffffe09, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}}, 0xfffffd65}, 0x1, 0x0, 0x0, 0x10}, 0x4060010) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000340)='hugetlb.2MB.failcnt\x00', 0x2, 0x0) 07:59:30 executing program 5: socket$inet(0x10, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept4$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000280)=0x1c, 0x100400) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80000000) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(0xffffffffffffffff, 0x0, 0x483, &(0x7f0000000380), &(0x7f0000000400)=0x68) lsetxattr$security_ima(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='security.ima\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="030400000000000000000081000000"], 0x1, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = socket(0x11, 0x2, 0xfe) getsockopt$sock_cred(r3, 0x1, 0x11, 0x0, 0xfffffffffffffffd) bind$packet(r3, &(0x7f0000000100)={0x11, 0x1c, r2, 0x1, 0x0, 0x6, @local}, 0x14) r4 = socket$inet(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0xffffff69, &(0x7f000000d000)=[{&(0x7f0000000000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0xfffffffffffffe09, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x8000}}, 0xfffffd65}, 0x1, 0x0, 0x0, 0x10}, 0x4060010) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000340)='hugetlb.2MB.failcnt\x00', 0x2, 0x0) [ 220.253867][ T9430] netlink: 'syz-executor.0': attribute type 29 has an invalid length. [ 220.522650][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 220.522753][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 220.602737][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 220.602778][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 220.814854][ T9430] netlink: 'syz-executor.0': attribute type 29 has an invalid length. 07:59:33 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = eventfd2(0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f00000000c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x153}) ptrace$setopts(0x4206, r3, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0, 0xfffffffffffffe9c}, {&(0x7f0000000140)=""/64, 0xfffffffffffffdbe}], 0x3, 0x0, 0x0, 0x0) tkill(r3, 0x3c) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r3, 0x0, 0x0) 07:59:33 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2842, 0x0) io_submit(0x0, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(0xffffffffffffffff, 0xc02c5341, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000380)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x0, 0x0, @loopback}}}, 0x90) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x2) 07:59:33 executing program 3: socket$inet(0x10, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept4$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000280)=0x1c, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x5b, &(0x7f00000002c0)=ANY=[@ANYBLOB="3b06040300000000fe8000000000ff010008000000000000e0ffffffff0000000000000000000000ffffac1414aa"], 0x38) mkdir(0x0, 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80000000) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(0xffffffffffffffff, 0x0, 0x483, &(0x7f0000000380), &(0x7f0000000400)=0x68) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0xfffffffffffffffd) bind$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x1c, r2, 0x1, 0x0, 0x6, @local}, 0x14) r3 = socket$inet(0x10, 0x3, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0xffffff69, &(0x7f000000d000)=[{&(0x7f0000000000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0xfffffffffffffe09, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}}, 0xfffffd65}, 0x1, 0x0, 0x0, 0x10}, 0x4060010) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000340)='hugetlb.2MB.failcnt\x00', 0x2, 0x0) 07:59:33 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x5}) ioctl$TIOCL_PASTESEL(r0, 0x541c, &(0x7f0000000140)) 07:59:33 executing program 5: socket$inet(0x10, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept4$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000280)=0x1c, 0x100400) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x80000000) add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(0xffffffffffffffff, 0x0, 0x483, &(0x7f0000000380), &(0x7f0000000400)=0x68) lsetxattr$security_ima(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='security.ima\x00', &(0x7f0000000440)=ANY=[@ANYBLOB="030400000000000000000081000000"], 0x1, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r3 = socket(0x11, 0x2, 0xfe) getsockopt$sock_cred(r3, 0x1, 0x11, 0x0, 0xfffffffffffffffd) bind$packet(r3, &(0x7f0000000100)={0x11, 0x1c, r2, 0x1, 0x0, 0x6, @local}, 0x14) r4 = socket$inet(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0xffffff69, &(0x7f000000d000)=[{&(0x7f0000000000)="4c0000001200ff09fffefd956fa283b724a6008000000000000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000500)=@newlink={0xfffffffffffffe09, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x0, 0x8000}}, 0xfffffd65}, 0x1, 0x0, 0x0, 0x10}, 0x4060010) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000340)='hugetlb.2MB.failcnt\x00', 0x2, 0x0) 07:59:33 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x5}) ioctl$TIOCL_PASTESEL(r0, 0x541c, &(0x7f0000000140)) [ 222.412534][ T21] tipc: TX() has been purged, node left! 07:59:33 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2842, 0x0) io_submit(0x0, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(0xffffffffffffffff, 0xc02c5341, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) [ 222.555057][ T9464] __nla_validate_parse: 4 callbacks suppressed [ 222.555088][ T9464] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. [ 222.602460][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 222.602510][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 222.682544][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 222.682588][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 222.922435][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 222.922483][ C0] protocol 88fb is buggy, dev hsr_slave_1 07:59:33 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2842, 0x0) io_submit(0x0, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(0xffffffffffffffff, 0xc02c5341, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) 07:59:34 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2842, 0x0) io_submit(0x0, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) 07:59:34 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2842, 0x0) io_submit(0x0, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) [ 223.968195][ T9464] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. 07:59:34 executing program 2: 07:59:34 executing program 3: 07:59:34 executing program 4: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cuse\x00', 0x2842, 0x0) io_submit(0x0, 0x0, &(0x7f0000000180)) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) 07:59:35 executing program 2: 07:59:35 executing program 3: 07:59:36 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x5}) ioctl$TIOCL_PASTESEL(r0, 0x541c, &(0x7f0000000140)) [ 225.443064][ T9469] ================================================================== [ 225.451213][ T9469] BUG: KASAN: use-after-free in n_tty_receive_buf_common+0x270f/0x2b70 [ 225.460237][ T9469] Read of size 1 at addr ffff88805be480ee by task syz-executor.0/9469 [ 225.460242][ T9469] [ 225.460258][ T9469] CPU: 0 PID: 9469 Comm: syz-executor.0 Not tainted 5.5.0-rc2-syzkaller #0 [ 225.460265][ T9469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 225.460269][ T9469] Call Trace: [ 225.460290][ T9469] dump_stack+0x197/0x210 [ 225.460309][ T9469] ? n_tty_receive_buf_common+0x270f/0x2b70 [ 225.460329][ T9469] print_address_description.constprop.0.cold+0xd4/0x30b [ 225.460344][ T9469] ? n_tty_receive_buf_common+0x270f/0x2b70 [ 225.460360][ T9469] ? n_tty_receive_buf_common+0x270f/0x2b70 [ 225.460377][ T9469] __kasan_report.cold+0x1b/0x41 [ 225.460397][ T9469] ? n_tty_receive_buf_common+0x270f/0x2b70 [ 225.460414][ T9469] kasan_report+0x12/0x20 [ 225.460432][ T9469] __asan_report_load1_noabort+0x14/0x20 [ 225.460449][ T9469] n_tty_receive_buf_common+0x270f/0x2b70 [ 225.460464][ T9469] ? __kasan_check_read+0x11/0x20 [ 225.460502][ T9469] n_tty_receive_buf2+0x34/0x40 [ 225.460520][ T9469] tty_ldisc_receive_buf+0xad/0x1c0 [ 225.460533][ T9469] ? add_wait_queue+0x112/0x170 [ 225.460547][ T9469] ? n_tty_receive_buf_common+0x2b70/0x2b70 [ 225.460564][ T9469] paste_selection+0x1ff/0x460 [ 225.460584][ T9469] ? vcs_remove_sysfs+0x60/0x60 [ 225.460599][ T9469] ? lock_downgrade+0x920/0x920 [ 225.460617][ T9469] ? wake_up_q+0x140/0x140 [ 225.460643][ T9469] tioclinux+0x133/0x480 [ 225.460662][ T9469] vt_ioctl+0x1a41/0x26d0 [ 225.460681][ T9469] ? complete_change_console+0x3a0/0x3a0 [ 225.460693][ T9469] ? lock_downgrade+0x920/0x920 [ 225.460708][ T9469] ? rwlock_bug.part.0+0x90/0x90 [ 225.460725][ T9469] ? tomoyo_path_number_perm+0x214/0x520 [ 225.460739][ T9469] ? find_held_lock+0x35/0x130 [ 225.460755][ T9469] ? tomoyo_path_number_perm+0x214/0x520 [ 225.460772][ T9469] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 225.460788][ T9469] ? tty_jobctrl_ioctl+0x50/0xd40 [ 225.460804][ T9469] ? complete_change_console+0x3a0/0x3a0 [ 225.460820][ T9469] tty_ioctl+0xa37/0x14f0 [ 225.460836][ T9469] ? tty_vhangup+0x30/0x30 [ 225.460850][ T9469] ? tomoyo_path_number_perm+0x454/0x520 [ 225.460870][ T9469] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 225.460885][ T9469] ? tomoyo_path_number_perm+0x25e/0x520 [ 225.460903][ T9469] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 225.460935][ T9469] ? tty_vhangup+0x30/0x30 [ 225.460952][ T9469] do_vfs_ioctl+0x977/0x14e0 [ 225.460972][ T9469] ? compat_ioctl_preallocate+0x220/0x220 [ 225.460987][ T9469] ? __fget+0x37f/0x550 [ 225.461007][ T9469] ? ksys_dup3+0x3e0/0x3e0 [ 225.461023][ T9469] ? ns_to_kernel_old_timeval+0x100/0x100 [ 225.461044][ T9469] ? tomoyo_file_ioctl+0x23/0x30 [ 225.461059][ T9469] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 225.461073][ T9469] ? security_file_ioctl+0x8d/0xc0 [ 225.461090][ T9469] ksys_ioctl+0xab/0xd0 [ 225.461108][ T9469] __x64_sys_ioctl+0x73/0xb0 [ 225.461126][ T9469] do_syscall_64+0xfa/0x790 [ 225.461145][ T9469] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 225.461156][ T9469] RIP: 0033:0x45a919 [ 225.461173][ T9469] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 225.461180][ T9469] RSP: 002b:00007f8468c6ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 225.461201][ T9469] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a919 [ 225.461210][ T9469] RDX: 0000000020000140 RSI: 000000000000541c RDI: 0000000000000003 [ 225.461218][ T9469] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 225.461227][ T9469] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8468c6b6d4 [ 225.461235][ T9469] R13: 00000000004c5c45 R14: 00000000004dc018 R15: 00000000ffffffff [ 225.461255][ T9469] [ 225.461262][ T9469] Allocated by task 9458: [ 225.461275][ T9469] save_stack+0x23/0x90 [ 225.461287][ T9469] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 225.461299][ T9469] kasan_kmalloc+0x9/0x10 [ 225.461310][ T9469] __kmalloc+0x163/0x770 [ 225.461321][ T9469] set_selection_kernel+0x872/0x13b0 [ 225.461332][ T9469] set_selection_user+0x95/0xd9 [ 225.461345][ T9469] tioclinux+0x11c/0x480 [ 225.461358][ T9469] vt_ioctl+0x1a41/0x26d0 [ 225.461370][ T9469] tty_ioctl+0xa37/0x14f0 [ 225.461382][ T9469] do_vfs_ioctl+0x977/0x14e0 [ 225.461393][ T9469] ksys_ioctl+0xab/0xd0 [ 225.461406][ T9469] __x64_sys_ioctl+0x73/0xb0 [ 225.461419][ T9469] do_syscall_64+0xfa/0x790 [ 225.461432][ T9469] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 225.461436][ T9469] [ 225.461443][ T9469] Freed by task 9518: [ 225.461454][ T9469] save_stack+0x23/0x90 [ 225.461466][ T9469] __kasan_slab_free+0x102/0x150 [ 225.461478][ T9469] kasan_slab_free+0xe/0x10 [ 225.461488][ T9469] kfree+0x10a/0x2c0 [ 225.461501][ T9469] set_selection_kernel+0x88f/0x13b0 [ 225.461513][ T9469] set_selection_user+0x95/0xd9 [ 225.461527][ T9469] tioclinux+0x11c/0x480 [ 225.461541][ T9469] vt_ioctl+0x1a41/0x26d0 [ 225.461554][ T9469] tty_ioctl+0xa37/0x14f0 [ 225.461567][ T9469] do_vfs_ioctl+0x977/0x14e0 [ 225.461579][ T9469] ksys_ioctl+0xab/0xd0 [ 225.461593][ T9469] __x64_sys_ioctl+0x73/0xb0 [ 225.461607][ T9469] do_syscall_64+0xfa/0x790 [ 225.461621][ T9469] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 225.461625][ T9469] [ 225.461635][ T9469] The buggy address belongs to the object at ffff88805be48000 [ 225.461635][ T9469] which belongs to the cache kmalloc-8k of size 8192 [ 225.461648][ T9469] The buggy address is located 238 bytes inside of [ 225.461648][ T9469] 8192-byte region [ffff88805be48000, ffff88805be4a000) [ 225.461652][ T9469] The buggy address belongs to the page: [ 225.461670][ T9469] page:ffffea00016f9200 refcount:1 mapcount:0 mapping:ffff8880aa4021c0 index:0x0 compound_mapcount: 0 [ 225.461688][ T9469] raw: 00fffe0000010200 ffffea000175c008 ffff8880aa401b48 ffff8880aa4021c0 [ 225.461704][ T9469] raw: 0000000000000000 ffff88805be48000 0000000100000001 0000000000000000 [ 225.461711][ T9469] page dumped because: kasan: bad access detected [ 225.461714][ T9469] [ 225.461719][ T9469] Memory state around the buggy address: [ 225.461730][ T9469] ffff88805be47f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 225.461741][ T9469] ffff88805be48000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 225.461752][ T9469] >ffff88805be48080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 225.461758][ T9469] ^ [ 225.461769][ T9469] ffff88805be48100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 225.461781][ T9469] ffff88805be48180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 225.461786][ T9469] ================================================================== [ 225.461791][ T9469] Disabling lock debugging due to kernel taint [ 225.461874][ T9469] Kernel panic - not syncing: panic_on_warn set ... [ 225.461891][ T9469] CPU: 0 PID: 9469 Comm: syz-executor.0 Tainted: G B 5.5.0-rc2-syzkaller #0 [ 225.461903][ T9469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 225.461912][ T9469] Call Trace: [ 225.461928][ T9469] dump_stack+0x197/0x210 [ 225.461946][ T9469] panic+0x2e3/0x75c [ 225.461961][ T9469] ? add_taint.cold+0x16/0x16 [ 225.461981][ T9469] ? trace_hardirqs_on+0x5e/0x240 [ 225.461997][ T9469] ? trace_hardirqs_on+0x5e/0x240 [ 225.462015][ T9469] ? n_tty_receive_buf_common+0x270f/0x2b70 [ 225.462030][ T9469] end_report+0x47/0x4f [ 225.462049][ T9469] ? n_tty_receive_buf_common+0x270f/0x2b70 [ 225.462064][ T9469] __kasan_report.cold+0xe/0x41 [ 225.462081][ T9469] ? n_tty_receive_buf_common+0x270f/0x2b70 [ 225.462096][ T9469] kasan_report+0x12/0x20 [ 225.462112][ T9469] __asan_report_load1_noabort+0x14/0x20 [ 225.462129][ T9469] n_tty_receive_buf_common+0x270f/0x2b70 [ 225.462144][ T9469] ? __kasan_check_read+0x11/0x20 [ 225.462170][ T9469] n_tty_receive_buf2+0x34/0x40 [ 225.462189][ T9469] tty_ldisc_receive_buf+0xad/0x1c0 [ 225.462205][ T9469] ? add_wait_queue+0x112/0x170 [ 225.462222][ T9469] ? n_tty_receive_buf_common+0x2b70/0x2b70 [ 225.462238][ T9469] paste_selection+0x1ff/0x460 [ 225.462254][ T9469] ? vcs_remove_sysfs+0x60/0x60 [ 225.462270][ T9469] ? lock_downgrade+0x920/0x920 [ 225.462285][ T9469] ? wake_up_q+0x140/0x140 [ 225.462302][ T9469] tioclinux+0x133/0x480 [ 225.462319][ T9469] vt_ioctl+0x1a41/0x26d0 [ 225.462345][ T9469] ? complete_change_console+0x3a0/0x3a0 [ 225.462356][ T9469] ? lock_downgrade+0x920/0x920 [ 225.462371][ T9469] ? rwlock_bug.part.0+0x90/0x90 [ 225.462385][ T9469] ? tomoyo_path_number_perm+0x214/0x520 [ 225.462396][ T9469] ? find_held_lock+0x35/0x130 [ 225.462409][ T9469] ? tomoyo_path_number_perm+0x214/0x520 [ 225.462428][ T9469] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 225.462443][ T9469] ? tty_jobctrl_ioctl+0x50/0xd40 [ 225.462460][ T9469] ? complete_change_console+0x3a0/0x3a0 [ 225.462475][ T9469] tty_ioctl+0xa37/0x14f0 [ 225.462491][ T9469] ? tty_vhangup+0x30/0x30 [ 225.462507][ T9469] ? tomoyo_path_number_perm+0x454/0x520 [ 225.462525][ T9469] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 225.462540][ T9469] ? tomoyo_path_number_perm+0x25e/0x520 [ 225.462556][ T9469] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 225.462581][ T9469] ? tty_vhangup+0x30/0x30 [ 225.462596][ T9469] do_vfs_ioctl+0x977/0x14e0 [ 225.462613][ T9469] ? compat_ioctl_preallocate+0x220/0x220 [ 225.462633][ T9469] ? __fget+0x37f/0x550 [ 225.462650][ T9469] ? ksys_dup3+0x3e0/0x3e0 [ 225.462670][ T9469] ? ns_to_kernel_old_timeval+0x100/0x100 [ 225.462687][ T9469] ? tomoyo_file_ioctl+0x23/0x30 [ 225.462708][ T9469] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 225.462723][ T9469] ? security_file_ioctl+0x8d/0xc0 [ 225.462738][ T9469] ksys_ioctl+0xab/0xd0 [ 225.462754][ T9469] __x64_sys_ioctl+0x73/0xb0 [ 225.462770][ T9469] do_syscall_64+0xfa/0x790 [ 225.462787][ T9469] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 225.462799][ T9469] RIP: 0033:0x45a919 [ 225.462815][ T9469] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 225.462826][ T9469] RSP: 002b:00007f8468c6ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 225.462848][ T9469] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a919 [ 225.462860][ T9469] RDX: 0000000020000140 RSI: 000000000000541c RDI: 0000000000000003 [ 225.462872][ T9469] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 225.462884][ T9469] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8468c6b6d4 [ 225.462897][ T9469] R13: 00000000004c5c45 R14: 00000000004dc018 R15: 00000000ffffffff [ 225.464525][ T9469] Kernel Offset: disabled [ 226.470847][ T9469] Rebooting in 86400 seconds..