Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '[localhost]:51935' (ECDSA) to the list of known hosts. syzkaller login: [ 184.875472][ T41] kauditd_printk_skb: 7 callbacks suppressed [ 184.875516][ T41] audit: type=1400 audit(1590165233.280:42): avc: denied { map } for pid=9521 comm="syz-fuzzer" path="/syz-fuzzer" dev="sda1" ino=16524 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:file_t:s0 tclass=file permissive=1 2020/05/22 16:33:53 fuzzer started 2020/05/22 16:33:53 dialing manager at 10.0.2.10:34811 2020/05/22 16:33:53 syscalls: 3057 2020/05/22 16:33:53 code coverage: enabled 2020/05/22 16:33:53 comparison tracing: enabled 2020/05/22 16:33:53 extra coverage: enabled 2020/05/22 16:33:53 setuid sandbox: enabled 2020/05/22 16:33:53 namespace sandbox: enabled 2020/05/22 16:33:53 Android sandbox: /sys/fs/selinux/policy does not exist 2020/05/22 16:33:53 fault injection: enabled 2020/05/22 16:33:53 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2020/05/22 16:33:53 net packet injection: enabled 2020/05/22 16:33:53 net device setup: enabled 2020/05/22 16:33:53 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2020/05/22 16:33:53 devlink PCI setup: PCI device 0000:00:10.0 is not available 2020/05/22 16:33:53 USB emulation: enabled [ 185.443518][ T41] audit: type=1400 audit(1590165233.850:43): avc: denied { integrity } for pid=9539 comm="syz-executor" lockdown_reason="debugfs access" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=lockdown permissive=1 16:34:46 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x42) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x1, 0x0) write$FUSE_CREATE_OPEN(r0, &(0x7f00000000c0)={0xa0}, 0xa0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) lseek(0xffffffffffffffff, 0x100, 0x0) [ 238.178634][ T41] audit: type=1400 audit(1590165286.580:44): avc: denied { map } for pid=9542 comm="syz-executor.0" path="/sys/kernel/debug/kcov" dev="debugfs" ino=2118 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 239.220280][ T9543] IPVS: ftp: loaded support on port[0] = 21 16:34:47 executing program 1: clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 16:34:48 executing program 2: syz_open_procfs(0x0, &(0x7f0000000000)='oom_score_adj\x00') pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x1420000a7a, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001e00"], 0x1c}}, 0x0) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xfffa) [ 239.938382][ T9543] chnl_net:caif_netlink_parms(): no params data found [ 240.094787][ T9546] IPVS: ftp: loaded support on port[0] = 21 [ 240.181182][ T9543] bridge0: port 1(bridge_slave_0) entered blocking state 16:34:48 executing program 3: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000080)='/dev/md0\x00', 0x0, 0x0) syz_open_procfs(0x0, 0x0) capget(0x0, 0x0) ioctl$BLKPG(r0, 0x125d, 0x0) [ 240.213220][ T9543] bridge0: port 1(bridge_slave_0) entered disabled state [ 240.257812][ T9543] device bridge_slave_0 entered promiscuous mode [ 240.324119][ T9543] bridge0: port 2(bridge_slave_1) entered blocking state [ 240.369887][ T9543] bridge0: port 2(bridge_slave_1) entered disabled state [ 240.407803][ T9543] device bridge_slave_1 entered promiscuous mode [ 240.551231][ T9543] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 240.616187][ T9543] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 240.691395][ T9543] team0: Port device team_slave_0 added [ 240.692742][ T9554] IPVS: ftp: loaded support on port[0] = 21 [ 240.720202][ T9543] team0: Port device team_slave_1 added [ 240.796735][ T9543] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 240.821981][ T9543] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 240.895104][ T9543] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 240.939237][ T9543] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 240.965361][ T9543] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 241.045781][ T9543] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 241.127848][ T9555] IPVS: ftp: loaded support on port[0] = 21 [ 241.187889][ T9543] device hsr_slave_0 entered promiscuous mode [ 241.303876][ T9543] device hsr_slave_1 entered promiscuous mode [ 241.506031][ T9546] chnl_net:caif_netlink_parms(): no params data found [ 241.811697][ T9554] chnl_net:caif_netlink_parms(): no params data found [ 241.873519][ T9546] bridge0: port 1(bridge_slave_0) entered blocking state [ 241.898105][ T9546] bridge0: port 1(bridge_slave_0) entered disabled state [ 241.917805][ T9546] device bridge_slave_0 entered promiscuous mode [ 241.974430][ T9546] bridge0: port 2(bridge_slave_1) entered blocking state [ 242.004113][ T9546] bridge0: port 2(bridge_slave_1) entered disabled state [ 242.038265][ T9546] device bridge_slave_1 entered promiscuous mode [ 242.163347][ T9555] chnl_net:caif_netlink_parms(): no params data found [ 242.340789][ T9546] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 242.461497][ T9546] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 242.514707][ T9554] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.541814][ T9554] bridge0: port 1(bridge_slave_0) entered disabled state [ 242.576722][ T9554] device bridge_slave_0 entered promiscuous mode [ 242.616512][ T41] audit: type=1400 audit(1590165291.020:45): avc: denied { create } for pid=9543 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 242.618430][ T9555] bridge0: port 1(bridge_slave_0) entered blocking state [ 242.744576][ T41] audit: type=1400 audit(1590165291.020:46): avc: denied { write } for pid=9543 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 242.775923][ T9555] bridge0: port 1(bridge_slave_0) entered disabled state [ 242.896610][ T41] audit: type=1400 audit(1590165291.020:47): avc: denied { read } for pid=9543 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 242.920552][ T9555] device bridge_slave_0 entered promiscuous mode [ 243.041409][ T9546] team0: Port device team_slave_0 added [ 243.066163][ T9543] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 243.170096][ T9554] bridge0: port 2(bridge_slave_1) entered blocking state [ 243.190364][ T9554] bridge0: port 2(bridge_slave_1) entered disabled state [ 243.216588][ T9554] device bridge_slave_1 entered promiscuous mode [ 243.244611][ T9555] bridge0: port 2(bridge_slave_1) entered blocking state [ 243.261508][ T9555] bridge0: port 2(bridge_slave_1) entered disabled state [ 243.278113][ T9555] device bridge_slave_1 entered promiscuous mode [ 243.296480][ T9546] team0: Port device team_slave_1 added [ 243.343337][ T9543] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 243.430280][ T9543] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 243.556774][ T9546] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 243.611286][ T9546] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 243.728656][ T9546] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 243.768721][ T9543] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 243.855441][ T9554] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 243.874917][ T9546] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 243.897126][ T9546] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 243.964849][ T9546] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 244.016796][ T9555] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 244.061479][ T9554] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 244.117098][ T9555] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 244.189138][ T9554] team0: Port device team_slave_0 added [ 244.316177][ T9546] device hsr_slave_0 entered promiscuous mode [ 244.394080][ T9546] device hsr_slave_1 entered promiscuous mode [ 244.483506][ T9546] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 244.519788][ T9546] Cannot create hsr debugfs directory [ 244.550842][ T9554] team0: Port device team_slave_1 added [ 244.586532][ T9555] team0: Port device team_slave_0 added [ 244.634801][ T9555] team0: Port device team_slave_1 added [ 244.684983][ T9554] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 244.716325][ T9554] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 244.877072][ T9554] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 244.941865][ T9554] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 244.983569][ T9554] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 245.115883][ T9554] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 245.239505][ T9555] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 245.273002][ T9555] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 245.388646][ T9555] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 245.529837][ T9554] device hsr_slave_0 entered promiscuous mode [ 245.603410][ T9554] device hsr_slave_1 entered promiscuous mode [ 245.702829][ T9554] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 245.747817][ T9554] Cannot create hsr debugfs directory [ 245.784137][ T9555] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 245.813618][ T9555] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 245.939840][ T9555] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 246.118181][ T9555] device hsr_slave_0 entered promiscuous mode [ 246.213392][ T9555] device hsr_slave_1 entered promiscuous mode [ 246.302964][ T9555] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 246.344082][ T9555] Cannot create hsr debugfs directory [ 246.668787][ T9546] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 246.809303][ T9546] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 246.960647][ T9546] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 247.088215][ T9546] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 247.301658][ T9554] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 247.841950][ T9554] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 247.950827][ T9554] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 248.104451][ T9554] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 248.275469][ T9543] 8021q: adding VLAN 0 to HW filter on device bond0 [ 248.400373][ T1252] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 248.458867][ T1252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 248.508886][ T9543] 8021q: adding VLAN 0 to HW filter on device team0 [ 248.537596][ T9555] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 248.680949][ T9555] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 248.776152][ T9555] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 248.908154][ T9555] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 249.104985][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 249.164749][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 249.230669][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 249.275541][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 249.337503][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 249.401635][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 249.467335][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 249.516619][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 249.587386][ T3062] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 249.670187][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 249.758069][ T9569] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 249.810458][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 249.829239][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 249.855495][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 249.877931][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 249.895397][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 249.917208][ T9573] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 249.935805][ T9573] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 249.965092][ T9569] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 249.993437][ T9569] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 250.017560][ T9543] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 250.038074][ T9546] 8021q: adding VLAN 0 to HW filter on device bond0 [ 250.069735][ T9554] 8021q: adding VLAN 0 to HW filter on device bond0 [ 250.092152][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 250.114660][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 250.148612][ T9546] 8021q: adding VLAN 0 to HW filter on device team0 [ 250.180265][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 250.194080][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 250.212522][ T1252] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 250.228817][ T1252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 250.245921][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 250.265021][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 250.293837][ T28] bridge0: port 1(bridge_slave_0) entered blocking state [ 250.315234][ T28] bridge0: port 1(bridge_slave_0) entered forwarding state [ 250.335830][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 250.366969][ T9543] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 250.400916][ T9573] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 250.429736][ T9573] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 250.469273][ T9573] bridge0: port 2(bridge_slave_1) entered blocking state [ 250.497234][ T9573] bridge0: port 2(bridge_slave_1) entered forwarding state [ 250.531444][ T9554] 8021q: adding VLAN 0 to HW filter on device team0 [ 250.563978][ T9569] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 250.611188][ T9555] 8021q: adding VLAN 0 to HW filter on device bond0 [ 250.635416][ T1252] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 250.666151][ T1252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 250.698658][ T1252] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 250.733814][ T1252] bridge0: port 1(bridge_slave_0) entered blocking state [ 250.766880][ T1252] bridge0: port 1(bridge_slave_0) entered forwarding state [ 250.800787][ T1252] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 250.861426][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 250.904255][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 250.937752][ T9552] bridge0: port 2(bridge_slave_1) entered blocking state [ 250.964043][ T9552] bridge0: port 2(bridge_slave_1) entered forwarding state [ 250.997952][ T9569] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 251.028310][ T9569] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 251.057741][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 251.114452][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 251.141262][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 251.167585][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 251.200848][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 251.234534][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 251.265657][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 251.313147][ T9573] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 251.350474][ T9555] 8021q: adding VLAN 0 to HW filter on device team0 [ 251.397086][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 251.441947][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 251.473829][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 251.514152][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 251.561559][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 251.611440][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 251.644115][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 251.677520][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 251.707513][ T52] bridge0: port 2(bridge_slave_1) entered blocking state [ 251.736771][ T52] bridge0: port 2(bridge_slave_1) entered forwarding state [ 251.770473][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 251.794949][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 251.816622][ T52] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 251.865266][ T9543] device veth0_vlan entered promiscuous mode [ 251.917868][ T9543] device veth1_vlan entered promiscuous mode [ 251.941199][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 251.966499][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 251.984061][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 252.001301][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 252.017657][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 252.035326][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 252.053636][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 252.070766][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 252.095883][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 252.123686][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 252.160296][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 252.176332][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 252.198041][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 252.210656][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 252.225487][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 252.238917][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 252.251973][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 252.266980][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 252.283967][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 252.298762][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 252.344141][ T9546] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 252.357386][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 252.381249][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 252.400606][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 252.417903][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 252.446336][ T9555] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 252.476606][ T9554] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 252.508962][ T9554] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 252.541066][ T1252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 252.562318][ T1252] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 252.585986][ T1252] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 252.608441][ T1252] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 252.628479][ T1252] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 252.686391][ T9543] device veth0_macvtap entered promiscuous mode [ 252.723762][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 252.749602][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 252.789073][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 252.832154][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 252.863210][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 252.904612][ T9543] device veth1_macvtap entered promiscuous mode [ 252.931994][ T9554] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 252.948716][ T3062] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 252.967599][ T3062] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 252.994174][ T3062] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 253.019178][ T3062] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 253.045218][ T3062] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 253.073821][ T9555] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 253.135609][ T9543] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 253.161871][ T9546] device veth0_vlan entered promiscuous mode [ 253.188786][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 253.219320][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 253.245587][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 253.276949][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 253.314549][ T9543] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 253.354114][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 253.384265][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 253.411242][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 253.439787][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 253.485811][ T9546] device veth1_vlan entered promiscuous mode [ 253.553173][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 253.601032][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 253.645953][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 253.685536][ T28] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 253.744350][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 253.785710][ T3438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 253.923130][ T9556] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 253.944905][ T9556] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 254.165366][ T41] audit: type=1400 audit(1590165302.560:48): avc: denied { associate } for pid=9543 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 254.174232][ T9546] device veth0_macvtap entered promiscuous mode [ 254.284114][ T9555] device veth0_vlan entered promiscuous mode [ 254.323599][ T9556] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 254.343368][ T9556] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 254.358786][ T9556] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 254.388255][ T9556] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 254.423706][ T9556] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 254.455501][ T9556] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 254.485312][ T9556] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 254.506673][ T9556] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 254.526254][ T9556] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 254.550426][ T9554] device veth0_vlan entered promiscuous mode [ 254.584233][ T9543] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 254.585749][ T9546] device veth1_macvtap entered promiscuous mode [ 254.669864][ T9555] device veth1_vlan entered promiscuous mode [ 254.721543][ T9554] device veth1_vlan entered promiscuous mode [ 254.749385][ T41] audit: type=1400 audit(1590165303.150:49): avc: denied { open } for pid=9576 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1 [ 254.847981][ T9546] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 254.886270][ T9546] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 254.889001][ T9546] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 254.908964][ T41] audit: type=1400 audit(1590165303.150:50): avc: denied { kernel } for pid=9576 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1 [ 254.908996][ T41] audit: type=1400 audit(1590165303.150:51): avc: denied { confidentiality } for pid=9576 comm="syz-executor.0" lockdown_reason="unsafe use of perf" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=lockdown permissive=1 [ 255.135690][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 255.159691][ T9552] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 255.199553][ T9546] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 255.238349][ T9546] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 255.287364][ T9546] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 255.322177][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 255.353794][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 255.395270][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 255.421307][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready 16:35:03 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x42) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x1, 0x0) write$FUSE_CREATE_OPEN(r0, &(0x7f00000000c0)={0xa0}, 0xa0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) lseek(0xffffffffffffffff, 0x100, 0x0) [ 255.456250][ T9555] device veth0_macvtap entered promiscuous mode [ 256.338414][ T9569] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 256.369129][ T9569] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready 16:35:04 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x42) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x1, 0x0) write$FUSE_CREATE_OPEN(r0, &(0x7f00000000c0)={0xa0}, 0xa0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) lseek(0xffffffffffffffff, 0x100, 0x0) [ 256.395864][ T9569] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready 16:35:04 executing program 0: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r1) openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) [ 256.478025][ T9555] device veth1_macvtap entered promiscuous mode 16:35:04 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf32(r2, &(0x7f0000000a00)=ANY=[@ANYBLOB="7f454c4600000000000000000000000000000000000000000000000038000000000000000000000000002000000000000000000000000000fc3133cee8f0a3f63db6c856c8dd41460a3a19149d60643e04291f5c528a9dc176d6f6a541718f5b02ebdbb3f80ccdc9db152451fa5e01c103fcbde7100e4bd252a6894ed5a060aa3a8044c648681ed5bb0131fed33c3268be3b1214903cc61605f9532d8a21bb1923b9982545c3b1efee170d0b70aaaa1e27c52884c371419400955b623e960f5d5fabb2ec7f9d08578804de587f0b86f4eaaa8f8984296df90c5c297872134cf97c3ad21108c12659a905bb67e3b11ec3431b0d63"], 0x691) [ 256.496133][ T9554] device veth0_macvtap entered promiscuous mode [ 256.528146][ T9554] device veth1_macvtap entered promiscuous mode [ 256.599427][ T9555] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 256.599433][ T9555] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 256.599441][ T9555] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 256.599444][ T9555] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 256.601567][ T9555] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 256.601757][ T4050] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 256.603275][ T4050] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 256.603707][ T4050] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 256.611768][ T9555] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 256.791274][ T9555] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 256.839574][ T9555] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 256.839584][ T9555] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 256.842102][ T9555] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 256.927324][ T9554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 256.927331][ T9554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! 16:35:05 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x54, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa, 0x1, 'netem\x00'}, {0x24, 0x2, {{}, [@TCA_NETEM_DELAY_DIST={0x6, 0x2, "24c9"}]}}}]}, 0x54}}, 0x0) [ 256.927337][ T9554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 256.927341][ T9554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 256.927348][ T9554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 256.927351][ T9554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 256.928568][ T9554] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 256.931827][ T9554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 256.931831][ T9554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 256.931837][ T9554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 256.931840][ T9554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 256.931846][ T9554] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 256.931849][ T9554] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 256.934361][ T9554] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 256.934917][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 256.936282][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 256.936805][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 256.937348][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 256.937831][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 256.938280][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 16:35:06 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001e000909"], 0x1}}, 0x0) write$binfmt_misc(r4, &(0x7f0000000000)=ANY=[], 0xfffffecc) socket(0x10, 0x3, 0x0) splice(r3, 0x0, r5, 0x0, 0x4ffe0, 0x0) 16:35:06 executing program 2: syz_open_procfs(0x0, &(0x7f0000000000)='oom_score_adj\x00') pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x1420000a7a, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001e00"], 0x1c}}, 0x0) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xfffa) 16:35:06 executing program 2: r0 = io_uring_setup(0xe35, &(0x7f0000000100)={0x0, 0x0, 0x2}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000080)) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) io_uring_enter(r0, 0x0, 0x10001, 0x3, 0x0, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000540)=[r0], 0x1) timer_settime(r3, 0x0, &(0x7f0000000180)={{}, {0x0, 0x1c9c380}}, 0x0) 16:35:06 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000100)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x54, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa, 0x1, 'netem\x00'}, {0x24, 0x2, {{}, [@TCA_NETEM_DELAY_DIST={0x6, 0x2, "24c9"}]}}}]}, 0x54}}, 0x0) 16:35:06 executing program 3: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000080)='/dev/md0\x00', 0x0, 0x0) syz_open_procfs(0x0, 0x0) capget(0x0, 0x0) ioctl$BLKPG(r0, 0x125d, 0x0) 16:35:06 executing program 3: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000080)='/dev/md0\x00', 0x0, 0x0) syz_open_procfs(0x0, 0x0) capget(0x0, 0x0) ioctl$BLKPG(r0, 0x125d, 0x0) 16:35:06 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000600)={0x0, {0x2, 0x4c22, @multicast1=0xe0000002}, {0x2, 0x0, @dev}, {0x2, 0x0, @dev}, 0xef, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}) 16:35:06 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x27, &(0x7f0000000080)={@multicast1, @local}, 0xc) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) [ 258.732733][ T52] ------------[ cut here ]------------ [ 258.741364][ T52] WARNING: CPU: 1 PID: 52 at lib/percpu-refcount.c:112 percpu_ref_exit+0xa3/0xd0 [ 258.772488][ T52] Kernel panic - not syncing: panic_on_warn set ... [ 258.802660][ T52] CPU: 1 PID: 52 Comm: kworker/1:1 Not tainted 5.7.0-rc6-syzkaller #0 [ 258.817867][ T52] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 258.863283][ T52] Workqueue: events io_ring_exit_work [ 258.863283][ T52] Call Trace: [ 258.863283][ T52] dump_stack+0x188/0x20d [ 258.900724][ T52] ? percpu_ref_init+0x1e0/0x1e0 [ 258.900724][ T52] panic+0x2e3/0x75c [ 258.900724][ T52] ? add_taint.cold+0x16/0x16 [ 258.900724][ T52] ? printk+0xba/0xed [ 258.900724][ T52] ? kmsg_dump_rewind_nolock+0xd9/0xd9 [ 258.900724][ T52] ? __warn.cold+0x14/0x35 [ 258.900724][ T52] ? __warn+0xd5/0x1c8 [ 258.900724][ T52] ? percpu_ref_exit+0xa3/0xd0 [ 258.900724][ T52] __warn.cold+0x2f/0x35 [ 258.900724][ T52] ? percpu_ref_exit+0xa3/0xd0 [ 258.900724][ T52] report_bug+0x27b/0x2f0 [ 258.900724][ T52] do_error_trap+0x12b/0x220 [ 258.900724][ T52] ? percpu_ref_exit+0xa3/0xd0 [ 258.900724][ T52] do_invalid_op+0x32/0x40 [ 258.900724][ T52] ? percpu_ref_exit+0xa3/0xd0 [ 258.900724][ T52] invalid_op+0x23/0x30 [ 258.900724][ T52] RIP: 0010:percpu_ref_exit+0xa3/0xd0 [ 258.900724][ T52] Code: 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 1a 48 c7 43 08 03 00 00 00 5b 5d 41 5c e9 82 79 dd fd e8 7d 79 dd fd <0f> 0b eb c2 4c 89 e7 e8 51 5a 1b fe eb dc e8 ca 59 1b fe eb aa 4c [ 259.123329][ T52] RSP: 0018:ffffc90000697cc8 EFLAGS: 00010293 [ 259.123329][ T52] RAX: ffff88802bf74e80 RBX: ffff88801e057000 RCX: ffffffff8395bb3d [ 259.217168][ T52] RDX: 0000000000000000 RSI: ffffffff8395bba3 RDI: ffff88801e057018 [ 259.217168][ T52] RBP: 0000607f810655f8 R08: ffff88802bf74e80 R09: fffffbfff185dd51 [ 259.217168][ T52] R10: ffffffff8c2eea87 R11: fffffbfff185dd50 R12: ffff88801e057008 [ 259.217168][ T52] R13: ffff88801e0571a8 R14: ffff88801e057100 R15: 0000000000000000 [ 259.217168][ T52] ? percpu_ref_exit+0x3d/0xd0 [ 259.217168][ T52] ? percpu_ref_exit+0xa3/0xd0 [ 259.217168][ T52] ? percpu_ref_exit+0xa3/0xd0 [ 259.217168][ T52] io_ring_exit_work+0x315/0x6a0 [ 259.217168][ T52] process_one_work+0x965/0x16a0 [ 259.217168][ T52] ? lock_release+0x800/0x800 [ 259.217168][ T52] ? pwq_dec_nr_in_flight+0x310/0x310 [ 259.217168][ T52] ? rwlock_bug.part.0+0x90/0x90 [ 259.217168][ T52] worker_thread+0x96/0xe20 [ 259.217168][ T52] ? process_one_work+0x16a0/0x16a0 [ 259.217168][ T52] kthread+0x388/0x470 [ 259.217168][ T52] ? kthread_mod_delayed_work+0x1a0/0x1a0 [ 259.217168][ T52] ret_from_fork+0x24/0x30 [ 259.217168][ T52] Kernel Offset: disabled [ 259.217168][ T52] Rebooting in 86400 seconds..