[   37.603213][   T26] audit: type=1800 audit(1557287910.184:28): pid=7596 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[   38.587400][   T26] audit: type=1800 audit(1557287911.244:29): pid=7596 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0
[   38.607495][   T26] audit: type=1800 audit(1557287911.244:30): pid=7596 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0
[....] startpar: service(s) returned failure: ssh ...[?25l[?1c7[FAIL8[?25h[?0c failed!

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.0.193' (ECDSA) to the list of known hosts.
2019/05/08 03:58:40 fuzzer started
2019/05/08 03:58:43 dialing manager at 10.128.0.26:41005
2019/05/08 03:58:45 syscalls: 2440
2019/05/08 03:58:45 code coverage: enabled
2019/05/08 03:58:45 comparison tracing: enabled
2019/05/08 03:58:45 extra coverage: extra coverage is not supported by the kernel
2019/05/08 03:58:45 setuid sandbox: enabled
2019/05/08 03:58:45 namespace sandbox: enabled
2019/05/08 03:58:45 Android sandbox: /sys/fs/selinux/policy does not exist
2019/05/08 03:58:45 fault injection: enabled
2019/05/08 03:58:45 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2019/05/08 03:58:45 net packet injection: enabled
2019/05/08 03:58:45 net device setup: enabled
04:03:24 executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000740)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(tnepres-generic)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0)
r1 = accept$alg(r0, 0x0, 0x0)
recvmmsg(r1, &(0x7f0000004d80)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000800)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0)

syzkaller login: [  331.926728][ T7782] IPVS: ftp: loaded support on port[0] = 21
04:03:24 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070")
syz_execute_func(&(0x7f0000000300)="b13691cd806969ef69dc00d9c4a2d1920cec38c4ab39fd5bf9e2f9e2c7c7e4c653fb0fc4014cb63a3af4a95ff9c44149f2168f4808eebce00000802000c421fc51c12aeac461a1f8a100000021c4e189d8a42973858e2c0f186746f3400faee47e7c730f5726400f0d18c401fe5ff6e7df646736676666430fefb3000000000804f4f30f1a1254111d54111d00")
sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0)
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/audio\x00', 0x0, 0x0)
ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300))
readv(r1, &(0x7f0000002680)=[{0x0}, {0x0}, {&(0x7f0000000280)=""/99, 0x63}, {0x0}, {0x0}, {&(0x7f00000015c0)=""/4096, 0x1000}, {0x0}], 0x7)

[  332.062623][ T7782] chnl_net:caif_netlink_parms(): no params data found
[  332.144079][ T7785] IPVS: ftp: loaded support on port[0] = 21
[  332.158103][ T7782] bridge0: port 1(bridge_slave_0) entered blocking state
[  332.166766][ T7782] bridge0: port 1(bridge_slave_0) entered disabled state
[  332.174709][ T7782] device bridge_slave_0 entered promiscuous mode
[  332.193482][ T7782] bridge0: port 2(bridge_slave_1) entered blocking state
[  332.205405][ T7782] bridge0: port 2(bridge_slave_1) entered disabled state
[  332.213446][ T7782] device bridge_slave_1 entered promiscuous mode
04:03:24 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x80001000008912, &(0x7f0000000700)="0adc1f123c123f319bd070")
getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000000)={'icmp\x00'}, &(0x7f0000000040)=0x1e)

[  332.261533][ T7782] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  332.280778][ T7782] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  332.367711][ T7782] team0: Port device team_slave_0 added
[  332.375589][ T7782] team0: Port device team_slave_1 added
[  332.388673][ T7785] chnl_net:caif_netlink_parms(): no params data found
04:03:25 executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c)
r1 = dup2(r0, r0)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224)
clone(0x500, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r2 = gettid()
setsockopt$inet6_tcp_int(r0, 0x6, 0x100000000005, &(0x7f0000000040), 0x75ba3224)
ptrace$setopts(0x4206, r2, 0x0, 0x0)
tkill(r2, 0x3c)
fcntl$setstatus(r1, 0x4, 0x42803)

[  332.446959][ T7791] IPVS: ftp: loaded support on port[0] = 21
[  332.479875][ T7782] device hsr_slave_0 entered promiscuous mode
[  332.537053][ T7782] device hsr_slave_1 entered promiscuous mode
[  332.622499][ T7793] IPVS: ftp: loaded support on port[0] = 21
[  332.623665][ T7782] bridge0: port 2(bridge_slave_1) entered blocking state
[  332.635651][ T7782] bridge0: port 2(bridge_slave_1) entered forwarding state
[  332.643366][ T7782] bridge0: port 1(bridge_slave_0) entered blocking state
[  332.650477][ T7782] bridge0: port 1(bridge_slave_0) entered forwarding state
[  332.662555][ T7785] bridge0: port 1(bridge_slave_0) entered blocking state
[  332.670661][ T7785] bridge0: port 1(bridge_slave_0) entered disabled state
[  332.681239][ T7785] device bridge_slave_0 entered promiscuous mode
[  332.693937][ T7785] bridge0: port 2(bridge_slave_1) entered blocking state
[  332.703473][ T7785] bridge0: port 2(bridge_slave_1) entered disabled state
[  332.711916][ T7785] device bridge_slave_1 entered promiscuous mode
04:03:25 executing program 4:
mbind(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, &(0x7f00000002c0)=0xfffffffffffffffc, 0x7c3c, 0x0)

[  332.796598][ T7785] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  332.810802][ T7785] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  332.926882][ T7782] 8021q: adding VLAN 0 to HW filter on device bond0
[  332.954218][ T7785] team0: Port device team_slave_0 added
[  332.988809][ T7782] 8021q: adding VLAN 0 to HW filter on device team0
[  332.999743][ T7785] team0: Port device team_slave_1 added
[  333.008736][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  333.025084][   T22] bridge0: port 1(bridge_slave_0) entered disabled state
[  333.044183][   T22] bridge0: port 2(bridge_slave_1) entered disabled state
[  333.058607][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
04:03:25 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070")
syz_execute_func(&(0x7f0000000400)="b13691cd806969ef69dc00d9c4a2d1920cec38c4ab39fd5bf9e2f9e2c7c7e4c653fb0fc4014cb63a3af4a95ff9c44149f2168f4808eebce00000802000c421fc51c12aeac461a1f8a100000021c4e189d8a42973858e2c0f186746f3400faee47e7c730f5726400f0d18c401fe5ff6e7df646736676666430fefb3000000000804f4f30f1a1254111d54111d00")
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0)
fanotify_mark(0xffffffffffffffff, 0x0, 0xd, 0xffffffffffffffff, 0x0)
ioctl$SNDRV_TIMER_IOCTL_STOP(0xffffffffffffffff, 0x54a1)
r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0)
write$eventfd(r1, &(0x7f0000000080), 0xfffffe5e)

[  333.104705][ T7798] IPVS: ftp: loaded support on port[0] = 21
[  333.113489][ T7793] chnl_net:caif_netlink_parms(): no params data found
[  333.143321][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  333.153675][   T22] bridge0: port 1(bridge_slave_0) entered blocking state
[  333.160796][   T22] bridge0: port 1(bridge_slave_0) entered forwarding state
[  333.173443][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  333.182335][   T22] bridge0: port 2(bridge_slave_1) entered blocking state
[  333.189446][   T22] bridge0: port 2(bridge_slave_1) entered forwarding state
[  333.200934][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  333.209737][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  333.228932][ T7791] chnl_net:caif_netlink_parms(): no params data found
[  333.326953][ T7785] device hsr_slave_0 entered promiscuous mode
[  333.395674][ T7785] device hsr_slave_1 entered promiscuous mode
[  333.481672][ T7794] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  333.490753][ T7794] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  333.517446][ T7801] IPVS: ftp: loaded support on port[0] = 21
[  333.540970][ T7791] bridge0: port 1(bridge_slave_0) entered blocking state
[  333.549691][ T7791] bridge0: port 1(bridge_slave_0) entered disabled state
[  333.557741][ T7791] device bridge_slave_0 entered promiscuous mode
[  333.566073][ T7791] bridge0: port 2(bridge_slave_1) entered blocking state
[  333.573131][ T7791] bridge0: port 2(bridge_slave_1) entered disabled state
[  333.581440][ T7791] device bridge_slave_1 entered promiscuous mode
[  333.597344][ T7793] bridge0: port 1(bridge_slave_0) entered blocking state
[  333.604414][ T7793] bridge0: port 1(bridge_slave_0) entered disabled state
[  333.612380][ T7793] device bridge_slave_0 entered promiscuous mode
[  333.621995][ T7793] bridge0: port 2(bridge_slave_1) entered blocking state
[  333.629495][ T7793] bridge0: port 2(bridge_slave_1) entered disabled state
[  333.637406][ T7793] device bridge_slave_1 entered promiscuous mode
[  333.651644][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  333.660165][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  333.702459][ T7794] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  333.711100][ T7794] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  333.720660][ T7782] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  333.735483][ T7791] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  333.745222][ T7793] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  333.781256][ T7791] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  333.797695][ T7793] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  333.838722][ T7791] team0: Port device team_slave_0 added
[  333.850785][ T7791] team0: Port device team_slave_1 added
[  333.881534][ T7793] team0: Port device team_slave_0 added
[  333.891387][ T7782] 8021q: adding VLAN 0 to HW filter on device batadv0
[  333.899421][ T7798] chnl_net:caif_netlink_parms(): no params data found
[  333.957251][ T7791] device hsr_slave_0 entered promiscuous mode
[  334.005675][ T7791] device hsr_slave_1 entered promiscuous mode
[  334.056874][ T7793] team0: Port device team_slave_1 added
[  334.138209][ T7793] device hsr_slave_0 entered promiscuous mode
[  334.176295][ T7793] device hsr_slave_1 entered promiscuous mode
[  334.292284][ T7798] bridge0: port 1(bridge_slave_0) entered blocking state
[  334.300696][ T7798] bridge0: port 1(bridge_slave_0) entered disabled state
[  334.309085][ T7798] device bridge_slave_0 entered promiscuous mode
[  334.326034][ T7785] 8021q: adding VLAN 0 to HW filter on device bond0
[  334.358200][ T7801] chnl_net:caif_netlink_parms(): no params data found
[  334.375693][ T7798] bridge0: port 2(bridge_slave_1) entered blocking state
[  334.383503][ T7798] bridge0: port 2(bridge_slave_1) entered disabled state
[  334.391621][ T7798] device bridge_slave_1 entered promiscuous mode
[  334.406844][ T7788] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  334.414517][ T7788] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  334.462127][ T7785] 8021q: adding VLAN 0 to HW filter on device team0
[  334.516480][ T7793] 8021q: adding VLAN 0 to HW filter on device bond0
[  334.525360][ T7798] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  334.534021][ T7794] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  334.542806][ T7794] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  334.556827][ T7794] bridge0: port 1(bridge_slave_0) entered blocking state
04:03:27 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070")
syz_execute_func(&(0x7f0000000300)="b13691cd806969ef69dc00d9c4a2d1920cec38c4ab39fd5bf9e2f9e2c7c7e4c653fb0fc4014cb63a3af4a95ff9c44149f2168f4808eebce00000802000c421fc51c12aeac461a1f8a100000021c4e189d8a42973858e2c0f186746f3400faee47e7c730f5726400f0d18c401fe5ff6e7df646736676666430fefb3000000000804f4f30f1a1254111d54111d00")
r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x0, 0x0)
sendmmsg$alg(r1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, 0x0)
r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/audio\x00', 0x400, 0x0)
ioctl$int_in(r2, 0x800000c004500a, &(0x7f0000000300))
readv(r2, &(0x7f0000002680)=[{&(0x7f00000015c0)=""/4096, 0x1000}], 0x1)
sendmsg$FOU_CMD_DEL(0xffffffffffffffff, 0x0, 0x0)

[  334.563907][ T7794] bridge0: port 1(bridge_slave_0) entered forwarding state
[  334.572877][ T7794] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  334.582628][ T7794] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  334.591545][ T7794] bridge0: port 2(bridge_slave_1) entered blocking state
[  334.598660][ T7794] bridge0: port 2(bridge_slave_1) entered forwarding state
[  334.610678][ T7794] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  334.625763][ T7786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  334.634287][ T7786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  334.654289][ T7801] bridge0: port 1(bridge_slave_0) entered blocking state
[  334.664389][ T7801] bridge0: port 1(bridge_slave_0) entered disabled state
[  334.672334][ T7801] device bridge_slave_0 entered promiscuous mode
[  334.681058][ T7798] bond0: Enslaving bond_slave_1 as an active interface with an up link
04:03:27 executing program 0:

[  334.713146][ T7785] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  334.723973][ T7785] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  334.747729][ T7801] bridge0: port 2(bridge_slave_1) entered blocking state
[  334.754819][ T7801] bridge0: port 2(bridge_slave_1) entered disabled state
04:03:27 executing program 0:

[  334.764552][ T7801] device bridge_slave_1 entered promiscuous mode
[  334.786095][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  334.797504][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  334.806956][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
04:03:27 executing program 0:

[  334.821349][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  334.830834][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
04:03:27 executing program 0:
setrlimit(0x6, &(0x7f00000006c0)={0x10000000000b35d, 0x800000b35d})
r0 = fcntl$dupfd(0xffffffffffffff9c, 0x11, 0xffffffffffffff9c)
getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x900, 0x0, &(0x7f0000000540))
poll(&(0x7f00000000c0)=[{r0, 0x2020}, {r0, 0x66}, {r0, 0xa0}], 0x3, 0x9)
setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x20)
execve(0x0, &(0x7f00000005c0)=[0x0, &(0x7f0000000380)='}\x00', &(0x7f00000003c0)='^\x00', &(0x7f0000000400)='@\x00', 0x0, &(0x7f0000000500)=']\x00', &(0x7f0000000580)='&)#\x00'], &(0x7f0000000640))
mlockall(0x3)
sync()
getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x3e, 0x0, 0x0)
fsync(0xffffffffffffffff)
fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff)
r1 = msgget$private(0x0, 0x0)
msgsnd(r1, &(0x7f0000000580)=ANY=[], 0x0, 0x7fd)
msgrcv(r1, &(0x7f0000000200)={0x0, ""/115}, 0x7b, 0xc674b6c14fdecad8, 0x1800)

[  334.863116][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  334.877236][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  334.890081][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  334.899880][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  334.908114][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  334.916092][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  334.923866][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  334.948047][ T7793] 8021q: adding VLAN 0 to HW filter on device team0
[  334.972836][ T7798] team0: Port device team_slave_0 added
[  334.991633][ T7791] 8021q: adding VLAN 0 to HW filter on device bond0
[  335.003367][ T7785] 8021q: adding VLAN 0 to HW filter on device batadv0
[  335.034475][ T7801] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  335.054198][ T7798] team0: Port device team_slave_1 added
[  335.072272][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  335.082938][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  335.091431][   T12] bridge0: port 1(bridge_slave_0) entered blocking state
[  335.098545][   T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[  335.106918][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  335.118573][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  335.127073][   T12] bridge0: port 2(bridge_slave_1) entered blocking state
[  335.134120][   T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[  335.141828][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  335.151533][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  335.160670][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  335.169460][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  335.187543][ T7801] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  335.204653][ T7791] 8021q: adding VLAN 0 to HW filter on device team0
04:03:27 executing program 0:
setrlimit(0x6, &(0x7f00000006c0)={0x10000000000b35d, 0x800000b35d})
r0 = fcntl$dupfd(0xffffffffffffff9c, 0x11, 0xffffffffffffff9c)
getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x900, 0x0, &(0x7f0000000540))
poll(&(0x7f00000000c0)=[{r0, 0x2020}, {r0, 0x66}, {r0, 0xa0}], 0x3, 0x9)
setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x20)
execve(0x0, &(0x7f00000005c0)=[0x0, &(0x7f0000000380)='}\x00', &(0x7f00000003c0)='^\x00', &(0x7f0000000400)='@\x00', 0x0, &(0x7f0000000500)=']\x00', &(0x7f0000000580)='&)#\x00'], &(0x7f0000000640))
mlockall(0x3)
sync()
getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x3e, 0x0, 0x0)
fsync(0xffffffffffffffff)
fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff)
r1 = msgget$private(0x0, 0x0)
msgsnd(r1, &(0x7f0000000580)=ANY=[], 0x0, 0x7fd)
msgrcv(r1, &(0x7f0000000200)={0x0, ""/115}, 0x7b, 0xc674b6c14fdecad8, 0x1800)

[  335.248418][ T7798] device hsr_slave_0 entered promiscuous mode
[  335.295802][ T7798] device hsr_slave_1 entered promiscuous mode
[  335.336502][ T7802] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  335.344349][ T7802] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  335.366175][ T7802] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  335.374938][ T7802] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  335.383828][ T7802] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  335.392564][ T7802] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  335.401677][ T7802] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  335.410181][ T7802] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  335.419341][ T7802] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  335.427318][ T7802] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  335.439428][ T7793] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  335.513466][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  335.526492][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  335.535041][ T2993] bridge0: port 1(bridge_slave_0) entered blocking state
[  335.542140][ T2993] bridge0: port 1(bridge_slave_0) entered forwarding state
[  335.550878][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
04:03:28 executing program 0:
setrlimit(0x6, &(0x7f00000006c0)={0x10000000000b35d, 0x800000b35d})
r0 = fcntl$dupfd(0xffffffffffffff9c, 0x11, 0xffffffffffffff9c)
getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x900, 0x0, &(0x7f0000000540))
poll(&(0x7f00000000c0)=[{r0, 0x2020}, {r0, 0x66}, {r0, 0xa0}], 0x3, 0x9)
setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x20)
execve(0x0, &(0x7f00000005c0)=[0x0, &(0x7f0000000380)='}\x00', &(0x7f00000003c0)='^\x00', &(0x7f0000000400)='@\x00', 0x0, &(0x7f0000000500)=']\x00', &(0x7f0000000580)='&)#\x00'], &(0x7f0000000640))
mlockall(0x3)
sync()
getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x3e, 0x0, 0x0)
fsync(0xffffffffffffffff)
fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff)
r1 = msgget$private(0x0, 0x0)
msgsnd(r1, &(0x7f0000000580)=ANY=[], 0x0, 0x7fd)
msgrcv(r1, &(0x7f0000000200)={0x0, ""/115}, 0x7b, 0xc674b6c14fdecad8, 0x1800)

[  335.559841][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  335.568537][ T2993] bridge0: port 2(bridge_slave_1) entered blocking state
[  335.575689][ T2993] bridge0: port 2(bridge_slave_1) entered forwarding state
[  335.583906][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  335.593693][ T2993] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  335.606926][ T7801] team0: Port device team_slave_0 added
04:03:28 executing program 1:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f319bd070")
syz_execute_func(&(0x7f0000000300)="b13691cd806969ef69dc00d9c4a2d1920cec38c4ab39fd5bf9e2f9e2c7c7e4c653fb0fc4014cb63a3af4a95ff9c44149f2168f4808eebce00000802000c421fc51c12aeac461a1f8a100000021c4e189d8a42973858e2c0f186746f3400faee47e7c730f5726400f0d18c401fe5ff6e7df646736676666430fefb3000000000804f4f30f1a1254111d54111d00")
ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, 0x0)
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000400)='/dev/audio\x00', 0x400, 0x0)
ioctl$int_in(r1, 0x800000c004500a, &(0x7f0000000300))
readv(r1, &(0x7f0000002680)=[{&(0x7f0000000100)=""/119, 0x77}, {&(0x7f0000000280)=""/99, 0x63}, {0x0}, {&(0x7f00000015c0)=""/4096, 0x1000}, {0x0}], 0x5)
ioctl$VIDIOC_ENUM_FRAMEINTERVALS(0xffffffffffffffff, 0xc034564b, 0x0)
sendmsg$FOU_CMD_DEL(0xffffffffffffffff, 0x0, 0x0)

[  335.639298][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  335.651132][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  335.667192][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  335.682038][ T7801] team0: Port device team_slave_1 added
[  335.694397][ T7793] 8021q: adding VLAN 0 to HW filter on device batadv0
[  335.721826][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  335.732244][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  335.742938][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  335.757758][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  335.771411][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  335.782207][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  335.794564][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  335.822322][ T7791] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  335.913459][ T7791] 8021q: adding VLAN 0 to HW filter on device batadv0
[  335.968459][ T7801] device hsr_slave_0 entered promiscuous mode
[  336.019069][ T7801] device hsr_slave_1 entered promiscuous mode
[  336.085446][ T7798] 8021q: adding VLAN 0 to HW filter on device bond0
[  336.133700][ T7798] 8021q: adding VLAN 0 to HW filter on device team0
[  336.180427][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  336.197066][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  336.230712][ T7786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  336.245858][ T7786] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  336.254480][ T7786] bridge0: port 1(bridge_slave_0) entered blocking state
[  336.261604][ T7786] bridge0: port 1(bridge_slave_0) entered forwarding state
[  336.278238][ T7786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  336.291873][ T7786] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  336.302077][ T7786] bridge0: port 2(bridge_slave_1) entered blocking state
[  336.309210][ T7786] bridge0: port 2(bridge_slave_1) entered forwarding state
[  336.398977][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  336.415705][ T7870] WARNING: CPU: 0 PID: 7870 at kernel/cgroup/cgroup.c:6008 cgroup_exit+0x51a/0x5d0
[  336.419548][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  336.425122][ T7870] Kernel panic - not syncing: panic_on_warn set ...
[  336.425144][ T7870] CPU: 0 PID: 7870 Comm: syz-executor.3 Not tainted 5.1.0-next-20190507 #2
[  336.425153][ T7870] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  336.425218][ T7870] Call Trace:
[  336.425312][ T7870]  dump_stack+0x172/0x1f0
[  336.465941][ T7870]  ? cgroup_exit+0x430/0x5d0
[  336.470579][ T7870]  panic+0x2cb/0x75a
[  336.474471][ T7870]  ? __warn_printk+0xf3/0xf3
[  336.479043][ T7870]  ? cgroup_exit+0x51a/0x5d0
[  336.483636][ T7870]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[  336.489859][ T7870]  ? __warn.cold+0x5/0x47
[  336.494167][ T7870]  ? __warn+0xe8/0x1d0
[  336.498224][ T7870]  ? cgroup_exit+0x51a/0x5d0
[  336.502796][ T7870]  __warn.cold+0x20/0x47
[  336.507064][ T7870]  ? mark_held_locks+0xf0/0xf0
[  336.511809][ T7870]  ? cgroup_exit+0x51a/0x5d0
[  336.516385][ T7870]  report_bug+0x263/0x2b0
[  336.520736][ T7870]  do_error_trap+0x11b/0x200
[  336.525311][ T7870]  do_invalid_op+0x37/0x50
[  336.529705][ T7870]  ? cgroup_exit+0x51a/0x5d0
[  336.534305][ T7870]  invalid_op+0x14/0x20
[  336.538444][ T7870] RIP: 0010:cgroup_exit+0x51a/0x5d0
[  336.543622][ T7870] Code: 00 48 c7 c2 20 7f 6d 87 be d3 01 00 00 48 c7 c7 20 80 6d 87 c6 05 01 93 f1 07 01 e8 fb 03 ed ff e9 b1 fb ff ff e8 96 f9 05 00 <0f> 0b e9 75 fc ff ff e8 8a f9 05 00 48 c7 c2 e0 82 6d 87 be 85 02
[  336.563206][ T7870] RSP: 0018:ffff88804b93fa80 EFLAGS: 00010093
[  336.569250][ T7870] RAX: ffff88804b936080 RBX: 0000000000000001 RCX: ffffffff816b0b5e
[  336.577203][ T7870] RDX: 0000000000000000 RSI: ffffffff816b0eea RDI: 0000000000000001
[  336.585151][ T7870] RBP: ffff88804b93fb18 R08: ffff88804b936080 R09: ffffed1009727f3e
[  336.593109][ T7870] R10: ffffed1009727f3d R11: 0000000000000003 R12: ffff88804b936080
[  336.601061][ T7870] R13: ffff888096b404c0 R14: ffff88804b93faf0 R15: 1ffff11009727f52
[  336.609025][ T7870]  ? cgroup_exit+0x18e/0x5d0
[  336.613592][ T7870]  ? cgroup_exit+0x51a/0x5d0
[  336.618168][ T7870]  ? cgroup_post_fork+0x540/0x540
[  336.623226][ T7870]  do_exit+0x97a/0x2fa0
[  336.627385][ T7870]  ? get_signal+0xa7d/0x2270
[  336.631956][ T7870]  ? find_held_lock+0x35/0x130
[  336.636712][ T7870]  ? mm_update_next_owner+0x640/0x640
[  336.642065][ T7870]  ? lock_acquire+0x16f/0x3f0
[  336.646725][ T7870]  ? _raw_spin_unlock_irq+0x28/0x90
[  336.651902][ T7870]  ? get_signal+0xa7d/0x2270
[  336.656470][ T7870]  ? _raw_spin_unlock_irq+0x28/0x90
[  336.661652][ T7870]  do_group_exit+0x135/0x370
[  336.666227][ T7870]  get_signal+0x425/0x2270
[  336.670654][ T7870]  ? __might_sleep+0x95/0x190
[  336.675321][ T7870]  do_signal+0x87/0x1900
[  336.679583][ T7870]  ? tcp_setsockopt+0x9d/0xf0
[  336.684245][ T7870]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[  336.690466][ T7870]  ? setup_sigcontext+0x7d0/0x7d0
[  336.695507][ T7870]  ? fput+0x1b/0x20
[  336.699334][ T7870]  ? __sys_setsockopt+0x1aa/0x280
[  336.704367][ T7870]  ? do_syscall_64+0x57e/0x670
[  336.709114][ T7870]  ? exit_to_usermode_loop+0x43/0x2c0
[  336.714468][ T7870]  ? lockdep_hardirqs_on+0x418/0x5d0
[  336.719777][ T7870]  ? trace_hardirqs_on+0x67/0x230
[  336.724794][ T7870]  exit_to_usermode_loop+0x244/0x2c0
[  336.730062][ T7870]  do_syscall_64+0x57e/0x670
[  336.734636][ T7870]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  336.740515][ T7870] RIP: 0033:0x458da9
[  336.744390][ T7870] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  336.763972][ T7870] RSP: 002b:00007fe135b4dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  336.772360][ T7870] RAX: ffffffffffffffea RBX: 0000000000000005 RCX: 0000000000458da9
[  336.780310][ T7870] RDX: 0000100000000005 RSI: 0000000000000006 RDI: 0000000000000003
[  336.788258][ T7870] RBP: 000000000073bfa0 R08: 0000000075ba3224 R09: 0000000000000000
[  336.796212][ T7870] R10: 0000000020000040 R11: 0000000000000246 R12: 00007fe135b4e6d4
[  336.804168][ T7870] R13: 00000000004c6e18 R14: 00000000004dbdc8 R15: 00000000ffffffff
[  337.965769][ T7870] Shutting down cpus with NMI
[  337.971557][ T7870] Kernel Offset: disabled
[  337.975946][ T7870] Rebooting in 86400 seconds..