[ 34.457072][ T25] audit: type=1800 audit(1572728964.115:25): pid=7027 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2447 res=0 [ 34.484362][ T25] audit: type=1800 audit(1572728964.115:26): pid=7027 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2490 res=0 [ 34.523474][ T25] audit: type=1800 audit(1572728964.115:27): pid=7027 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2469 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 34.835632][ T7092] sshd (7092) used greatest stack depth: 10136 bytes left [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.10.21' (ECDSA) to the list of known hosts. 2019/11/02 21:09:34 fuzzer started 2019/11/02 21:09:35 dialing manager at 10.128.0.105:46001 2019/11/02 21:09:35 syscalls: 2554 2019/11/02 21:09:35 code coverage: enabled 2019/11/02 21:09:35 comparison tracing: enabled 2019/11/02 21:09:35 extra coverage: extra coverage is not supported by the kernel 2019/11/02 21:09:35 setuid sandbox: enabled 2019/11/02 21:09:35 namespace sandbox: enabled 2019/11/02 21:09:35 Android sandbox: /sys/fs/selinux/policy does not exist 2019/11/02 21:09:35 fault injection: enabled 2019/11/02 21:09:35 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/11/02 21:09:35 net packet injection: enabled 2019/11/02 21:09:35 net device setup: enabled 2019/11/02 21:09:35 concurrency sanitizer: enabled 2019/11/02 21:09:39 adding functions to KCSAN blacklist: 'mod_timer' 'pipe_poll' 'tomoyo_supervisor' '__nf_conntrack_find_get' 'find_next_bit' 'task_dump_owner' 'ep_poll' 'tcp_poll' 'pcpu_alloc' '__hrtimer_run_queues' '__tcp_select_window' 'vm_area_dup' 'rcu_gp_fqs_check_wake' 'tcp_add_backlog' 'poll_schedule_timeout' syzkaller login: [ 50.168260][ T7191] KCSAN: could not find function: 'poll_schedule_timeout' 21:09:43 executing program 0: r0 = mq_open(&(0x7f00000010c0)='eth0\x00\xc2\xa8\xe1\xc7%\xe3M\xa9\xa5\xdf\x9e6\xe4\xff\x06Tj\xd94\x8f\xc0\xff\t\x9er\xacVu\x11Q\xa5\xc2\xd7\xc6n\xef\x1f\x92m7S\xd1\x0fO\xb0\xf0\x15h\b\x01\xeae\xe1E\xcd\x8c\xc4\xb6\xe5b\x100\xde\x93\xd0\xcfd7\x91+\xd4i\x90\xe6\x8b\x8e7\x11P\r\x1dY\x1e\x92\xfe&\xf0\xd8t\xc2B:?\xa9gj\xcc\x1a\xf2y8C\xadu{\xf3jg[\xc9\x1f\xcd(\xf0\x91/\x97\xbeR\xec0\n\xb8T\x185\xa3\x9cJ\x18}\x16dIJ\xcd\xda\xad\xb3\x8bJM\xf3\xfd\tTxQ\xb5!7\xd3\xc8d\xa1:\xda^\xff\xeag\xeaT\a\xcf\xf5\xa1\x8e\xf8\xc1\x15H\xb0\xa9\xe7H\x99W=F\x8b=\x93\x926\xf6~S0\xfd\xc7M}.\x18\xc1\xe1*\x91\\\x8cVrV5\x89q\x1eA\x00\xc7%IwX\xac\xc8\xc4\x7f&$\x8e\xb3E', 0x80, 0x200, 0x0) mq_timedreceive(r0, &(0x7f0000000000)=""/4096, 0xffffffbd, 0x0, &(0x7f0000001040)) times(&(0x7f0000001080)) r1 = socket$unix(0x1, 0x801, 0x0) connect(r1, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0xb4, 0x100) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000003740)={0x14, 0x19, 0xfffffffffffffffd, 0x0, 0x0, {0x1c}}, 0x14}}, 0x0) fcntl$setstatus(r2, 0x4, 0x2000) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x30020100, 0x0, 0x0, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in=@initdev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in6=@ipv4={[], [], @remote}}, 0x0, @in6=@local, 0x0, 0x3}}, 0xe8) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/18, @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x5}}, 0x0) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) socket(0xa, 0x1, 0x0) syz_mount_image$xfs(&(0x7f00000000c0)='xfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x95, &(0x7f0000000080)=[{&(0x7f0000000100)="3d72201800000000b12ac38a920ca866d9ee2c7f86d9e74ed8d9c6bba94c2aae0795e0d15336c61beec315a82344e62a2bc91b9f4fa6e6662aafd7478ac2", 0x8, 0x5}], 0x40, 0xfffffffffffffffe) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) getsockopt$bt_BT_CHANNEL_POLICY(r5, 0x112, 0xa, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet_udp_int(r6, 0x11, 0x67, &(0x7f0000000140)=0x10001, 0x4) 21:09:43 executing program 1: r0 = socket$inet(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="24000000520007031dfffd946fa2830081200a0009000300001d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000}}], 0x210, 0x2, 0x0) [ 53.701947][ T7195] IPVS: ftp: loaded support on port[0] = 21 [ 53.845227][ T7197] IPVS: ftp: loaded support on port[0] = 21 [ 53.865302][ T7195] chnl_net:caif_netlink_parms(): no params data found 21:09:43 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6(0xa, 0x1000000000005, 0x0) getsockopt$inet_buf(r3, 0x84, 0x7f, &(0x7f0000dcffe8)=""/24, &(0x7f0000000000)=0x104) [ 53.944399][ T7195] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.960857][ T7195] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.968825][ T7195] device bridge_slave_0 entered promiscuous mode [ 54.009156][ T7195] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.016638][ T7195] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.031775][ T7195] device bridge_slave_1 entered promiscuous mode [ 54.100852][ T7195] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.131973][ T7195] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.180498][ T7197] chnl_net:caif_netlink_parms(): no params data found [ 54.209728][ T7202] IPVS: ftp: loaded support on port[0] = 21 [ 54.222940][ T7195] team0: Port device team_slave_0 added [ 54.230171][ T7195] team0: Port device team_slave_1 added 21:09:43 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) syz_open_dev$adsp(0x0, 0x101, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x0, 0x2000000000002) mbind(&(0x7f0000489000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0) [ 54.343937][ T7195] device hsr_slave_0 entered promiscuous mode [ 54.392489][ T7195] device hsr_slave_1 entered promiscuous mode [ 54.446488][ T7197] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.460842][ T7197] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.468856][ T7197] device bridge_slave_0 entered promiscuous mode [ 54.513735][ T7197] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.530890][ T7197] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.538917][ T7197] device bridge_slave_1 entered promiscuous mode [ 54.578240][ T7204] IPVS: ftp: loaded support on port[0] = 21 [ 54.676995][ T7197] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link 21:09:44 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x8}, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x5, 0x0) pipe(&(0x7f0000000140)) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x1d7) r1 = socket$inet_sctp(0x2, 0x801, 0x84) sendmsg(r1, &(0x7f0000000180)={&(0x7f0000000000)=@in={0x2, 0x4e23, @local}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)='#', 0x1a000}], 0x1, 0x0, 0x0, 0x9000004}, 0x0) [ 54.814756][ T7197] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.866557][ T7202] chnl_net:caif_netlink_parms(): no params data found [ 55.012518][ T7197] team0: Port device team_slave_0 added [ 55.058341][ T7197] team0: Port device team_slave_1 added [ 55.153134][ T7202] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.160218][ T7202] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.191770][ T7202] device bridge_slave_0 entered promiscuous mode [ 55.239455][ T7195] 8021q: adding VLAN 0 to HW filter on device bond0 [ 55.302699][ T7202] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.309776][ T7202] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.341791][ T7202] device bridge_slave_1 entered promiscuous mode [ 55.444129][ T7197] device hsr_slave_0 entered promiscuous mode [ 55.481221][ T7197] device hsr_slave_1 entered promiscuous mode [ 55.500824][ T7197] debugfs: Directory 'hsr0' with parent '/' already present! [ 55.552177][ T7202] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.584804][ T7202] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.648653][ T7195] 8021q: adding VLAN 0 to HW filter on device team0 [ 55.719560][ T3501] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 55.729960][ T7230] IPVS: ftp: loaded support on port[0] = 21 [ 55.743750][ T3501] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 55.791880][ T7204] chnl_net:caif_netlink_parms(): no params data found [ 55.846300][ T2827] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 55.914572][ T2827] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 55.961560][ T2827] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.968724][ T2827] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.067226][ T7202] team0: Port device team_slave_0 added [ 56.117065][ T2827] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 56.134772][ T2827] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 56.179402][ T2827] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 56.231384][ T2827] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.238495][ T2827] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.299213][ T7202] team0: Port device team_slave_1 added [ 56.423101][ T7204] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.434221][ T7204] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.472059][ T7204] device bridge_slave_0 entered promiscuous mode [ 56.511304][ T7200] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 56.539925][ T7200] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 56.657241][ T7202] device hsr_slave_0 entered promiscuous mode [ 56.714563][ T7202] device hsr_slave_1 entered promiscuous mode [ 56.770884][ T7202] debugfs: Directory 'hsr0' with parent '/' already present! [ 56.778555][ T7204] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.803671][ T7204] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.812223][ T7204] device bridge_slave_1 entered promiscuous mode [ 56.904305][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 56.931828][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 56.965285][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 56.995261][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 57.032147][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 57.071588][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 57.111525][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 57.141500][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 57.214519][ T7195] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.247191][ T7204] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 57.276126][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 57.355556][ T7197] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.392187][ T7204] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 57.590356][ T7197] 8021q: adding VLAN 0 to HW filter on device team0 [ 57.629529][ T7204] team0: Port device team_slave_0 added [ 57.641807][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 57.670014][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 57.703442][ T7195] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.788413][ T7204] team0: Port device team_slave_1 added [ 57.815034][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 57.844479][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 57.864397][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 57.871625][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.901561][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 57.921446][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 57.954156][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.961295][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.994700][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 58.059810][ T7230] chnl_net:caif_netlink_parms(): no params data found [ 58.157669][ T7204] device hsr_slave_0 entered promiscuous mode [ 58.222058][ T7204] device hsr_slave_1 entered promiscuous mode [ 58.281687][ T7204] debugfs: Directory 'hsr0' with parent '/' already present! [ 58.289320][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 58.301692][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 58.331523][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 58.340647][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 58.392374][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 58.411504][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 58.445647][ T7197] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 58.482499][ T7197] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 58.559315][ T7254] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 58.608726][ T7254] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 58.655411][ T7254] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready 21:09:48 executing program 5: syz_open_dev$adsp(&(0x7f0000000200)='/dev/adsp#\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(0xffffffffffffffff, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000380)={&(0x7f0000000340)='./file0\x00'}, 0x10) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x5c831, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) io_submit(0x0, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, &(0x7f0000000000)={0x3, 0x0, 0x8b, 0x80, 0x4}, 0xc) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000600)={'syz\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1b\x00\x00\a\x00', {0x0, 0x1, 0x6a}, 0x0, [0x0, 0x3, 0x0, 0x5a, 0x3, 0x0, 0x1, 0x3, 0x0, 0x8, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x5, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x7, 0x0, 0x200, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x8, 0x7, 0xb15, 0xfffffffffffffffe, 0x5, 0xae8, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x7, 0x1000, 0x0, 0x0, 0x5, 0xfffffffffffffff8, 0x0, 0x8001, 0x2, 0x0, 0x0, 0xffffffffffff0001], [0x3, 0xfffffffffffffff9, 0x2, 0x0, 0x7, 0x0, 0x1000, 0x0, 0xbe, 0x100000000, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4, 0x8ffe, 0x1, 0x0, 0xe27, 0x0, 0x0, 0x0, 0x1, 0x8, 0x7, 0x10001, 0x0, 0x7ff, 0x6, 0x0, 0x7fff, 0xfffffffffffffffb, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x9, 0x43, 0x6, 0x0, 0xc, 0x8000, 0x0, 0x0, 0x5, 0x3ae9, 0x6, 0x0, 0x0, 0x0, 0x2, 0x7, 0x8000, 0x0, 0x8, 0xab0], [0x0, 0x1f, 0xfff, 0x0, 0x5a, 0x7, 0x0, 0x200, 0x0, 0x0, 0x4, 0x3ff, 0xc5, 0x7f, 0x2, 0x0, 0xfffffffffffffff9, 0x6, 0x4, 0xff, 0x0, 0x400, 0x0, 0x7, 0x4, 0x8, 0x0, 0x0, 0x0, 0x8, 0x0, 0xd, 0x80000000, 0x6, 0x20, 0x0, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0x6, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x7ff, 0x0, 0x0, 0x2, 0x8000, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x9], [0x2, 0x2325, 0x5d, 0x0, 0x10000, 0x0, 0x8de, 0x10001, 0xffff, 0x3ff, 0x401, 0xe16, 0x2, 0x0, 0x2, 0x1, 0x0, 0x401, 0x0, 0x0, 0x9, 0x5, 0x1c8, 0x40, 0x22, 0x0, 0x0, 0x0, 0x9, 0x5, 0x0, 0x8, 0x81, 0x56e4, 0x0, 0x3, 0x10000, 0xfffffffffffff000, 0x1, 0x20, 0x10000000, 0x1, 0x8, 0x6, 0x3, 0x6878000000000000, 0x9, 0x3ff, 0x2, 0x0, 0x2, 0x2, 0x0, 0x8, 0x60ef, 0x100, 0x0, 0x80, 0x7fffffff, 0x0, 0x0, 0x0, 0x100]}, 0x45c) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f00001da000/0x18000)=nil, 0x0, 0xfffffe72, 0x0, 0x0, 0xa00000000000000) [ 58.695646][ T7254] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 58.720356][ T7254] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 58.902706][ T7202] 8021q: adding VLAN 0 to HW filter on device bond0 [ 58.949309][ T7254] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 58.995056][ T7197] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 59.015172][ C1] hrtimer: interrupt took 29196 ns [ 59.164095][ T7202] 8021q: adding VLAN 0 to HW filter on device team0 [ 59.187985][ T7230] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.220670][ T7230] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.279448][ T7230] device bridge_slave_0 entered promiscuous mode [ 59.341916][ T7254] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 59.370338][ T7254] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 59.442001][ T7230] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.451729][ T7230] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.510535][ T7230] device bridge_slave_1 entered promiscuous mode [ 59.629861][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 59.663945][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 59.723048][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.730133][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 59.840383][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 59.901676][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 59.945330][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.952436][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state 21:09:49 executing program 0: r0 = mq_open(&(0x7f00000010c0)='eth0\x00\xc2\xa8\xe1\xc7%\xe3M\xa9\xa5\xdf\x9e6\xe4\xff\x06Tj\xd94\x8f\xc0\xff\t\x9er\xacVu\x11Q\xa5\xc2\xd7\xc6n\xef\x1f\x92m7S\xd1\x0fO\xb0\xf0\x15h\b\x01\xeae\xe1E\xcd\x8c\xc4\xb6\xe5b\x100\xde\x93\xd0\xcfd7\x91+\xd4i\x90\xe6\x8b\x8e7\x11P\r\x1dY\x1e\x92\xfe&\xf0\xd8t\xc2B:?\xa9gj\xcc\x1a\xf2y8C\xadu{\xf3jg[\xc9\x1f\xcd(\xf0\x91/\x97\xbeR\xec0\n\xb8T\x185\xa3\x9cJ\x18}\x16dIJ\xcd\xda\xad\xb3\x8bJM\xf3\xfd\tTxQ\xb5!7\xd3\xc8d\xa1:\xda^\xff\xeag\xeaT\a\xcf\xf5\xa1\x8e\xf8\xc1\x15H\xb0\xa9\xe7H\x99W=F\x8b=\x93\x926\xf6~S0\xfd\xc7M}.\x18\xc1\xe1*\x91\\\x8cVrV5\x89q\x1eA\x00\xc7%IwX\xac\xc8\xc4\x7f&$\x8e\xb3E', 0x80, 0x200, 0x0) mq_timedreceive(r0, &(0x7f0000000000)=""/4096, 0xffffffbd, 0x0, &(0x7f0000001040)) times(&(0x7f0000001080)) r1 = socket$unix(0x1, 0x801, 0x0) connect(r1, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0xb4, 0x100) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000003740)={0x14, 0x19, 0xfffffffffffffffd, 0x0, 0x0, {0x1c}}, 0x14}}, 0x0) fcntl$setstatus(r2, 0x4, 0x2000) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x30020100, 0x0, 0x0, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in=@initdev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in6=@ipv4={[], [], @remote}}, 0x0, @in6=@local, 0x0, 0x3}}, 0xe8) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/18, @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x5}}, 0x0) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) socket(0xa, 0x1, 0x0) syz_mount_image$xfs(&(0x7f00000000c0)='xfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x95, &(0x7f0000000080)=[{&(0x7f0000000100)="3d72201800000000b12ac38a920ca866d9ee2c7f86d9e74ed8d9c6bba94c2aae0795e0d15336c61beec315a82344e62a2bc91b9f4fa6e6662aafd7478ac2", 0x8, 0x5}], 0x40, 0xfffffffffffffffe) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) getsockopt$bt_BT_CHANNEL_POLICY(r5, 0x112, 0xa, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet_udp_int(r6, 0x11, 0x67, &(0x7f0000000140)=0x10001, 0x4) [ 60.087469][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 60.164920][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 60.242280][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 60.332439][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 60.381885][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 60.390656][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 60.530096][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 60.604471][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 60.719803][ T7327] XFS (loop0): Invalid superblock magic number [ 60.772424][ T7202] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 60.881890][ T7202] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 60.970892][ T7254] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 60.979111][ T7254] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 61.042348][ T7254] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 61.117218][ T7254] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.192472][ T7230] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 61.245416][ T7204] 8021q: adding VLAN 0 to HW filter on device bond0 21:09:50 executing program 0: r0 = mq_open(&(0x7f00000010c0)='eth0\x00\xc2\xa8\xe1\xc7%\xe3M\xa9\xa5\xdf\x9e6\xe4\xff\x06Tj\xd94\x8f\xc0\xff\t\x9er\xacVu\x11Q\xa5\xc2\xd7\xc6n\xef\x1f\x92m7S\xd1\x0fO\xb0\xf0\x15h\b\x01\xeae\xe1E\xcd\x8c\xc4\xb6\xe5b\x100\xde\x93\xd0\xcfd7\x91+\xd4i\x90\xe6\x8b\x8e7\x11P\r\x1dY\x1e\x92\xfe&\xf0\xd8t\xc2B:?\xa9gj\xcc\x1a\xf2y8C\xadu{\xf3jg[\xc9\x1f\xcd(\xf0\x91/\x97\xbeR\xec0\n\xb8T\x185\xa3\x9cJ\x18}\x16dIJ\xcd\xda\xad\xb3\x8bJM\xf3\xfd\tTxQ\xb5!7\xd3\xc8d\xa1:\xda^\xff\xeag\xeaT\a\xcf\xf5\xa1\x8e\xf8\xc1\x15H\xb0\xa9\xe7H\x99W=F\x8b=\x93\x926\xf6~S0\xfd\xc7M}.\x18\xc1\xe1*\x91\\\x8cVrV5\x89q\x1eA\x00\xc7%IwX\xac\xc8\xc4\x7f&$\x8e\xb3E', 0x80, 0x200, 0x0) mq_timedreceive(r0, &(0x7f0000000000)=""/4096, 0xffffffbd, 0x0, &(0x7f0000001040)) times(&(0x7f0000001080)) r1 = socket$unix(0x1, 0x801, 0x0) connect(r1, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0xb4, 0x100) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000003740)={0x14, 0x19, 0xfffffffffffffffd, 0x0, 0x0, {0x1c}}, 0x14}}, 0x0) fcntl$setstatus(r2, 0x4, 0x2000) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x30020100, 0x0, 0x0, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in=@initdev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in6=@ipv4={[], [], @remote}}, 0x0, @in6=@local, 0x0, 0x3}}, 0xe8) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/18, @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x5}}, 0x0) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) socket(0xa, 0x1, 0x0) syz_mount_image$xfs(&(0x7f00000000c0)='xfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x95, &(0x7f0000000080)=[{&(0x7f0000000100)="3d72201800000000b12ac38a920ca866d9ee2c7f86d9e74ed8d9c6bba94c2aae0795e0d15336c61beec315a82344e62a2bc91b9f4fa6e6662aafd7478ac2", 0x8, 0x5}], 0x40, 0xfffffffffffffffe) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) getsockopt$bt_BT_CHANNEL_POLICY(r5, 0x112, 0xa, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet_udp_int(r6, 0x11, 0x67, &(0x7f0000000140)=0x10001, 0x4) [ 61.290590][ T7202] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 61.382427][ T7230] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 61.478083][ T7204] 8021q: adding VLAN 0 to HW filter on device team0 [ 61.531573][ T7254] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 61.548680][ T7341] IPVS: ftp: loaded support on port[0] = 21 [ 61.558002][ T7254] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 61.627758][ T7230] team0: Port device team_slave_0 added [ 61.683300][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 61.709471][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 61.779070][ T7231] bridge0: port 1(bridge_slave_0) entered blocking state [ 61.786209][ T7231] bridge0: port 1(bridge_slave_0) entered forwarding state [ 61.891589][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 61.918697][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 61.947544][ T7231] bridge0: port 2(bridge_slave_1) entered blocking state [ 61.954705][ T7231] bridge0: port 2(bridge_slave_1) entered forwarding state [ 61.999017][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 62.037045][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 62.056209][ T7359] XFS (loop0): Invalid superblock magic number [ 62.067673][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready 21:09:51 executing program 1: r0 = socket$inet(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="24000000520007031dfffd946fa2830081200a0009000300001d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000}}], 0x210, 0x2, 0x0) [ 62.098693][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 62.122419][ T7230] team0: Port device team_slave_1 added [ 62.266415][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 62.311654][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 62.320117][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 62.394161][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready 21:09:52 executing program 0: r0 = mq_open(&(0x7f00000010c0)='eth0\x00\xc2\xa8\xe1\xc7%\xe3M\xa9\xa5\xdf\x9e6\xe4\xff\x06Tj\xd94\x8f\xc0\xff\t\x9er\xacVu\x11Q\xa5\xc2\xd7\xc6n\xef\x1f\x92m7S\xd1\x0fO\xb0\xf0\x15h\b\x01\xeae\xe1E\xcd\x8c\xc4\xb6\xe5b\x100\xde\x93\xd0\xcfd7\x91+\xd4i\x90\xe6\x8b\x8e7\x11P\r\x1dY\x1e\x92\xfe&\xf0\xd8t\xc2B:?\xa9gj\xcc\x1a\xf2y8C\xadu{\xf3jg[\xc9\x1f\xcd(\xf0\x91/\x97\xbeR\xec0\n\xb8T\x185\xa3\x9cJ\x18}\x16dIJ\xcd\xda\xad\xb3\x8bJM\xf3\xfd\tTxQ\xb5!7\xd3\xc8d\xa1:\xda^\xff\xeag\xeaT\a\xcf\xf5\xa1\x8e\xf8\xc1\x15H\xb0\xa9\xe7H\x99W=F\x8b=\x93\x926\xf6~S0\xfd\xc7M}.\x18\xc1\xe1*\x91\\\x8cVrV5\x89q\x1eA\x00\xc7%IwX\xac\xc8\xc4\x7f&$\x8e\xb3E', 0x80, 0x200, 0x0) mq_timedreceive(r0, &(0x7f0000000000)=""/4096, 0xffffffbd, 0x0, &(0x7f0000001040)) times(&(0x7f0000001080)) r1 = socket$unix(0x1, 0x801, 0x0) connect(r1, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) socket$netlink(0x10, 0x3, 0x0) syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0xb4, 0x100) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000003740)={0x14, 0x19, 0xfffffffffffffffd, 0x0, 0x0, {0x1c}}, 0x14}}, 0x0) fcntl$setstatus(r2, 0x4, 0x2000) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) clone(0x30020100, 0x0, 0x0, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000340)={{{@in=@initdev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in6=@ipv4={[], [], @remote}}, 0x0, @in6=@local, 0x0, 0x3}}, 0xe8) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/18, @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x5}}, 0x0) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) socket(0xa, 0x1, 0x0) syz_mount_image$xfs(&(0x7f00000000c0)='xfs\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x95, &(0x7f0000000080)=[{&(0x7f0000000100)="3d72201800000000b12ac38a920ca866d9ee2c7f86d9e74ed8d9c6bba94c2aae0795e0d15336c61beec315a82344e62a2bc91b9f4fa6e6662aafd7478ac2", 0x8, 0x5}], 0x40, 0xfffffffffffffffe) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x0) getsockopt$bt_BT_CHANNEL_POLICY(r5, 0x112, 0xa, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x0, 0x0) setsockopt$inet_udp_int(r6, 0x11, 0x67, &(0x7f0000000140)=0x10001, 0x4) [ 62.474030][ T7230] device hsr_slave_0 entered promiscuous mode [ 62.511209][ T7230] device hsr_slave_1 entered promiscuous mode [ 62.540825][ T7230] debugfs: Directory 'hsr0' with parent '/' already present! [ 62.640863][ T7200] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 62.685033][ T7200] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 62.751658][ T7200] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready 21:09:52 executing program 0: r0 = socket$inet(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="24000000520007031dfffd946fa2830081200a0009000300001d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000}}], 0x210, 0x2, 0x0) [ 62.798208][ T7200] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 62.905584][ T7204] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 21:09:52 executing program 1: r0 = socket$inet(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="24000000520007031dfffd946fa2830081200a0009000300001d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000}}], 0x210, 0x2, 0x0) [ 63.090242][ T7204] 8021q: adding VLAN 0 to HW filter on device batadv0 21:09:52 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6(0xa, 0x1000000000005, 0x0) getsockopt$inet_buf(r3, 0x84, 0x7f, &(0x7f0000dcffe8)=""/24, &(0x7f0000000000)=0x104) [ 63.495696][ T7230] 8021q: adding VLAN 0 to HW filter on device bond0 21:09:53 executing program 0: r0 = socket$inet(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="24000000520007031dfffd946fa2830081200a0009000300001d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff000000}}], 0x210, 0x2, 0x0) [ 63.554053][ T7341] chnl_net:caif_netlink_parms(): no params data found 21:09:53 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$inet6(0xa, 0x1000000000005, 0x0) getsockopt$inet_buf(r3, 0x84, 0x7f, &(0x7f0000dcffe8)=""/24, &(0x7f0000000000)=0x104) [ 63.696729][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 63.715345][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 63.774099][ T7230] 8021q: adding VLAN 0 to HW filter on device team0 [ 63.915878][ T7446] mmap: syz-executor.3 (7446) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 63.929252][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 63.941695][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 63.950344][ T7231] bridge0: port 1(bridge_slave_0) entered blocking state [ 63.957533][ T7231] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.066933][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 64.118431][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 64.165005][ T7231] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.172132][ T7231] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.209784][ T7341] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.224830][ T7341] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.272117][ T7341] device bridge_slave_0 entered promiscuous mode [ 64.331912][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 64.371648][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 64.436613][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 64.492337][ T7341] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.499466][ T7341] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.544668][ T7341] device bridge_slave_1 entered promiscuous mode [ 64.587674][ T7230] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 64.651391][ T7230] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 64.721801][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 64.738137][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 64.789212][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 64.801607][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 64.827364][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 64.856090][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 64.878953][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 64.901815][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 64.986931][ T7341] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.032180][ T7341] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.070939][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 65.079675][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 65.137313][ T7230] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.226199][ T7341] team0: Port device team_slave_0 added [ 65.247369][ T7341] team0: Port device team_slave_1 added [ 65.393866][ T7341] device hsr_slave_0 entered promiscuous mode [ 65.441183][ T7341] device hsr_slave_1 entered promiscuous mode [ 65.480820][ T7341] debugfs: Directory 'hsr0' with parent '/' already present! [ 65.917018][ T7341] 8021q: adding VLAN 0 to HW filter on device bond0 21:09:55 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x0, 0x0) socket$inet(0x2, 0x0, 0x0) syz_open_dev$adsp(0x0, 0x101, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x0, 0x2000000000002) mbind(&(0x7f0000489000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0) [ 66.005732][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 66.029265][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 66.085956][ T7341] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.128950][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 66.196121][ T7231] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 66.211177][ C1] ================================================================== [ 66.219310][ C1] BUG: KCSAN: data-race in add_timer / run_timer_softirq [ 66.226317][ C1] [ 66.228666][ C1] read to 0xffff88812bf1b6c8 of 8 bytes by task 2557 on cpu 0: [ 66.236204][ C1] add_timer+0x16f/0x550 [ 66.240441][ C1] __queue_delayed_work+0x13b/0x1d0 [ 66.245636][ C1] queue_delayed_work_on+0xf3/0x110 [ 66.250832][ C1] wb_wakeup_delayed+0xad/0xb0 [ 66.255590][ C1] wb_workfn+0x826/0x970 [ 66.259828][ C1] process_one_work+0x3d4/0x890 [ 66.264678][ C1] worker_thread+0xa0/0x800 [ 66.269177][ C1] kthread+0x1d4/0x200 [ 66.273247][ C1] ret_from_fork+0x1f/0x30 [ 66.277648][ C1] [ 66.279968][ C1] write to 0xffff88812bf1b6c8 of 8 bytes by interrupt on cpu 1: [ 66.287593][ C1] run_timer_softirq+0xcc0/0xd20 [ 66.292545][ C1] __do_softirq+0x115/0x33f [ 66.297044][ C1] irq_exit+0xbb/0xe0 [ 66.301020][ C1] smp_apic_timer_interrupt+0xe6/0x280 [ 66.306475][ C1] apic_timer_interrupt+0xf/0x20 [ 66.311412][ C1] write_comp_data+0x68/0x70 [ 66.316009][ C1] tomoyo_path_matches_pattern+0x127/0x160 [ 66.321814][ C1] tomoyo_compare_name_union+0x71/0xa0 [ 66.327270][ C1] tomoyo_check_path_acl+0x85/0xa0 [ 66.332373][ C1] tomoyo_check_acl+0xf6/0x270 [ 66.337130][ C1] tomoyo_path_permission+0xe3/0x160 [ 66.342410][ C1] tomoyo_check_open_permission+0x2fd/0x320 [ 66.348295][ C1] tomoyo_file_open+0x75/0x90 [ 66.352952][ C1] [ 66.355266][ C1] Reported by Kernel Concurrency Sanitizer on: [ 66.361409][ C1] CPU: 1 PID: 7484 Comm: ps Not tainted 5.4.0-rc3+ #0 [ 66.368157][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 66.378204][ C1] ================================================================== [ 66.386261][ C1] Kernel panic - not syncing: panic_on_warn set ... [ 66.392848][ C1] CPU: 1 PID: 7484 Comm: ps Not tainted 5.4.0-rc3+ #0 [ 66.399594][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 66.409654][ C1] Call Trace: [ 66.412945][ C1] [ 66.415811][ C1] dump_stack+0xf5/0x159 [ 66.420059][ C1] panic+0x210/0x640 [ 66.423952][ C1] ? tomoyo_check_path_acl+0x85/0xa0 [ 66.429236][ C1] ? vprintk_func+0x8d/0x140 [ 66.433830][ C1] kcsan_report.cold+0xc/0x10 [ 66.438514][ C1] __kcsan_setup_watchpoint+0x32e/0x4a0 [ 66.444077][ C1] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 66.449806][ C1] ? dsp_cmx_receive+0x730/0x730 [ 66.454743][ C1] __tsan_write8+0x32/0x40 [ 66.459163][ C1] run_timer_softirq+0xcc0/0xd20 [ 66.464111][ C1] ? sched_clock+0x34/0x40 [ 66.468531][ C1] ? sched_clock_cpu+0x15/0xe0 [ 66.473310][ C1] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 66.479557][ C1] __do_softirq+0x115/0x33f [ 66.484066][ C1] irq_exit+0xbb/0xe0 [ 66.488062][ C1] smp_apic_timer_interrupt+0xe6/0x280 [ 66.493524][ C1] ? smp_reschedule_interrupt+0x71/0x1d0 [ 66.499163][ C1] apic_timer_interrupt+0xf/0x20 [ 66.504197][ C1] [ 66.507139][ C1] RIP: 0010:write_comp_data+0x68/0x70 [ 66.512512][ C1] Code: 00 00 4e 8d 14 dd 28 00 00 00 4d 39 d0 72 1b 49 83 c1 01 4a 89 7c 10 e0 4a 89 74 10 e8 4a 89 54 10 f0 4a 89 4c d8 20 4c 89 08 0f 1f 80 00 00 00 00 55 40 0f b6 d6 40 0f b6 f7 31 ff 48 89 e5 [ 66.532116][ C1] RSP: 0018:ffffc900020df858 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 [ 66.540538][ C1] RAX: 0000000000000000 RBX: 0000000083209541 RCX: ffffffff82314817 [ 66.548507][ C1] RDX: 0000000083209541 RSI: 00000000b8a1faea RDI: 0000000000000004 [ 66.556480][ C1] RBP: ffffc900020df860 R08: ffff888121c09100 R09: 00008881265f55e3 [ 66.564445][ C1] R10: 00000000aaaaaaab R11: ffffffff86045dc0 R12: 0000000000000000 [ 66.572430][ C1] R13: 00000000b8a1faea R14: ffff888102553b40 R15: ffff8881265f55e8 [ 66.580424][ C1] ? tomoyo_path_matches_pattern+0x127/0x160 [ 66.586417][ C1] ? __tsan_read4+0x2c/0x30 [ 66.590926][ C1] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 66.596656][ C1] tomoyo_path_matches_pattern+0x127/0x160 [ 66.602560][ C1] tomoyo_compare_name_union+0x71/0xa0 [ 66.608023][ C1] tomoyo_check_path_acl+0x85/0xa0 [ 66.613149][ C1] tomoyo_check_acl+0xf6/0x270 [ 66.617920][ C1] ? tomoyo_compare_name_union+0xa0/0xa0 [ 66.623556][ C1] tomoyo_path_permission+0xe3/0x160 [ 66.628856][ C1] tomoyo_check_open_permission+0x2fd/0x320 [ 66.634771][ C1] tomoyo_file_open+0x75/0x90 [ 66.639452][ C1] security_file_open+0x69/0x210 [ 66.644394][ C1] do_dentry_open+0x20a/0x8f0 [ 66.649062][ C1] ? security_inode_permission+0xa5/0xc0 [ 66.654693][ C1] ? __kcsan_setup_watchpoint+0x6b/0x4a0 [ 66.660331][ C1] vfs_open+0x62/0x80 [ 66.664309][ C1] path_openat+0xf75/0x36e0 [ 66.668813][ C1] ? __kcsan_setup_watchpoint+0x6b/0x4a0 [ 66.674445][ C1] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 66.680695][ C1] ? debug_smp_processor_id+0x4c/0x172 [ 66.686160][ C1] ? __udelay+0x10/0x20 [ 66.690316][ C1] do_filp_open+0x11e/0x1b0 [ 66.694823][ C1] ? __alloc_fd+0x316/0x4c0 [ 66.699325][ C1] do_sys_open+0x3b3/0x4f0 [ 66.703740][ C1] __x64_sys_open+0x55/0x70 [ 66.708245][ C1] do_syscall_64+0xcc/0x370 [ 66.712751][ C1] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 66.718641][ C1] RIP: 0033:0x7fecbdb56120 [ 66.723055][ C1] Code: 48 8b 15 1b 4d 2b 00 f7 d8 64 89 02 83 c8 ff c3 90 90 90 90 90 90 90 90 90 90 83 3d d5 a4 2b 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 5e 8c 01 00 48 89 04 24 [ 66.742658][ C1] RSP: 002b:00007ffc767f3c18 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 66.751067][ C1] RAX: ffffffffffffffda RBX: 0000000000616760 RCX: 00007fecbdb56120 [ 66.759039][ C1] RDX: 00007ffc767f3c52 RSI: 0000000000000000 RDI: 00007ffc767f3c40 [ 66.767015][ C1] RBP: 0000000000020000 R08: 0000000000000000 R09: 00007fecbde1e55f [ 66.774989][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000772220 [ 66.782960][ C1] R13: 0000000000000020 R14: 00007fecbe20b010 R15: 0000000000000000 [ 66.792065][ C1] Kernel Offset: disabled [ 66.796401][ C1] Rebooting in 86400 seconds..