[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 20.940890] random: sshd: uninitialized urandom read (32 bytes read, 32 bits of entropy available) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 26.116321] random: sshd: uninitialized urandom read (32 bytes read, 38 bits of entropy available) [ 26.511141] random: sshd: uninitialized urandom read (32 bytes read, 39 bits of entropy available) [ 27.796272] random: nonblocking pool is initialized Warning: Permanently added '10.128.10.29' (ECDSA) to the list of known hosts. 2018/07/23 22:08:11 fuzzer started 2018/07/23 22:08:13 dialing manager at 10.128.0.26:38707 2018/07/23 22:08:15 syscalls: 1176 2018/07/23 22:08:15 code coverage: enabled 2018/07/23 22:08:15 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/07/23 22:08:15 setuid sandbox: enabled 2018/07/23 22:08:15 namespace sandbox: enabled 2018/07/23 22:08:15 fault injection: CONFIG_FAULT_INJECTION is not enabled 2018/07/23 22:08:15 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/07/23 22:08:15 net packed injection: enabled 2018/07/23 22:08:15 net device setup: enabled 22:08:52 executing program 0: r0 = socket$inet6(0xa, 0x1000000080002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_emit_ethernet(0x2e, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x6, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x223}, {[@timestamp={0xffffff89, 0x4}]}}, @udp={0x0, 0x0, 0x8}}}}}, &(0x7f0000000000)) 22:08:52 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f0000000280)={0x14, 0x4, 0x1, 0x319}, 0x14}}, 0x0) sendmsg$nl_netfilter(r1, &(0x7f0000000000)={&(0x7f0000de2ff4), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x1, 0x1, 0xffffffffffffffff}, 0x14}}, 0x0) 22:08:52 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000040)={@local, @random="34e331d0db3a", [], {@ipv6={0x86dd, {0x0, 0x6, "b7e720", 0x8, 0x3a, 0x0, @local, @local, {[], @icmpv6=@echo_request}}}}}, &(0x7f0000000180)) 22:08:52 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@loopback}, 0x0, @in6=@loopback}}, 0xe4) sendmsg(r1, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000001c0)}, 0x0) 22:08:52 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_emit_ethernet(0x36, &(0x7f0000000040)={@local, @random="cf2bb43c40b8", [], {@ipv4={0x800, {{0x6, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0xffffff88, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}, @multicast1}, @tcp={{0x0, 0x0, 0x42424242, 0x42424242, 0x0, 0x0, 0x5}}}}}}, 0x0) mmap(&(0x7f000042c000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 22:08:52 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000029000)={0xffffffffffffffff, 0xffffffffffffffff}) poll(&(0x7f0000b2c000)=[{r1}], 0x1, 0xfffffffffffffff8) r2 = dup2(r0, r1) sendmsg$key(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x2, 0x0, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 22:08:52 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f000099e000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008005, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback}, 0x10) recvfrom(r0, &(0x7f0000f9cf9b)=""/101, 0x6478c8501c739c9d, 0x0, 0x0, 0x35) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) 22:08:52 executing program 6: syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0xffffff84, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply}}}}, &(0x7f0000000100)) [ 75.699102] IPVS: Creating netns size=2552 id=1 [ 75.832166] IPVS: Creating netns size=2552 id=2 [ 75.908036] IPVS: Creating netns size=2552 id=3 [ 76.016256] IPVS: Creating netns size=2552 id=4 [ 76.170290] IPVS: Creating netns size=2552 id=5 [ 76.300984] IPVS: Creating netns size=2552 id=6 [ 76.565165] IPVS: Creating netns size=2552 id=7 [ 76.602992] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 76.674955] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 76.778818] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 76.834190] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 76.884585] IPVS: Creating netns size=2552 id=8 [ 77.289163] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 77.302507] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 77.401894] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 77.416425] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 77.455692] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.531594] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.565306] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.630309] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.874894] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.942834] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 77.952294] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.971629] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 77.991373] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 78.005438] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 78.031491] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 78.099957] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 78.115851] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 78.126566] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.137672] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 78.154898] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 78.208459] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.249641] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 78.257992] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 78.267189] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 78.405513] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 78.526476] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.591380] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 78.695436] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 78.762917] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 78.771023] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 78.787681] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 78.840807] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 78.858227] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 78.883236] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 78.893461] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.918410] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 78.957326] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 78.998375] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 79.013156] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 79.028697] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 79.045458] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 79.133285] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 79.271094] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.345342] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 79.391521] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 79.411636] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 79.443647] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 79.488379] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 79.510170] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 79.531956] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 79.637242] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.740305] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 79.896145] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 79.909967] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 79.977659] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 80.003213] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 80.067919] ip (4654) used greatest stack depth: 23536 bytes left [ 80.076957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 80.099553] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 80.153517] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 80.190343] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.984910] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 83.107535] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 83.132711] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 83.285871] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 83.430943] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 83.466211] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 83.520306] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 83.621379] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 83.772517] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 83.888338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 83.969444] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 84.058426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 84.300455] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 84.429374] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 84.622530] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 84.701203] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 22:09:02 executing program 2: r0 = socket$inet(0x2, 0x200000002, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syz_tun\x00', 0x0}) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000140)={r1, @local, @broadcast}, 0xc) syz_emit_ethernet(0xfdef, &(0x7f00003f3fd5)={@broadcast, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, @udp={0x0, 0x4e21, 0x8}}}}}, 0x0) 22:09:02 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x78, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f0000000080)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000000)={0x14, 0x0, 0x4}, 0x14}}, 0x0) recvmmsg(r0, &(0x7f0000000200)=[{{&(0x7f0000001400)=@alg, 0x36c, &(0x7f0000000100)=[{&(0x7f0000001480)=""/4096, 0x1000}], 0x1, &(0x7f0000002740)=""/218, 0xda}}], 0x1, 0x0, &(0x7f0000000140)={0x0, 0x989680}) sendmsg$nl_generic(r0, &(0x7f0000000340)={&(0x7f00000002c0), 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x14, 0x42, 0x105}, 0x14}}, 0x0) [ 85.347304] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket 22:09:02 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000000)={0x2, 0x4, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x0, 0xa0, 0x0, @in6={0xa, 0x0, 0x0, @mcast1}}]}, 0x38}}, 0x0) [ 85.393009] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket 22:09:02 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f00000002c0)={@multicast2, @loopback}, 0xc) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)={@multicast2, @loopback, 0x0, 0x1, [@empty]}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x27, &(0x7f00003fdff5)={@multicast2, @loopback, @rand_addr}, 0xc) 22:09:03 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000180)="025cc80a2b345f8f762070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x2, 0x288, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, &(0x7f0000000000), &(0x7f0000000480)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x11, 0x0, 0x0, 'eql\x00', 'yam0\x00', "746502000000000020000000000800", 'veth1_to_team\x00', @local, [], @remote, [], 0xb0, 0xb0, 0xe0, [@time={'time\x00', 0x18}]}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x5, 0x0, 0x0, 'veth0\x00', 'gre0\x00', 'bond_slave_0\x00', 'dummy0\x00', @random="221f1cf52862", [], @dev, [], 0x70, 0x70, 0xe8}}, @common=@nflog={'nflog\x00', 0x50, {{0x0, 0x0, 0x0, 0x0, 0x0, "c08e36751842cab380434dc086c938639570fbfa40dce636424fa87c9ad03f9063959cccf655bd32af6f9623f131fb264cb97297cd6b8dc712f5baf56e808e9c"}}}}]}]}, 0x300) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f0000000180)={'broute\x00', 0x0, 0x0, 0x0, [], 0x2, &(0x7f00000000c0), 0x0, [{}, {}]}, 0x98) 22:09:03 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000000)={{0x2, 0x0, @multicast1}, {}, 0x0, {0x2, 0x0, @rand_addr}}) 22:09:03 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc49ca}}}}}}}, &(0x7f00000002c0)) 22:09:03 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket(0xa, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000440)={'veth0_to_bridge\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@ipv4_newaddr={0x34, 0x14, 0x287396a7f262e109, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, r3}, [@IFA_LOCAL={0x8, 0x2, @local}, @IFA_CACHEINFO={0x14}]}, 0x34}}, 0x0) 22:09:03 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f000044f000)={0xa, 0x4e20}, 0x1c) listen(r0, 0x2c) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xa}}}}}}}, &(0x7f00000002c0)) [ 85.700605] TCP: request_sock_TCPv6: Possible SYN flooding on port 20000. Sending cookies. Check SNMP counters. 22:09:03 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000200)={&(0x7f0000000040), 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)={0x14}, 0x14}}, 0x0) bind$inet(r0, &(0x7f00001edff0)={0x2, 0x0, @multicast1}, 0x10) 22:09:03 executing program 7: r0 = socket$inet6(0xa, 0x80003, 0xfc) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000240)=0x990, 0x4) sendmmsg(r0, &(0x7f0000001300)=[{{0x0, 0x0, &(0x7f0000001180), 0x240, &(0x7f00000011c0)}}], 0x249, 0x0) 22:09:03 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000001c0), 0xfa) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020b00010200000000a6004000000000"], 0x10}}, 0x0) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) recvmmsg(r1, &(0x7f0000000f00), 0x7ef1b1c798572d, 0x10000, &(0x7f0000001000)={0x77359400}) 22:09:03 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_emit_ethernet(0xe, &(0x7f0000000480)={@broadcast, @local, [], {@mpls_uc}}, 0x0) 22:09:04 executing program 4: syz_emit_ethernet(0x66, &(0x7f000072afb1)={@link_local, @random="bd75869612db", [], {@ipv6={0x86dd, {0x0, 0x6, "06f526", 0x30, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}, @mcast2={0xff, 0xffffff80}, {[], @icmpv6=@dest_unreach={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, "c7a93c", 0x0, 0x0, 0x0, @mcast2, @remote={0xfe, 0x80, [], 0xffffffffffffffff}}}}}}}}, &(0x7f0000ce9000)) 22:09:04 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={&(0x7f00000001c0)={0x10, 0x11e}, 0xc, &(0x7f0000000180)={&(0x7f0000000240)=@newsa={0x13c, 0x10, 0x101, 0x0, 0x0, {{@in6=@ipv4={[], [], @local}, @in=@remote}, {@in6=@local, 0x0, 0x32}, @in6=@mcast2, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x80}, [@algo_aead={0x4c, 0x12, {{'rfc4106-gcm-aesni\x00'}}}]}, 0x13c}}, 0x0) 22:09:04 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = memfd_create(&(0x7f00000000c0)="237d00d3fc1ee4671fbaa0a455e73e678b8e96f7fd829d4d39f1828ebf765e220913b73db94f6d495077a6df5ab82b4c4f8d", 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000000)=0x3, 0x4) ftruncate(r1, 0x40001) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x0, 0x51657e6adbcbddc1}, 0xc) sendfile(r0, r1, &(0x7f0000000080), 0xffe4) 22:09:04 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x27, &(0x7f0000683ff4)={@multicast2, @loopback}, 0xc) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000080)={0x3, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000140)={@multicast2, @loopback}, 0x10) 22:09:04 executing program 2: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x2, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind(r0, &(0x7f00005a2000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r2 = dup3(r0, r0, 0x80000) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') getpeername$packet(r0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000340)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000380)={{{@in6=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@remote}}, &(0x7f0000000480)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000004c0)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@loopback}}, &(0x7f00000005c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000780)={{{@in=@remote, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@local}}, &(0x7f0000000880)=0xe8) bind$inet(r2, &(0x7f0000000140)={0x2, 0x4e21, @multicast2}, 0x10) getsockname(r0, &(0x7f00000008c0)=@xdp={0x0, 0x0, 0x0}, &(0x7f0000000940)=0x80) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000980)={'bond_slave_1\x00'}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}}}, &(0x7f0000000b00)=0xe8) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000b40)={0x0, @remote, @rand_addr}, &(0x7f0000000b80)=0xc) getpeername$packet(r2, &(0x7f0000004340)={0x0, 0x0, 0x0}, &(0x7f0000004380)=0x14) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000043c0)={@empty, @loopback, 0x0}, &(0x7f0000004400)=0xc) getsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f0000004440)={@empty, 0x0}, &(0x7f0000004480)=0x14) getsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f00000045c0)={@remote, @local, 0x0}, &(0x7f0000004600)=0xc) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000004640)={0x0, @broadcast, @remote}, &(0x7f0000004680)=0xc) accept$packet(r0, &(0x7f00000046c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000004700)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000004740)={{{@in6=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@dev}}, &(0x7f0000004840)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000004940)={{{@in=@multicast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast2}}, &(0x7f0000004a40)=0xe8) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000008000)={0x0, @multicast2, @multicast1}, &(0x7f0000008040)=0xc) getsockopt$inet6_mreq(r2, 0x29, 0x1f, &(0x7f0000008080)={@loopback, 0x0}, &(0x7f00000080c0)=0x14) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000008940)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000008900)={&(0x7f0000008100)={0x6f0, r3, 0x200, 0x70bd27, 0x25dfdbfc, {}, [{{0x8, 0x1, r4}, {0x1d4, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x20000000000000}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7fff}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}]}}, {{0x8, 0x1, r6}, {0x7c, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r7}}}]}}, {{0x8, 0x1, r8}, {0x1a8, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffc00}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x3c}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r11}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x20}}, {0x8}}}]}}, {{0x8, 0x1, r12}, {0x7c, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x1000}}}]}}, {{0x8, 0x1, r13}, {0x80, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r14}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r15}}}]}}, {{0x8, 0x1, r16}, {0x1b8, 0x2, [{0x7c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x4c, 0x4, [{0x3ff, 0x100000, 0x66da, 0x6}, {0xbf8, 0x3, 0xffffffff, 0x7fff}, {0x5, 0x80000001, 0x6, 0x7}, {0x1, 0x7, 0x7, 0x7}, {0x7ff, 0x2, 0x81, 0xdc}, {0xfffffffffffffeff, 0x1f, 0x8775, 0x2}, {0x7, 0x100000000, 0x40, 0x9}, {0xd3, 0x200, 0x1, 0x1ac}, {0x3, 0x5, 0x7, 0x4}]}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r17}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r18}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1000}}, {0x8, 0x6, r19}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r20}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}]}}]}, 0x6f0}}, 0x5) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'lo\x00', 0xffffffffffffffff}) 22:09:04 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000140)="025cc83d6d345f8f762070") r1 = socket$nl_route(0x10, 0x3, 0x0) clock_gettime(0x0, &(0x7f0000003d40)={0x0}) recvmmsg(r1, &(0x7f0000003ac0)=[{{&(0x7f0000000140)=@hci, 0x80, &(0x7f00000001c0)}}, {{&(0x7f00000029c0)=@ax25, 0x80, &(0x7f0000003a40), 0x0, &(0x7f0000003a80)=""/10, 0xa}}], 0x2, 0x0, &(0x7f0000003d80)={r2}) sendmsg$nl_route(r1, &(0x7f0000000b00)={&(0x7f0000000ac0), 0xc, &(0x7f00000000c0)={&(0x7f0000000a40)=@ipv6_getnetconf={0x14, 0x52, 0x7c5fd5fa6bcda905}, 0x14}}, 0x0) 22:09:04 executing program 7: r0 = socket(0xa, 0x1, 0x0) r1 = memfd_create(&(0x7f0000000100)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000080)="a85883156f794c05e0", 0x9) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r0, &(0x7f0000317000), 0xff8) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1b, 0x4, "726455e101c8550d7a91df82b2584f6f6bdac771145d85f2f1926a443219e6700fc7ec52d4e63b7772b944849211bb0dac969bd44a208bc9fd38ea2f5ebc3d6d", "747a569c9206bfd79a1739396fe796b190309140e65e422441bede00c3cf753a", [0x4, 0xd1f]}) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f00000000c0)) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000380)={@local, @loopback, @remote}) fcntl$getownex(r1, 0x10, &(0x7f0000000000)={0x0, 0x0}) fstat(r1, &(0x7f0000000200)) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000040)=r2) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000180)=""/98) 22:09:04 executing program 6: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000de2ff4), 0xc, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000000000000002"], 0x9}}, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x10}]}, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000380)={'bridge0\x00', &(0x7f0000000040)=ANY=[]}) 22:09:04 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f000044f000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") listen(r0, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) sendto$inet6(r2, &(0x7f0000000040)="86", 0x1, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20}, 0x1c) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xa}}}}}}}, &(0x7f00000002c0)) 22:09:04 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x4}, 0x4) syz_emit_ethernet(0x3e, &(0x7f00000001c0)={@local, @dev, [], {@ipv6={0x86dd, {0x0, 0x6, "50a09c", 0x8, 0x0, 0x0, @remote, @local, {[], @udp={0x0, 0x0, 0x8}}}}}}, &(0x7f0000000040)) 22:09:04 executing program 6: r0 = socket$inet6(0x10, 0x4000000000000002, 0x0) sendmsg(r0, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000000080)=[{&(0x7f000000dfaa)="5500000018007f5300fe01b2a4a280930a602c0fffa84302910000003900090035000c00060000001900050000000000000000dc1338d54400009bcdc66ef75afb83de448daa7227c43ab8220000060cec4fab91cf", 0x55}], 0x1, &(0x7f0000001480)}, 0x0) 22:09:04 executing program 7: r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000deb000)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r2, &(0x7f0000000000), 0xa4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) sendto$inet(r2, &(0x7f0000000000), 0xfffffffffffffe4e, 0x0, &(0x7f00000000c0), 0x6) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000deb000)={0x2, 0x4e23, @rand_addr=0x69c}, 0x10) sendto$inet(r3, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10) shutdown(r3, 0x1) 22:09:04 executing program 3: r0 = socket(0x10, 0x8000000000000002, 0x0) bind$unix(r0, &(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e) bind(r0, &(0x7f0000000140)=@can, 0x80) 22:09:04 executing program 6: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000000c0)=@filter={'filter\x00', 0xe, 0x2, 0x290, [0x0, 0x20000840, 0x20000958, 0x20000988], 0x0, &(0x7f0000000000), &(0x7f0000000840)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'ip6gre0\x00', '\x00', 'veth0\x00', '\x00', @local, [], @broadcast, [], 0x70, 0xb8, 0xe8}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00'}}}]}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x15, 0x0, 0x0, 'syz_tun\x00', 'yam0\x00', 'bond_slave_1\x00', "736964300f00", @dev, [], @link_local, [], 0x70, 0xd0, 0x118}, [@common=@CONNSECMARK={'CONNSECMARK\x00', 0x8}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8}]}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}]}, 0x308) [ 87.408530] device lo entered promiscuous mode [ 87.416473] TCP: request_sock_TCPv6: Possible SYN flooding on port 20000. Sending cookies. Check SNMP counters. 22:09:04 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = memfd_create(&(0x7f00000000c0)="237d00d3fc1ee4671fbaa0a455e73e678b8e96f7fd829d4d39f1828ebf765e220913b73db94f6d495077a6df5ab82b4c4f8d", 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000000)=0x3, 0x4) ftruncate(r1, 0x40001) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x0, 0x51657e6adbcbddc1}, 0xc) sendfile(r0, r1, &(0x7f0000000080), 0xffe4) 22:09:04 executing program 3: r0 = socket$inet6(0xa, 0x1000000000003, 0x100000003) memfd_create(&(0x7f00000000c0)='eth0bdev:vmnet1\\\x00', 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="025cc83d6d345f8f762070") syz_emit_ethernet(0x3a, &(0x7f0000000040)={@local, @broadcast, [], {@ipv4={0x800, {{0x6, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0xf401, 0x0, @dev, @remote={0xac, 0x14, 0x223}, {[@rr={0x7, 0x3}]}}, @icmp=@timestamp_reply}}}}, &(0x7f0000000080)) 22:09:04 executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000040)={{{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xfffffffffffffffd}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x33}, 0x0, @in=@rand_addr}}, 0xe8) sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f000031e000), 0x1c) 22:09:04 executing program 2: r0 = socket$inet6(0xa, 0x400000000001, 0x0) r1 = dup(r0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") bind$inet6(r1, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000000)={"6c6f0000ffffff9f0000ddff00"}) sendmsg$nl_xfrm(r1, &(0x7f0000000500)={&(0x7f0000000040), 0xc, &(0x7f00000004c0)={&(0x7f0000000400)=ANY=[@ANYBLOB], 0x1}}, 0x4881) r5 = gettid() ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f00000000c0)=r5) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000001c0)={'lo\x00', 0xfff}) sendfile(r1, r3, &(0x7f0000d83ff8), 0x8000fffffffe) accept4(r1, &(0x7f0000000200)=@hci, &(0x7f0000000180)=0x80, 0x0) 22:09:04 executing program 5: socket$key(0xf, 0x3, 0x2) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f0000000540)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in=@multicast2, @in=@rand_addr}, {@in6=@ipv4={[0xfffffff0], [], @broadcast}, 0x0, 0x32}, @in6=@ipv4, {}, {}, {}, 0x0, 0x0, 0x2}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x0) 22:09:04 executing program 4: perf_event_open(&(0x7f0000000040)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000340)={&(0x7f0000000080), 0xc, &(0x7f0000000000)={&(0x7f00000003c0)={0x14}, 0x14}}, 0x0) 22:09:04 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") sendmsg$nl_xfrm(r0, &(0x7f0000000500)={&(0x7f0000000000), 0xc, &(0x7f00000004c0)={&(0x7f0000000440)=@getpolicy={0x5c, 0x15, 0xc03, 0x0, 0x0, {{@in6, @in=@multicast2}}, [@policy_type={0xc}]}, 0x5c}}, 0x0) [ 87.546936] ================================================================== [ 87.554344] BUG: KASAN: stack-out-of-bounds in memcmp+0x126/0x160 [ 87.560575] Read of size 1 at addr ffff8801bb8878e0 by task syz-executor6/6145 [ 87.567926] [ 87.569562] CPU: 0 PID: 6145 Comm: syz-executor6 Not tainted 4.4.141-g1b37d68 #71 [ 87.572956] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 87.573905] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket [ 87.596051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 87.605405] 0000000000000000 69b5db518e50943b ffff8801bb887410 ffffffff81e0e18d [ 87.613459] ffffea0006ee21c0 ffff8801bb8878e0 0000000000000000 ffff8801bb8878e0 [ 87.621549] 0000000000000000 ffff8801bb887448 ffffffff81515a86 ffff8801bb8878e0 [ 87.629617] Call Trace: [ 87.632198] [] dump_stack+0xc1/0x124 [ 87.637564] [] print_address_description+0x6c/0x216 [ 87.644226] [] kasan_report.cold.7+0x175/0x2f7 [ 87.650472] [] ? memcmp+0x126/0x160 [ 87.655744] [] __asan_report_load1_noabort+0x14/0x20 [ 87.662501] [] memcmp+0x126/0x160 [ 87.667610] [] ? __lock_is_held+0xa2/0xf0 [ 87.673407] [] xfrm_selector_match+0x12d/0xe50 [ 87.679635] [] xfrm_sk_policy_lookup+0x151/0x350 [ 87.686042] [] ? xfrm_sk_policy_lookup+0x42/0x350 [ 87.692542] [] xfrm_lookup+0x1b5/0xb70 [ 87.698078] [] ? xfrm_bundle_lookup+0x1220/0x1220 [ 87.704580] [] ? ip6_dst_lookup_tail+0x3b9/0x1460 [ 87.711071] [] ? ip6_dst_lookup_tail+0x454/0x1460 [ 87.717565] [] ? ip6_forward_finish+0x4a0/0x4a0 [ 87.723869] [] ? __kernel_text_address+0x6b/0xa0 [ 87.730253] [] ? print_context_stack+0x4b/0xd0 [ 87.736475] [] xfrm_lookup_route+0x39/0x1b0 [ 87.742698] [] ip6_dst_lookup_flow+0x1b7/0x2f0 [ 87.748912] [] ? ip6_dst_lookup+0x60/0x60 [ 87.754695] [] ? selinux_sk_getsecid+0x77/0xc0 [ 87.760915] [] tcp_v6_connect+0xd58/0x1b70 [ 87.766779] [] ? sock_sendmsg+0xcc/0x110 [ 87.772483] [] ? SYSC_sendto+0x21c/0x370 [ 87.778175] [] ? tcp_v6_syn_recv_sock+0x1f20/0x1f20 [ 87.784821] [] ? __lock_is_held+0xa2/0xf0 [ 87.790600] [] __inet_stream_connect+0x2a9/0xc30 [ 87.796999] [] ? inet_dgram_connect+0x200/0x200 [ 87.803322] [] ? kasan_kmalloc+0xc7/0xe0 [ 87.809023] [] ? tcp_sendmsg+0x14d6/0x2b00 [ 87.814893] [] ? kmem_cache_alloc_trace+0x104/0x2c0 [ 87.821538] [] tcp_sendmsg+0x1600/0x2b00 [ 87.827233] [] ? debug_check_no_locks_freed+0x210/0x210 [ 87.834234] [] ? tcp_sendpage+0x1840/0x1840 [ 87.840186] [] ? inet_sendmsg+0x143/0x4d0 [ 87.845973] [] inet_sendmsg+0x203/0x4d0 [ 87.851577] [] ? inet_sendmsg+0x73/0x4d0 [ 87.857274] [] ? inet_recvmsg+0x4c0/0x4c0 [ 87.863052] [] sock_sendmsg+0xcc/0x110 [ 87.868564] [] SYSC_sendto+0x21c/0x370 [ 87.874092] [] ? SYSC_connect+0x300/0x300 [ 87.879889] [] ? sock_has_perm+0x29f/0x400 [ 87.885772] [] ? selinux_file_send_sigiotask+0x310/0x310 [ 87.892861] [] ? selinux_netlbl_socket_setsockopt+0x97/0x340 [ 87.900296] [] ? selinux_netlbl_sock_rcv_skb+0x400/0x400 [ 87.907384] [] ? SyS_futex+0x1f8/0x300 [ 87.912899] [] ? do_futex+0x17f0/0x17f0 [ 87.918507] [] ? move_addr_to_kernel+0x50/0x50 [ 87.924718] [] SyS_sendto+0x40/0x50 [ 87.929974] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 87.936536] [ 87.938161] The buggy address belongs to the page: [ 87.943072] page:ffffea0006ee21c0 count:0 mapcount:0 mapping: (null) index:0x0 [ 87.951191] flags: 0x8000000000000000() [ 87.955261] page dumped because: kasan: bad access detected [ 87.960948] [ 87.962551] Memory state around the buggy address: [ 87.967453] ffff8801bb887780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 87.974793] ffff8801bb887800: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f2 f2 f2 f2 [ 87.982126] >ffff8801bb887880: f2 f2 00 00 00 00 00 00 00 00 00 00 f2 f2 00 00 [ 87.989474] ^ [ 87.995955] ffff8801bb887900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 88.003290] ffff8801bb887980: 00 00 00 f1 f1 f1 f1 00 00 00 00 00 f2 f2 f2 00 [ 88.010623] ================================================================== [ 88.017975] Disabling lock debugging due to kernel taint [ 88.023471] Kernel panic - not syncing: panic_on_warn set ... [ 88.023471] [ 88.030840] CPU: 0 PID: 6145 Comm: syz-executor6 Tainted: G B 4.4.141-g1b37d68 #71 [ 88.039657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 88.048985] 0000000000000000 69b5db518e50943b ffff8801bb887370 ffffffff81e0e18d [ 88.056993] ffffffff841ee30f 0000000000000001 0000000000000000 ffff8801bb8878e0 [ 88.064994] 0000000000000000 ffff8801bb887430 ffffffff8140a1f4 0000000041b58ab3 [ 88.073015] Call Trace: [ 88.075592] [] dump_stack+0xc1/0x124 [ 88.080947] [] panic+0x19e/0x38d [ 88.085952] [] ? add_taint.cold.4+0x16/0x16 [ 88.091916] [] kasan_end_report+0x47/0x4f [ 88.097697] [] kasan_report.cold.7+0x192/0x2f7 [ 88.103910] [] ? memcmp+0x126/0x160 [ 88.109178] [] __asan_report_load1_noabort+0x14/0x20 [ 88.115921] [] memcmp+0x126/0x160 [ 88.121035] [] ? __lock_is_held+0xa2/0xf0 [ 88.126815] [] xfrm_selector_match+0x12d/0xe50 [ 88.133028] [] xfrm_sk_policy_lookup+0x151/0x350 [ 88.139411] [] ? xfrm_sk_policy_lookup+0x42/0x350 [ 88.145890] [] xfrm_lookup+0x1b5/0xb70 [ 88.151426] [] ? xfrm_bundle_lookup+0x1220/0x1220 [ 88.157903] [] ? ip6_dst_lookup_tail+0x3b9/0x1460 [ 88.164371] [] ? ip6_dst_lookup_tail+0x454/0x1460 [ 88.170840] [] ? ip6_forward_finish+0x4a0/0x4a0 [ 88.177134] [] ? __kernel_text_address+0x6b/0xa0 [ 88.183527] [] ? print_context_stack+0x4b/0xd0 [ 88.189736] [] xfrm_lookup_route+0x39/0x1b0 [ 88.195682] [] ip6_dst_lookup_flow+0x1b7/0x2f0 [ 88.201889] [] ? ip6_dst_lookup+0x60/0x60 [ 88.207663] [] ? selinux_sk_getsecid+0x77/0xc0 [ 88.213870] [] tcp_v6_connect+0xd58/0x1b70 [ 88.219731] [] ? sock_sendmsg+0xcc/0x110 [ 88.225427] [] ? SYSC_sendto+0x21c/0x370 [ 88.231123] [] ? tcp_v6_syn_recv_sock+0x1f20/0x1f20 [ 88.237767] [] ? __lock_is_held+0xa2/0xf0 [ 88.243544] [] __inet_stream_connect+0x2a9/0xc30 [ 88.249931] [] ? inet_dgram_connect+0x200/0x200 [ 88.256229] [] ? kasan_kmalloc+0xc7/0xe0 [ 88.261922] [] ? tcp_sendmsg+0x14d6/0x2b00 [ 88.267810] [] ? kmem_cache_alloc_trace+0x104/0x2c0 [ 88.274468] [] tcp_sendmsg+0x1600/0x2b00 [ 88.280165] [] ? debug_check_no_locks_freed+0x210/0x210 [ 88.287155] [] ? tcp_sendpage+0x1840/0x1840 [ 88.293103] [] ? inet_sendmsg+0x143/0x4d0 [ 88.298877] [] inet_sendmsg+0x203/0x4d0 [ 88.304484] [] ? inet_sendmsg+0x73/0x4d0 [ 88.310177] [] ? inet_recvmsg+0x4c0/0x4c0 [ 88.315955] [] sock_sendmsg+0xcc/0x110 [ 88.321468] [] SYSC_sendto+0x21c/0x370 [ 88.326991] [] ? SYSC_connect+0x300/0x300 [ 88.332772] [] ? sock_has_perm+0x29f/0x400 [ 88.338655] [] ? selinux_file_send_sigiotask+0x310/0x310 [ 88.345731] [] ? selinux_netlbl_socket_setsockopt+0x97/0x340 [ 88.353154] [] ? selinux_netlbl_sock_rcv_skb+0x400/0x400 [ 88.360231] [] ? SyS_futex+0x1f8/0x300 [ 88.365740] [] ? do_futex+0x17f0/0x17f0 [ 88.371353] [] ? move_addr_to_kernel+0x50/0x50 [ 88.377570] [] SyS_sendto+0x40/0x50 [ 88.382820] [] entry_SYSCALL_64_fastpath+0x22/0x9e [ 88.389854] Dumping ftrace buffer: [ 88.393374] (ftrace buffer empty) [ 88.397057] Kernel Offset: disabled [ 88.400656] Rebooting in 86400 seconds..