[   62.133791] audit: type=1800 audit(1539229604.195:27): pid=6297 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[   63.657725] random: sshd: uninitialized urandom read (32 bytes read)
[?25l[?1c7[ ok 8[?25h[?0c.
[   64.139787] random: sshd: uninitialized urandom read (32 bytes read)
[   64.860040] random: sshd: uninitialized urandom read (32 bytes read)

Debian GNU/Linux 7 syzkaller ttyS0

syzkaller login: [   67.351968] random: sshd: uninitialized urandom read (32 bytes read)
Warning: Permanently added '10.128.10.46' (ECDSA) to the list of known hosts.
[   73.379787] random: sshd: uninitialized urandom read (32 bytes read)
2018/10/11 03:46:57 fuzzer started
[   78.248386] random: cc1: uninitialized urandom read (8 bytes read)
2018/10/11 03:47:02 dialing manager at 10.128.0.26:39089
2018/10/11 03:47:02 syscalls: 1
2018/10/11 03:47:02 code coverage: enabled
2018/10/11 03:47:02 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled
2018/10/11 03:47:02 setuid sandbox: enabled
2018/10/11 03:47:02 namespace sandbox: enabled
2018/10/11 03:47:02 Android sandbox: /sys/fs/selinux/policy does not exist
2018/10/11 03:47:02 fault injection: enabled
2018/10/11 03:47:02 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2018/10/11 03:47:02 net packed injection: /dev/net/tun can't be opened (open /dev/net/tun: cannot allocate memory)
2018/10/11 03:47:02 net device setup: enabled
[   83.543801] random: crng init done
03:49:01 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x0, 0x81, 0x0, 0x0, 0xef4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, &(0x7f0000000580), &(0x7f00000001c0), &(0x7f0000000380), &(0x7f0000000400))
r0 = memfd_create(&(0x7f0000000140)="2b8b8a16114fdddf6b284699df92d53e6f4a02759b9461ac", 0x3)
write$binfmt_misc(r0, &(0x7f0000000540)=ANY=[@ANYRES32], 0xfffffda2)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0x0)
fcntl$addseals(r0, 0x409, 0x8)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000100)={0x0, 0x0, 0x1})
write$UHID_DESTROY(r0, &(0x7f0000000040), 0x4)
getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000001d80)={0x0, 0x401, 0x6, 0x78b}, &(0x7f0000001dc0)=0x10)
sendmmsg$inet_sctp(r0, &(0x7f0000001e80)=[{&(0x7f0000000940)=@in={0x2, 0x4e21, @multicast1}, 0x10, &(0x7f0000000c00)=[{&(0x7f0000000b80)="aa6ab139c3cffb7886ce46a5b80cb223a2621a82324e527a6fb71773674c3d50f6d64adf9797686977ac945b8ef3868d571cc25ef0d27224d37123b20019dc36f1962719c8ee44ee23addf3cd7f1787d50969dabc52deb47e8c23ae8d9bd2572f6d21a984886c5c4a19d2f", 0x6b}], 0x1, &(0x7f0000000c40)=[@dstaddrv6={0x20, 0x84, 0x8, @ipv4={[], [], @broadcast}}, @authinfo={0x18, 0x84, 0x6, {0x8}}, @authinfo={0x18, 0x84, 0x6, {0xf8}}], 0x50, 0x1}, {&(0x7f0000000cc0)=@in6={0xa, 0x4e22, 0x4, @mcast2, 0x9}, 0x1c, &(0x7f0000000d40)=[{&(0x7f0000000d00)}], 0x1, &(0x7f0000001e00), 0x0, 0x4}], 0x2, 0x24008004)
getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x4, 0x8, 0x4}, &(0x7f00000004c0)=0x364)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x200000, 0x0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
read$FUSE(0xffffffffffffffff, &(0x7f0000000d80), 0x1000)
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000580)={{{@in6=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in=@dev}, 0x0, @in6}}, &(0x7f0000000240)=0xe8)
r3 = getuid()
getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000700)={{{@in6=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@multicast2}, 0x0, @in=@broadcast}}, &(0x7f00000002c0)=0xe8)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, <r5=>0x0}, &(0x7f0000000340)=0xc)
r6 = getegid()
lstat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0})
stat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0})
setxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)='system.posix_acl_default\x00', &(0x7f0000000880)={{}, {0x1, 0x4}, [{0x2, 0x4, r2}, {0x2, 0x1, r3}, {0x2, 0x1, r4}, {0x2, 0x6, r5}], {0x4, 0x3}, [{0x8, 0x1, r6}, {0x8, 0x0, r7}, {0x8, 0x0, r8}], {0x10, 0x7}, {0x20, 0x4}}, 0x5c, 0x3)
socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000080))
r9 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000900), 0x0)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)}, 0x20)
socket$alg(0x26, 0x5, 0x0)
write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000980)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x3, 0x4, 0x6, 0x9, 0x0, 0x0, 0xfffffffffffffffc, 0x236, 0x38, 0x0, 0x0, 0x5, 0x20, 0x0, 0x0, 0xff, 0x401}, [{0x1, 0x4, 0x1, 0x800, 0x3f, 0x80000001, 0x0, 0x101}], "03ebbf761e6a6133570e2659f7b2a8ed1ff79b03c61af5585cb88e6af99651b4"}, 0x78)
ioctl$sock_inet_SIOCGIFDSTADDR(r9, 0x8917, &(0x7f00000000c0)={'team_slave_1\x00', {0x2, 0x4e24, @loopback}})
openat$vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vsock\x00', 0x200, 0x0)

[  200.270675] IPVS: ftp: loaded support on port[0] = 21
[  201.691220] bridge0: port 1(bridge_slave_0) entered blocking state
[  201.697796] bridge0: port 1(bridge_slave_0) entered disabled state
[  201.706715] device bridge_slave_0 entered promiscuous mode
[  201.874357] bridge0: port 2(bridge_slave_1) entered blocking state
[  201.880835] bridge0: port 2(bridge_slave_1) entered disabled state
[  201.889720] device bridge_slave_1 entered promiscuous mode
[  202.039841] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  202.184296] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  202.643110] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  202.794171] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  203.085273] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  203.092508] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  203.551233] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  203.559740] team0: Port device team_slave_0 added
03:49:05 executing program 1:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000300)={[], 0x0, 0x800006, 0x4000000004})
ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0)

[  203.735015] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  203.743421] team0: Port device team_slave_1 added
[  203.996376] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  204.168214] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  204.175451] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  204.184738] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  204.487099] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  204.494950] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  204.504207] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  204.526968] IPVS: ftp: loaded support on port[0] = 21
[  204.792816] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  204.800395] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  204.809723] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  206.734445] bridge0: port 1(bridge_slave_0) entered blocking state
[  206.740937] bridge0: port 1(bridge_slave_0) entered disabled state
[  206.749688] device bridge_slave_0 entered promiscuous mode
[  207.029346] bridge0: port 2(bridge_slave_1) entered blocking state
[  207.036051] bridge0: port 2(bridge_slave_1) entered disabled state
[  207.044848] device bridge_slave_1 entered promiscuous mode
[  207.245901] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  207.485982] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  207.586420] bridge0: port 2(bridge_slave_1) entered blocking state
[  207.593065] bridge0: port 2(bridge_slave_1) entered forwarding state
[  207.600102] bridge0: port 1(bridge_slave_0) entered blocking state
[  207.606738] bridge0: port 1(bridge_slave_0) entered forwarding state
[  207.616110] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  207.682473] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  208.182328] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  208.373414] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  209.322749] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  209.331018] team0: Port device team_slave_0 added
03:49:11 executing program 2:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000001c0))
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0x10, 0x802, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'erspan0\x00', 0x1})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000001c0)={'erspan0\x00'})

[  209.585082] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  209.593566] team0: Port device team_slave_1 added
[  210.039000] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  210.046302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  210.055441] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  210.362976] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  210.370089] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  210.379425] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  210.624902] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  210.632665] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  210.641965] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  210.932644] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  210.940271] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  210.949537] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  211.061298] IPVS: ftp: loaded support on port[0] = 21
[  214.144249] bridge0: port 1(bridge_slave_0) entered blocking state
[  214.150732] bridge0: port 1(bridge_slave_0) entered disabled state
[  214.159612] device bridge_slave_0 entered promiscuous mode
[  214.454787] bridge0: port 2(bridge_slave_1) entered blocking state
[  214.461271] bridge0: port 2(bridge_slave_1) entered disabled state
[  214.469934] device bridge_slave_1 entered promiscuous mode
[  214.653592] bridge0: port 2(bridge_slave_1) entered blocking state
[  214.660139] bridge0: port 2(bridge_slave_1) entered forwarding state
[  214.667189] bridge0: port 1(bridge_slave_0) entered blocking state
[  214.673735] bridge0: port 1(bridge_slave_0) entered forwarding state
[  214.682916] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  214.822748] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  215.108930] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  215.512624] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  216.124480] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  216.385997] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  216.596305] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  216.603617] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  216.866311] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  216.873976] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  217.830608] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  217.838923] team0: Port device team_slave_0 added
03:49:20 executing program 3:
socketpair(0x0, 0x0, 0x0, &(0x7f0000000140))
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040))
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10)
sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)={0x12, 0xbe, 0x4, 0x400000000078}, 0x2c)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r1, &(0x7f0000000000), &(0x7f0000000140)}, 0x20)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000200)=""/70}, 0x18)

[  218.211559] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  218.220539] team0: Port device team_slave_1 added
[  218.624271] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  218.631395] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  218.641403] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  219.027945] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  219.035342] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  219.044510] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  219.446850] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  219.454647] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  219.464142] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  219.734853] IPVS: ftp: loaded support on port[0] = 21
[  219.833237] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  219.840830] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  219.850155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  220.069679] 8021q: adding VLAN 0 to HW filter on device bond0
[  221.580547] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  222.956827] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  222.963434] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  222.971513] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  223.227118] bridge0: port 1(bridge_slave_0) entered blocking state
[  223.233837] bridge0: port 1(bridge_slave_0) entered disabled state
[  223.242564] device bridge_slave_0 entered promiscuous mode
[  223.657778] bridge0: port 2(bridge_slave_1) entered blocking state
[  223.664552] bridge0: port 2(bridge_slave_1) entered disabled state
[  223.673596] device bridge_slave_1 entered promiscuous mode
[  223.978213] bridge0: port 2(bridge_slave_1) entered blocking state
[  223.984803] bridge0: port 2(bridge_slave_1) entered forwarding state
[  223.991802] bridge0: port 1(bridge_slave_0) entered blocking state
[  223.998424] bridge0: port 1(bridge_slave_0) entered forwarding state
[  224.007594] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  224.030341] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  224.352657] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  224.413876] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  224.521659] 8021q: adding VLAN 0 to HW filter on device team0
[  225.600500] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  225.936837] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  226.290821] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  226.298077] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  226.653983] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  226.661136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  227.717128] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  227.725479] team0: Port device team_slave_0 added
[  228.152126] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  228.160573] team0: Port device team_slave_1 added
[  228.509542] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  228.516760] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  228.525966] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  228.868708] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  228.875861] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  228.884886] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  229.174789] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  229.182784] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  229.191891] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
03:49:31 executing program 4:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ptmx\x00', 0x0, 0x0)
read(r0, &(0x7f0000000180)=""/11, 0xa)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100))
r1 = dup2(r0, r0)
clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff)
r2 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r2, &(0x7f000000cfe4)={0xa, 0x0, 0x0, @loopback}, 0x1c)
recvmsg(r2, &(0x7f0000000400)={&(0x7f0000000000)=@nfc, 0x80, &(0x7f0000000080), 0x0, &(0x7f00000001c0)=""/128, 0x80}, 0x0)
ioctl$KDGKBENT(r1, 0x4b46, &(0x7f00000000c0)={0x100})
sendmsg(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240), 0x0, &(0x7f0000000280)}, 0x0)

[  229.612124] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  229.619943] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  229.629190] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  229.817195] 8021q: adding VLAN 0 to HW filter on device bond0
[  231.144712] IPVS: ftp: loaded support on port[0] = 21
[  231.680172] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  233.272508] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  233.278887] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  233.287185] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  233.935203] hrtimer: interrupt took 44053 ns
[  234.888975] bridge0: port 2(bridge_slave_1) entered blocking state
[  234.895548] bridge0: port 2(bridge_slave_1) entered forwarding state
[  234.902672] bridge0: port 1(bridge_slave_0) entered blocking state
[  234.909177] bridge0: port 1(bridge_slave_0) entered forwarding state
[  234.918471] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  235.078079] 8021q: adding VLAN 0 to HW filter on device team0
03:49:37 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x0, 0x81, 0x0, 0x0, 0xef4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, &(0x7f0000000580), &(0x7f00000001c0), &(0x7f0000000380), &(0x7f0000000400))
r0 = memfd_create(&(0x7f0000000140)="2b8b8a16114fdddf6b284699df92d53e6f4a02759b9461ac", 0x3)
write$binfmt_misc(r0, &(0x7f0000000540)=ANY=[@ANYRES32], 0xfffffda2)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0x0)
fcntl$addseals(r0, 0x409, 0x8)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000100)={0x0, 0x0, 0x1})
write$UHID_DESTROY(r0, &(0x7f0000000040), 0x4)
getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000001d80)={0x0, 0x401, 0x6, 0x78b}, &(0x7f0000001dc0)=0x10)
sendmmsg$inet_sctp(r0, &(0x7f0000001e80)=[{&(0x7f0000000940)=@in={0x2, 0x4e21, @multicast1}, 0x10, &(0x7f0000000c00)=[{&(0x7f0000000b80)="aa6ab139c3cffb7886ce46a5b80cb223a2621a82324e527a6fb71773674c3d50f6d64adf9797686977ac945b8ef3868d571cc25ef0d27224d37123b20019dc36f1962719c8ee44ee23addf3cd7f1787d50969dabc52deb47e8c23ae8d9bd2572f6d21a984886c5c4a19d2f", 0x6b}], 0x1, &(0x7f0000000c40)=[@dstaddrv6={0x20, 0x84, 0x8, @ipv4={[], [], @broadcast}}, @authinfo={0x18, 0x84, 0x6, {0x8}}, @authinfo={0x18, 0x84, 0x6, {0xf8}}], 0x50, 0x1}, {&(0x7f0000000cc0)=@in6={0xa, 0x4e22, 0x4, @mcast2, 0x9}, 0x1c, &(0x7f0000000d40)=[{&(0x7f0000000d00)}], 0x1, &(0x7f0000001e00), 0x0, 0x4}], 0x2, 0x24008004)
getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x4, 0x8, 0x4}, &(0x7f00000004c0)=0x364)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x200000, 0x0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
read$FUSE(0xffffffffffffffff, &(0x7f0000000d80), 0x1000)
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000580)={{{@in6=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in=@dev}, 0x0, @in6}}, &(0x7f0000000240)=0xe8)
r3 = getuid()
getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000700)={{{@in6=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@multicast2}, 0x0, @in=@broadcast}}, &(0x7f00000002c0)=0xe8)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, <r5=>0x0}, &(0x7f0000000340)=0xc)
r6 = getegid()
lstat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0})
stat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0})
setxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)='system.posix_acl_default\x00', &(0x7f0000000880)={{}, {0x1, 0x4}, [{0x2, 0x4, r2}, {0x2, 0x1, r3}, {0x2, 0x1, r4}, {0x2, 0x6, r5}], {0x4, 0x3}, [{0x8, 0x1, r6}, {0x8, 0x0, r7}, {0x8, 0x0, r8}], {0x10, 0x7}, {0x20, 0x4}}, 0x5c, 0x3)
socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000080))
r9 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000900), 0x0)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)}, 0x20)
socket$alg(0x26, 0x5, 0x0)
write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000980)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x3, 0x4, 0x6, 0x9, 0x0, 0x0, 0xfffffffffffffffc, 0x236, 0x38, 0x0, 0x0, 0x5, 0x20, 0x0, 0x0, 0xff, 0x401}, [{0x1, 0x4, 0x1, 0x800, 0x3f, 0x80000001, 0x0, 0x101}], "03ebbf761e6a6133570e2659f7b2a8ed1ff79b03c61af5585cb88e6af99651b4"}, 0x78)
ioctl$sock_inet_SIOCGIFDSTADDR(r9, 0x8917, &(0x7f00000000c0)={'team_slave_1\x00', {0x2, 0x4e24, @loopback}})
openat$vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vsock\x00', 0x200, 0x0)

[  235.279323] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  235.620916] bridge0: port 1(bridge_slave_0) entered blocking state
[  235.627548] bridge0: port 1(bridge_slave_0) entered disabled state
[  235.636260] device bridge_slave_0 entered promiscuous mode
[  236.393232] bridge0: port 2(bridge_slave_1) entered blocking state
[  236.399805] bridge0: port 2(bridge_slave_1) entered disabled state
[  236.408668] device bridge_slave_1 entered promiscuous mode
[  237.305393] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
03:49:39 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x0, 0x81, 0x0, 0x0, 0xef4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x0, &(0x7f0000000580), &(0x7f00000001c0), &(0x7f0000000380), &(0x7f0000000400))
r0 = memfd_create(&(0x7f0000000140)="2b8b8a16114fdddf6b284699df92d53e6f4a02759b9461ac", 0x3)
write$binfmt_misc(r0, &(0x7f0000000540)=ANY=[@ANYRES32], 0xfffffda2)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0x0)
fcntl$addseals(r0, 0x409, 0x8)
ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f0000000100)={0x0, 0x0, 0x1})
write$UHID_DESTROY(r0, &(0x7f0000000040), 0x4)
getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000001d80)={0x0, 0x401, 0x6, 0x78b}, &(0x7f0000001dc0)=0x10)
sendmmsg$inet_sctp(r0, &(0x7f0000001e80)=[{&(0x7f0000000940)=@in={0x2, 0x4e21, @multicast1}, 0x10, &(0x7f0000000c00)=[{&(0x7f0000000b80)="aa6ab139c3cffb7886ce46a5b80cb223a2621a82324e527a6fb71773674c3d50f6d64adf9797686977ac945b8ef3868d571cc25ef0d27224d37123b20019dc36f1962719c8ee44ee23addf3cd7f1787d50969dabc52deb47e8c23ae8d9bd2572f6d21a984886c5c4a19d2f", 0x6b}], 0x1, &(0x7f0000000c40)=[@dstaddrv6={0x20, 0x84, 0x8, @ipv4={[], [], @broadcast}}, @authinfo={0x18, 0x84, 0x6, {0x8}}, @authinfo={0x18, 0x84, 0x6, {0xf8}}], 0x50, 0x1}, {&(0x7f0000000cc0)=@in6={0xa, 0x4e22, 0x4, @mcast2, 0x9}, 0x1c, &(0x7f0000000d40)=[{&(0x7f0000000d00)}], 0x1, &(0x7f0000001e00), 0x0, 0x4}], 0x2, 0x24008004)
getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x4, 0x8, 0x4}, &(0x7f00000004c0)=0x364)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x200000, 0x0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
read$FUSE(0xffffffffffffffff, &(0x7f0000000d80), 0x1000)
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000580)={{{@in6=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in=@dev}, 0x0, @in6}}, &(0x7f0000000240)=0xe8)
r3 = getuid()
getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000700)={{{@in6=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@multicast2}, 0x0, @in=@broadcast}}, &(0x7f00000002c0)=0xe8)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300)={0x0, <r5=>0x0}, &(0x7f0000000340)=0xc)
r6 = getegid()
lstat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0})
stat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0})
setxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)='system.posix_acl_default\x00', &(0x7f0000000880)={{}, {0x1, 0x4}, [{0x2, 0x4, r2}, {0x2, 0x1, r3}, {0x2, 0x1, r4}, {0x2, 0x6, r5}], {0x4, 0x3}, [{0x8, 0x1, r6}, {0x8, 0x0, r7}, {0x8, 0x0, r8}], {0x10, 0x7}, {0x20, 0x4}}, 0x5c, 0x3)
socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000080))
r9 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000900), 0x0)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)}, 0x20)
socket$alg(0x26, 0x5, 0x0)
write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000980)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x3, 0x4, 0x6, 0x9, 0x0, 0x0, 0xfffffffffffffffc, 0x236, 0x38, 0x0, 0x0, 0x5, 0x20, 0x0, 0x0, 0xff, 0x401}, [{0x1, 0x4, 0x1, 0x800, 0x3f, 0x80000001, 0x0, 0x101}], "03ebbf761e6a6133570e2659f7b2a8ed1ff79b03c61af5585cb88e6af99651b4"}, 0x78)
ioctl$sock_inet_SIOCGIFDSTADDR(r9, 0x8917, &(0x7f00000000c0)={'team_slave_1\x00', {0x2, 0x4e24, @loopback}})
openat$vsock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vsock\x00', 0x200, 0x0)

[  237.911583] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  239.590628] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  240.330121] bond0: Enslaving bond_slave_1 as an active interface with an up link
03:49:42 executing program 0:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f00007e5000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f00000bc000)=@abs, 0x6e)
fcntl$setstatus(r1, 0x4, 0x800042c05)
sendmmsg$unix(r1, &(0x7f0000000000), 0x492492492492b6a, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
close(r1)

[  240.903668] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  240.910768] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
03:49:43 executing program 0:
r0 = socket$inet6(0xa, 0x2100000000000002, 0x0)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c)
sendmmsg(r0, &(0x7f000000b180)=[{{0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f0000001500)}}, {{&(0x7f0000000400)=@in={0x2, 0x4e24, @rand_addr=0x7}, 0x80, &(0x7f00000001c0), 0x0, &(0x7f0000003740)}}], 0x2, 0x0)
getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000000), &(0x7f0000000040)=0x8)

[  241.366524] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  241.373823] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
03:49:43 executing program 0:
r0 = memfd_create(&(0x7f0000000100)="0100546e098ce41958000000000000000000", 0x0)
r1 = syz_open_dev$sndseq(&(0x7f0000000180)='/dev/snd/seq\x00', 0x0, 0x0)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00')
sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x14000890}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c6fa289", @ANYRES16=r2, @ANYBLOB="000425bd7000fedbdf250b0000000800050002000000"], 0x1c}, 0x1, 0x0, 0x0, 0x8080}, 0x4000)
dup2(r1, r0)
ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r0, 0x4058534c, &(0x7f0000000280)={0x4000000000080, 0x7, 0x1})

03:49:43 executing program 0:
r0 = socket$l2tp(0x18, 0x1, 0x1)
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0)
ioctl$KVM_GET_REG_LIST(r1, 0xc008aeb0, &(0x7f0000000080)={0x3, [0x9, 0x2, 0xb0]})
ioctl(r0, 0x8912, &(0x7f0000000000)="153f6234488dd25d766070")
openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000100)='/proc/thread-self/attr/exec\x00', 0x2, 0x0)
r2 = syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x40000ffffff, 0x2)
ioctl$UI_SET_SWBIT(r2, 0x80045510, 0x0)

03:49:44 executing program 0:
r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0)
close(r0)
syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082)
r1 = memfd_create(&(0x7f0000000140)="000000008c00", 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1)
mmap(&(0x7f0000007000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x0)
msync(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x4)
write$FUSE_GETXATTR(r1, &(0x7f0000000000)={0x18, 0x0, 0x2, {0xb10a}}, 0x18)
ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000040)={0x3, 0x7, 0x5})

[  242.638775] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready
[  242.647499] team0: Port device team_slave_0 added
03:49:45 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x8000000004)
r1 = socket$inet6(0xa, 0x1800000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
writev(r0, &(0x7f0000e11ff0)=[{&(0x7f0000000340)="59000000140019232b834b80043f679a10ff6400940005002a925aaa000000000100008400f0fffeff2c707f8f00ff050000000010000100090a1000410400000000fcff00000000000000000000000000000000000000000f", 0x59}], 0x1)

[  243.177599] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready
[  243.186043] team0: Port device team_slave_1 added
[  243.589969] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  243.597498] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  243.606491] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  243.990222] 8021q: adding VLAN 0 to HW filter on device bond0
[  244.040195] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  244.047424] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  244.056339] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  244.471969] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  244.480002] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  244.489071] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  244.776005] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  244.783745] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  244.792929] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  245.209597] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  246.239159] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  246.245785] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  246.253796] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  247.204734] 8021q: adding VLAN 0 to HW filter on device team0
[  248.990153] bridge0: port 2(bridge_slave_1) entered blocking state
[  248.996738] bridge0: port 2(bridge_slave_1) entered forwarding state
[  249.003854] bridge0: port 1(bridge_slave_0) entered blocking state
[  249.010318] bridge0: port 1(bridge_slave_0) entered forwarding state
[  249.019194] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready
[  249.025950] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
03:49:52 executing program 1:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000300)={[], 0x0, 0x800006, 0x4000000004})
ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0)

[  252.729790] 8021q: adding VLAN 0 to HW filter on device bond0
[  253.812944] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  254.659919] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  254.666433] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  254.674604] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:49:57 executing program 2:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000001c0))
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0x10, 0x802, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'erspan0\x00', 0x1})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000001c0)={'erspan0\x00'})

[  255.431130] 8021q: adding VLAN 0 to HW filter on device team0
[  257.707203] 8021q: adding VLAN 0 to HW filter on device bond0
[  258.266221] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  258.804628] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  258.810907] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  258.818957] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:50:01 executing program 3:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070")
r1 = socket$inet6(0xa, 0x1, 0x8010000000000084)
bind$inet6(r1, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c)
listen(r1, 0x3)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
sendto$inet6(r2, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, &(0x7f0000000000)="de", 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @local, 0x100000001}, 0x1c)
getsockopt$IP6T_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x29, 0x44, &(0x7f0000000040)={'HL\x00'}, &(0x7f0000000080)=0x1e)
close(r2)

[  259.438589] 8021q: adding VLAN 0 to HW filter on device team0
03:50:04 executing program 4:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ptmx\x00', 0x0, 0x0)
read(r0, &(0x7f0000000180)=""/11, 0xa)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100))
r1 = dup2(r0, r0)
clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff)
r2 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r2, &(0x7f000000cfe4)={0xa, 0x0, 0x0, @loopback}, 0x1c)
recvmsg(r2, &(0x7f0000000400)={&(0x7f0000000000)=@nfc, 0x80, &(0x7f0000000080), 0x0, &(0x7f00000001c0)=""/128, 0x80}, 0x0)
ioctl$KDGKBENT(r1, 0x4b46, &(0x7f00000000c0)={0x100})
sendmsg(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240), 0x0, &(0x7f0000000280)}, 0x0)

03:50:04 executing program 0:
r0 = socket$l2tp(0x18, 0x1, 0x1)
ioctl(r0, 0x8912, &(0x7f00000000c0)="153f6234418dd25d766070")
pipe2(&(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x800)
ioctl$sock_inet_SIOCDARP(r1, 0x8953, &(0x7f00000001c0)={{0x2, 0x4e20, @remote}, {0x6, @broadcast}, 0x40, {0x2, 0x4e22, @rand_addr=0x80000000}, 'vcan0\x00'})
write$FUSE_STATFS(r1, &(0x7f0000000300)={0x60, 0x0, 0x3, {{0x1, 0x0, 0x0, 0xfff, 0x0, 0xff, 0x1, 0x1}}}, 0x60)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000100))
ioctl$EVIOCSABS0(r2, 0x401845c0, &(0x7f00000003c0)={0xfffffffffffffff9, 0x6, 0x4e8c, 0x81, 0x0, 0x314})
ftruncate(r0, 0x1)
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x8, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x40, 0x0, 0x2, 0x0, 0x0, 0x10000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$l2tp(0x18, 0x1, 0x1)
ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000480)=<r3=>0x0)
sendmsg$nl_generic(r2, &(0x7f0000000640)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000600)={&(0x7f0000000500)={0xf0, 0x1c, 0x0, 0x70bd27, 0x25dfdbfc, {0x8}, [@typed={0x8, 0x1c, @ipv4}, @typed={0x8, 0x1b, @pid=r3}, @generic="c6a3f0708f5896ddf2206a9079ca9543d8fcb849adcd553243b6f056271446687d6506d97d4570841d83c1dab5d091a348bde49965459ce828e5c1838c2d0b114956cec68be6c8fa0fce1435dc18d97a02a6e119d4170b8c94d36f0a023bfc2c7960fc83ca7e813525c6d8d3398cc824b105183f4d49cb27e8c08ac4e904e755a1379db2b2dbac025e87176db01e7b813ee0037b3d59301b5f0782a1eb8e683193f9b7d018332d66e3a52c3f1978a4271e7aab53df854b3797be0dc1b0d0320c9d6521a4650cc07e55ce"]}, 0xf0}, 0x1, 0x0, 0x0, 0x800}, 0x4000)
write$P9_RLCREATE(r1, &(0x7f0000000380)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x2}, 0xf4}}, 0x18)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000280)='\x00', 0xffffffffffffffff}, 0x30)
r4 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x0, 0x4000)
mbind(&(0x7f0000ff8000/0x2000)=nil, 0x2000, 0x3, &(0x7f0000002280)=0x73a, 0x5, 0x0)
sendto$inet(r2, &(0x7f0000000240)="449a6765f51e82f72690a6abcbcab7b59f4117d775211332d2876e13ded1daf1", 0x20, 0x4, 0x0, 0x0)
r5 = syz_open_dev$ndb(&(0x7f00000004c0)='/dev/nbd#\x00', 0x0, 0x103001)
ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000440)={0x0, r4, 0x2, 0x7f, 0x8f, 0x4})

03:50:04 executing program 1:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0)
ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000300)={[], 0x0, 0x800006, 0x4000000004})
ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0)

03:50:04 executing program 5:
r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0)
write$P9_RREADDIR(r0, &(0x7f0000000040)={0x2a, 0x29, 0x2, {0x5, [{{0x0, 0x4, 0x1}, 0x7fff, 0xffff, 0x7, './file0'}]}}, 0x2a)
ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0x1569)
setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000080)={0x20, 0x6, 0x8afa, 0x800, 0xffffffffffffffff, 0x9, 0x2, 0x1, 0x33f74000000, 0x8f, 0x1}, 0xb)
ioctl$PIO_UNIMAPCLR(r0, 0x4b68, &(0x7f00000000c0)={0x7, 0xffffffffffffff4b, 0x5})
setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000100)='tls\x00', 0x4)
modify_ldt$read_default(0x2, &(0x7f0000000140)=""/155, 0x9b)
write$UHID_DESTROY(r0, &(0x7f0000000200), 0x4)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000240)={0x4, [0x0, <r1=>0x0, 0x0, <r2=>0x0]}, &(0x7f0000000280)=0x14)
setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f00000002c0)={r1, 0x703f64da}, 0x8)
ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000300)=<r3=>0x0)
fcntl$lock(r0, 0x5, &(0x7f0000000340)={0x1, 0x6, 0x6, 0x3, r3})
ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r0, 0x5386, &(0x7f0000000380))
r4 = semget(0x2, 0x0, 0x0)
semctl$GETZCNT(r4, 0x0, 0xf, &(0x7f00000003c0)=""/35)
ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000400))
r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000440)='/dev/null\x00', 0x2000, 0x0)
write$P9_RAUTH(r5, &(0x7f0000000480)={0x14, 0x67, 0x1, {0x10, 0x1, 0x4}}, 0x14)
setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000004c0)={0x3, 0x1000, 0x4, 0x8, 0x3f, 0x5, 0x4, 0xffffffffffff3d22, r1}, 0x20)
setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000500)='tls\x00', 0x4)
r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000580)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0xa4, r6, 0x60c, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x54, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xf09c}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x2c}}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wlc\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40080}, 0x20000000)
write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000740)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000700)={<r7=>0xffffffffffffffff}, 0x13f, 0x7}}, 0x20)
write$RDMA_USER_CM_CMD_DISCONNECT(r5, &(0x7f0000000780)={0xa, 0x4, 0xfa00, {r7}}, 0xc)
ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f00000007c0)=""/172)
setsockopt$inet_sctp_SCTP_NODELAY(r5, 0x84, 0x3, &(0x7f0000000880)=0x6, 0x4)
sendmsg$IPVS_CMD_NEW_DAEMON(r5, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x1c, r6, 0x2, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4f485921}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x8000)
ioctl$VT_RESIZE(r5, 0x5609, &(0x7f00000009c0)={0x4, 0xfffffffffffffffe, 0x3b})
fcntl$lock(r0, 0x7, &(0x7f0000000a00)={0x0, 0x3, 0x8001, 0x2, r3})
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r5, 0x84, 0x7c, &(0x7f0000000a40)={r2, 0x10000, 0x3}, 0x8)

03:50:04 executing program 2:
msgget(0x2, 0x600)

03:50:04 executing program 3:
r0 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r0, &(0x7f00000000c0)={0x18, 0x0, {0x2, @random="277a4c148d89", 'bridge_slave_0\x00'}}, 0x1e)
ioctl$PPPOEIOCSFWD(r0, 0x80047453, &(0x7f0000000080)={0x18, 0x0, {0x0, @link_local, 'irlan0\x00'}})

03:50:04 executing program 2:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x2}, 0x1c)
sendto$inet6(r1, &(0x7f0000000300), 0x0, 0x400806e, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
dup3(r0, r1, 0x0)

03:50:04 executing program 3:
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0x10, 0x2, 0xc)
write(r0, &(0x7f0000000000)="1f0000000103ff00fd4354c007110000f305010008000100010423dcffdf00", 0x1f)

03:50:05 executing program 0:
r0 = socket$inet6(0xa, 0x1, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff)
listen(r0, 0x0)
accept(r0, &(0x7f000000ae00)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, &(0x7f000000ae80)=0x80)

03:50:05 executing program 2:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r0, 0xc0505510, &(0x7f0000000240))

03:50:05 executing program 4:
r0 = socket$inet6(0xa, 0x11000000000002, 0x0)
ioctl(r0, 0x4000000000008912, &(0x7f0000000140)="023a00000000fa000000001b0000000984347482a1aee59f592bb0a4b79e7d254c9bbb61d137a4c84d0f94632cbf3f7e81906cc084ee206c69ac5488c3cb8988677192d71be59a18316ab4e0e527028e8842be84f9d2d38e88fb35102e931281deae47929be7003ac7f0e9")
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000400)='/dev/vhost-vsock\x00', 0x2, 0x0)
socketpair(0x0, 0x803, 0x4, &(0x7f0000000040)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
getsockopt$inet_udp_int(r2, 0x11, 0x65, &(0x7f0000000080), &(0x7f0000000100)=0x4)

[  263.464907] netlink: 3 bytes leftover after parsing attributes in process `syz-executor3'.
03:50:05 executing program 2:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r0, 0xc0505510, &(0x7f0000000240))

[  263.688885] device lo entered promiscuous mode
03:50:05 executing program 3:
openat$fuse(0xffffffffffffff9c, &(0x7f0000000540)='/dev/fuse\x00', 0x2, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
semget$private(0x0, 0x4, 0x4)
semctl$GETPID(0x0, 0x7, 0xb, &(0x7f0000000480)=""/183)
ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000001000)=ANY=[@ANYBLOB="fcca"])
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000440)=[@textreal={0x8, &(0x7f0000000000)="0f01c8f20f35ba2000b000ee0f2336360fc76df20f2054440f20c0663504000000440f22c064f3e10a660f3a63a63c6700baf80c66b8bd08428766efbafc0cb066ee", 0x42}], 0x1, 0x0, &(0x7f0000000400), 0x100000000000000c)
recvmmsg(0xffffffffffffffff, &(0x7f0000006080)=[{{&(0x7f0000000080)=@xdp, 0x80, &(0x7f0000002040)=[{&(0x7f0000000dc0)=""/52, 0x34}], 0x1, &(0x7f00000020c0)=""/4096, 0x1000}}], 0x1, 0x22, &(0x7f0000006340))
ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000380)={{0x2, 0x0, @local}, {0x6, @remote}, 0x20, {0x2, 0x4e22}, 'ipddp0\x00'})
ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, &(0x7f0000000200))
ioctl$KVM_NMI(r2, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil})
socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000280)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
getsockopt$EBT_SO_GET_INIT_INFO(r3, 0x0, 0x82, &(0x7f0000000300)={'broute\x00'}, &(0x7f0000000400)=0x78)
getgroups(0x4, &(0x7f0000000240)=[0xee01, 0x0, <r4=>0xee01, 0x0])
fstat(r2, &(0x7f0000000540))
setresgid(r4, 0x0, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x0, 0x0)
ioctl$sock_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000600))
r5 = add_key(&(0x7f0000000180)='syzkaller\x00', &(0x7f00000005c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe)
keyctl$get_security(0x11, r5, &(0x7f0000000640)=""/211, 0xd3)
ioctl$SNDRV_TIMER_IOCTL_TREAD(0xffffffffffffffff, 0x40045402, &(0x7f00000001c0))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
r6 = semget(0x3, 0x0, 0x200)
semop(r6, &(0x7f0000000180), 0x0)
sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0)

03:50:06 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-vsock\x00', 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, &(0x7f0000000140))
close(r0)

[  263.900585] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details.
[  264.230441] ==================================================================
[  264.237867] BUG: KMSAN: uninit-value in vmx_set_constant_host_state+0x1778/0x1830
[  264.245510] CPU: 0 PID: 7813 Comm: syz-executor3 Not tainted 4.19.0-rc4+ #66
[  264.252712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  264.262100] Call Trace:
[  264.264730]  dump_stack+0x306/0x460
[  264.268405]  ? vmx_set_constant_host_state+0x1778/0x1830
[  264.273891]  kmsan_report+0x1a2/0x2e0
[  264.277727]  __msan_warning+0x7c/0xe0
[  264.281567]  vmx_set_constant_host_state+0x1778/0x1830
[  264.286878]  vmx_create_vcpu+0x3e6f/0x7870
[  264.291137]  ? kmsan_set_origin_inline+0x6b/0x120
[  264.296015]  ? __msan_poison_alloca+0x17a/0x210
[  264.300719]  ? vmx_vm_init+0x340/0x340
[  264.304635]  kvm_arch_vcpu_create+0x25d/0x2f0
[  264.309161]  kvm_vm_ioctl+0x13fd/0x33d0
[  264.313172]  ? __msan_poison_alloca+0x17a/0x210
[  264.317891]  ? do_vfs_ioctl+0x18a/0x2810
[  264.321991]  ? __se_sys_ioctl+0x1da/0x270
[  264.326164]  ? vcpu_stat_clear_per_vm+0x420/0x420
[  264.331032]  ? vcpu_stat_clear_per_vm+0x420/0x420
[  264.335910]  do_vfs_ioctl+0xcf3/0x2810
[  264.339849]  ? security_file_ioctl+0x92/0x200
[  264.344381]  __se_sys_ioctl+0x1da/0x270
[  264.348389]  __x64_sys_ioctl+0x4a/0x70
[  264.352302]  do_syscall_64+0xbe/0x100
[  264.356136]  entry_SYSCALL_64_after_hwframe+0x63/0xe7
[  264.361346] RIP: 0033:0x457519
[  264.364573] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  264.383487] RSP: 002b:00007f8ae9b7ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  264.391212] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457519
[  264.398491] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000005
[  264.405769] RBP: 000000000072c180 R08: 0000000000000000 R09: 0000000000000000
[  264.413048] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8ae9b7f6d4
[  264.420336] R13: 00000000004bfbb7 R14: 00000000004cfc40 R15: 00000000ffffffff
[  264.427642] 
[  264.429274] Local variable description: ----dt@vmx_set_constant_host_state
[  264.436288] Variable was created at:
[  264.440021]  vmx_set_constant_host_state+0x2b0/0x1830
[  264.445224]  vmx_create_vcpu+0x3e6f/0x7870
[  264.449462] ==================================================================
[  264.456825] Disabling lock debugging due to kernel taint
[  264.462280] Kernel panic - not syncing: panic_on_warn set ...
[  264.462280] 
[  264.469683] CPU: 0 PID: 7813 Comm: syz-executor3 Tainted: G    B             4.19.0-rc4+ #66
[  264.478266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  264.487629] Call Trace:
[  264.490246]  dump_stack+0x306/0x460
[  264.493906]  panic+0x54c/0xafa
[  264.497188]  ? __msan_metadata_ptr_for_store_1+0x13/0x20
[  264.502706]  kmsan_report+0x2d3/0x2e0
[  264.506547]  __msan_warning+0x7c/0xe0
[  264.510383]  vmx_set_constant_host_state+0x1778/0x1830
[  264.515718]  vmx_create_vcpu+0x3e6f/0x7870
[  264.519972]  ? kmsan_set_origin_inline+0x6b/0x120
[  264.524835]  ? __msan_poison_alloca+0x17a/0x210
[  264.529540]  ? vmx_vm_init+0x340/0x340
[  264.533452]  kvm_arch_vcpu_create+0x25d/0x2f0
[  264.537997]  kvm_vm_ioctl+0x13fd/0x33d0
[  264.542000]  ? __msan_poison_alloca+0x17a/0x210
[  264.546708]  ? do_vfs_ioctl+0x18a/0x2810
[  264.550785]  ? __se_sys_ioctl+0x1da/0x270
[  264.554963]  ? vcpu_stat_clear_per_vm+0x420/0x420
[  264.559828]  ? vcpu_stat_clear_per_vm+0x420/0x420
[  264.564714]  do_vfs_ioctl+0xcf3/0x2810
[  264.568638]  ? security_file_ioctl+0x92/0x200
[  264.573163]  __se_sys_ioctl+0x1da/0x270
[  264.577192]  __x64_sys_ioctl+0x4a/0x70
[  264.581099]  do_syscall_64+0xbe/0x100
[  264.584920]  entry_SYSCALL_64_after_hwframe+0x63/0xe7
[  264.590131] RIP: 0033:0x457519
[  264.593338] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[  264.612269] RSP: 002b:00007f8ae9b7ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  264.619991] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457519
[  264.627282] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000005
[  264.634557] RBP: 000000000072c180 R08: 0000000000000000 R09: 0000000000000000
[  264.641833] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8ae9b7f6d4
[  264.649114] R13: 00000000004bfbb7 R14: 00000000004cfc40 R15: 00000000ffffffff
[  264.657356] Kernel Offset: disabled
[  264.660994] Rebooting in 86400 seconds..