[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 92.839776] audit: type=1800 audit(1546969306.889:25): pid=10927 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2414 res=0 [ 92.858882] audit: type=1800 audit(1546969306.899:26): pid=10927 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2457 res=0 [ 92.878327] audit: type=1800 audit(1546969306.919:27): pid=10927 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.33' (ECDSA) to the list of known hosts. 2019/01/08 17:42:02 fuzzer started 2019/01/08 17:42:07 dialing manager at 10.128.0.26:40833 2019/01/08 17:42:07 syscalls: 1 2019/01/08 17:42:07 code coverage: enabled 2019/01/08 17:42:07 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2019/01/08 17:42:07 setuid sandbox: enabled 2019/01/08 17:42:07 namespace sandbox: enabled 2019/01/08 17:42:07 Android sandbox: /sys/fs/selinux/policy does not exist 2019/01/08 17:42:07 fault injection: enabled 2019/01/08 17:42:07 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/01/08 17:42:07 net packet injection: enabled 2019/01/08 17:42:07 net device setup: enabled 17:45:13 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) syzkaller login: [ 300.479029] IPVS: ftp: loaded support on port[0] = 21 [ 300.632822] chnl_net:caif_netlink_parms(): no params data found [ 300.702332] bridge0: port 1(bridge_slave_0) entered blocking state [ 300.709342] bridge0: port 1(bridge_slave_0) entered disabled state [ 300.717920] device bridge_slave_0 entered promiscuous mode [ 300.727214] bridge0: port 2(bridge_slave_1) entered blocking state [ 300.733822] bridge0: port 2(bridge_slave_1) entered disabled state [ 300.742164] device bridge_slave_1 entered promiscuous mode [ 300.775562] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 300.786916] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 300.818498] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 300.827275] team0: Port device team_slave_0 added [ 300.833982] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 300.842711] team0: Port device team_slave_1 added [ 300.848999] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 300.857792] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 301.037233] device hsr_slave_0 entered promiscuous mode [ 301.132432] device hsr_slave_1 entered promiscuous mode [ 301.393500] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 301.401068] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 301.431122] bridge0: port 2(bridge_slave_1) entered blocking state [ 301.437743] bridge0: port 2(bridge_slave_1) entered forwarding state [ 301.444982] bridge0: port 1(bridge_slave_0) entered blocking state [ 301.451546] bridge0: port 1(bridge_slave_0) entered forwarding state [ 301.546699] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 301.553534] 8021q: adding VLAN 0 to HW filter on device bond0 [ 301.567503] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 301.582017] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 301.592887] bridge0: port 1(bridge_slave_0) entered disabled state [ 301.601628] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.612969] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 301.632162] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 301.638325] 8021q: adding VLAN 0 to HW filter on device team0 [ 301.655605] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 301.662883] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 301.672985] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 301.681252] bridge0: port 1(bridge_slave_0) entered blocking state [ 301.687854] bridge0: port 1(bridge_slave_0) entered forwarding state [ 301.705121] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 301.712452] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 301.721040] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 301.730985] bridge0: port 2(bridge_slave_1) entered blocking state [ 301.737561] bridge0: port 2(bridge_slave_1) entered forwarding state [ 301.753956] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 301.766510] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 301.773993] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 301.783853] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 301.799428] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 301.808268] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 301.817620] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 301.832979] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 301.845937] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready [ 301.853125] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 301.861514] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 301.871081] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 301.880170] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 301.889677] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 301.905305] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 301.914935] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 301.927199] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 301.933306] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 301.952670] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 301.960977] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 301.984179] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 302.009577] 8021q: adding VLAN 0 to HW filter on device batadv0 17:45:16 executing program 0: socket$inet6(0xa, 0x0, 0x40000000000800) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) r0 = memfd_create(0x0, 0x2) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={&(0x7f0000000080)=@nl, 0x80, &(0x7f0000000540), 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x400000000000) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000c85000)) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) 17:45:17 executing program 1: socket$inet6(0xa, 0x2000002, 0x9) connect$inet6(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x800000000000, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) memfd_create(0x0, 0x0) epoll_create1(0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) socket$inet6_udplite(0xa, 0x2, 0x88) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) close(0xffffffffffffffff) syz_open_procfs(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x0) mkdir(0x0, 0x800000000c0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000001c0)) truncate(0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) 17:45:17 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$SIOCGIFHWADDR(r0, 0x8927, &(0x7f0000000000)) 17:45:18 executing program 0: r0 = socket$inet(0x2, 0x3, 0x3) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in6=@dev}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) 17:45:18 executing program 0: perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x859, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x84) getsockopt$inet6_int(r0, 0x29, 0x50, 0x0, &(0x7f00000001c0)=0x6d) [ 304.500985] IPVS: ftp: loaded support on port[0] = 21 17:45:18 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x301080, 0x0) connect$l2tp(r2, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x0, 0x2, 0x3, {0xa, 0x4e20, 0x7, @remote, 0xfffffffffffff001}}}, 0x32) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffff9c, 0x0, 0x482, &(0x7f0000000840)=""/93, &(0x7f00000008c0)=0x5d) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000080), &(0x7f00000000c0)=0x30) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000400)='team\x00') getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000440)={{{@in6=@initdev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f0000000540)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000580)={'vcan0\x00', 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f00000005c0)={{{@in6=@mcast1, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@broadcast}}, &(0x7f00000006c0)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000700)={{{@in6=@mcast1, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000800)=0xe8) getpeername$packet(r2, &(0x7f0000000940)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000980)=0x14) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f0000000c40)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x880000}, 0xc, &(0x7f0000000c00)={&(0x7f00000009c0)={0x220, r3, 0x100, 0x70bd2b, 0x25dfdbfd, {}, [{{0x8, 0x1, r4}, {0x78, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0x184, 0x2, [{0x6c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x3c, 0x4, [{0x6, 0x3, 0x77c3, 0x2b8fcb08}, {0x2, 0x20, 0x1000, 0x456}, {0x1, 0x8, 0xb64, 0x7f}, {0x8, 0x3, 0x9}, {0x2, 0x3, 0x6, 0xffffffffffffffff}, {0x5, 0x100, 0x8, 0x3}, {0x87f, 0xff, 0xa9, 0x6}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r7}}}, {0x64, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x34, 0x4, [{0x4, 0xffffffffffffff00, 0x0, 0x8}, {0x5, 0x7, 0x2, 0x4}, {0x3, 0xfffffffffffeffff, 0xff, 0x6}, {0xdf, 0x7ff, 0x1, 0xfff}, {0x5, 0x7fffffff, 0xfffffffffffffffc, 0x5}, {0x6, 0x1ff, 0x0, 0x3}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x85}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}]}}]}, 0x220}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) r9 = gettid() migrate_pages(r9, 0x6, 0x0, &(0x7f00000001c0)=0x1) ioctl$KDSIGACCEPT(r2, 0x4b4e, 0x1) ioctl$TIOCLINUX7(r2, 0x541c, &(0x7f0000000380)={0x7, 0xe287}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000200)={0x0, 0x0, @pic={0x3, 0x8, 0x50f, 0x5, 0x1, 0x80, 0x3, 0x7, 0x7, 0x200, 0x3, 0x6, 0x2dd, 0x5, 0x0, 0xffff}}) sendmsg$nl_route(r2, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000140)=@ipv4_getroute={0x1c, 0x1a, 0x12, 0x70bd2a, 0x25dfdbfc, {0x2, 0x10, 0x14, 0x6c6cc633, 0xfc, 0x3, 0xc8, 0x7, 0x2100}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x8c0) [ 304.725563] chnl_net:caif_netlink_parms(): no params data found [ 304.802768] bridge0: port 1(bridge_slave_0) entered blocking state [ 304.809365] bridge0: port 1(bridge_slave_0) entered disabled state [ 304.817831] device bridge_slave_0 entered promiscuous mode [ 304.826914] bridge0: port 2(bridge_slave_1) entered blocking state [ 304.833639] bridge0: port 2(bridge_slave_1) entered disabled state [ 304.842098] device bridge_slave_1 entered promiscuous mode 17:45:18 executing program 0: unshare(0x28020400) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0x7, 0x9}, 0x2c) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0xd, 0x8, 0x4, 0x100000001, 0x0, r0, 0xfffffffffffffffa}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0xff85, &(0x7f00000000c0)}, 0x2fd) sendfile(r0, r1, &(0x7f0000000100), 0xffff) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r1, &(0x7f00000001c0), 0x0}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r1, &(0x7f00000001c0), 0x0}, 0x18) r2 = syz_open_dev$midi(&(0x7f0000000140)='/dev/midi#\x00', 0x2, 0x400) write$P9_ROPEN(r2, &(0x7f0000000240)={0x18, 0x71, 0x1, {{0xa, 0x1, 0x8}}}, 0x18) fstatfs(r1, &(0x7f0000000280)=""/149) ioctl$IMGETDEVINFO(r0, 0x80044944, &(0x7f00000001c0)={0x6}) [ 304.876144] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 304.888175] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 304.940192] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 304.948905] team0: Port device team_slave_0 added [ 304.955597] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 304.964312] team0: Port device team_slave_1 added [ 304.970424] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 304.997630] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 305.102907] device hsr_slave_0 entered promiscuous mode [ 305.132974] device hsr_slave_1 entered promiscuous mode [ 305.184097] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 305.191797] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 305.219239] bridge0: port 2(bridge_slave_1) entered blocking state [ 305.225859] bridge0: port 2(bridge_slave_1) entered forwarding state 17:45:19 executing program 0: r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0x1000000000000004, @dev={[], 0xa}, 'lo\x00'}}, 0x1e) sendto(r0, 0x0, 0x0, 0x0, 0x0, 0x0) recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 305.233040] bridge0: port 1(bridge_slave_0) entered blocking state [ 305.239588] bridge0: port 1(bridge_slave_0) entered forwarding state [ 305.393008] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 305.399151] 8021q: adding VLAN 0 to HW filter on device bond0 [ 305.413298] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 305.426787] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 17:45:19 executing program 0: r0 = socket$packet(0x11, 0x0, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth0_to_bridge\x00', 0x0}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000140)="0a5c1f023c126285719070") r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@setlink={0x24, 0x13, 0x101, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_IFALIASn={0x4}]}, 0x24}}, 0x0) [ 305.443260] bridge0: port 1(bridge_slave_0) entered disabled state [ 305.482987] bridge0: port 2(bridge_slave_1) entered disabled state [ 305.522089] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 305.540688] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 305.546999] 8021q: adding VLAN 0 to HW filter on device team0 [ 305.568314] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 305.576774] bridge0: port 1(bridge_slave_0) entered blocking state [ 305.583366] bridge0: port 1(bridge_slave_0) entered forwarding state 17:45:19 executing program 0: r0 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x25fd, 0x40) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000180)={0x2, &(0x7f0000000140)=[{0x97e, 0x4, 0x3, 0x5}, {0x6, 0x81, 0x6, 0x6}]}, 0x10) ioctl$VIDIOC_TRY_ENCODER_CMD(0xffffffffffffffff, 0xc028564e, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_bt_bnep_BNEPCONNDEL(r1, 0x400442c9, &(0x7f0000000000)={0x8, @remote}) getsockopt$inet_sctp_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, 0x0) seccomp(0x1, 0x2, &(0x7f0000007ff0)={0x1, &(0x7f0000004fe8)=[{0x6, 0x0, 0x0, 0x50000}]}) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000200)=0x5, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x80240, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f00000000c0)={0x7, &(0x7f0000000080)=[{0x5, 0x5, 0x0, 0x101}, {0xea, 0x2, 0x9, 0x3f}, {0x7, 0x3ff, 0x5, 0x1000}, {0x2, 0x8, 0x80000000, 0x8}, {0x8, 0x224a, 0xffffffff, 0x100000000}, {0x3, 0x19e, 0x6, 0x12}, {0x80000000, 0x3f, 0x7f, 0x98}]}) init_module(0x0, 0x0, 0x0) setsockopt$packet_fanout_data(r1, 0x107, 0x16, 0x0, 0xfffffffffffffec4) [ 305.632025] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 305.640326] bridge0: port 2(bridge_slave_1) entered blocking state [ 305.646910] bridge0: port 2(bridge_slave_1) entered forwarding state [ 305.657050] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 305.666290] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 305.713832] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 305.723656] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 305.735478] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 305.745959] kauditd_printk_skb: 3 callbacks suppressed [ 305.745987] audit: type=1326 audit(1546969519.799:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11135 comm="syz-executor0" exe="/root/syz-executor0" sig=0 arch=c000003e syscall=228 compat=0 ip=0x45ad2a code=0x50000 [ 305.773167] audit: type=1326 audit(1546969519.799:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11135 comm="syz-executor0" exe="/root/syz-executor0" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457ec9 code=0x50000 [ 305.794465] audit: type=1326 audit(1546969519.799:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11135 comm="syz-executor0" exe="/root/syz-executor0" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457ec9 code=0x50000 [ 305.815822] audit: type=1326 audit(1546969519.799:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11135 comm="syz-executor0" exe="/root/syz-executor0" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457ec9 code=0x50000 [ 305.837143] audit: type=1326 audit(1546969519.799:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11135 comm="syz-executor0" exe="/root/syz-executor0" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457ec9 code=0x50000 [ 305.858485] audit: type=1326 audit(1546969519.799:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11135 comm="syz-executor0" exe="/root/syz-executor0" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457ec9 code=0x50000 [ 305.879834] audit: type=1326 audit(1546969519.799:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11135 comm="syz-executor0" exe="/root/syz-executor0" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457ec9 code=0x50000 [ 305.901190] audit: type=1326 audit(1546969519.799:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11135 comm="syz-executor0" exe="/root/syz-executor0" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457ec9 code=0x50000 [ 305.922509] audit: type=1326 audit(1546969519.799:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11135 comm="syz-executor0" exe="/root/syz-executor0" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457ec9 code=0x50000 [ 305.943849] audit: type=1326 audit(1546969519.799:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=11135 comm="syz-executor0" exe="/root/syz-executor0" sig=0 arch=c000003e syscall=202 compat=0 ip=0x457ec9 code=0x50000 [ 305.974228] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 305.982569] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 305.991216] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 306.027900] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 306.052719] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 306.066911] 8021q: adding VLAN 0 to HW filter on device batadv0 17:45:20 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000000)='trusted.overlay.redirect\x00', &(0x7f0000000040)='./file0\x00', 0x8, 0x2) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000340)={0x0, @in6}, &(0x7f0000000400)=0x90) r1 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x1, 0x2) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000100)={0x0, @multicast2}, &(0x7f0000000140)=0xc) sendmsg$nl_route(r1, &(0x7f0000000440)={&(0x7f00000000c0), 0xc, &(0x7f0000000300)={&(0x7f0000000180)=@setlink={0x17c, 0x13, 0x1, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, 0x9060, 0x8000}, [@IFLA_ADDRESS={0xc, 0x1, @dev={[], 0x1d}}, @IFLA_PORT_SELF={0x34, 0x19, [@IFLA_PORT_VF={0x8}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "3ff4f3cbc0ed6a2dcfcc64f5cd127ef1"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "c2d8d4f2dec5e10a1dbba3135baba28e"}]}, @IFLA_EXT_MASK={0x8, 0x1d, 0x33c}, @IFLA_VFINFO_LIST={0x114, 0x16, [{0x94, 0x1, [@IFLA_VF_VLAN_LIST={0x54, 0xc, [{0x14, 0x1, {0x10000, 0x18a, 0x4, 0x88a8}}, {0x14, 0x1, {0x1, 0x7f9, 0x3, 0x8100}}, {0x14, 0x1, {0x40, 0x5a, 0x4, 0x88a8}}, {0x14, 0x1, {0x2, 0x3ba, 0xb756}}]}, @IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0x4, 0xc4ae}}, @IFLA_VF_MAC={0x28, 0x1, {0x401, @local}}]}, {0x10, 0x1, [@IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0x9, 0x9}}]}, {0x4c, 0x1, [@IFLA_VF_RATE={0x10, 0x6, {0xffffffffffffffc1, 0x1, 0xffffffff}}, @IFLA_VF_VLAN_LIST={0x2c, 0xc, [{0x14, 0x1, {0x0, 0xf34, 0x0, 0x88a8}}, {0x14, 0x1, {0xffffffff, 0xaa1, 0x20, 0x8100}}]}, @IFLA_VF_TRUST={0xc, 0x9, {0x7fffffff}}]}, {0x20, 0x1, [@IFLA_VF_RATE={0x10, 0x6, {0x3, 0x5386, 0x3}}, @IFLA_VF_LINK_STATE={0xc, 0x5, {0xd3b}}]}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x4000011}, 0x1) 17:45:20 executing program 0: r0 = userfaultfd(0x10080800) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_API(r0, 0x8010aa01, &(0x7f0000000140)) openat$random(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x400, 0x0) 17:45:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000000140)={0x401, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000000), &(0x7f0000000040)=0x30) 17:45:21 executing program 1: getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{{@in=@dev, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@mcast2}}, &(0x7f0000000000)=0xe8) r1 = geteuid() setreuid(r0, r1) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_int(r2, 0x0, 0x8, 0x0, &(0x7f0000000040)) 17:45:21 executing program 0: r0 = socket$rxrpc(0x21, 0x2, 0xa) sendto$rxrpc(r0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x10400, 0x0) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x0, &(0x7f0000000380)={@mcast1, 0x0}, &(0x7f00000003c0)=0x14) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000400)={r2, 0x1, 0x6}, 0x10) r3 = socket$rxrpc(0x21, 0x2, 0xa) accept$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, &(0x7f0000000080)=0x1c) bind$rxrpc(r3, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0xffffffa4, 0x0, @ipv4={[], [], @loopback}}}, 0x65) 17:45:21 executing program 0: mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = accept(0xffffffffffffffff, &(0x7f00000000c0)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, &(0x7f0000000140)=0x80) ioctl$int_in(r0, 0x5473, &(0x7f0000000180)=0x8) r1 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$getownex(r1, 0x10, &(0x7f00000001c0)) r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x10000) ioctl$KVM_SMI(r2, 0xaeb7) getsockopt$IP6T_SO_GET_REVISION_TARGET(r2, 0x29, 0x45, &(0x7f0000000040)={'ah\x00'}, &(0x7f0000000080)=0x1e) setsockopt$inet_mreqsrc(r1, 0x88, 0x66, &(0x7f0000001840)={@loopback, @remote, @multicast2}, 0xc) 17:45:21 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0xfffffffffffffffc) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x420001, 0x0) bind$unix(r3, &(0x7f0000000080)=@abs={0x0, 0x0, 0x4e23}, 0x6e) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae9c, &(0x7f00000001c0)={0x2}) [ 307.968974] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 17:45:22 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci\x00', 0x222880, 0x0) setsockopt$inet_icmp_ICMP_FILTER(r1, 0x1, 0x1, &(0x7f0000000180)={0x2}, 0x4) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000240)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f00000000c0)={0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x0, 'lc\x00', 0x4, 0x5, 0x7d}, 0x2c) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000000)={0x1, {{0x2, 0x0, @multicast1}}}, 0xe83496097ed8ae17) utime(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x9, 0x6}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_group_source_req(r0, 0x0, 0x2d, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @remote}}}, 0x108) 17:45:22 executing program 1: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x6000, 0x0) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000040)=""/59) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f000004c000)=0x23, 0x4) bind$inet6(r1, &(0x7f0000f13000)={0xa, 0x0, 0xffffffff, @ipv4={[], [], @dev}}, 0x1c) sync_file_range(r1, 0x1ff, 0x3, 0x6) sync_file_range(r1, 0xda09, 0x1f, 0x1) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000080)={0x0, @reserved}) [ 308.155054] IPVS: set_ctl: invalid protocol: 0 172.30.1.1:20000 [ 308.183762] IPVS: set_ctl: invalid protocol: 0 172.30.1.1:20000 17:45:22 executing program 0: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) r1 = fcntl$getown(r0, 0x9) sched_setaffinity(r1, 0xfffffffffffffe99, &(0x7f0000000080)=0x1) ioctl$CAPI_GET_MANUFACTURER(r0, 0xc0044306, &(0x7f0000000980)=0x3) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000040)=0x1e) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140)={0xffffffffffffffff}, 0x0, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000200)={0x1, 0x10, 0xfa00, {&(0x7f0000000100), r3}}, 0x18) 17:45:22 executing program 1: perf_event_open(&(0x7f000025c000)={0x1, 0x1e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x40, 0x0) accept4(r0, 0x0, &(0x7f0000000040), 0x800) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) 17:45:22 executing program 0: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x0, 0x0) r1 = fcntl$getown(r0, 0x9) sched_setaffinity(r1, 0xfffffffffffffe99, &(0x7f0000000080)=0x1) ioctl$CAPI_GET_MANUFACTURER(r0, 0xc0044306, &(0x7f0000000980)=0x3) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f0000000040)=0x1e) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140)={0xffffffffffffffff}, 0x0, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000200)={0x1, 0x10, 0xfa00, {&(0x7f0000000100), r3}}, 0x18) 17:45:22 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001980)) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = gettid() clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_nanosleep(0x2, 0x0, &(0x7f0000000100)={0x0, r2+30000000}, 0xfffffffffffffffd) timer_create(0x0, &(0x7f0000cd0000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000f7a000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x40000000016) 17:45:22 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001980)) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = gettid() clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_nanosleep(0x2, 0x0, &(0x7f0000000100)={0x0, r2+30000000}, 0xfffffffffffffffd) timer_create(0x0, &(0x7f0000cd0000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000f7a000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x40000000016) 17:45:23 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001980)) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = gettid() clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_nanosleep(0x2, 0x0, &(0x7f0000000100)={0x0, r2+30000000}, 0xfffffffffffffffd) timer_create(0x0, &(0x7f0000cd0000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000f7a000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x40000000016) 17:45:23 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001980)) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = gettid() clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_nanosleep(0x2, 0x0, &(0x7f0000000100)={0x0, r2+30000000}, 0xfffffffffffffffd) timer_create(0x0, &(0x7f0000cd0000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000f7a000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x40000000016) 17:45:23 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001980)) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) gettid() clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_nanosleep(0x2, 0x0, &(0x7f0000000100)={0x0, r1+30000000}, 0xfffffffffffffffd) timer_create(0x0, &(0x7f0000cd0000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000f7a000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 17:45:23 executing program 2: r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xa271, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000040)) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000080)={0xd74e, 0x3, 0x4, 0x400, {0x0, 0x2710}, {0x0, 0x1, 0x9, 0x7fff, 0xfffffffffffff801, 0x100, "c65ef721"}, 0xfffffffffffffffe, 0x7, @fd=r0, 0x4}) r2 = accept$alg(r0, 0x0, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000100), &(0x7f0000000140)=0x30) lsetxattr$trusted_overlay_redirect(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='trusted.overlay.redirect\x00', &(0x7f0000000200)='./file0\x00', 0x8, 0x3) ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f0000000240)=""/23) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000280)=0x0) prctl$PR_SET_PTRACER(0x59616d61, r3) sendmsg$nl_route(r0, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80004}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=@ipv6_getmulticast={0x14, 0x3a, 0x100, 0x70bd29, 0x25dfdbfd, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f00000003c0)={0x4, 0xc4, 0x20, 0x6, 0x1, 0x8, 0x9, 0x5, 0x4, 0x9, 0x1, 0xffffffffffffffc0}) ioctl$IMHOLD_L1(r0, 0x80044948, &(0x7f0000000400)=0x401000000) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000440)={0x2, @time, 0x100000001, {0x77, 0x5}, 0x361c8cf5, 0x2, 0x6}) fcntl$setsig(r0, 0xa, 0x26) r4 = dup(r0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r4, 0x84, 0x1c, &(0x7f00000004c0), &(0x7f0000000500)=0x4) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000000540)='trusted.overlay.redirect\x00', &(0x7f0000000580)='./file0\x00', 0x8, 0x2) ioctl$BLKDISCARD(r0, 0x1277, &(0x7f00000005c0)=0x80000001) syz_open_dev$sg(&(0x7f0000000600)='/dev/sg#\x00', 0x8001, 0x80280) ioctl$VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000640)={0x0, 0x42c}) ioctl$DRM_IOCTL_AGP_ALLOC(r4, 0xc0206434, &(0x7f0000000680)={0x10, 0x0, 0x3, 0xbdd9}) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f00000006c0)={r5, 0x1f}) syz_open_dev$sndtimer(&(0x7f0000000700)='/dev/snd/timer\x00', 0x0, 0x4000) ioctl$VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000740)={0x1800000000000000, 0x2}) link(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0)='./file1\x00') ioctl$VIDIOC_G_PRIORITY(r4, 0x80045643, 0x1) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000800)={0x0, 0x28}, &(0x7f0000000840)=0x8) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f0000000880)={r6, 0x3, 0x7, [0x0, 0x8, 0x6, 0x5, 0x5, 0x10, 0x4]}, 0x16) ioctl$EVIOCSFF(r4, 0x40304580, &(0x7f00000008c0)={0x55, 0x1, 0x2, {0x0, 0x1ff}, {0x7, 0x9}, @cond=[{0x6, 0x10000, 0x7, 0x8, 0xfffffffffffff000, 0x2}, {0x0, 0x10000, 0x1, 0x3, 0x3, 0x2}]}) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r4, 0x40505331, &(0x7f0000000900)={{0x2, 0x3f}, {0xe6, 0xa30}, 0x6, 0x6, 0x8001}) 17:45:24 executing program 1: perf_event_open(&(0x7f000025c000)={0x1, 0x1e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x40, 0x0) accept4(r0, 0x0, &(0x7f0000000040), 0x800) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) 17:45:24 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001980)) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) gettid() clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_nanosleep(0x2, 0x0, &(0x7f0000000100)={0x0, r1+30000000}, 0xfffffffffffffffd) timer_create(0x0, &(0x7f0000cd0000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000f7a000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) [ 310.511409] IPVS: ftp: loaded support on port[0] = 21 [ 310.794458] chnl_net:caif_netlink_parms(): no params data found [ 310.902988] bridge0: port 1(bridge_slave_0) entered blocking state [ 310.909602] bridge0: port 1(bridge_slave_0) entered disabled state [ 310.917982] device bridge_slave_0 entered promiscuous mode [ 310.946747] bridge0: port 2(bridge_slave_1) entered blocking state [ 310.953439] bridge0: port 2(bridge_slave_1) entered disabled state [ 310.961947] device bridge_slave_1 entered promiscuous mode [ 311.000364] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 311.013961] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 311.048997] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 311.058765] team0: Port device team_slave_0 added [ 311.067271] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 311.076386] team0: Port device team_slave_1 added [ 311.084368] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 311.093336] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 311.166772] device hsr_slave_0 entered promiscuous mode [ 311.202445] device hsr_slave_1 entered promiscuous mode [ 311.243094] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 311.250581] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 311.317658] bridge0: port 2(bridge_slave_1) entered blocking state [ 311.324263] bridge0: port 2(bridge_slave_1) entered forwarding state [ 311.331380] bridge0: port 1(bridge_slave_0) entered blocking state [ 311.338004] bridge0: port 1(bridge_slave_0) entered forwarding state 17:45:25 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001980)) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) gettid() clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_nanosleep(0x2, 0x0, &(0x7f0000000100)={0x0, r1+30000000}, 0xfffffffffffffffd) timer_create(0x0, &(0x7f0000cd0000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000f7a000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) [ 311.553111] IPv6: ADDRCONF(NETDEV_UP): bond0: link is not ready [ 311.559252] 8021q: adding VLAN 0 to HW filter on device bond0 [ 311.614323] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 311.632982] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 311.644443] bridge0: port 1(bridge_slave_0) entered disabled state [ 311.654380] bridge0: port 2(bridge_slave_1) entered disabled state [ 311.678861] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 311.714463] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 311.720584] 8021q: adding VLAN 0 to HW filter on device team0 [ 311.751424] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 311.761214] bridge0: port 1(bridge_slave_0) entered blocking state [ 311.767801] bridge0: port 1(bridge_slave_0) entered forwarding state [ 311.824856] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 311.833219] bridge0: port 2(bridge_slave_1) entered blocking state [ 311.839710] bridge0: port 2(bridge_slave_1) entered forwarding state [ 311.849377] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 311.864967] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 311.892358] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 311.900574] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 311.909748] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 311.923578] IPv6: ADDRCONF(NETDEV_UP): veth0_to_hsr: link is not ready 17:45:26 executing program 1: r0 = syz_open_dev$radio(&(0x7f00000000c0)='/dev/radio#\x00', 0x1, 0x2) ioctl$RTC_WKALM_RD(r0, 0x80287010, &(0x7f0000000100)) recvfrom$inet6(0xffffffffffffffff, &(0x7f0000000180)=""/193, 0xc1, 0x21, 0x0, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x1, 0x40) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000140)={r1, &(0x7f0000000040)="f35458df955c61acf1fc4b963177a37818455690c260b39ceee4c17602bbdae23bc662d63db40ee7c0cdc46a1dae2776f5c072bb25050955f8a2b467af9d2c78ba573caaf8ea1040866d6b6e64e2", &(0x7f0000000280)=""/4096}, 0xffffffffffffff91) write$apparmor_exec(r1, &(0x7f0000001280)={'exec ', '/dev/radio#\x00'}, 0x11) [ 311.938805] IPv6: ADDRCONF(NETDEV_UP): veth1_to_hsr: link is not ready [ 311.949942] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 311.959903] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 311.972789] IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready [ 311.980213] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 311.989386] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 311.998139] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 312.006636] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 312.036904] IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready [ 312.074722] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 312.082411] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 17:45:26 executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) shutdown(r0, 0x1) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000280)={0x0, 0x1000, "5e468c8664c8ea2b1f40600c5d358c46f5b866f253a4fda3fd1747d1e4e154b641935a5433e9cb29009eca3bed3d862e38f6e5117836fcaf6ae4bd5aea09eda276b2f3b9d3fc78fd6eab443af0f6fb2dba35ca83352cfa8930bc3a96576e6742c93466fd3061dd4ba134f3e5f2dd7024435af2716f2c6497423c05c199358cdbb6603d237bab3d6189b6a25fcce804c25e7ec6ffaa4e1db403ee379a79b519da3da239cf57fd26182d5136948c84cc74d8251afc9816578bbf3414c70b127b2626658b2fbf0b7ec91ac1fbe19802a814efa5bb51b3d594cb39be63a95f93d04294f794e39bca8f48906add811947b3fbc12dd4b529585484bf65b07f916754d63625ad06b743e2d55e3bd36da979edaf54174f7a10c115420906342db4a46305ae8326935f1e695777e74959123afebeb1b8f499a987c1826076b0b1959097b4fcaa64b6e6533807f31aa7bc6e20c70c43ab252fdd9a6082cbc933f2cd00e996386159f4b023fd0ec9069a3495e0c6188dcf33c924b8c267e43e0aaa0bad9e7f7a35751fc025ff0c279576d691164e89cb358585f50afa1d616cec1002f18b53b6b3d7a69406b0caa6ff3aceccf05892f383f8ca92b8b0c2071212ad97475faeb09f87f1394c243e4b8df87ee4b939f21be6d74755c514d3c1bd756391362e21cf47e266499ee5d452a62ad10e4109ac4193842cf967b8abde61d4ea09949d78fdbb4500eabb014a5fdd8880e0d90fcd1695ce9ba0b010fbac94b7fef8d2fb5a34c7246026400a83cea580d24be7afd3f9fbe2a7768c6d8895e660ad77f76789f4aae01aef260f7b0e7f4522a7d69b7573376b2359102e018b83ac8b3929f82653cf3189f8c8c57fc22cd590275946df4e9f54ad99aec7fa2611d77f16e99608ace82467b3efe2c305af79f8e891dcd7755f46ed55bcd469f0e5ef60e07fb9c43bbfef59816d0768c9a6a6dc07fe1f458881370dd28f8fe086e095913d343322c75980282b700352f6fbf7058b086ba209a311f71d9ee4677a514f92b37195f052590a53f393269e89631c414b96f98da095478cb46752e9c38a41a386271b464f7b63db291f7fe6fc15f6606ed609769e18b7dd174146c07e73a493925cff3632a2c48ea61e792bbda8754f00a1e7ebfff018d836ba0c4342314fdf661b2943cb8ddf7e7205d5fef273687af42bf328b6c8600a7243aacfe1beffd78afcacd19b203e23663be58c3c5ef1560527d84d3da24a414b0e0acf86f7598a358b5ef5637532b3cc02053ee16f6beaba15a748c0a081cdee74714239b6600f887f46d981da162d408ec4c78398a15e81a88bfc7060efccf3e1efd332fc9874dcf19458a7e175e730d09d59e721152b71034dc0f1fb23a5e1eed7e89001a503b22a87e5d77ec2d11d1daa0bfdf027e0a802fa6125d8deff5dedb0880b76741f33d6e9af41783cdb936431f9e9fd580e93dfb90fc94845f693dae287f80ec28da7cd84ba152609f12a3b80924d77f2894dcc4e1b1d0aea1953bbf23be8320b07862fc3b633e15662771b8f5eea6c035d216fc86ad74fbad9e52bb0b35fc65d720e92a4f1e3fbc94bc6738d0aac693fdfb099c9c26669bcdfd377379220f35ce92900810c14620370815591d87407caa571e45f58f0451ca940398a9b25421ce3e1219e9cf3a1ba70f4fef080c17fd908e524f5b910edfd6f3d6f904f4a3024db887acedfcca1eae794b961b2ff088cc0cd23d0e3f7fb8f0e96f7cac46abea02c14080bf9a81562d794c3b1dd980afa8d948f01fd451e6c188df1869bf1ec51085f61c7362014315f6d6556792fb1527c1e531b713078850e6b2345b7da7f8e9542c70281694a717066972cd882f0144d9513708e5d271e278f0ea3fae49c09a6fae2bca174275dddac7a5a7c9f0574579d7fbc644c7a6e0ac9ca0552e92c0f8a843db618e63b2ae4f86511acc85527cb48180942099bd9e08c0d340c7d51fcd23cb0d0fb652bf862fe4da2f53b96435d8b10ec80fd2d3b392b8e98d30ac3e631c19a282ae6d0c38fae15377d0e8ebc100ed449556453ac2db49fced13fc156630492f690da4f1163ab23fcccae3b86290260c70c8116e336f59f88e8a95992c24c2c1833592aaf5b109b36ac33d6a85a41bc51cc9a2ae3504c0605eb94f919830ddb6883d75c4bada752b90a33934bd3b0eb5e37970fe125415c398876c7252f6db2abc253a560b6de097c2cd8efaa00998f88f37c8cef525e3e80bcda28f3c6771df9470d20f83b44391aa0eb0c7db2a8f543e2795226bbca5d0265f21424a82e872ffddc8855016ffbc3ee4f423aa36a3e4c7f602b31bebedbed0abb8ae3cf99cdd21f69138c041c0ca0828370da4a9e8acbed064f444c1ef0888b28479eca8c4fc71f615390b255baed833f0e2108a18905007aa0a9a9ba5fc897446b00cba3b3c62d512d9f73a141a97b3b7ea007fdce555dfa962ee5dbe3b61cc00b25af2a836ddc6e8587658b8677fdef74ff04a7ab84097976d3ef949b365cef4fb98a7bdf58446e549ad74f3c86c76a6d01fea802947970d4cc881c37a1043a576ed34d7fca2ad882f775dfa30f39900288f3523e96a3bee2b4f6aea9cde7eb791bbf09a5893108de638315101b18c6d5b68856791a3e667938862ccbd50b8d3d14dc13702c64f7abb1932121d73117459042fb49f960766197c024b4b29d6eded87d6a6cbfb5c9d19b9856ebb46ffacfd879e2095b3046873b1c12c007841e8d16d52c5b2c3f14642cf1c6786c27909c9e3b4a49b31499d05e5a7c5b0cd6af4f99a64557a2eb3ba584a20ecb0c90ed6b3649e3adf6cfc92a0e2c80d54e27cc3750ddb7cecaba88f3f92c327ed8f1b30469b1c016046a09aabfb2f3245982c1d6a5c09ecfd56bd93c058204cc1844eaab60c75fc535bd971b824e761e0ec588c0d106919e936fc8813877ac1804503fc0817034148b4c40bcb8ec14688bb99222c5d41f6a71f0cd6d3ec592e55600bd94d45d7c5a71235beb2faf891bfbaf11e058c363befcf29ab127e0d8e5d5099ed910c5c872a7c374d8d1f3f05aa94df93c74fef5a70c4c06d61876c9a1e18b8d18de710df25f3c42b824fad6d6a88e98ed965096db5169503ec27f552d60f3909b3fbfcb703ea5923b1ff74ec9dd5f3bb544ccc379478f9deed1cd5540495b18e9f303e492d602176d63437dfbd5c81bd03acf16b6cc5fe3552e2a392058d297a782ef6883bbd009cd3f171cba09003951cef601873566bd995c156de0a79991e2de464aa4cf500b82e6bfe2cc635db0eb77047b25f386eb368e24902099494429c8ced4e6fb8d05f666145b6235c55b6570abf4a1f1fad1c82144728c657a2d92276c7fa474eb66a15dd260c8414550761e503dd49ee078f6c37fec10e3651d13df00c6f8376dc7663a43177ae90f610dac5e44929c80456b4eb096009339508230c63c8c4acb2fbaccc61f9789cc05a9d7e8169623681aa53c3a0af2ef6f634e75edc9b11ab7e289c5ef4b2b38ee30a478532ff7d4355143cf411826fbf5a4cbf84016bcd9bdf135aff68208ddb73af0675d6fa448a0d4b305ba2e316bcf98f3491dd972e612e71e7141ea40a4765fad7dae4b94c2d03436bf069089e29a9dd88d183fb49cce361cf3d97079b757e92a88249dec900bf59025f48bee5d51c8e7345bb171f5bcb1f9630ef9de48668194067f9c9ea08480fe2299923454e8c9c41730c2f80cfaa4917a1468cc0f2750d253c53c550f4d286c24619f790d2cf0b03e7e15729236fbfa453a9dfad66c26ee19709e5967ffefffdee65c1cca29d0e27ee073d0dfdd3cfe57631921b9265c15565031ae7d18386e7f5eab76974660d906534388b97f544955c65506a2014fbc12d9abc6a4b56809699dd52034d7c7416940c5d7bb480d2236bf9bc273f53118c9eee82309df9409ab799763946bd019627450cfe08a59f8addc90d7bf03bd2f43e0f82adb3751a99ec76e4b3434129f6c491e893a540c532e0ecf6ee81e4fe2a55092874439bd07e94919bad5cf41dc2d6db674efa77858d3a2f060b6782103b74b117dd0d811df249c2f52b0df0e03846e02586eaa51c0163f539b358d3a98ba18b8f75fca9401a6e7f51066a1092f189d6a0ba51bd00e2b062e03d6be1868b4b9a308f87d6d8a1ed55a36431a95eebded569ae76cf656133a4992e1268f408e728264cab0a55e42caf07f9be6b88382d6f4a599e4ba9641df27edbbe7bd7f294328e168317517c841d7396cbf142fbcd8d2e3336b1ba34d8118be3095e4749faed3615701b35cd3cdbf2ffbc37762df067a33ee399961d0cb1020309914a801780a7438fa2f9633b8ce80462352331c0d9213e1bec01799e9f2a73a64d98bf39c40f3be8b98db954634cb638ce94723bb0d6b45366f6dfd6c51f6720fc0a8399d11ff14c45a7e1202d35c304f6b6b2090bdf890b7f683210fdcd3c8108d8bb2cf03c529a2e110c6a6c83635d365c7b1facd54c695e688da1661ac674fcb9153b68afa179aabf503b7f48b549fa54dc3652a98c5a977d09818b4a29cc4ae9c6e5a8cf71e686b18efa66f9d7babeba771506b8f5e6f422072ab9700a6ecb80b49be2c04f3c150def7e0593519ac98fcfd3fb5ba18632cba52653bada592ad2e9f5b3139e2236bfa8aaa9ee3e800776255127eb23e94ff0bbfecee795658d9ceb210b4f84b27a719bf7b41a86791721afc4401c3f48c44855c88bf708196df640dc7d337c84ac82ab46e09267e01a542ccb873fc3bccadcf9b3108a7c095a5b3350bdf164bd9401ae795cfe5614228221c8a6df2896ebd085aa3d99360ee7eaf4c19ba992fe261944b905b1008dbb0fad4d1583d1a35f60f1f9515b15485b50a184382128e849cd0d1f3d1377ba82bf9fe0a2a7aa28ff37e98f417ab0476a25c98d5e3fb71d6899b6cc86a6582abc8320b71b3faa1702881584342a42bb544a6bf2948ca59f271e80867bbfea1af1bd1a9b4cad21fc4cf7ce426e430f332144cb5a148ae3886ed4b90ac9c7fc73a816b1bf6f518a6d9797f35d33c8009784106d5d7764963e4f242d6b06b8a5f0fdc5ba5a7b64edc06bde8f9e769fc9025109c5e242669f569a40dc634c22b3096c59c3cdfab07a2e3ed16abcd2d39bc637644f19f1acbfdef28809c5b60046b37f784bab03ece4fe53a10e6f8b5007e75eb2a9b26ffa5edb904f0c129231fb7b2229abcdf2c9b58eff9fa7d3e379575e167a39615c416c8b3108b565360783d3ecdd8c625afc748fdf29a3c22ea43473c50659710093f3efd0e06816b5048fa70e2c2ec56cd73b3685aaaab499b337610377a020e36dc9d8381ee28217a7877917df5a08d7e0f5f3f7a4bff6913234d6c416f8734afe16dcbb9d333d9b138cf987fd8b2e03a0d57af568664454f394476d7f0c5a7ed148011f16925a471b72bf41fb2564166d4b9a50465ed6db01276181a2619d1aba90f2de4b5c9521c83a828210edc14df3fcd2224f67302e167bedec464f76e198d2a0ede77c14ab0163a33c6cb5670525960fdfae86d8bd4b65d4506aa956ea989f6f7fefa8c27a01d91f190e76f9ceaf332323e6179819aa5b597172f628f16f4e5211aae698765b6971b24335b0a11ffe27682acbc5ffb210ee3f203e3a63cfba18818d92f0c074c86705f6df0040393adfb0669a95affb037781f2edca7f0fd5515fca63b065aa40f260a0c4b5a4b50119392a0843dd2cefd2d9b9539229f0c94fc104c3fd0a18fcc7965407ab1ae5171614a51c74b84b6ae72f517ad95dcabe4e1"}, &(0x7f0000000140)=0x1008) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000180)={0x53, 0x4, 0x3ff, 0xe5}, &(0x7f00000001c0)=0x10) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000200)={0x5, 0x209, 0xbefd, 0x7f, 0x0}, &(0x7f00000012c0)=0x10) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000240)={r1, 0x4, 0x4, 0x3}, 0x10) 17:45:26 executing program 2: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x4000000000000001, 0x3, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffffc5, 0x0, 0x0, 0x2}}, &(0x7f0000000040)='GPL\x00', 0x1, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x2200, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f00000000c0)) [ 312.321149] ================================================================== [ 312.328582] BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 [ 312.335108] CPU: 0 PID: 11234 Comm: syz-executor1 Not tainted 4.20.0-rc7+ #4 [ 312.342301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 312.351675] Call Trace: [ 312.354319] dump_stack+0x173/0x1d0 [ 312.357993] kmsan_report+0x12e/0x2a0 [ 312.361848] kmsan_internal_check_memory+0x455/0xb00 [ 312.366993] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 312.372382] ? trace_kmalloc+0xc2/0x2e0 [ 312.376397] kmsan_copy_to_user+0xab/0xc0 [ 312.380578] _copy_to_user+0x16b/0x1f0 [ 312.384530] sctp_getsockopt+0x164ef/0x17530 [ 312.389068] ? aa_sk_perm+0x605/0x950 [ 312.392937] ? aa_sock_opt_perm+0x121/0x270 [ 312.397298] ? sctp_setsockopt+0x12480/0x12480 [ 312.401907] sock_common_getsockopt+0x13f/0x180 [ 312.406633] ? sock_recv_errqueue+0x8f0/0x8f0 [ 312.411145] __sys_getsockopt+0x489/0x550 [ 312.415337] __se_sys_getsockopt+0xe1/0x100 [ 312.419693] __x64_sys_getsockopt+0x62/0x80 [ 312.424032] do_syscall_64+0xbc/0xf0 [ 312.427798] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 312.433001] RIP: 0033:0x457ec9 [ 312.436205] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 312.455118] RSP: 002b:00007f4fe5f98c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 312.462836] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457ec9 [ 312.470112] RDX: 000000000000006d RSI: 0000000000000084 RDI: 0000000000000003 [ 312.477386] RBP: 000000000073bf00 R08: 0000000020000140 R09: 0000000000000000 [ 312.484666] R10: 0000000020000280 R11: 0000000000000246 R12: 00007f4fe5f996d4 [ 312.491942] R13: 00000000004c98f8 R14: 00000000004d00b8 R15: 00000000ffffffff [ 312.499250] [ 312.500883] Uninit was stored to memory at: [ 312.505230] kmsan_internal_chain_origin+0x134/0x230 [ 312.510347] kmsan_memcpy_memmove_metadata+0x58f/0xfa0 [ 312.515636] kmsan_memcpy_metadata+0xb/0x10 [ 312.519964] __msan_memcpy+0x58/0x70 [ 312.523688] sctp_getsockopt+0x16cee/0x17530 [ 312.528106] sock_common_getsockopt+0x13f/0x180 [ 312.532792] __sys_getsockopt+0x489/0x550 [ 312.536955] __se_sys_getsockopt+0xe1/0x100 [ 312.541287] __x64_sys_getsockopt+0x62/0x80 [ 312.545619] do_syscall_64+0xbc/0xf0 [ 312.549344] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 312.554533] [ 312.556161] Uninit was stored to memory at: [ 312.560508] kmsan_internal_chain_origin+0x134/0x230 [ 312.565626] kmsan_memcpy_memmove_metadata+0x58f/0xfa0 [ 312.570918] kmsan_memcpy_metadata+0xb/0x10 [ 312.575246] __msan_memcpy+0x58/0x70 [ 312.579172] sctp_getsockopt+0x16b9a/0x17530 [ 312.583636] sock_common_getsockopt+0x13f/0x180 [ 312.588322] __sys_getsockopt+0x489/0x550 [ 312.592485] __se_sys_getsockopt+0xe1/0x100 [ 312.596827] __x64_sys_getsockopt+0x62/0x80 [ 312.601157] do_syscall_64+0xbc/0xf0 [ 312.604895] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 312.610086] [ 312.611717] Uninit was created at: [ 312.615301] kmsan_internal_poison_shadow+0x92/0x150 [ 312.620415] kmsan_kmalloc+0xa6/0x130 [ 312.624227] kmem_cache_alloc_trace+0x55a/0xb90 [ 312.628903] sctp_inetaddr_event+0x47b/0xa90 [ 312.633324] blocking_notifier_call_chain+0x1a5/0x2f0 [ 312.638537] __inet_insert_ifa+0xfaa/0x1200 [ 312.642870] inet_rtm_newaddr+0x1362/0x2210 [ 312.647202] rtnetlink_rcv_msg+0x115b/0x1550 [ 312.651622] netlink_rcv_skb+0x444/0x640 [ 312.655698] rtnetlink_rcv+0x50/0x60 [ 312.659421] netlink_unicast+0xf40/0x1020 [ 312.663576] netlink_sendmsg+0x127f/0x1300 [ 312.667825] __sys_sendto+0x8c4/0xac0 [ 312.671640] __se_sys_sendto+0x107/0x130 [ 312.675708] __x64_sys_sendto+0x6e/0x90 [ 312.679687] do_syscall_64+0xbc/0xf0 [ 312.683414] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 312.688614] [ 312.690246] Bytes 8-15 of 544 are uninitialized [ 312.694916] Memory access of size 544 starts at ffff8880508f6000 [ 312.701061] Data copied to user address 0000000020000288 [ 312.706513] ================================================================== [ 312.713871] Disabling lock debugging due to kernel taint [ 312.719337] Kernel panic - not syncing: panic_on_warn set ... [ 312.725235] CPU: 0 PID: 11234 Comm: syz-executor1 Tainted: G B 4.20.0-rc7+ #4 [ 312.733811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 312.743168] Call Trace: [ 312.745800] dump_stack+0x173/0x1d0 [ 312.749457] panic+0x3ce/0x961 [ 312.752714] kmsan_report+0x293/0x2a0 [ 312.756550] kmsan_internal_check_memory+0x455/0xb00 [ 312.761675] ? __msan_metadata_ptr_for_load_4+0x10/0x20 [ 312.767051] ? trace_kmalloc+0xc2/0x2e0 [ 312.771059] kmsan_copy_to_user+0xab/0xc0 [ 312.775225] _copy_to_user+0x16b/0x1f0 [ 312.779143] sctp_getsockopt+0x164ef/0x17530 [ 312.783616] ? aa_sk_perm+0x605/0x950 [ 312.787445] ? aa_sock_opt_perm+0x121/0x270 [ 312.791799] ? sctp_setsockopt+0x12480/0x12480 [ 312.796400] sock_common_getsockopt+0x13f/0x180 [ 312.801091] ? sock_recv_errqueue+0x8f0/0x8f0 [ 312.805596] __sys_getsockopt+0x489/0x550 [ 312.809789] __se_sys_getsockopt+0xe1/0x100 [ 312.814141] __x64_sys_getsockopt+0x62/0x80 [ 312.818473] do_syscall_64+0xbc/0xf0 [ 312.822214] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 312.827412] RIP: 0033:0x457ec9 [ 312.830611] Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 312.849527] RSP: 002b:00007f4fe5f98c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 312.857244] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457ec9 [ 312.864527] RDX: 000000000000006d RSI: 0000000000000084 RDI: 0000000000000003 [ 312.871802] RBP: 000000000073bf00 R08: 0000000020000140 R09: 0000000000000000 [ 312.879080] R10: 0000000020000280 R11: 0000000000000246 R12: 00007f4fe5f996d4 [ 312.886357] R13: 00000000004c98f8 R14: 00000000004d00b8 R15: 00000000ffffffff [ 312.894557] Kernel Offset: disabled [ 312.898212] Rebooting in 86400 seconds..