[   36.189721][   T26] audit: type=1800 audit(1548856080.680:27): pid=7528 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2436 res=0
[   36.212001][   T26] audit: type=1800 audit(1548856080.680:28): pid=7528 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="ssh" dev="sda1" ino=2417 res=0
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[   36.913329][   T26] audit: type=1800 audit(1548856081.450:29): pid=7528 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0
[   36.933485][   T26] audit: type=1800 audit(1548856081.450:30): pid=7528 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.10.12' (ECDSA) to the list of known hosts.
2019/01/30 13:48:12 fuzzer started
2019/01/30 13:48:14 dialing manager at 10.128.0.26:43669
2019/01/30 13:48:15 syscalls: 1
2019/01/30 13:48:15 code coverage: enabled
2019/01/30 13:48:15 comparison tracing: enabled
2019/01/30 13:48:15 extra coverage: extra coverage is not supported by the kernel
2019/01/30 13:48:15 setuid sandbox: enabled
2019/01/30 13:48:15 namespace sandbox: enabled
2019/01/30 13:48:15 Android sandbox: /sys/fs/selinux/policy does not exist
2019/01/30 13:48:15 fault injection: enabled
2019/01/30 13:48:15 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled
2019/01/30 13:48:15 net packet injection: enabled
2019/01/30 13:48:15 net device setup: enabled
13:50:42 executing program 0:
r0 = socket$kcm(0x2b, 0x200000000000001, 0x0)
setsockopt$sock_attach_bpf(r0, 0x6, 0xe, &(0x7f00000002c0), 0x4)

syzkaller login: [  198.501527][ T7694] IPVS: ftp: loaded support on port[0] = 21
13:50:43 executing program 1:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3, 0x0, 0xfb})

[  198.623752][ T7694] chnl_net:caif_netlink_parms(): no params data found
[  198.721159][ T7694] bridge0: port 1(bridge_slave_0) entered blocking state
[  198.739214][ T7694] bridge0: port 1(bridge_slave_0) entered disabled state
[  198.759080][ T7694] device bridge_slave_0 entered promiscuous mode
[  198.769320][ T7694] bridge0: port 2(bridge_slave_1) entered blocking state
[  198.776423][ T7694] bridge0: port 2(bridge_slave_1) entered disabled state
[  198.785926][ T7694] device bridge_slave_1 entered promiscuous mode
[  198.812644][ T7694] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  198.813715][ T7698] IPVS: ftp: loaded support on port[0] = 21
[  198.827104][ T7694] bond0: Enslaving bond_slave_1 as an active interface with an up link
13:50:43 executing program 2:
mkdir(&(0x7f00000003c0)='./file0\x00', 0x0)
clone(0xa000010d, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
perf_event_open(&(0x7f0000000000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xa00000000, 0x420000000002}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000))
r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TCGETA(r0, 0x5405, &(0x7f0000000240))
ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0x40a85323, &(0x7f0000000400)={{}, 'port0\x00', 0x0, 0x0, 0xfffffffffffffff8, 0x1, 0x0, 0x40})
r1 = request_key(&(0x7f0000000080)='dns_resolver\x00', &(0x7f0000000100)={'syz', 0x1}, &(0x7f0000000140)='port0\x00', 0xfffffffffffffffc)
keyctl$describe(0x6, r1, &(0x7f0000000180)=""/181, 0xb5)

[  198.854108][ T7694] team0: Port device team_slave_0 added
[  198.863297][ T7694] team0: Port device team_slave_1 added
[  198.951166][ T7694] device hsr_slave_0 entered promiscuous mode
[  198.988428][ T7694] device hsr_slave_1 entered promiscuous mode
[  199.057820][ T7694] bridge0: port 2(bridge_slave_1) entered blocking state
[  199.065046][ T7694] bridge0: port 2(bridge_slave_1) entered forwarding state
[  199.072772][ T7694] bridge0: port 1(bridge_slave_0) entered blocking state
[  199.079735][ T7700] IPVS: ftp: loaded support on port[0] = 21
[  199.079869][ T7694] bridge0: port 1(bridge_slave_0) entered forwarding state
13:50:43 executing program 3:
mknod(&(0x7f0000000180)='./file0\x00', 0x1ffb, 0x0)
r0 = open$dir(&(0x7f0000000440)='./file0\x00', 0x0, 0x0)
r1 = open$dir(&(0x7f0000001940)='./file0\x00', 0x801, 0x0)
select(0x40, &(0x7f0000000040), 0x0, &(0x7f00000000c0)={0x9}, 0x0)
select(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000200)={0x4, 0x0, 0xedc, 0xcf75, 0x40, 0x1}, &(0x7f0000000240)={0x74, 0x8})
select(0x40, &(0x7f00000001c0)={0x8}, 0x0, 0x0, 0x0)
dup2(r0, r1)

[  199.240677][ T7698] chnl_net:caif_netlink_parms(): no params data found
[  199.325272][ T7700] chnl_net:caif_netlink_parms(): no params data found
[  199.360431][ T7704] IPVS: ftp: loaded support on port[0] = 21
[  199.376113][ T7694] 8021q: adding VLAN 0 to HW filter on device bond0
[  199.401319][ T7698] bridge0: port 1(bridge_slave_0) entered blocking state
[  199.410525][ T7698] bridge0: port 1(bridge_slave_0) entered disabled state
13:50:44 executing program 4:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
r2 = dup(r1)
ioctl$EVIOCGSND(r2, 0x8040451a, 0x0)
r3 = fcntl$dupfd(r1, 0x0, r2)
bind$bt_rfcomm(r3, &(0x7f00000001c0)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa)

[  199.422318][ T7698] device bridge_slave_0 entered promiscuous mode
[  199.445390][ T7694] 8021q: adding VLAN 0 to HW filter on device team0
[  199.457094][ T2979] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  199.474509][ T2979] bridge0: port 1(bridge_slave_0) entered disabled state
[  199.496654][ T2979] bridge0: port 2(bridge_slave_1) entered disabled state
[  199.512452][ T2979] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[  199.542311][ T7698] bridge0: port 2(bridge_slave_1) entered blocking state
[  199.570951][ T7698] bridge0: port 2(bridge_slave_1) entered disabled state
[  199.579227][ T7698] device bridge_slave_1 entered promiscuous mode
[  199.616507][ T2979] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  199.632570][ T2979] bridge0: port 1(bridge_slave_0) entered blocking state
[  199.639683][ T2979] bridge0: port 1(bridge_slave_0) entered forwarding state
[  199.650939][ T2979] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  199.659606][ T2979] bridge0: port 2(bridge_slave_1) entered blocking state
[  199.666642][ T2979] bridge0: port 2(bridge_slave_1) entered forwarding state
[  199.675260][ T2979] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
13:50:44 executing program 5:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc\x00', 0x2000, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syslog(0x0, 0x0, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
r2 = socket$packet(0x11, 0x0, 0x300)
r3 = dup2(0xffffffffffffffff, r2)
openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10)
getsockopt$ARPT_SO_GET_INFO(r1, 0x0, 0x60, &(0x7f0000000200)={'filter\x00'}, &(0x7f0000000080)=0x44)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4)
recvmsg(0xffffffffffffffff, 0x0, 0x0)
connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r1, &(0x7f0000007fc0), 0x2ed75feae06cc8a, 0x0)
ioctl$TCSBRKP(r3, 0x5425, 0x6)
ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000340)=""/181)
ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000))

[  199.714815][ T7708] IPVS: ftp: loaded support on port[0] = 21
[  199.715069][ T7694] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  199.732671][ T7694] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  199.748705][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  199.756488][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  199.779297][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  199.787588][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  199.796013][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  199.804802][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  199.814133][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  199.840646][ T7700] bridge0: port 1(bridge_slave_0) entered blocking state
[  199.847707][ T7700] bridge0: port 1(bridge_slave_0) entered disabled state
[  199.856541][ T7700] device bridge_slave_0 entered promiscuous mode
[  199.870804][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  199.892581][ T7694] 8021q: adding VLAN 0 to HW filter on device batadv0
[  199.902725][ T7698] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  199.911685][ T7700] bridge0: port 2(bridge_slave_1) entered blocking state
[  199.918928][ T7700] bridge0: port 2(bridge_slave_1) entered disabled state
[  199.926613][ T7700] device bridge_slave_1 entered promiscuous mode
[  199.951600][ T7698] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  199.966042][ T7700] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  200.003847][ T7698] team0: Port device team_slave_0 added
[  200.012865][ T7698] team0: Port device team_slave_1 added
[  200.024050][ T7710] IPVS: ftp: loaded support on port[0] = 21
[  200.033352][ T7700] bond0: Enslaving bond_slave_1 as an active interface with an up link
13:50:44 executing program 0:

[  200.095990][ T7700] team0: Port device team_slave_0 added
13:50:44 executing program 0:
r0 = socket$inet6(0x18, 0x2, 0x0)
r1 = dup2(r0, r0)
sendmsg$unix(r1, &(0x7f0000001700)={&(0x7f0000000300)=ANY=[@ANYBLOB="fb182e2f660300000000"], 0x1, 0x0}, 0x0)

[  200.164691][ T7700] team0: Port device team_slave_1 added
13:50:44 executing program 0:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
waitid(0x0, 0x0, 0x0, 0x0, 0x0)

[  200.237238][ T7704] chnl_net:caif_netlink_parms(): no params data found
[  200.299981][ T7698] device hsr_slave_0 entered promiscuous mode
[  200.318314][ T7698] device hsr_slave_1 entered promiscuous mode
[  200.394346][ T7708] chnl_net:caif_netlink_parms(): no params data found
[  200.450398][ T7700] device hsr_slave_0 entered promiscuous mode
[  200.488890][ T7700] device hsr_slave_1 entered promiscuous mode
13:50:45 executing program 0:
syz_emit_ethernet(0x7e, &(0x7f0000000000)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x223}, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x3, 0x2, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4011, 0x0, @local={0xac, 0x223}, @dev, {[@timestamp={0x8, 0x40, 0x0, 0x0, 0x0, [{[@rand_addr], 0x8060000}, {[@multicast2]}, {[@multicast1]}, {}, {[@loopback]}, {[@broadcast]}, {[@multicast1]}, {[@dev]}]}]}}}}}}}, 0x0)

13:50:45 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d76")
pkey_free(0xffffffffffffffff)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, &(0x7f00000006c0))
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vcs\x00', 0x2, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000700)={{{@in=@remote, @in6}}, {{@in6=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000800)=0xe8)
bind$inet(0xffffffffffffffff, &(0x7f0000b9bff0)={0x2, 0x2004e21}, 0x10)
getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f00000000c0), &(0x7f0000000100)=0x30)
arch_prctl$ARCH_SET_CPUID(0x1012, 0x0)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x100000000000000, &(0x7f00000002c0)={@remote, <r3=>0x0}, &(0x7f0000000200)=0x14)
setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000400)={r3, @empty, @local}, 0x361)
ioctl$TIOCLINUX7(r2, 0x541c, &(0x7f0000000240)={0x7, 0x8})
setresuid(0x0, 0xee01, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, 0x0, 0x0)
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280))
r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0)
ioctl$int_in(r5, 0x800000c0045002, &(0x7f0000000200)=0x1000)
accept4(r0, &(0x7f0000000580)=@ethernet={0x0, @broadcast}, &(0x7f0000000600)=0xfffffffffffffebb, 0x80000)
r6 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sysinfo(&(0x7f00000007c0)=""/154)
ioctl$BLKPG(r6, 0x1269, &(0x7f00000006c0)={0x1, 0x0, 0x0, &(0x7f0000000800)})
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
connect$l2tp(0xffffffffffffffff, 0x0, 0x0)
r7 = socket$vsock_stream(0x28, 0x1, 0x0)
bind$vsock_stream(r7, &(0x7f0000000000), 0x10)

[  200.623732][ T7700] bridge0: port 2(bridge_slave_1) entered blocking state
[  200.630923][ T7700] bridge0: port 2(bridge_slave_1) entered forwarding state
[  200.638261][ T7700] bridge0: port 1(bridge_slave_0) entered blocking state
[  200.645316][ T7700] bridge0: port 1(bridge_slave_0) entered forwarding state
[  200.696382][ T7708] bridge0: port 1(bridge_slave_0) entered blocking state
[  200.703652][ T7708] bridge0: port 1(bridge_slave_0) entered disabled state
[  200.712955][ T7708] device bridge_slave_0 entered promiscuous mode
[  200.722658][ T7708] bridge0: port 2(bridge_slave_1) entered blocking state
[  200.730137][ T7708] bridge0: port 2(bridge_slave_1) entered disabled state
[  200.737773][ T7708] device bridge_slave_1 entered promiscuous mode
[  200.745282][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[  200.752938][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[  200.781037][    C1] hrtimer: interrupt took 43449 ns
13:50:45 executing program 0:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d76")
pkey_free(0xffffffffffffffff)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, &(0x7f00000006c0))
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vcs\x00', 0x2, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000700)={{{@in=@remote, @in6}}, {{@in6=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000800)=0xe8)
bind$inet(0xffffffffffffffff, &(0x7f0000b9bff0)={0x2, 0x2004e21}, 0x10)
getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f00000000c0), &(0x7f0000000100)=0x30)
arch_prctl$ARCH_SET_CPUID(0x1012, 0x0)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x100000000000000, &(0x7f00000002c0)={@remote, <r3=>0x0}, &(0x7f0000000200)=0x14)
setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000400)={r3, @empty, @local}, 0x361)
ioctl$TIOCLINUX7(r2, 0x541c, &(0x7f0000000240)={0x7, 0x8})
setresuid(0x0, 0xee01, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, 0x0, 0x0)
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280))
r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0)
ioctl$int_in(r5, 0x800000c0045002, &(0x7f0000000200)=0x1000)
accept4(r0, &(0x7f0000000580)=@ethernet={0x0, @broadcast}, &(0x7f0000000600)=0xfffffffffffffebb, 0x80000)
r6 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sysinfo(&(0x7f00000007c0)=""/154)
ioctl$BLKPG(r6, 0x1269, &(0x7f00000006c0)={0x1, 0x0, 0x0, &(0x7f0000000800)})
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
connect$l2tp(0xffffffffffffffff, 0x0, 0x0)
r7 = socket$vsock_stream(0x28, 0x1, 0x0)
bind$vsock_stream(r7, &(0x7f0000000000), 0x10)

[  200.845040][ T7698] 8021q: adding VLAN 0 to HW filter on device bond0
[  200.852478][ T7704] bridge0: port 1(bridge_slave_0) entered blocking state
[  200.860462][ T7704] bridge0: port 1(bridge_slave_0) entered disabled state
[  200.874932][ T7704] device bridge_slave_0 entered promiscuous mode
[  200.883305][ T7704] bridge0: port 2(bridge_slave_1) entered blocking state
[  200.890415][ T7704] bridge0: port 2(bridge_slave_1) entered disabled state
[  200.903626][ T7704] device bridge_slave_1 entered promiscuous mode
[  200.934399][ T7710] chnl_net:caif_netlink_parms(): no params data found
[  200.969738][ T7708] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  200.989078][ T7704] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  201.004136][ T7698] 8021q: adding VLAN 0 to HW filter on device team0
[  201.036629][ T7708] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  201.051563][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  201.059546][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  201.068377][ T7704] bond0: Enslaving bond_slave_1 as an active interface with an up link
13:50:45 executing program 0:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3, 0x0, 0xfb})

[  201.119823][ T7700] 8021q: adding VLAN 0 to HW filter on device bond0
[  201.143534][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  201.158690][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  201.167369][ T7705] bridge0: port 1(bridge_slave_0) entered blocking state
[  201.174461][ T7705] bridge0: port 1(bridge_slave_0) entered forwarding state
[  201.182713][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  201.202287][ T7704] team0: Port device team_slave_0 added
[  201.211530][ T7708] team0: Port device team_slave_0 added
[  201.223935][ T7700] 8021q: adding VLAN 0 to HW filter on device team0
[  201.234989][ T7710] bridge0: port 1(bridge_slave_0) entered blocking state
[  201.244483][ T7710] bridge0: port 1(bridge_slave_0) entered disabled state
[  201.254716][ T7710] device bridge_slave_0 entered promiscuous mode
[  201.263481][ T7704] team0: Port device team_slave_1 added
[  201.273807][ T7708] team0: Port device team_slave_1 added
[  201.285026][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  201.293174][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  201.308569][ T7710] bridge0: port 2(bridge_slave_1) entered blocking state
[  201.315613][ T7710] bridge0: port 2(bridge_slave_1) entered disabled state
[  201.323491][ T7710] device bridge_slave_1 entered promiscuous mode
[  201.346110][ T7710] bond0: Enslaving bond_slave_0 as an active interface with an up link
[  201.355897][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  201.364464][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  201.373412][   T22] bridge0: port 2(bridge_slave_1) entered blocking state
[  201.380522][   T22] bridge0: port 2(bridge_slave_1) entered forwarding state
[  201.387965][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  201.396463][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  201.404708][   T22] bridge0: port 1(bridge_slave_0) entered blocking state
[  201.411793][   T22] bridge0: port 1(bridge_slave_0) entered forwarding state
[  201.420011][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  201.428582][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  201.436957][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  201.445278][   T22] bridge0: port 2(bridge_slave_1) entered blocking state
[  201.452317][   T22] bridge0: port 2(bridge_slave_1) entered forwarding state
[  201.460553][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  201.492284][ T7710] bond0: Enslaving bond_slave_1 as an active interface with an up link
[  201.502066][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  201.511323][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  201.579870][ T7708] device hsr_slave_0 entered promiscuous mode
[  201.638475][ T7708] device hsr_slave_1 entered promiscuous mode
[  201.770512][ T7704] device hsr_slave_0 entered promiscuous mode
[  201.808364][ T7704] device hsr_slave_1 entered promiscuous mode
[  201.889044][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  201.897512][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  201.906262][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  201.915020][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  201.923467][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  201.932373][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  201.940673][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  201.949252][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  201.957429][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  201.965850][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  201.974005][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  201.982405][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  201.990754][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  201.998575][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  202.015163][ T7710] team0: Port device team_slave_0 added
[  202.025595][ T7710] team0: Port device team_slave_1 added
[  202.041408][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  202.053515][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  202.064224][ T7700] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  202.075564][ T7700] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  202.083882][ T7698] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  202.102537][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  202.111278][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  202.126255][ T7700] 8021q: adding VLAN 0 to HW filter on device batadv0
[  202.161459][ T7710] device hsr_slave_0 entered promiscuous mode
[  202.218577][ T7710] device hsr_slave_1 entered promiscuous mode
[  202.293742][ T7698] 8021q: adding VLAN 0 to HW filter on device batadv0
13:50:46 executing program 1:

13:50:46 executing program 0:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3, 0x0, 0xfb})

[  202.470766][ T7704] 8021q: adding VLAN 0 to HW filter on device bond0
[  202.506382][ T7710] 8021q: adding VLAN 0 to HW filter on device bond0
[  202.519924][ T7708] 8021q: adding VLAN 0 to HW filter on device bond0
[  202.562630][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  202.570588][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  202.578512][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  202.586011][ T7747] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  202.596887][ T7710] 8021q: adding VLAN 0 to HW filter on device team0
[  202.605267][ T7704] 8021q: adding VLAN 0 to HW filter on device team0
[  202.615526][ T7708] 8021q: adding VLAN 0 to HW filter on device team0
[  202.625015][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  202.632711][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  202.643195][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  202.651902][    T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  202.660229][    T5] bridge0: port 1(bridge_slave_0) entered blocking state
[  202.667245][    T5] bridge0: port 1(bridge_slave_0) entered forwarding state
[  202.687328][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  202.695199][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  202.703732][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  202.712313][ T7705] bridge0: port 1(bridge_slave_0) entered blocking state
[  202.719385][ T7705] bridge0: port 1(bridge_slave_0) entered forwarding state
[  202.727372][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  202.736206][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  202.744580][ T7705] bridge0: port 1(bridge_slave_0) entered blocking state
[  202.751647][ T7705] bridge0: port 1(bridge_slave_0) entered forwarding state
[  202.759417][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  202.768451][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  202.776708][ T7705] bridge0: port 2(bridge_slave_1) entered blocking state
[  202.783766][ T7705] bridge0: port 2(bridge_slave_1) entered forwarding state
[  202.791244][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  202.799898][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  202.809018][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  202.817381][ T7705] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  202.825716][ T7705] bridge0: port 2(bridge_slave_1) entered blocking state
[  202.832757][ T7705] bridge0: port 2(bridge_slave_1) entered forwarding state
[  202.850457][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  202.858628][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  202.866317][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  202.874823][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  202.883676][   T12] bridge0: port 2(bridge_slave_1) entered blocking state
[  202.890763][   T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[  202.898955][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  202.907370][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  202.915952][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  202.924294][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  202.932741][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  202.955978][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  202.963680][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  202.972658][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  202.981353][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  202.990075][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  202.998764][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  203.006960][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  203.015395][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  203.023742][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  203.032184][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  203.040219][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  203.049312][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  203.058621][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  203.066245][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  203.073982][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  203.082540][   T12] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  203.104389][ T7710] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  203.115536][ T7710] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  203.127393][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  203.136707][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  203.146915][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  203.155368][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  203.166939][ T7708] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  203.178665][ T7708] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  203.188577][ T7704] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  203.200605][ T7704] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  203.208200][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  203.216343][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  203.225222][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  203.233428][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  203.257305][ T7710] 8021q: adding VLAN 0 to HW filter on device batadv0
[  203.274976][ T7708] 8021q: adding VLAN 0 to HW filter on device batadv0
[  203.304684][ T7704] 8021q: adding VLAN 0 to HW filter on device batadv0
13:50:48 executing program 3:

13:50:48 executing program 2:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0)
ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f00000000c0)={0x0, 0xffffffffffffff9c})

13:50:49 executing program 5:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc\x00', 0x2000, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syslog(0x0, 0x0, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
r2 = socket$packet(0x11, 0x0, 0x300)
r3 = dup2(0xffffffffffffffff, r2)
openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10)
getsockopt$ARPT_SO_GET_INFO(r1, 0x0, 0x60, &(0x7f0000000200)={'filter\x00'}, &(0x7f0000000080)=0x44)
setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4)
recvmsg(0xffffffffffffffff, 0x0, 0x0)
connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10)
sendmmsg(r1, &(0x7f0000007fc0), 0x2ed75feae06cc8a, 0x0)
ioctl$TCSBRKP(r3, 0x5425, 0x6)
ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000340)=""/181)
ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000))

13:50:49 executing program 1:

13:50:49 executing program 0:

13:50:49 executing program 4:

13:50:49 executing program 3:

13:50:49 executing program 2:

13:50:49 executing program 3:

13:50:49 executing program 0:

13:50:49 executing program 2:

13:50:49 executing program 4:

13:50:49 executing program 1:

13:50:49 executing program 2:

13:50:50 executing program 5:

13:50:50 executing program 0:

13:50:50 executing program 3:

13:50:50 executing program 4:

13:50:50 executing program 1:

13:50:50 executing program 2:

13:50:50 executing program 2:

13:50:50 executing program 4:

13:50:50 executing program 1:

13:50:50 executing program 3:

13:50:50 executing program 0:

13:50:50 executing program 4:

13:50:50 executing program 5:

13:50:50 executing program 0:

13:50:50 executing program 3:

13:50:50 executing program 2:

13:50:50 executing program 4:

13:50:50 executing program 1:

13:50:50 executing program 0:

13:50:50 executing program 2:

13:50:50 executing program 3:

13:50:50 executing program 1:

13:50:50 executing program 4:

13:50:50 executing program 5:
r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000740)='/dev/vfio/vfio\x00', 0x40000, 0x0)
r1 = inotify_init1(0x0)
dup2(r1, r0)

13:50:50 executing program 0:
bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0)
r0 = socket$kcm(0xa, 0x4000000000005, 0x88)
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={<r1=>0x0, <r2=>0x0})
recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)=""/49, 0x31}], 0x10000023, &(0x7f00000002c0)=""/77, 0x4d}, 0x0)
recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00)
sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0)
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r3 = socket$kcm(0x2, 0x2, 0x2)
recvmsg$kcm(0xffffffffffffffff, 0x0, 0x40000162)
bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400, 0x0)
ioctl$TUNSETVNETLE(r4, 0x400454dc, &(0x7f00000003c0)=0x1)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000c00)={0xffffffffffffffff, 0x0, 0x0}, 0x18)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0)
openat$cgroup_ro(r3, 0x0, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000))
bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000280)={0x0, r0}, 0x10)
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
socket$kcm(0x10, 0x2, 0x0)

13:50:50 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_dev$dri(0x0, 0x0, 0x0)
shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffa000/0x4000)=nil)
ioctl$sock_FIOSETOWN(0xffffffffffffffff, 0x8901, 0x0)
clone(0x2902001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
rt_sigtimedwait(&(0x7f0000000040), 0x0, &(0x7f0000000180)={0x0, 0x1c9c380}, 0x8)
r0 = getpid()
rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000100))
ptrace(0x10, r0)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000240)={0x0, 0x9c4}, 0x0)
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, 0x0)
ptrace$pokeuser(0x6, r0, 0x388, 0xfffffffffffffffe)

13:50:50 executing program 1:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14)
dup3(r1, r0, 0x0)

13:50:50 executing program 3:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
semctl$GETPID(0x0, 0x0, 0xb, 0x0)

13:50:50 executing program 2:
request_key(&(0x7f0000000080)='dns_resolver\x00', &(0x7f0000000100)={'syz'}, 0x0, 0xfffffffffffffffc)

13:50:50 executing program 5:

13:50:50 executing program 4:

13:50:50 executing program 2:
clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000000, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x17)
ptrace$cont(0x18, r0, 0x0, 0x0)
ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x80000001, 0x0, 0xab})
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x1f, r0, 0x0, 0x0)

13:50:50 executing program 1:
r0 = socket$unix(0x1, 0x100000000000001, 0x0)
write$P9_RLINK(0xffffffffffffffff, 0x0, 0xfffffffffffffd94)
r1 = socket$unix(0x1, 0x1, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0xff, 0x0)
bind$unix(r1, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
getgid()
listen(r1, 0x0)
pipe(0x0)
r2 = accept4(r1, 0x0, 0x0, 0x0)
connect$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
ioctl$sock_proto_private(0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_QUEUE_SEQ(0xffffffffffffffff, 0x6, 0x15, 0x0, 0x0)
write$binfmt_elf32(r2, 0x0, 0x0)

13:50:50 executing program 5:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$inet6(0xa, 0x0, 0x0)
dup(0xffffffffffffffff)
socket(0x0, 0x0, 0x0)
syz_open_dev$sndtimer(0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e23, @rand_addr=0x3}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x20000003, &(0x7f0000000040)={0x2, 0x1000004e23, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='veth1_to_bond\x00', 0xf)
r1 = memfd_create(&(0x7f0000000200)='Pev ', 0x0)
ftruncate(r1, 0x200739)
sendfile(r0, r1, 0x0, 0xa00004000000000)

13:50:51 executing program 3:
mkdir(&(0x7f00000003c0)='./file0\x00', 0x0)
clone(0xa000010d, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
perf_event_open(&(0x7f0000000000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xa00000000, 0x420000000002}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000000))
r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0x40a85323, &(0x7f0000000400)={{}, 'port0\x00', 0x0, 0x0, 0xfffffffffffffff8, 0x1, 0x0, 0x40})
keyctl$describe(0x6, 0x0, &(0x7f0000000300)=""/181, 0xb5)

13:50:51 executing program 4:

13:50:51 executing program 0:
bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0)
r0 = socket$kcm(0xa, 0x4000000000005, 0x88)
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={<r1=>0x0, <r2=>0x0})
recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000000c0)=""/49, 0x31}], 0x10000023, &(0x7f00000002c0)=""/77, 0x4d}, 0x0)
recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x3f00)
sendmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), 0x47, &(0x7f0000000000)}, 0x0)
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r3 = socket$kcm(0x2, 0x2, 0x2)
recvmsg$kcm(0xffffffffffffffff, 0x0, 0x40000162)
bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x400, 0x0)
ioctl$TUNSETVNETLE(r4, 0x400454dc, &(0x7f00000003c0)=0x1)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000c00)={0xffffffffffffffff, 0x0, 0x0}, 0x18)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0)
ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0)
openat$cgroup_ro(r3, 0x0, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000))
bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000280)={0x0, r0}, 0x10)
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
socket$kcm(0x10, 0x2, 0x0)

13:50:51 executing program 3:

13:50:51 executing program 1:

13:50:51 executing program 4:

13:50:51 executing program 5:

13:50:51 executing program 3:

13:50:51 executing program 4:

13:50:53 executing program 2:

13:50:53 executing program 1:

13:50:53 executing program 5:

13:50:53 executing program 3:

13:50:53 executing program 4:

13:50:53 executing program 0:

13:50:54 executing program 3:

13:50:54 executing program 1:

13:50:54 executing program 4:

13:50:54 executing program 5:

13:50:54 executing program 0:

13:50:54 executing program 2:

13:50:54 executing program 3:

13:50:54 executing program 4:

13:50:54 executing program 0:

13:50:54 executing program 1:

13:50:54 executing program 5:

13:50:54 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070")
unshare(0x400)
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r1, &(0x7f0000000000)=@full={0xb, @dev, @null, 0x0, [@netrom, @bcast, @null, @netrom, @rose, @netrom]}, 0x40)

13:50:54 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000200)='mounts\x00')
sendfile(r0, r0, &(0x7f0000000000)=0x1fffd, 0x800000080000002)

13:50:54 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$alg(0x26, 0x5, 0x0)
bind$alg(0xffffffffffffffff, 0x0, 0x0)
membarrier(0x2, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00')
lsetxattr$security_smack_entry(0x0, &(0x7f0000000040)='security.SMACK64IPIN\x00', 0x0, 0x0, 0x0)
write$evdev(r0, 0x0, 0x0)
write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0)

13:50:54 executing program 4:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000200)='bbr\x00', 0x4)
setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000000)=0x1, 0x4)
connect$inet(r0, &(0x7f0000000180), 0x10)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000006c0)={0x0, 0x7fff, 0x80000001}, 0x14)
shutdown(r0, 0x1)

13:50:54 executing program 1:
r0 = socket(0x10, 0x803, 0x0)
sendto(r0, &(0x7f0000000000)="120000001600e75de28f60424c621e8a48f9", 0x12, 0x0, 0x0, 0x0)

13:50:54 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070")
unshare(0x400)
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r1, &(0x7f0000000000)=@full={0xb, @dev, @null, 0x0, [@netrom, @bcast, @null, @netrom, @rose, @netrom]}, 0x40)

13:50:54 executing program 5:
socket$inet_udplite(0x2, 0x2, 0x88)
socket$caif_seqpacket(0x25, 0x5, 0x0)
socket$inet_dccp(0x2, 0x6, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
write(r1, &(0x7f0000000340), 0x41395527)
shmat(0x0, &(0x7f0000ffb000/0x3000)=nil, 0x0)
ioctl$VIDIOC_S_JPEGCOMP(0xffffffffffffffff, 0x408c563e, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000380)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f0000000040)={0x0, 0x7, 0x4}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x80000001}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1)

13:50:54 executing program 2:
r0 = creat(&(0x7f0000000180)='./file0\x00', 0x0)
write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setrlimit(0x7, &(0x7f0000a9cff8))
socket$packet(0x11, 0x3, 0x300)
link(&(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='./file1\x00')
umount2(&(0x7f0000000080)='./file1\x00', 0x0)

13:50:54 executing program 0:
r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x0)
ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x0)

13:50:54 executing program 4:
r0 = msgget(0x3, 0x0)
msgrcv(r0, 0x0, 0x0, 0x3, 0x0)
msgrcv(r0, 0x0, 0x0, 0x0, 0x0)

13:50:54 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070")
unshare(0x400)
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r1, &(0x7f0000000000)=@full={0xb, @dev, @null, 0x0, [@netrom, @bcast, @null, @netrom, @rose, @netrom]}, 0x40)

13:50:54 executing program 1:
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0)

13:50:54 executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00'})
sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="000000000000000008001a0000000a00"], 0x1}}, 0x0)

13:50:54 executing program 2:
r0 = creat(&(0x7f0000000180)='./file0\x00', 0x0)
write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setrlimit(0x7, &(0x7f0000a9cff8))
socket$packet(0x11, 0x3, 0x300)
link(&(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='./file1\x00')
umount2(&(0x7f0000000080)='./file1\x00', 0x0)

13:50:54 executing program 4:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00003dd000)='/dev/ppp\x00', 0x0, 0x0)
ioctl$EVIOCGPROP(r0, 0x40047438, &(0x7f0000000180)=""/246)

13:50:54 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070")
unshare(0x400)
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r1, &(0x7f0000000000)=@full={0xb, @dev, @null, 0x0, [@netrom, @bcast, @null, @netrom, @rose, @netrom]}, 0x40)

13:50:54 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00')
sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f00000001c0)={0x0, 0x60, &(0x7f0000000180)={&(0x7f0000000100)={0x30, r1, 0x825, 0x0, 0x0, {{}, 0x0, 0x410c, 0x0, {0x14, 0x14, 'broadcast-link\x02'}}}, 0x30}}, 0x0)

13:50:54 executing program 0:
r0 = gettid()
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
timer_create(0x0, &(0x7f0000000280)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000200))
futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0)
futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
tkill(r0, 0x1000000000016)

13:50:55 executing program 5:
socket$inet_udplite(0x2, 0x2, 0x88)
socket$caif_seqpacket(0x25, 0x5, 0x0)
socket$inet_dccp(0x2, 0x6, 0x0)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
write(r1, &(0x7f0000000340), 0x41395527)
shmat(0x0, &(0x7f0000ffb000/0x3000)=nil, 0x0)
ioctl$VIDIOC_S_JPEGCOMP(0xffffffffffffffff, 0x408c563e, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000380)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f0000000040)={0x0, 0x7, 0x4}, 0x0, &(0x7f0000000140)={0x1b7, 0x0, 0x0, 0x0, 0x80000001}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1)

13:50:55 executing program 1:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x2, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)=0x19)
write$binfmt_misc(r0, 0x0, 0x0)

13:50:55 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070")
unshare(0x400)
connect$rose(0xffffffffffffffff, &(0x7f0000000000)=@full={0xb, @dev, @null, 0x0, [@netrom, @bcast, @null, @netrom, @rose, @netrom]}, 0x40)

13:50:55 executing program 4:
setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x0, 0x0, 0x400}, 0x10)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0)
r1 = openat$cgroup_int(r0, &(0x7f0000000100)='memory.high\x00', 0x2, 0x0)
writev(r1, &(0x7f0000000700), 0x1000000000000110)
sendfile(r1, r1, 0x0, 0x7)

13:50:55 executing program 0:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
lsetxattr$trusted_overlay_nlink(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='trusted.overlay.nlink\x00', &(0x7f0000000280)={'U-', 0xfffffffffffffffe}, 0x28, 0x0)
setxattr$trusted_overlay_nlink(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.nlink\x00', &(0x7f0000000180)={'L+', 0x687}, 0x28, 0x0)

13:50:55 executing program 2:
r0 = creat(&(0x7f0000000180)='./file0\x00', 0x0)
write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setrlimit(0x7, &(0x7f0000a9cff8))
socket$packet(0x11, 0x3, 0x300)
link(&(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='./file1\x00')
umount2(&(0x7f0000000080)='./file1\x00', 0x0)

13:50:55 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070")
unshare(0x400)
connect$rose(0xffffffffffffffff, &(0x7f0000000000)=@full={0xb, @dev, @null, 0x0, [@netrom, @bcast, @null, @netrom, @rose, @netrom]}, 0x40)

13:50:55 executing program 1:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f00000001c0)=@abs={0x1}, 0x6e)

13:50:55 executing program 0:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
lsetxattr$trusted_overlay_nlink(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='trusted.overlay.nlink\x00', &(0x7f0000000280)={'U-', 0xfffffffffffffffe}, 0x28, 0x0)
setxattr$trusted_overlay_nlink(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.nlink\x00', &(0x7f0000000180)={'L+', 0x687}, 0x28, 0x0)

13:50:55 executing program 2:
r0 = creat(&(0x7f0000000180)='./file0\x00', 0x0)
write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
clone(0x2100001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
connect$inet6(0xffffffffffffffff, 0x0, 0x0)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setrlimit(0x7, &(0x7f0000a9cff8))
socket$packet(0x11, 0x3, 0x300)
link(&(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='./file1\x00')
umount2(&(0x7f0000000080)='./file1\x00', 0x0)

13:50:55 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070")
unshare(0x400)
connect$rose(0xffffffffffffffff, &(0x7f0000000000)=@full={0xb, @dev, @null, 0x0, [@netrom, @bcast, @null, @netrom, @rose, @netrom]}, 0x40)

[  211.346103][ T8104] ==================================================================
[  211.354331][ T8104] BUG: KASAN: null-ptr-deref in reclaim_high.constprop.0+0xa6/0x1e0
[  211.362306][ T8104] Read of size 8 at addr 0000000000000138 by task syz-executor4/8104
[  211.370353][ T8104] 
[  211.372681][ T8104] CPU: 1 PID: 8104 Comm: syz-executor4 Not tainted 5.0.0-rc4-next-20190130 #22
[  211.381608][ T8104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  211.392166][ T8104] Call Trace:
[  211.395468][ T8104]  dump_stack+0x1db/0x2d0
[  211.399805][ T8104]  ? dump_stack_print_info.cold+0x20/0x20
[  211.405526][ T8104]  ? reclaim_high.constprop.0+0xa6/0x1e0
[  211.411176][ T8104]  ? vprintk_func+0x86/0x189
[  211.415767][ T8104]  ? reclaim_high.constprop.0+0xa6/0x1e0
[  211.421396][ T8104]  ? reclaim_high.constprop.0+0xa6/0x1e0
[  211.427025][ T8104]  kasan_report.cold+0x5/0x40
[  211.431698][ T8104]  ? check_preemption_disabled+0x20/0x290
[  211.437413][ T8104]  ? reclaim_high.constprop.0+0xa6/0x1e0
[  211.443054][ T8104]  check_memory_region+0x123/0x190
[  211.448167][ T8104]  kasan_check_read+0x11/0x20
[  211.452850][ T8104]  reclaim_high.constprop.0+0xa6/0x1e0
[  211.458306][ T8104]  ? lockdep_hardirqs_on+0x418/0x5d0
[  211.463586][ T8104]  ? memcg_oom_wake_function+0x6b0/0x6b0
[  211.469219][ T8104]  ? syscall_return_slowpath+0x519/0x5f0
[  211.474850][ T8104]  ? trace_hardirqs_off_caller+0x300/0x300
[  211.480665][ T8104]  ? lockdep_hardirqs_on+0x418/0x5d0
[  211.485957][ T8104]  mem_cgroup_handle_over_high+0xc1/0x180
[  211.491679][ T8104]  exit_to_usermode_loop+0x299/0x3b0
13:50:55 executing program 1:
r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x7, 0x2)
write$evdev(r0, &(0x7f000004d000)=[{{}, 0x0, 0x1}], 0x18)

[  211.496968][ T8104]  ? ret_from_fork+0x15/0x50
[  211.501563][ T8104]  ? syscall_trace_enter+0x12a0/0x12a0
[  211.507047][ T8104]  ? _raw_spin_unlock_irq+0x28/0x90
[  211.512244][ T8104]  ? lockdep_hardirqs_on+0x418/0x5d0
[  211.517533][ T8104]  syscall_return_slowpath+0x519/0x5f0
[  211.523122][ T8104]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  211.528858][ T8104]  ? __switch_to_asm+0x34/0x70
[  211.533621][ T8104]  ? _raw_spin_unlock_irq+0x5e/0x90
[  211.538837][ T8104]  ret_from_fork+0x15/0x50
[  211.543245][ T8104] RIP: 0033:0x45aa59
[  211.543261][ T8104] Code: ff 48 85 f6 0f 84 97 8d fb ff 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 0f 8c 6e 8d fb ff 74 01 c3 31 ed 48 f7 c7 00 00 01 00 75
[  211.543269][ T8104] RSP: 002b:00007f69eb7abdb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000038
[  211.543286][ T8104] RAX: 0000000000000000 RBX: 00007f69eb7ac700 RCX: 000000000045aa59
[  211.543294][ T8104] RDX: 00007f69eb7ac9d0 RSI: 00007f69eb7abdb0 RDI: 00000000003d0f00
[  211.543301][ T8104] RBP: 00007ffcaba541f0 R08: 00007f69eb7ac700 R09: 00007f69eb7ac700
[  211.543307][ T8104] R10: 00007f69eb7ac9d0 R11: 0000000000000202 R12: 0000000000000000
[  211.543314][ T8104] R13: 00007ffcaba5409f R14: 00007f69eb7ac9c0 R15: 0000000000000002
[  211.543330][ T8104] ==================================================================
[  211.543333][ T8104] Disabling lock debugging due to kernel taint
[  211.551304][ T8104] Kernel panic - not syncing: panic_on_warn set ...
[  211.579231][ T3865] kobject: 'loop2' (00000000d6a7bb17): fill_kobj_path: path = '/devices/virtual/block/loop2'
[  211.583319][ T8104] CPU: 1 PID: 8104 Comm: syz-executor4 Tainted: G    B             5.0.0-rc4-next-20190130 #22
[  211.583326][ T8104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  211.583335][ T8104] Call Trace:
[  211.594599][ T3865] kobject: 'loop0' (00000000f908d045): kobject_uevent_env
[  211.599248][ T8104]  dump_stack+0x1db/0x2d0
[  211.599265][ T8104]  ? dump_stack_print_info.cold+0x20/0x20
[  211.599290][ T8104]  panic+0x2cb/0x65c
[  211.607280][ T3865] kobject: 'loop0' (00000000f908d045): fill_kobj_path: path = '/devices/virtual/block/loop0'
[  211.615306][ T8104]  ? add_taint.cold+0x16/0x16
[  211.615321][ T8104]  ? reclaim_high.constprop.0+0xa6/0x1e0
[  211.615332][ T8104]  ? preempt_schedule+0x4b/0x60
[  211.615344][ T8104]  ? ___preempt_schedule+0x16/0x18
[  211.615356][ T8104]  ? trace_hardirqs_on+0xb4/0x310
[  211.615369][ T8104]  ? reclaim_high.constprop.0+0xa6/0x1e0
[  211.615387][ T8104]  end_report+0x47/0x4f
[  211.650010][ T3865] kobject: 'loop3' (00000000a86466cc): kobject_uevent_env
[  211.656547][ T8104]  ? reclaim_high.constprop.0+0xa6/0x1e0
[  211.656567][ T8104]  kasan_report.cold+0xe/0x40
[  211.694881][ T3865] kobject: 'loop3' (00000000a86466cc): fill_kobj_path: path = '/devices/virtual/block/loop3'
[  211.700968][ T8104]  ? check_preemption_disabled+0x20/0x290
[  211.700982][ T8104]  ? reclaim_high.constprop.0+0xa6/0x1e0
[  211.700996][ T8104]  check_memory_region+0x123/0x190
[  211.701009][ T8104]  kasan_check_read+0x11/0x20
[  211.701025][ T8104]  reclaim_high.constprop.0+0xa6/0x1e0
[  211.789922][ T8104]  ? lockdep_hardirqs_on+0x418/0x5d0
[  211.795185][ T8104]  ? memcg_oom_wake_function+0x6b0/0x6b0
[  211.800793][ T8104]  ? syscall_return_slowpath+0x519/0x5f0
[  211.806409][ T8104]  ? trace_hardirqs_off_caller+0x300/0x300
[  211.812193][ T8104]  ? lockdep_hardirqs_on+0x418/0x5d0
[  211.817453][ T8104]  mem_cgroup_handle_over_high+0xc1/0x180
[  211.823148][ T8104]  exit_to_usermode_loop+0x299/0x3b0
[  211.828418][ T8104]  ? ret_from_fork+0x15/0x50
[  211.832994][ T8104]  ? syscall_trace_enter+0x12a0/0x12a0
[  211.838435][ T8104]  ? _raw_spin_unlock_irq+0x28/0x90
[  211.843618][ T8104]  ? lockdep_hardirqs_on+0x418/0x5d0
[  211.848892][ T8104]  syscall_return_slowpath+0x519/0x5f0
[  211.854346][ T8104]  ? prepare_exit_to_usermode+0x3b0/0x3b0
[  211.860054][ T8104]  ? __switch_to_asm+0x34/0x70
[  211.864800][ T8104]  ? _raw_spin_unlock_irq+0x5e/0x90
[  211.869987][ T8104]  ret_from_fork+0x15/0x50
[  211.874375][ T8104] RIP: 0033:0x45aa59
[  211.878252][ T8104] Code: ff 48 85 f6 0f 84 97 8d fb ff 48 83 ee 10 48 89 4e 08 48 89 3e 48 89 d7 4c 89 c2 4d 89 c8 4c 8b 54 24 08 b8 38 00 00 00 0f 05 <48> 85 c0 0f 8c 6e 8d fb ff 74 01 c3 31 ed 48 f7 c7 00 00 01 00 75
[  211.897837][ T8104] RSP: 002b:00007f69eb7abdb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000038
[  211.906221][ T8104] RAX: 0000000000000000 RBX: 00007f69eb7ac700 RCX: 000000000045aa59
[  211.914170][ T8104] RDX: 00007f69eb7ac9d0 RSI: 00007f69eb7abdb0 RDI: 00000000003d0f00
[  211.922117][ T8104] RBP: 00007ffcaba541f0 R08: 00007f69eb7ac700 R09: 00007f69eb7ac700
[  211.930064][ T8104] R10: 00007f69eb7ac9d0 R11: 0000000000000202 R12: 0000000000000000
[  211.938009][ T8104] R13: 00007ffcaba5409f R14: 00007f69eb7ac9c0 R15: 0000000000000002
[  211.947236][ T8104] Kernel Offset: disabled
[  211.951555][ T8104] Rebooting in 86400 seconds..