[ 38.015099][ T25] audit: type=1800 audit(1572003359.561:25): pid=6982 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2447 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 38.150451][ T25] audit: type=1800 audit(1572003359.691:26): pid=6982 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2490 res=0 [ 38.203353][ T25] audit: type=1800 audit(1572003359.751:27): pid=6982 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="restorecond" dev="sda1" ino=2469 res=0 [ 38.526558][ T7076] sshd (7076) used greatest stack depth: 10136 bytes left [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.126' (ECDSA) to the list of known hosts. 2019/10/25 11:36:09 fuzzer started 2019/10/25 11:36:10 dialing manager at 10.128.0.105:33971 2019/10/25 11:36:10 syscalls: 2529 2019/10/25 11:36:10 code coverage: enabled 2019/10/25 11:36:10 comparison tracing: enabled 2019/10/25 11:36:10 extra coverage: extra coverage is not supported by the kernel 2019/10/25 11:36:10 setuid sandbox: enabled 2019/10/25 11:36:10 namespace sandbox: enabled 2019/10/25 11:36:10 Android sandbox: /sys/fs/selinux/policy does not exist 2019/10/25 11:36:10 fault injection: enabled 2019/10/25 11:36:10 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/10/25 11:36:10 net packet injection: enabled 2019/10/25 11:36:10 net device setup: enabled 2019/10/25 11:36:10 concurrency sanitizer: enabled 2019/10/25 11:36:12 adding functions to KCSAN blacklist: 'tomoyo_supervisor' 'run_timer_softirq' 'ext4_free_inodes_count' '__tcp_select_window' 'tcp_add_backlog' '__hrtimer_run_queues' 'generic_permission' 'find_next_bit' 11:36:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setitimer(0x1, &(0x7f0000000000)={{0x0, 0x7530}, {0x0, 0x7530}}, 0x0) getitimer(0x1, &(0x7f0000000080)) syzkaller login: [ 52.712169][ T7150] IPVS: ftp: loaded support on port[0] = 21 11:36:14 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000000)="6664a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c92465e52d3fbf03", 0x3e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 52.815227][ T7150] chnl_net:caif_netlink_parms(): no params data found [ 52.903121][ T7150] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.910289][ T7150] bridge0: port 1(bridge_slave_0) entered disabled state [ 52.932355][ T7150] device bridge_slave_0 entered promiscuous mode [ 52.940001][ T7150] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.947339][ T7150] bridge0: port 2(bridge_slave_1) entered disabled state [ 52.956366][ T7150] device bridge_slave_1 entered promiscuous mode [ 52.998707][ T7150] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 53.022270][ T7150] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 11:36:14 executing program 2: sendmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000240007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1", 0x39}], 0x1}, 0x0) writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)="39000000130009006900000000000006ab0080481e000000460001070000001419000a00", 0x24}], 0x1) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl(r1, 0x1000008912, &(0x7f0000000080)="11dca50d5e0bcfe47bf070") [ 53.054171][ T7153] IPVS: ftp: loaded support on port[0] = 21 [ 53.071440][ T7150] team0: Port device team_slave_0 added [ 53.082978][ T7150] team0: Port device team_slave_1 added [ 53.174396][ T7150] device hsr_slave_0 entered promiscuous mode [ 53.230934][ T7150] device hsr_slave_1 entered promiscuous mode [ 53.319421][ T7155] IPVS: ftp: loaded support on port[0] = 21 11:36:14 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x200000000000df8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) r0 = socket$rds(0x15, 0x5, 0x0) r1 = io_uring_setup(0xa4, &(0x7f0000000100)) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f0000000280)=[r0], 0x35b) [ 53.469724][ T7150] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.476834][ T7150] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.484240][ T7150] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.491363][ T7150] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.681973][ T7153] chnl_net:caif_netlink_parms(): no params data found [ 53.812804][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 53.841082][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 53.913437][ T7150] 8021q: adding VLAN 0 to HW filter on device bond0 [ 54.000439][ T7150] 8021q: adding VLAN 0 to HW filter on device team0 [ 54.031202][ T7153] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.038309][ T7153] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.081993][ T7153] device bridge_slave_0 entered promiscuous mode [ 54.101397][ T7153] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.108568][ T7153] bridge0: port 2(bridge_slave_1) entered disabled state [ 54.151643][ T7153] device bridge_slave_1 entered promiscuous mode [ 54.182482][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 54.190516][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 54.257904][ T7153] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 54.302461][ T7184] IPVS: ftp: loaded support on port[0] = 21 [ 54.302500][ T7153] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 54.344296][ T7153] team0: Port device team_slave_0 added [ 54.350176][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 54.391618][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 54.400377][ T7175] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.407555][ T7175] bridge0: port 1(bridge_slave_0) entered forwarding state [ 54.471393][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 54.501302][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready 11:36:16 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_STATS(r0, 0x80f86406, &(0x7f00000001c0)=""/181) [ 54.530972][ T7175] bridge0: port 2(bridge_slave_1) entered blocking state [ 54.538093][ T7175] bridge0: port 2(bridge_slave_1) entered forwarding state [ 54.586475][ T7153] team0: Port device team_slave_1 added [ 54.653726][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 54.663739][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 54.712106][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 54.743011][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 54.772230][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 54.803316][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 54.843781][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 54.872147][ T7155] chnl_net:caif_netlink_parms(): no params data found [ 54.974956][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 55.002168][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 55.103768][ T7153] device hsr_slave_0 entered promiscuous mode [ 55.140967][ T7153] device hsr_slave_1 entered promiscuous mode [ 55.180611][ T7153] debugfs: Directory 'hsr0' with parent '/' already present! [ 55.198072][ T7150] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 55.270709][ T7150] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 55.288213][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 55.311700][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 55.427682][ T7188] IPVS: ftp: loaded support on port[0] = 21 [ 55.463880][ T7150] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.495012][ T7155] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.512959][ T7155] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.577042][ T7155] device bridge_slave_0 entered promiscuous mode [ 55.682528][ T7155] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.689592][ T7155] bridge0: port 2(bridge_slave_1) entered disabled state 11:36:17 executing program 5: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) [ 55.729773][ T7155] device bridge_slave_1 entered promiscuous mode [ 55.854195][ T7155] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.961034][ T7155] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.990348][ T7184] chnl_net:caif_netlink_parms(): no params data found [ 56.049666][ T7155] team0: Port device team_slave_0 added [ 56.152116][ T7155] team0: Port device team_slave_1 added [ 56.356049][ T7184] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.369046][ T7223] IPVS: ftp: loaded support on port[0] = 21 [ 56.382547][ T7184] bridge0: port 1(bridge_slave_0) entered disabled state [ 56.407950][ T7184] device bridge_slave_0 entered promiscuous mode [ 56.445322][ T7153] 8021q: adding VLAN 0 to HW filter on device bond0 11:36:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setitimer(0x1, &(0x7f0000000000)={{0x0, 0x7530}, {0x0, 0x7530}}, 0x0) getitimer(0x1, &(0x7f0000000080)) [ 56.523748][ T7155] device hsr_slave_0 entered promiscuous mode [ 56.554303][ T7155] device hsr_slave_1 entered promiscuous mode [ 56.600593][ T7155] debugfs: Directory 'hsr0' with parent '/' already present! [ 56.618897][ T7184] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.668411][ T7184] bridge0: port 2(bridge_slave_1) entered disabled state [ 56.723945][ T7184] device bridge_slave_1 entered promiscuous mode [ 56.736608][ T7153] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.819866][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 56.842751][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 56.933678][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 56.950394][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 56.979337][ T7175] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.986479][ T7175] bridge0: port 1(bridge_slave_0) entered forwarding state [ 57.040812][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 57.077790][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready 11:36:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setitimer(0x1, &(0x7f0000000000)={{0x0, 0x7530}, {0x0, 0x7530}}, 0x0) getitimer(0x1, &(0x7f0000000080)) [ 57.119009][ T7175] bridge0: port 2(bridge_slave_1) entered blocking state [ 57.126153][ T7175] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.221340][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 57.271818][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 57.321739][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 57.374368][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 57.401910][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 57.454646][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 57.500446][ T7153] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 57.543561][ T7153] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 57.594197][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 57.624673][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 57.673755][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready 11:36:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setitimer(0x1, &(0x7f0000000000)={{0x0, 0x7530}, {0x0, 0x7530}}, 0x0) getitimer(0x1, &(0x7f0000000080)) [ 57.727594][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 57.779727][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 57.834581][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 57.897341][ T7184] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 57.944168][ T7188] chnl_net:caif_netlink_parms(): no params data found [ 57.971490][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 57.987744][ T7153] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 58.075816][ T7184] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 58.286597][ T7184] team0: Port device team_slave_0 added [ 58.336491][ T7155] 8021q: adding VLAN 0 to HW filter on device bond0 11:36:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setitimer(0x1, &(0x7f0000000000)={{0x0, 0x7530}, {0x0, 0x7530}}, 0x0) getitimer(0x1, &(0x7f0000000080)) [ 58.381681][ T7184] team0: Port device team_slave_1 added [ 58.387526][ T7188] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.420402][ T7188] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.464269][ T7188] device bridge_slave_0 entered promiscuous mode [ 58.583867][ T7155] 8021q: adding VLAN 0 to HW filter on device team0 [ 58.618262][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 58.645138][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 58.672395][ T7188] bridge0: port 2(bridge_slave_1) entered blocking state [ 58.679468][ T7188] bridge0: port 2(bridge_slave_1) entered disabled state [ 58.736677][ T7188] device bridge_slave_1 entered promiscuous mode [ 58.790256][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 58.811592][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 58.825351][ T7175] bridge0: port 1(bridge_slave_0) entered blocking state [ 58.832452][ T7175] bridge0: port 1(bridge_slave_0) entered forwarding state 11:36:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setitimer(0x1, &(0x7f0000000000)={{0x0, 0x7530}, {0x0, 0x7530}}, 0x0) getitimer(0x1, &(0x7f0000000080)) [ 58.938233][ T7184] device hsr_slave_0 entered promiscuous mode [ 58.984230][ T7184] device hsr_slave_1 entered promiscuous mode [ 59.024636][ T7184] debugfs: Directory 'hsr0' with parent '/' already present! [ 59.086312][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 59.107120][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 59.140135][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 59.178214][ T7175] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.185350][ T7175] bridge0: port 2(bridge_slave_1) entered forwarding state [ 59.216105][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 59.240258][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 59.265676][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 59.301457][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 59.339416][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 59.359199][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 59.386309][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 59.408089][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 59.483117][ T7155] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 59.536685][ T7155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 59.578572][ T7223] chnl_net:caif_netlink_parms(): no params data found [ 59.632148][ T7188] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.677843][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 59.690290][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 59.727962][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 59.769967][ T7188] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.818079][ T7155] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 59.926916][ T7188] team0: Port device team_slave_0 added [ 59.975872][ T7188] team0: Port device team_slave_1 added [ 60.028130][ T7184] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.067352][ T7223] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.080170][ T7223] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.114088][ T7223] device bridge_slave_0 entered promiscuous mode [ 60.146905][ T7223] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.161925][ T7223] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.180244][ T7223] device bridge_slave_1 entered promiscuous mode [ 60.265980][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 60.281712][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 60.323963][ T7188] device hsr_slave_0 entered promiscuous mode [ 60.350950][ T7188] device hsr_slave_1 entered promiscuous mode [ 60.430617][ T7188] debugfs: Directory 'hsr0' with parent '/' already present! [ 60.444354][ T7184] 8021q: adding VLAN 0 to HW filter on device team0 [ 60.478056][ T7223] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 60.567139][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 60.585728][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 60.615625][ T3007] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.622737][ T3007] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.696854][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 60.726528][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 60.777060][ T3007] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.784186][ T3007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.831264][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 60.847614][ T7223] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 60.891515][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 60.900324][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 60.998674][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 61.036063][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 61.079472][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 61.126641][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 61.173932][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 61.246185][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 61.271594][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 61.301176][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 61.346918][ T7184] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 61.419850][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 61.476120][ T7184] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 61.496908][ T7223] team0: Port device team_slave_0 added 11:36:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setitimer(0x1, &(0x7f0000000000)={{0x0, 0x7530}, {0x0, 0x7530}}, 0x0) getitimer(0x1, &(0x7f0000000080)) [ 61.606374][ T7223] team0: Port device team_slave_1 added [ 61.764956][ T7188] 8021q: adding VLAN 0 to HW filter on device bond0 [ 61.825809][ T7344] netlink: 'syz-executor.2': attribute type 10 has an invalid length. [ 61.883467][ T7344] bond0: (slave bond_slave_0): Releasing backup interface 11:36:23 executing program 0: getsockname(0xffffffffffffffff, &(0x7f0000000300)=@generic, &(0x7f0000000280)=0x80) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r3 = socket$alg(0x26, 0x5, 0x0) accept4(r3, 0x0, 0x0, 0x0) ioctl$UI_DEV_CREATE(r2, 0x5501) ioctl$TIOCNOTTY(0xffffffffffffffff, 0x5422) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000480), 0x80000) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={0x0, @remote, @empty}, &(0x7f0000000100)=0xc) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001d00)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f0000000580)=[{0x0}, {0x0}], 0x2, &(0x7f0000001a80)=[@ip_tos_u8={{0x11}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4}}], 0x30}}, {{&(0x7f00000005c0)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10, &(0x7f0000001c00)=[{&(0x7f0000001b00)="10837532cf3afe8d3aded6e13cddc3267759d6e326e92da7608298cbe82693d6f6150cb5a6d9e14ed87252e6d816c0baf8a0a89ee48c8e58958e831d4ee29adde715053afdd3c080adcf9cc9b4bd4bebb6185327a157cbbb1e54ea7905b92867bdfc6031b9c98b551efd759633bc1a436ca531b07473ef77a6f33dbcc80070202ccdea27e2dbf96fbc6dedf2fd426ffb08afb05588358814c918e1013e3780703c3940ce8cbf3b07bfa6c8415f3ccd138f80ef42a4bb8e578a43389d850426f6e8ea1188fb89c8eb4efa267d6dd6c8", 0xcf}], 0x1, &(0x7f0000000180)=[@ip_retopts={{0x60, 0x0, 0x7, {[@timestamp={0x44, 0x8, 0x0, 0x1, 0xc, [{[], 0x2}]}, @rr={0x7, 0xf, 0x0, [@empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1]}, @timestamp={0x44, 0xc, 0x98, 0x0, 0xe, [{[@remote]}]}, @ra={0x94, 0x6, 0x96}, @generic={0x88, 0x7, "dec89f3ec9"}, @ssrr={0x89, 0x1f, 0x1, [@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, @dev={0xac, 0x14, 0x14, 0x20}, @empty, @rand_addr, @remote, @multicast1]}]}}}], 0x60}}], 0x3, 0x8000) ioctl$SCSI_IOCTL_SYNC(0xffffffffffffffff, 0x4) r4 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000800)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d6", 0x1fe) sendfile(r1, r4, 0x0, 0x7fffffa7) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000900), 0xfffffcec) sendfile(r5, r1, 0x0, 0xffffffff) ioctl$sock_netdev_private(0xffffffffffffffff, 0x89fa, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) mmap(&(0x7f0000a05000/0x400000)=nil, 0x400300, 0x1000002, 0x10, 0xffffffffffffffff, 0x0) 11:36:23 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000000)="6664a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c92465e52d3fbf03", 0x3e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 62.343730][ T7223] device hsr_slave_0 entered promiscuous mode [ 62.359554][ T25] kauditd_printk_skb: 3 callbacks suppressed [ 62.359626][ T25] audit: type=1800 audit(1572003383.901:31): pid=7352 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=16523 res=0 [ 62.391897][ T25] audit: type=1804 audit(1572003383.921:32): pid=7352 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir052723446/syzkaller.hgG3Fs/7/file0/file0" dev="sda1" ino=16523 res=1 [ 62.452008][ T7223] device hsr_slave_1 entered promiscuous mode [ 62.458665][ T25] audit: type=1804 audit(1572003383.971:33): pid=7356 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir052723446/syzkaller.hgG3Fs/7/file0/file0" dev="sda1" ino=16523 res=1 [ 62.491823][ C1] hrtimer: interrupt took 46689 ns [ 62.510621][ T7223] debugfs: Directory 'hsr0' with parent '/' already present! [ 62.676800][ T7188] 8021q: adding VLAN 0 to HW filter on device team0 [ 62.735160][ T25] audit: type=1804 audit(1572003384.081:34): pid=7352 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir052723446/syzkaller.hgG3Fs/7/file0/file0" dev="sda1" ino=16523 res=1 [ 62.771590][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 62.779562][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 62.852920][ T7359] netlink: 'syz-executor.2': attribute type 10 has an invalid length. [ 62.903946][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 62.971628][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 62.980269][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.987381][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 63.171417][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 63.180163][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 63.291058][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 63.298125][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 63.478212][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 63.521393][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 63.642074][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 63.731752][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 63.804651][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 63.861969][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 63.911571][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 63.922001][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 63.961803][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 64.005727][ T7188] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 64.051971][ T7188] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 64.101391][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 64.114099][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 64.161601][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 64.199760][ T7188] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.389093][ T7223] 8021q: adding VLAN 0 to HW filter on device bond0 [ 64.442218][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 64.456300][ T3007] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 64.491573][ T7223] 8021q: adding VLAN 0 to HW filter on device team0 [ 64.542541][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 64.552023][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 64.560497][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.567582][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.650937][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 64.659024][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 64.706016][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 64.735618][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.742724][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.776832][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 64.807442][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 64.846555][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 64.855907][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 64.893677][ T7223] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 64.930611][ T7223] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 64.966132][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 64.975547][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 65.011685][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 65.050885][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 65.059498][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 65.091791][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 65.100385][ T7175] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 65.140363][ T7223] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.165328][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 11:36:26 executing program 2: sendmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000240007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1", 0x39}], 0x1}, 0x0) writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)="39000000130009006900000000000006ab0080481e000000460001070000001419000a00", 0x24}], 0x1) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl(r1, 0x1000008912, &(0x7f0000000080)="11dca50d5e0bcfe47bf070") 11:36:26 executing program 0: getsockname(0xffffffffffffffff, &(0x7f0000000300)=@generic, &(0x7f0000000280)=0x80) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r3 = socket$alg(0x26, 0x5, 0x0) accept4(r3, 0x0, 0x0, 0x0) ioctl$UI_DEV_CREATE(r2, 0x5501) ioctl$TIOCNOTTY(0xffffffffffffffff, 0x5422) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000480), 0x80000) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={0x0, @remote, @empty}, &(0x7f0000000100)=0xc) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001d00)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f0000000580)=[{0x0}, {0x0}], 0x2, &(0x7f0000001a80)=[@ip_tos_u8={{0x11}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4}}], 0x30}}, {{&(0x7f00000005c0)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10, &(0x7f0000001c00)=[{&(0x7f0000001b00)="10837532cf3afe8d3aded6e13cddc3267759d6e326e92da7608298cbe82693d6f6150cb5a6d9e14ed87252e6d816c0baf8a0a89ee48c8e58958e831d4ee29adde715053afdd3c080adcf9cc9b4bd4bebb6185327a157cbbb1e54ea7905b92867bdfc6031b9c98b551efd759633bc1a436ca531b07473ef77a6f33dbcc80070202ccdea27e2dbf96fbc6dedf2fd426ffb08afb05588358814c918e1013e3780703c3940ce8cbf3b07bfa6c8415f3ccd138f80ef42a4bb8e578a43389d850426f6e8ea1188fb89c8eb4efa267d6dd6c8", 0xcf}], 0x1, &(0x7f0000000180)=[@ip_retopts={{0x60, 0x0, 0x7, {[@timestamp={0x44, 0x8, 0x0, 0x1, 0xc, [{[], 0x2}]}, @rr={0x7, 0xf, 0x0, [@empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1]}, @timestamp={0x44, 0xc, 0x98, 0x0, 0xe, [{[@remote]}]}, @ra={0x94, 0x6, 0x96}, @generic={0x88, 0x7, "dec89f3ec9"}, @ssrr={0x89, 0x1f, 0x1, [@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, @dev={0xac, 0x14, 0x14, 0x20}, @empty, @rand_addr, @remote, @multicast1]}]}}}], 0x60}}], 0x3, 0x8000) ioctl$SCSI_IOCTL_SYNC(0xffffffffffffffff, 0x4) r4 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000800)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d6", 0x1fe) sendfile(r1, r4, 0x0, 0x7fffffa7) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000900), 0xfffffcec) sendfile(r5, r1, 0x0, 0xffffffff) ioctl$sock_netdev_private(0xffffffffffffffff, 0x89fa, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) mmap(&(0x7f0000a05000/0x400000)=nil, 0x400300, 0x1000002, 0x10, 0xffffffffffffffff, 0x0) [ 65.381227][ T7417] netlink: 'syz-executor.2': attribute type 10 has an invalid length. [ 65.435373][ T25] audit: type=1800 audit(1572003386.981:35): pid=7420 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=16545 res=0 [ 65.625636][ T25] audit: type=1804 audit(1572003387.171:36): pid=7414 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir052723446/syzkaller.hgG3Fs/8/file0/file0" dev="sda1" ino=16545 res=1 [ 65.830712][ T25] audit: type=1804 audit(1572003387.251:37): pid=7420 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir052723446/syzkaller.hgG3Fs/8/file0/file0" dev="sda1" ino=16545 res=1 [ 66.018443][ T25] audit: type=1804 audit(1572003387.461:38): pid=7426 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir055951220/syzkaller.rDmoeR/0/bus" dev="sda1" ino=16541 res=1 [ 66.206751][ T25] audit: type=1804 audit(1572003387.521:39): pid=7429 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir055951220/syzkaller.rDmoeR/0/bus" dev="sda1" ino=16541 res=1 [ 66.596271][ T25] audit: type=1804 audit(1572003388.141:40): pid=7429 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir055951220/syzkaller.rDmoeR/0/bus" dev="sda1" ino=16541 res=1 11:36:28 executing program 2: sendmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000240007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1", 0x39}], 0x1}, 0x0) writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)="39000000130009006900000000000006ab0080481e000000460001070000001419000a00", 0x24}], 0x1) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl(r1, 0x1000008912, &(0x7f0000000080)="11dca50d5e0bcfe47bf070") 11:36:28 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x200000000000df8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) r0 = socket$rds(0x15, 0x5, 0x0) r1 = io_uring_setup(0xa4, &(0x7f0000000100)) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f0000000280)=[r0], 0x35b) 11:36:28 executing program 0: getsockname(0xffffffffffffffff, &(0x7f0000000300)=@generic, &(0x7f0000000280)=0x80) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r3 = socket$alg(0x26, 0x5, 0x0) accept4(r3, 0x0, 0x0, 0x0) ioctl$UI_DEV_CREATE(r2, 0x5501) ioctl$TIOCNOTTY(0xffffffffffffffff, 0x5422) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000480), 0x80000) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={0x0, @remote, @empty}, &(0x7f0000000100)=0xc) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001d00)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f0000000580)=[{0x0}, {0x0}], 0x2, &(0x7f0000001a80)=[@ip_tos_u8={{0x11}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4}}], 0x30}}, {{&(0x7f00000005c0)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10, &(0x7f0000001c00)=[{&(0x7f0000001b00)="10837532cf3afe8d3aded6e13cddc3267759d6e326e92da7608298cbe82693d6f6150cb5a6d9e14ed87252e6d816c0baf8a0a89ee48c8e58958e831d4ee29adde715053afdd3c080adcf9cc9b4bd4bebb6185327a157cbbb1e54ea7905b92867bdfc6031b9c98b551efd759633bc1a436ca531b07473ef77a6f33dbcc80070202ccdea27e2dbf96fbc6dedf2fd426ffb08afb05588358814c918e1013e3780703c3940ce8cbf3b07bfa6c8415f3ccd138f80ef42a4bb8e578a43389d850426f6e8ea1188fb89c8eb4efa267d6dd6c8", 0xcf}], 0x1, &(0x7f0000000180)=[@ip_retopts={{0x60, 0x0, 0x7, {[@timestamp={0x44, 0x8, 0x0, 0x1, 0xc, [{[], 0x2}]}, @rr={0x7, 0xf, 0x0, [@empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1]}, @timestamp={0x44, 0xc, 0x98, 0x0, 0xe, [{[@remote]}]}, @ra={0x94, 0x6, 0x96}, @generic={0x88, 0x7, "dec89f3ec9"}, @ssrr={0x89, 0x1f, 0x1, [@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, @dev={0xac, 0x14, 0x14, 0x20}, @empty, @rand_addr, @remote, @multicast1]}]}}}], 0x60}}], 0x3, 0x8000) ioctl$SCSI_IOCTL_SYNC(0xffffffffffffffff, 0x4) r4 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000800)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d6", 0x1fe) sendfile(r1, r4, 0x0, 0x7fffffa7) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000900), 0xfffffcec) sendfile(r5, r1, 0x0, 0xffffffff) ioctl$sock_netdev_private(0xffffffffffffffff, 0x89fa, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) mmap(&(0x7f0000a05000/0x400000)=nil, 0x400300, 0x1000002, 0x10, 0xffffffffffffffff, 0x0) 11:36:28 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000000)="6664a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c92465e52d3fbf03", 0x3e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) [ 67.068795][ T7449] netlink: 'syz-executor.2': attribute type 10 has an invalid length. 11:36:28 executing program 5: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:28 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_STATS(r0, 0x80f86406, &(0x7f00000001c0)=""/181) 11:36:29 executing program 2: sendmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000240007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1", 0x39}], 0x1}, 0x0) writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)="39000000130009006900000000000006ab0080481e000000460001070000001419000a00", 0x24}], 0x1) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl(r1, 0x1000008912, &(0x7f0000000080)="11dca50d5e0bcfe47bf070") 11:36:29 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x200000000000df8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) r0 = socket$rds(0x15, 0x5, 0x0) r1 = io_uring_setup(0xa4, &(0x7f0000000100)) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f0000000280)=[r0], 0x35b) [ 67.604509][ T7472] netlink: 'syz-executor.2': attribute type 10 has an invalid length. [ 67.616103][ T25] kauditd_printk_skb: 6 callbacks suppressed [ 67.616145][ T25] audit: type=1804 audit(1572003389.141:47): pid=7470 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir055951220/syzkaller.rDmoeR/1/bus" dev="sda1" ino=16562 res=1 [ 67.683851][ T25] audit: type=1804 audit(1572003389.201:48): pid=7474 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir055951220/syzkaller.rDmoeR/1/bus" dev="sda1" ino=16562 res=1 11:36:29 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x200000000000df8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) r0 = socket$rds(0x15, 0x5, 0x0) r1 = io_uring_setup(0xa4, &(0x7f0000000100)) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f0000000280)=[r0], 0x35b) 11:36:29 executing program 5: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:29 executing program 0: getsockname(0xffffffffffffffff, &(0x7f0000000300)=@generic, &(0x7f0000000280)=0x80) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x40c2, 0x0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r3 = socket$alg(0x26, 0x5, 0x0) accept4(r3, 0x0, 0x0, 0x0) ioctl$UI_DEV_CREATE(r2, 0x5501) ioctl$TIOCNOTTY(0xffffffffffffffff, 0x5422) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x0) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000480), 0x80000) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={0x0, @remote, @empty}, &(0x7f0000000100)=0xc) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001d00)=[{{0x0, 0x0, 0x0}}, {{&(0x7f00000004c0)={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f0000000580)=[{0x0}, {0x0}], 0x2, &(0x7f0000001a80)=[@ip_tos_u8={{0x11}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4}}], 0x30}}, {{&(0x7f00000005c0)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10, &(0x7f0000001c00)=[{&(0x7f0000001b00)="10837532cf3afe8d3aded6e13cddc3267759d6e326e92da7608298cbe82693d6f6150cb5a6d9e14ed87252e6d816c0baf8a0a89ee48c8e58958e831d4ee29adde715053afdd3c080adcf9cc9b4bd4bebb6185327a157cbbb1e54ea7905b92867bdfc6031b9c98b551efd759633bc1a436ca531b07473ef77a6f33dbcc80070202ccdea27e2dbf96fbc6dedf2fd426ffb08afb05588358814c918e1013e3780703c3940ce8cbf3b07bfa6c8415f3ccd138f80ef42a4bb8e578a43389d850426f6e8ea1188fb89c8eb4efa267d6dd6c8", 0xcf}], 0x1, &(0x7f0000000180)=[@ip_retopts={{0x60, 0x0, 0x7, {[@timestamp={0x44, 0x8, 0x0, 0x1, 0xc, [{[], 0x2}]}, @rr={0x7, 0xf, 0x0, [@empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1]}, @timestamp={0x44, 0xc, 0x98, 0x0, 0xe, [{[@remote]}]}, @ra={0x94, 0x6, 0x96}, @generic={0x88, 0x7, "dec89f3ec9"}, @ssrr={0x89, 0x1f, 0x1, [@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, @dev={0xac, 0x14, 0x14, 0x20}, @empty, @rand_addr, @remote, @multicast1]}]}}}], 0x60}}], 0x3, 0x8000) ioctl$SCSI_IOCTL_SYNC(0xffffffffffffffff, 0x4) r4 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000800)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d6", 0x1fe) sendfile(r1, r4, 0x0, 0x7fffffa7) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000900), 0xfffffcec) sendfile(r5, r1, 0x0, 0xffffffff) ioctl$sock_netdev_private(0xffffffffffffffff, 0x89fa, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) mmap(&(0x7f0000a05000/0x400000)=nil, 0x400300, 0x1000002, 0x10, 0xffffffffffffffff, 0x0) 11:36:29 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_STATS(r0, 0x80f86406, &(0x7f00000001c0)=""/181) 11:36:29 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_STATS(r0, 0x80f86406, &(0x7f00000001c0)=""/181) [ 68.182492][ T25] audit: type=1804 audit(1572003389.731:49): pid=7482 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir055951220/syzkaller.rDmoeR/2/bus" dev="sda1" ino=16549 res=1 11:36:29 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_STATS(r0, 0x80f86406, &(0x7f00000001c0)=""/181) 11:36:29 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_STATS(r0, 0x80f86406, &(0x7f00000001c0)=""/181) [ 68.273181][ T25] audit: type=1804 audit(1572003389.761:50): pid=7491 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir055951220/syzkaller.rDmoeR/2/bus" dev="sda1" ino=16549 res=1 [ 68.446382][ T25] audit: type=1800 audit(1572003389.811:51): pid=7488 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=16566 res=0 [ 68.518966][ T25] audit: type=1804 audit(1572003389.871:52): pid=7488 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir052723446/syzkaller.hgG3Fs/10/file0/file0" dev="sda1" ino=16566 res=1 [ 68.606340][ T25] audit: type=1804 audit(1572003389.911:53): pid=7488 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir052723446/syzkaller.hgG3Fs/10/file0/file0" dev="sda1" ino=16566 res=1 11:36:31 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000000)="6664a8990785363940aed12f0000db2f00000022f1f169a4000000000000009f1f8175442ce71022fe50377a22cbccb0353cffd7a7c0c92465e52d3fbf03", 0x3e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x9, r0, 0x0, 0x0) 11:36:31 executing program 3: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:31 executing program 5: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:31 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:31 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_STATS(r0, 0x80f86406, &(0x7f00000001c0)=""/181) 11:36:31 executing program 0: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:31 executing program 2: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) [ 70.239229][ T25] audit: type=1804 audit(1572003391.781:55): pid=7506 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir855950495/syzkaller.IK6haA/4/bus" dev="sda1" ino=16567 res=1 [ 70.348823][ T25] audit: type=1804 audit(1572003391.791:56): pid=7512 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir055951220/syzkaller.rDmoeR/3/bus" dev="sda1" ino=16576 res=1 11:36:32 executing program 1: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:32 executing program 3: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) [ 70.565889][ T25] audit: type=1804 audit(1572003391.811:57): pid=7515 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir052723446/syzkaller.hgG3Fs/11/bus" dev="sda1" ino=16582 res=1 11:36:32 executing program 2: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:32 executing program 5: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:32 executing program 0: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:32 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:33 executing program 3: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:33 executing program 4: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:33 executing program 1: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:33 executing program 0: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:33 executing program 5: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:34 executing program 2: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) 11:36:34 executing program 1: creat(&(0x7f00000001c0)='./bus\x00', 0xffffffffffdffffe) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) write$apparmor_current(r0, &(0x7f0000000380)=ANY=[@ANYRES64], 0x1) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setstatus(r1, 0x4, 0x42800) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x8) r2 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) lsetxattr$security_selinux(&(0x7f0000000240)='./bus\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:inetd_var_run_t:s0\x00', 0x25, 0x0) sendfile(r0, r2, 0x0, 0x8000fffffffe) creat(&(0x7f0000000140)='./bus\x00', 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x40010, r3, 0x0) [ 72.844202][ T25] kauditd_printk_skb: 29 callbacks suppressed [ 72.844280][ T25] audit: type=1804 audit(1572003394.391:86): pid=7573 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir112924236/syzkaller.BfGgF8/9/bus" dev="sda1" ino=16601 res=1 [ 73.068933][ T25] audit: type=1804 audit(1572003394.501:87): pid=7574 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir112924236/syzkaller.BfGgF8/9/bus" dev="sda1" ino=16601 res=1 [ 73.252776][ T25] audit: type=1804 audit(1572003394.781:88): pid=7577 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir440689175/syzkaller.eJZzyP/6/bus" dev="sda1" ino=16592 res=1 [ 73.312484][ T7577] ================================================================== [ 73.320623][ T7577] BUG: KCSAN: data-race in ext4_setattr / generic_file_read_iter [ 73.328403][ T7577] [ 73.330730][ T7577] write to 0xffff888125cd7628 of 8 bytes by task 7578 on cpu 0: [ 73.338359][ T7577] ext4_setattr+0xef4/0x1620 [ 73.342972][ T7577] notify_change+0x7e1/0xaa0 [ 73.347558][ T7577] do_truncate+0xfb/0x180 [ 73.349984][ T25] audit: type=1804 audit(1572003394.861:89): pid=7578 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir440689175/syzkaller.eJZzyP/6/bus" dev="sda1" ino=16592 res=1 [ 73.351886][ T7577] path_openat+0x2f4a/0x36e0 [ 73.351898][ T7577] do_filp_open+0x11e/0x1b0 [ 73.351910][ T7577] do_sys_open+0x3b3/0x4f0 [ 73.351925][ T7577] __x64_sys_creat+0x45/0x60 [ 73.351941][ T7577] do_syscall_64+0xcc/0x370 [ 73.351956][ T7577] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 73.351959][ T7577] [ 73.351973][ T7577] read to 0xffff888125cd7628 of 8 bytes by task 7577 on cpu 1: [ 73.352004][ T7577] generic_file_read_iter+0x860/0x1440 [ 73.419520][ T7577] ext4_file_read_iter+0xfa/0x240 [ 73.424541][ T7577] generic_file_splice_read+0x35c/0x500 [ 73.430079][ T7577] do_splice_to+0xf2/0x130 [ 73.434488][ T7577] splice_direct_to_actor+0x1a1/0x510 [ 73.439867][ T7577] do_splice_direct+0x161/0x1e0 [ 73.444718][ T7577] do_sendfile+0x384/0x7f0 [ 73.449123][ T7577] __x64_sys_sendfile64+0x12a/0x140 [ 73.454401][ T7577] do_syscall_64+0xcc/0x370 [ 73.458900][ T7577] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 73.464779][ T7577] [ 73.467095][ T7577] Reported by Kernel Concurrency Sanitizer on: [ 73.473245][ T7577] CPU: 1 PID: 7577 Comm: syz-executor.1 Not tainted 5.4.0-rc3+ #0 [ 73.481047][ T7577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 73.491098][ T7577] ================================================================== [ 73.499154][ T7577] Kernel panic - not syncing: panic_on_warn set ... [ 73.505748][ T7577] CPU: 1 PID: 7577 Comm: syz-executor.1 Not tainted 5.4.0-rc3+ #0 [ 73.513547][ T7577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 73.523598][ T7577] Call Trace: [ 73.526892][ T7577] dump_stack+0xf5/0x159 [ 73.531133][ T7577] panic+0x210/0x640 [ 73.535033][ T7577] ? do_syscall_64+0xcc/0x370 [ 73.539723][ T7577] ? vprintk_func+0x8d/0x140 [ 73.544309][ T7577] kcsan_report.cold+0xc/0x10 [ 73.548990][ T7577] __kcsan_setup_watchpoint+0x32e/0x4a0 [ 73.554540][ T7577] ? pagecache_get_page+0x1b7/0x760 [ 73.559741][ T7577] __tsan_read8+0x2c/0x30 [ 73.564070][ T7577] generic_file_read_iter+0x860/0x1440 [ 73.569537][ T7577] ext4_file_read_iter+0xfa/0x240 [ 73.574564][ T7577] generic_file_splice_read+0x35c/0x500 [ 73.580119][ T7577] do_splice_to+0xf2/0x130 [ 73.584532][ T7577] ? add_to_pipe+0x1a0/0x1a0 [ 73.589117][ T7577] ? add_to_pipe+0x1a0/0x1a0 [ 73.593704][ T7577] splice_direct_to_actor+0x1a1/0x510 [ 73.599069][ T7577] ? generic_pipe_buf_nosteal+0x20/0x20 [ 73.604621][ T7577] do_splice_direct+0x161/0x1e0 [ 73.609480][ T7577] do_sendfile+0x384/0x7f0 [ 73.613902][ T7577] __x64_sys_sendfile64+0x12a/0x140 [ 73.619103][ T7577] do_syscall_64+0xcc/0x370 [ 73.623608][ T7577] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 73.629494][ T7577] RIP: 0033:0x459f39 [ 73.633407][ T7577] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 73.653013][ T7577] RSP: 002b:00007f4b01a04c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 73.661424][ T7577] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459f39 [ 73.669392][ T7577] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004 [ 73.677360][ T7577] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 73.685335][ T7577] R10: 00008000fffffffe R11: 0000000000000246 R12: 00007f4b01a056d4 [ 73.693306][ T7577] R13: 00000000004c7b14 R14: 00000000004dd9f0 R15: 00000000ffffffff [ 73.702553][ T7577] Kernel Offset: disabled [ 73.706874][ T7577] Rebooting in 86400 seconds..