[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 58.545833] sshd (6040) used greatest stack depth: 53216 bytes left [....] Starting OpenBSD Secure Shell server: sshd[ 58.760754] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. [ 60.106783] random: sshd: uninitialized urandom read (32 bytes read) Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 60.569012] random: sshd: uninitialized urandom read (32 bytes read) [ 63.164744] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.0.77' (ECDSA) to the list of known hosts. [ 68.920989] random: sshd: uninitialized urandom read (32 bytes read) 2018/10/09 23:50:38 fuzzer started [ 73.570764] random: cc1: uninitialized urandom read (8 bytes read) 2018/10/09 23:50:42 dialing manager at 10.128.0.26:44001 2018/10/09 23:50:43 syscalls: 1 2018/10/09 23:50:43 code coverage: enabled 2018/10/09 23:50:43 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2018/10/09 23:50:43 setuid sandbox: enabled 2018/10/09 23:50:43 namespace sandbox: enabled 2018/10/09 23:50:43 Android sandbox: /sys/fs/selinux/policy does not exist 2018/10/09 23:50:43 fault injection: enabled 2018/10/09 23:50:43 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/10/09 23:50:43 net packed injection: enabled 2018/10/09 23:50:43 net device setup: enabled [ 78.338393] random: crng init done 23:52:46 executing program 0: r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, &(0x7f0000000140)=0x1c) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYRESDEC], 0xfffffdd1) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='memory.events\x00', 0x0, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080), &(0x7f00000000c0)=0xc) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)="153f6234488d") [ 200.721529] IPVS: ftp: loaded support on port[0] = 21 [ 203.163618] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.170160] bridge0: port 1(bridge_slave_0) entered disabled state [ 203.178939] device bridge_slave_0 entered promiscuous mode [ 203.329066] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.335747] bridge0: port 2(bridge_slave_1) entered disabled state [ 203.344544] device bridge_slave_1 entered promiscuous mode [ 203.487791] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 203.630268] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 23:52:50 executing program 1: r0 = socket$inet6(0xa, 0x801, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @broadcast}}, 0x1c) [ 204.327963] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 204.402407] IPVS: ftp: loaded support on port[0] = 21 [ 204.588626] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 204.775999] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 204.783210] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 204.963073] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 204.970121] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 205.639982] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 205.648315] team0: Port device team_slave_0 added [ 205.860550] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 205.868819] team0: Port device team_slave_1 added [ 206.070997] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 206.078183] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 206.087596] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 206.288158] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 206.295356] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 206.304469] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 206.455155] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 206.462947] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 206.472157] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 206.711561] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 206.719545] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 206.728752] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 208.486851] bridge0: port 1(bridge_slave_0) entered blocking state [ 208.493617] bridge0: port 1(bridge_slave_0) entered disabled state [ 208.502250] device bridge_slave_0 entered promiscuous mode [ 208.705071] bridge0: port 2(bridge_slave_1) entered blocking state [ 208.711572] bridge0: port 2(bridge_slave_1) entered disabled state [ 208.720254] device bridge_slave_1 entered promiscuous mode [ 208.891401] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 209.097184] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 209.211046] bridge0: port 2(bridge_slave_1) entered blocking state [ 209.217624] bridge0: port 2(bridge_slave_1) entered forwarding state [ 209.224709] bridge0: port 1(bridge_slave_0) entered blocking state [ 209.231196] bridge0: port 1(bridge_slave_0) entered forwarding state [ 209.240081] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 209.592616] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 23:52:56 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f00004c0000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x10000200003) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f000087dffe)='F', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, &(0x7f0000da8ffc), 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in6={{0x2, 0x0, 0x0, @empty={[0x0, 0xe00, 0x0, 0x0, 0x9]}}}, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x98) [ 209.908392] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 210.247296] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 210.586643] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 210.595471] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 210.769823] IPVS: ftp: loaded support on port[0] = 21 [ 210.928017] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 210.935202] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 211.640628] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 211.648816] team0: Port device team_slave_0 added [ 211.946709] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 211.955177] team0: Port device team_slave_1 added [ 212.236389] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 212.243670] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 212.252758] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 212.497089] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 212.504417] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 212.513705] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 212.839769] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 212.847519] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 212.857004] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 213.198913] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 213.206747] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 213.216128] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 215.622488] bridge0: port 1(bridge_slave_0) entered blocking state [ 215.628968] bridge0: port 1(bridge_slave_0) entered disabled state [ 215.637858] device bridge_slave_0 entered promiscuous mode [ 215.869924] bridge0: port 2(bridge_slave_1) entered blocking state [ 215.876541] bridge0: port 2(bridge_slave_1) entered disabled state [ 215.885102] device bridge_slave_1 entered promiscuous mode [ 216.157228] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 216.392244] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 216.890143] bridge0: port 2(bridge_slave_1) entered blocking state [ 216.896704] bridge0: port 2(bridge_slave_1) entered forwarding state [ 216.903712] bridge0: port 1(bridge_slave_0) entered blocking state [ 216.910180] bridge0: port 1(bridge_slave_0) entered forwarding state [ 216.919090] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 217.272682] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 217.438729] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 217.692194] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 217.992087] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 217.999175] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 218.254423] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 218.261576] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 23:53:05 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x20000000008912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$inet6(0xa, 0x2000000000000001, 0x8010000000000084) bind$inet6(r1, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r1, 0xffbd) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000000100)='F', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) [ 219.368368] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 219.376537] team0: Port device team_slave_0 added [ 219.620055] IPVS: ftp: loaded support on port[0] = 21 [ 219.724242] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 219.732442] team0: Port device team_slave_1 added [ 220.055845] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 220.063125] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 220.072377] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 220.454225] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 220.461351] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 220.470514] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 220.833517] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 220.841108] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 220.850184] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 221.195934] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 221.203805] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 221.212887] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 222.385877] 8021q: adding VLAN 0 to HW filter on device bond0 [ 223.890354] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 225.245734] bridge0: port 1(bridge_slave_0) entered blocking state [ 225.252366] bridge0: port 1(bridge_slave_0) entered disabled state [ 225.260818] device bridge_slave_0 entered promiscuous mode [ 225.295679] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 225.304912] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 225.313149] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 225.323819] bridge0: port 2(bridge_slave_1) entered blocking state [ 225.330266] bridge0: port 2(bridge_slave_1) entered forwarding state [ 225.337236] bridge0: port 1(bridge_slave_0) entered blocking state [ 225.343798] bridge0: port 1(bridge_slave_0) entered forwarding state [ 225.352815] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 225.622120] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 225.631962] bridge0: port 2(bridge_slave_1) entered blocking state [ 225.638430] bridge0: port 2(bridge_slave_1) entered disabled state [ 225.647146] device bridge_slave_1 entered promiscuous mode [ 225.989155] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 226.379481] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 226.789512] 8021q: adding VLAN 0 to HW filter on device team0 [ 227.429347] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 227.781232] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 228.149881] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 228.157159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 228.566794] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 228.574039] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 23:53:16 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ptmx\x00', 0x2, 0x0) read(r0, &(0x7f0000000600)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) futex(&(0x7f0000000080)=0x2, 0x0, 0x2, &(0x7f0000000140)={0x0, r1+10000000}, &(0x7f0000000180), 0x0) write$binfmt_aout(r0, &(0x7f0000000640), 0x20) [ 229.674384] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 229.682698] team0: Port device team_slave_0 added [ 230.102000] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 230.110174] team0: Port device team_slave_1 added [ 230.586220] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 230.593464] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 230.602646] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 231.022412] IPVS: ftp: loaded support on port[0] = 21 [ 231.026549] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 231.034857] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 231.043992] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 231.540772] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 231.550672] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 231.559786] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 231.942345] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 231.949934] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 231.959188] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 232.889665] 8021q: adding VLAN 0 to HW filter on device bond0 [ 234.716319] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 236.335038] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 236.341479] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 236.350176] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 236.894305] bridge0: port 2(bridge_slave_1) entered blocking state [ 236.900836] bridge0: port 2(bridge_slave_1) entered forwarding state [ 236.907995] bridge0: port 1(bridge_slave_0) entered blocking state [ 236.914552] bridge0: port 1(bridge_slave_0) entered forwarding state [ 236.923366] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 237.052081] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 237.459228] ip (6886) used greatest stack depth: 53056 bytes left 23:53:24 executing program 0: r0 = socket$inet6_sctp(0xa, 0x3, 0x84) sendto$inet6(r0, &(0x7f0000e33fe0), 0x0, 0x0, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f00000000c0)) [ 238.033206] 8021q: adding VLAN 0 to HW filter on device team0 [ 238.231310] bridge0: port 1(bridge_slave_0) entered blocking state [ 238.237959] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.246601] device bridge_slave_0 entered promiscuous mode 23:53:25 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x10000, 0x181080) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000040)={0x9, 0x7ff, 0x1ff, 'queue0\x00', 0x7}) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000140)=[{&(0x7f0000000280)="480000001500199009004b0101048c590a880900000000000000fe5f0028213ee20600d4ff5bffff00c7e5ed5e00000000c80000000000000000f5ffffffffffffff00eaf60d1812", 0x48}], 0x1) [ 238.437111] netlink: 48 bytes leftover after parsing attributes in process `syz-executor0'. 23:53:25 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000180)=0x8000101, 0x4) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000000)) [ 238.806167] bridge0: port 2(bridge_slave_1) entered blocking state [ 238.812914] bridge0: port 2(bridge_slave_1) entered disabled state [ 238.821383] device bridge_slave_1 entered promiscuous mode 23:53:26 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x8000, 0x200000) setsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000080)=0x3, 0x4) syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x0, 0x0) r1 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r1, 0x1f00000000000000, 0xd2, &(0x7f0000000000), 0x3c) [ 239.304707] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready 23:53:26 executing program 0: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000000000), &(0x7f0000013000)=0xfffffffffffffd7f) socket$l2tp(0x18, 0x1, 0x1) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x300, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x43c8c9021b8eba21, 0x0) clock_gettime(0x0, &(0x7f0000000080)) setsockopt$inet_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f00000000c0), 0x4) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r1, 0xc0385720, &(0x7f0000000200)={0x1, {0x0, 0x989680}, 0x1fffff, 0x3}) [ 239.749541] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 23:53:27 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000140)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") ioctl$DRM_IOCTL_RES_CTX(r0, 0x40086607, &(0x7f0000000080)={0x0, &(0x7f0000000540)}) 23:53:27 executing program 0: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/cgroup\x00') capset(&(0x7f00001e8ff8)={0x19980330}, &(0x7f0000032fe8)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_cpus\x00', 0x0, 0x0) recvmsg$kcm(r1, &(0x7f0000001600)={&(0x7f0000000000)=@rc, 0x80, &(0x7f0000001500)=[{&(0x7f00000001c0)=""/4096, 0x1000}, {&(0x7f0000000080)}, {&(0x7f00000011c0)=""/32, 0x20}, {&(0x7f0000001200)=""/151, 0x97}, {&(0x7f00000012c0)=""/174, 0xae}, {&(0x7f0000001380)=""/81, 0x51}, {&(0x7f0000001400)=""/205, 0xcd}], 0x7, &(0x7f0000001580)=""/124, 0x7c, 0x8000}, 0x2) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000100), &(0x7f0000000180)=0x4) setns(r0, 0x0) [ 240.788926] capability: warning: `syz-executor0' uses 32-bit capabilities (legacy support in use) [ 241.070796] bond0: Enslaving bond_slave_0 as an active interface with an up link 23:53:28 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="390000001100090469001b00810800000700fd3f0300d881080000000000001419001a000414230007000000010000ddaf3ee2650698f2d567", 0x39}], 0x1) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f0000000040)={0x0, 0x3f}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000100)={r2, 0x61, "3592b15fe09c73c5bf4a4ca1d4942bd19ce1cc340a8c78d9e5b6c81bed8199e63efdf2ec5e1dee36471dad3c514424668f19333234bcc7370fe7287e2716bba0f26f7a6651aded78c76fe550971889170b6db246e57b88a28f290955fbd66d9d43"}, &(0x7f00000001c0)=0x69) [ 241.576730] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 242.055332] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 242.062460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 242.393751] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 242.400834] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 242.856589] 8021q: adding VLAN 0 to HW filter on device bond0 [ 243.449818] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 243.458033] team0: Port device team_slave_0 added [ 243.763772] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 243.772094] team0: Port device team_slave_1 added [ 244.021510] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 244.125292] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 244.132464] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 244.141155] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 244.421577] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 244.428799] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 244.437642] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 244.790774] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 244.798540] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 244.807581] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 245.099471] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 245.107186] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 245.116133] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 245.129510] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 245.143815] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 245.151893] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 246.398657] 8021q: adding VLAN 0 to HW filter on device team0 23:53:33 executing program 1: [ 248.515370] bridge0: port 2(bridge_slave_1) entered blocking state [ 248.521959] bridge0: port 2(bridge_slave_1) entered forwarding state [ 248.528880] bridge0: port 1(bridge_slave_0) entered blocking state [ 248.535500] bridge0: port 1(bridge_slave_0) entered forwarding state [ 248.543961] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 248.550641] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 249.852593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 250.627347] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 251.465279] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 251.471838] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 251.479605] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 252.165257] 8021q: adding VLAN 0 to HW filter on device team0 23:53:39 executing program 2: 23:53:43 executing program 3: [ 256.243112] 8021q: adding VLAN 0 to HW filter on device bond0 [ 256.542679] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 256.844069] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 256.850481] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 256.858582] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 257.152199] 8021q: adding VLAN 0 to HW filter on device team0 23:53:47 executing program 4: 23:53:47 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x80000, 0x0) ioctl$sock_ifreq(r0, 0x8923, &(0x7f00000002c0)={"65716c000000a95b00", @ifru_addrs=@can}) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x80001, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f0000000240)=""/87) 23:53:47 executing program 5: socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_group_source_req(r0, 0x0, 0x2c, &(0x7f0000000040)={0x9, {{0x2, 0x4e23, @multicast2}}, {{0x2, 0x4e20}}}, 0x108) socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f0000000180)=""/4096, &(0x7f0000001180)=0x1000) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f00000011c0)='/dev/dsp\x00', 0x200000, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffff9c, 0x84, 0x0, &(0x7f0000001200)={0x0, 0x8001, 0x7, 0x80000001}, &(0x7f0000001240)=0x10) setsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000001280)={r3, 0xfffffffffffffffc, 0x7, 0x3, 0x9}, 0x14) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = accept$inet6(r2, &(0x7f00000012c0), &(0x7f0000001300)=0x1c) ioctl$KDGKBENT(r2, 0x4b46, &(0x7f0000001340)={0x2, 0x5, 0x4}) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000001380)='/dev/vga_arbiter\x00', 0x8100, 0x0) ioctl$FS_IOC_SETVERSION(r2, 0x40087602, &(0x7f00000013c0)=0x80) ioctl$TIOCSSOFTCAR(r2, 0x541a, &(0x7f0000001400)) ioctl$SCSI_IOCTL_PROBE_HOST(r2, 0x5385, &(0x7f0000001440)={0x89, ""/137}) getsockopt$inet6_tcp_int(r2, 0x6, 0x24, &(0x7f0000001500), &(0x7f0000001540)=0x4) fsetxattr(r5, &(0x7f0000001580)=@known='system.advise\x00', &(0x7f00000015c0)="1776626f786e65743100", 0xa, 0x2) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000001600)) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r5, 0x84, 0x72, &(0x7f0000001640)={r3, 0x401, 0x30}, &(0x7f0000001680)=0xc) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f00000016c0)={r3, @in={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x11}}}, 0xe3}, &(0x7f0000001780)=0x90) r6 = add_key(&(0x7f0000001880)='.request_key_auth\x00', &(0x7f00000018c0)={'syz', 0x1}, &(0x7f0000001900)="c4209088a3426ee210320002b4f3e71f430cbcba7a2c112c329c3374593fa5e211180b417237badcebd46a07b8483bb2c1a370fda9cbd4a9a23b3c5e0feb919ba41faed37c5a8ecbc24d71154e8bcfa076f1d10cb3f41bf7dae6d7a17af1289c830caaeac67d0c0e23e3f8ce7d89f8556d3bf4ea1966db1aa9caa667879e7d86a253fd11a7b86f50c33067655037f137ae3cb350faf744ea8a51c3c0132d438be191b7a4050bf2ea1190dc1b84b150b5d695", 0xb2, 0xfffffffffffffff8) request_key(&(0x7f00000017c0)='dns_resolver\x00', &(0x7f0000001800)={'syz', 0x3}, &(0x7f0000001840)=':eth0}:!trusted%cgroup@\x00', r6) setsockopt$inet_group_source_req(r1, 0x0, 0x2f, &(0x7f00000019c0)={0x73c6, {{0x2, 0x4e24}}, {{0x2, 0x4e24, @rand_addr=0x1000}}}, 0x108) ioctl$TCXONC(r2, 0x540a, 0x96d) ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f0000001b00)=0x0) syz_open_procfs(r7, &(0x7f0000001b40)='net/ptype\x00') mknodat(r5, &(0x7f0000001b80)='./file0\x00', 0x0, 0x40) syz_open_dev$vcsn(&(0x7f0000001bc0)='/dev/vcs#\x00', 0x0, 0x242000) timerfd_create(0x7, 0x80000) ioctl$sock_inet_SIOCGIFDSTADDR(r2, 0x8917, &(0x7f0000001c00)={'ifb0\x00', {0x2, 0x4e22, @multicast2}}) write$P9_RSTATFS(r2, &(0x7f0000001c40)={0x43, 0x9, 0x1, {0x2, 0x1f, 0x8001, 0x7, 0x0, 0x5, 0x4, 0x101, 0x200}}, 0x43) 23:53:47 executing program 1: 23:53:47 executing program 2: 23:53:47 executing program 3: 23:53:47 executing program 0: 23:53:47 executing program 2: 23:53:47 executing program 1: 23:53:47 executing program 3: 23:53:47 executing program 4: 23:53:47 executing program 0: 23:53:47 executing program 2: 23:53:48 executing program 1: [ 261.450239] IPVS: ftp: loaded support on port[0] = 21 [ 262.750990] bridge0: port 1(bridge_slave_0) entered blocking state [ 262.757830] bridge0: port 1(bridge_slave_0) entered disabled state [ 262.766020] device bridge_slave_0 entered promiscuous mode [ 262.845537] bridge0: port 2(bridge_slave_1) entered blocking state [ 262.851997] bridge0: port 2(bridge_slave_1) entered disabled state [ 262.859630] device bridge_slave_1 entered promiscuous mode [ 262.938603] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 263.017252] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 263.255823] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 263.340003] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 263.421630] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 263.428783] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 263.506906] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 263.513967] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 263.752689] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 263.760278] team0: Port device team_slave_0 added [ 263.840640] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 263.848449] team0: Port device team_slave_1 added [ 263.928691] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 264.012301] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 264.097615] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 264.105246] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 264.114372] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 264.195205] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 264.202692] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 264.211487] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 265.117441] bridge0: port 2(bridge_slave_1) entered blocking state [ 265.123925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 265.130641] bridge0: port 1(bridge_slave_0) entered blocking state [ 265.137178] bridge0: port 1(bridge_slave_0) entered forwarding state [ 265.145077] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 265.402165] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 268.435578] 8021q: adding VLAN 0 to HW filter on device bond0 [ 268.743310] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 269.052701] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 269.058987] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 269.067135] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 269.505581] 8021q: adding VLAN 0 to HW filter on device team0 23:53:58 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000de2ff4), 0xc, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000000301ffff808f00003d88c8f00010ae1b"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x200002, &(0x7f0000000c40)={0x77359400}) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f00000001c0)="153f6234488dd25d766070") 23:53:58 executing program 4: 23:53:58 executing program 3: 23:53:58 executing program 0: 23:53:58 executing program 2: 23:53:58 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0xb, &(0x7f0000000040)=""/4096, &(0x7f0000001040)=0x1000) 23:53:58 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') r1 = socket$inet_sctp(0x2, 0x0, 0x84) socket(0x0, 0x0, 0x0) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000040)) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000006c0)={'sit0\x00'}) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f00000000c0)={0x20000010, 0xfe80}, 0xc, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000340)={'veth0_to_bridge\x00', 0x1000}) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000140)={0x0, 0x8}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f0000000300), 0x8) 23:53:58 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000001c0)="153f6234488dd25d766070") sendmmsg(r0, &(0x7f0000009a00)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e23, 0x0, @local}, 0x80, &(0x7f0000000540), 0x0, &(0x7f00000005c0)=[{0x10}], 0x10, 0x4}, 0xb5}], 0x1, 0x20000000) 23:53:58 executing program 0: 23:53:58 executing program 1: 23:53:59 executing program 3: 23:53:59 executing program 1: [ 272.561861] hrtimer: interrupt took 254445 ns [ 273.074474] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 273.081392] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 23:54:00 executing program 5: 23:54:00 executing program 0: 23:54:00 executing program 3: 23:54:00 executing program 1: 23:54:00 executing program 0: 23:54:00 executing program 3: [ 274.351463] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 23:54:01 executing program 2: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) pwrite64(r1, &(0x7f0000000200)="4ebefa1e923f1e018b6e53bf4815b78e1f2ef9212b93090c1ff6b35c208d50aef3fd759f995b53dd37c58cf8332b8a6b66575478e02ef0145bf122ba2e2c53a7ec45e375683475a6495f8d7b7a088f5e32dc266569074319bf8c8d3d8007cc92e2ba0d9082c41b63e330f353a3f675a98d2e74a08e38400f7f5eb113a0e25fd90115d57a7acdcab1128cf4f9c719f3f29d460c507f8a2a6594d259217d32eae9be93c6ed17a67ae2e7e689a31fa8449da12fd62bf423cff702b09e6ee1ff0e698b8bb517819eb712ba2b34b54b28b79d9399d920d5a5507e8a85f37060dfe3051f06f8d7cc9b068495ee5d5fcce85410bcd9f91d1f198353ce94b2e03370e43875c1a035bb88fd26fbb5b1252e2056d6b67e2b2f424051a40ad9170e76a81a6ca4f149ff643db76f8f2c1aa8024a6279952027489bbad6479e47ea5ba9e47d8136df398665f6cdfd15e93cfbf2ce1151afe9321ed63fe7100e704b232646fc1e0e936b90cceaaa70225ce71640e10316d2cc637355eddb3c4e16ff1635fa4e65a66eb5ab2cbf9d6f063e05f0e46fcc14bf31eedfb9f33c215fc14946cc6f7493924442e939f71ac4bd3e35e78857f9624c663f3669a47a7146e3249ee3eaaf681f371d515af5b934f9252c7ac2a164bf318fc2b194ee087b2b28ed5e4618c0906fc3f32c43a3b9e08a2e0d509f65a7de909e8c3c535f1d8cb9c236716e5ad709", 0x200, 0x1400) 23:54:01 executing program 1: 23:54:01 executing program 5: 23:54:01 executing program 3: 23:54:01 executing program 0: 23:54:01 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000000040)=0x3, 0x4) 23:54:01 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) r1 = syz_open_dev$vcsa(&(0x7f0000000140)='/dev/vcsa#\x00', 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000), 0x1c) r2 = fcntl$dupfd(r0, 0x0, r0) r3 = dup2(r2, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ffd, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) recvfrom(r1, &(0x7f0000000380)=""/225, 0xe1, 0x0, &(0x7f0000000280)=@rc, 0x80) 23:54:01 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$netlink(r0, 0x10e, 0x5, &(0x7f0000000040)=""/234, &(0x7f0000000140)=0xea) 23:54:02 executing program 5: 23:54:02 executing program 2: 23:54:02 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x31, &(0x7f00000002c0)={0x0, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @local}}}, 0x108) 23:54:02 executing program 0: r0 = socket$inet6(0xa, 0x800000001, 0x8010000000000084) listen(r0, 0x4000) 23:54:02 executing program 1: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x40000000002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) writev(r0, &(0x7f0000000080)=[{&(0x7f00000000c0)="0bd2430f000319", 0x7}], 0x1) 23:54:02 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x200000000f) sendmsg$nl_generic(r0, &(0x7f0000023000)={&(0x7f0000000000), 0xc, &(0x7f0000023ff0)={&(0x7f0000010ec4)=ANY=[@ANYBLOB="140000002700010be1ff00000000000003000000"], 0x1}}, 0x0) 23:54:02 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000b88ff3)='/dev/snd/seq\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x4, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f0000000400)={0x0, 0x0, 'client0\x00', 0x0, "268a87f1dfe05fa8", "ce4cd0b4b4fdc51c71f021606103e6a1eefdca11f560ac1c995ca8a623a9f1cd"}) 23:54:02 executing program 4: socketpair(0xa, 0x3, 0x5, &(0x7f0000000140)) 23:54:02 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f0000000380)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000000301ffff808f00003d8885000000ae1b"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f00000013c0), 0x1ad, 0x200002, &(0x7f0000000c40)={0x77359400}) 23:54:02 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000000)=[{0x6}]}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmmsg(r0, &(0x7f0000003040), 0x400000000000083, 0x0) 23:54:02 executing program 1: clone(0x44000000, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000c40), 0xffffffffffffffff) 23:54:03 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x200000000f) sendmsg$nl_generic(r0, &(0x7f0000023000)={&(0x7f0000000000), 0xc, &(0x7f0000023ff0)={&(0x7f0000010ec4)=ANY=[@ANYBLOB="140000002700010be1ff00000000000003000000"], 0x1}}, 0x0) 23:54:03 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000bc0)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) [ 276.299320] IPVS: ftp: loaded support on port[0] = 21 23:54:03 executing program 4: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff) r0 = gettid() wait4(0x0, &(0x7f00000003c0), 0x80000000, &(0x7f0000000400)) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x14) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) ptrace$cont(0x20, r0, 0x0, 0x7) tkill(r0, 0x17) writev(r1, &(0x7f0000000a80)=[{&(0x7f0000000000)="80", 0x1}], 0x1) 23:54:03 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x200000000f) sendmsg$nl_generic(r0, &(0x7f0000023000)={&(0x7f0000000000), 0xc, &(0x7f0000023ff0)={&(0x7f0000010ec4)=ANY=[@ANYBLOB="140000002700010be1ff00000000000003000000"], 0x1}}, 0x0) 23:54:03 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect(r0, &(0x7f0000000000)=@un=@file={0x0, './file0\x00'}, 0x80) [ 276.592796] ptrace attach of "/root/syz-executor4"[7901] was attempted by "/root/syz-executor4"[7906] 23:54:03 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100)="71e67a111f", 0x5) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) recvmsg$kcm(r1, &(0x7f0000008000)={&(0x7f0000006e40)=@hci, 0x80, &(0x7f0000007f80)=[{&(0x7f0000006f00)=""/124, 0x7c}], 0x1, &(0x7f0000007fc0)=""/28, 0x1c}, 0x0) 23:54:03 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x200000000f) sendmsg$nl_generic(r0, &(0x7f0000023000)={&(0x7f0000000000), 0xc, &(0x7f0000023ff0)={&(0x7f0000010ec4)=ANY=[@ANYBLOB="140000002700010be1ff00000000000003000000"], 0x1}}, 0x0) [ 276.967194] IPVS: ftp: loaded support on port[0] = 21 23:54:04 executing program 2: io_setup(0x81, &(0x7f0000000000)=0x0) socket$inet_udp(0x2, 0x2, 0x0) io_submit(r0, 0x1, &(0x7f0000001580)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x1}]) 23:54:04 executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) write$binfmt_misc(r0, &(0x7f0000000300)=ANY=[], 0xfe7c) 23:54:04 executing program 0: openat$vsock(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/vsock\x00', 0x4, 0x0) syz_open_dev$vcsn(&(0x7f0000000140)='/dev/vcs#\x00', 0xf4, 0x80400) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x105082) sendfile(r0, r0, &(0x7f00000ddff8), 0x102003b00) syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x0, 0x0) 23:54:04 executing program 5: sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000023000)={&(0x7f0000000000), 0xc, &(0x7f0000023ff0)={&(0x7f0000010ec4)=ANY=[@ANYBLOB="140000002700010be1ff00000000000003000000"], 0x1}}, 0x0) 23:54:05 executing program 1: clone(0x44000000, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000c40), 0xffffffffffffffff) 23:54:05 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f0000000380)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000000301ffff808f00003d8885000000ae1b"], 0x14}}, 0x0) 23:54:05 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0x2, &(0x7f0000001000)=ANY=[@ANYBLOB="61128c000000000061134c0000080000"], &(0x7f0000000100)="92504c00"}, 0x48) [ 278.195072] IPVS: ftp: loaded support on port[0] = 21 23:54:06 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB=',group_id=', @ANYRESDEC=0x0]) lgetxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000200)=@known='security.capability\x00', &(0x7f0000000280)=""/23, 0x17) 23:54:06 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000023000)={&(0x7f0000000000), 0xc, &(0x7f0000023ff0)={&(0x7f0000010ec4)=ANY=[@ANYBLOB="140000002700010be1ff00000000000003000000"], 0x1}}, 0x0) 23:54:06 executing program 3: pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r1, 0x8912, &(0x7f0000000100)="153f6234488dd25d766070") close(r0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000004f000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, &(0x7f0000000100)="26410f300f01c90f06643e400f01c9420f758e000000002ef3400fb8e566baf80cb8ac8abd80ef66bafc0cedd2fe0f01ca66ba4000ec", 0x36}], 0x1, 0x0, &(0x7f00000001c0), 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="660f382b1a0f01dfdde80f32d9e90f086665676426f7c5000000000f2245deef0f23f5", 0x23}], 0x1, 0x0, &(0x7f0000000140), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000062000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f00000001c0)="0f0f280dbaf80c66b8561eac8666efbafc0cecd8d80f01720cbad10466ed26900f019d848066b92902000066b80800000066ba000000000f300f01d10f013b", 0x3f}], 0x1, 0x0, &(0x7f0000000300), 0x0) select(0xffffffffffffffb4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x81}, &(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)={0x0, 0x7530}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 23:54:06 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x10000) r1 = accept4(r0, &(0x7f0000000340)=@alg, &(0x7f0000000040)=0x80, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000000080)='X', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) write$binfmt_misc(r2, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x34000) sendmmsg$alg(r1, &(0x7f0000000700)=[{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)='C', 0x1}], 0x1}], 0x1, 0x0) 23:54:06 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000080)={&(0x7f0000000100), 0xc, &(0x7f0000000380)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000000301ffff808f00003d8885000000ae1b"], 0x14}}, 0x0) [ 279.714173] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. [ 279.823187] ================================================================== [ 279.830653] BUG: KMSAN: uninit-value in vmx_set_constant_host_state+0x1778/0x1830 [ 279.838325] CPU: 1 PID: 7968 Comm: syz-executor3 Not tainted 4.19.0-rc4+ #65 [ 279.845540] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 279.854928] Call Trace: [ 279.857562] dump_stack+0x306/0x460 [ 279.861237] ? vmx_set_constant_host_state+0x1778/0x1830 [ 279.866777] kmsan_report+0x1a2/0x2e0 [ 279.870640] __msan_warning+0x7c/0xe0 [ 279.874497] vmx_set_constant_host_state+0x1778/0x1830 [ 279.879854] vmx_create_vcpu+0x3e6f/0x7870 [ 279.884137] ? kmsan_set_origin_inline+0x6b/0x120 [ 279.889021] ? __msan_poison_alloca+0x17a/0x210 [ 279.893767] ? vmx_vm_init+0x340/0x340 [ 279.897723] kvm_arch_vcpu_create+0x25d/0x2f0 [ 279.902286] kvm_vm_ioctl+0x13fd/0x33d0 [ 279.906317] ? __msan_poison_alloca+0x17a/0x210 [ 279.911038] ? do_vfs_ioctl+0x18a/0x2810 [ 279.915134] ? __se_sys_ioctl+0x1da/0x270 [ 279.919318] ? vcpu_stat_clear_per_vm+0x420/0x420 [ 279.924200] ? vcpu_stat_clear_per_vm+0x420/0x420 [ 279.929095] do_vfs_ioctl+0xcf3/0x2810 [ 279.933054] ? security_file_ioctl+0x92/0x200 [ 279.937608] __se_sys_ioctl+0x1da/0x270 [ 279.941651] __x64_sys_ioctl+0x4a/0x70 [ 279.945586] do_syscall_64+0xbe/0x100 [ 279.949446] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 279.954680] RIP: 0033:0x457579 [ 279.957929] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 279.976875] RSP: 002b:00007f04bbf1cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 279.984622] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579 [ 279.991921] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000006 [ 279.999229] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 280.006531] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f04bbf1d6d4 [ 280.013830] R13: 00000000004bfc18 R14: 00000000004cfca0 R15: 00000000ffffffff [ 280.021143] [ 280.022788] Local variable description: ----dt@vmx_set_constant_host_state [ 280.029815] Variable was created at: [ 280.033569] vmx_set_constant_host_state+0x2b0/0x1830 [ 280.038790] vmx_create_vcpu+0x3e6f/0x7870 [ 280.043038] ================================================================== [ 280.050414] Disabling lock debugging due to kernel taint [ 280.055882] Kernel panic - not syncing: panic_on_warn set ... [ 280.055882] [ 280.063295] CPU: 1 PID: 7968 Comm: syz-executor3 Tainted: G B 4.19.0-rc4+ #65 [ 280.071898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 280.081276] Call Trace: [ 280.083901] dump_stack+0x306/0x460 [ 280.087593] panic+0x54c/0xafa [ 280.090874] ? __msan_metadata_ptr_for_store_1+0x13/0x20 [ 280.096373] kmsan_report+0x2d3/0x2e0 [ 280.100217] __msan_warning+0x7c/0xe0 [ 280.104066] vmx_set_constant_host_state+0x1778/0x1830 [ 280.109399] vmx_create_vcpu+0x3e6f/0x7870 [ 280.113669] ? kmsan_set_origin_inline+0x6b/0x120 [ 280.118564] ? __msan_poison_alloca+0x17a/0x210 23:54:07 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x10000) r1 = accept4(r0, &(0x7f0000000340)=@alg, &(0x7f0000000040)=0x80, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000000080)='X', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) write$binfmt_misc(r2, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x34000) sendmmsg$alg(r1, &(0x7f0000000700)=[{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)='C', 0x1}], 0x1}], 0x1, 0x0) [ 280.123292] ? vmx_vm_init+0x340/0x340 [ 280.127224] kvm_arch_vcpu_create+0x25d/0x2f0 [ 280.131783] kvm_vm_ioctl+0x13fd/0x33d0 [ 280.135827] ? __msan_poison_alloca+0x17a/0x210 [ 280.140551] ? do_vfs_ioctl+0x18a/0x2810 [ 280.144662] ? __se_sys_ioctl+0x1da/0x270 [ 280.148869] ? vcpu_stat_clear_per_vm+0x420/0x420 [ 280.153760] ? vcpu_stat_clear_per_vm+0x420/0x420 [ 280.158642] do_vfs_ioctl+0xcf3/0x2810 [ 280.162590] ? security_file_ioctl+0x92/0x200 [ 280.167140] __se_sys_ioctl+0x1da/0x270 [ 280.171171] __x64_sys_ioctl+0x4a/0x70 [ 280.175104] do_syscall_64+0xbe/0x100 [ 280.178954] entry_SYSCALL_64_after_hwframe+0x63/0xe7 [ 280.184181] RIP: 0033:0x457579 [ 280.187420] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 280.206346] RSP: 002b:00007f04bbf1cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 280.214086] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579 [ 280.221375] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000006 [ 280.228674] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 280.235980] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f04bbf1d6d4 [ 280.243285] R13: 00000000004bfc18 R14: 00000000004cfca0 R15: 00000000ffffffff [ 280.251696] Kernel Offset: disabled [ 280.255347] Rebooting in 86400 seconds..