[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [ 36.206959][ T26] audit: type=1800 audit(1570241770.779:25): pid=7177 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="cron" dev="sda1" ino=2447 res=0 [ 36.258358][ T26] audit: type=1800 audit(1570241770.779:26): pid=7177 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="mcstrans" dev="sda1" ino=2490 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [ 36.860840][ T7242] sshd (7242) used greatest stack depth: 10032 bytes left [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.235' (ECDSA) to the list of known hosts. 2019/10/05 02:16:18 fuzzer started 2019/10/05 02:16:20 dialing manager at 10.128.0.105:35709 2019/10/05 02:16:20 syscalls: 2523 2019/10/05 02:16:20 code coverage: enabled 2019/10/05 02:16:20 comparison tracing: enabled 2019/10/05 02:16:20 extra coverage: extra coverage is not supported by the kernel 2019/10/05 02:16:20 setuid sandbox: enabled 2019/10/05 02:16:20 namespace sandbox: enabled 2019/10/05 02:16:20 Android sandbox: /sys/fs/selinux/policy does not exist 2019/10/05 02:16:20 fault injection: enabled 2019/10/05 02:16:20 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2019/10/05 02:16:20 net packet injection: enabled 2019/10/05 02:16:20 net device setup: enabled 2019/10/05 02:16:20 concurrency sanitizer: enabled 02:16:22 executing program 0: syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000080)=""/61) perf_event_open(&(0x7f0000001000)={0x0, 0xffffffffffffffcb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$chown(0x12, 0x0, 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0x0) keyctl$reject(0x13, 0x0, 0x200, 0x100, r0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [{}, {}], {}, [{}, {}, {}, {}, {0x8, 0x1}]}, 0x5c, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) syzkaller login: [ 47.854461][ T7349] IPVS: ftp: loaded support on port[0] = 21 [ 47.942162][ T7349] chnl_net:caif_netlink_parms(): no params data found [ 47.979536][ T7349] bridge0: port 1(bridge_slave_0) entered blocking state 02:16:22 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$SEM_STAT(0x0, 0x3, 0x12, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000004ec0)=[{{&(0x7f0000003b00)=@isdn, 0x80, &(0x7f0000004200)=[{&(0x7f0000003b80)=""/212, 0xd4}, {&(0x7f0000003c80)=""/165, 0xa5}, {&(0x7f0000003d40)=""/173, 0xad}, {&(0x7f0000005080)=""/192, 0x73}, {&(0x7f0000003ec0)=""/160, 0xa0}, {&(0x7f0000003f80)=""/50, 0x32}, {&(0x7f0000003fc0)=""/161, 0xa1}, {&(0x7f0000004080)=""/12, 0xc}, {&(0x7f00000040c0)=""/213, 0xd5}, {&(0x7f00000041c0)=""/25, 0x19}], 0x2e0, &(0x7f00000042c0)=""/8, 0x8}, 0x7fffffff}, {{&(0x7f0000004300)=@rc, 0x80, &(0x7f0000004740)=[{&(0x7f0000004380)=""/237, 0xed}, {&(0x7f0000004480)=""/5, 0xcb}, {&(0x7f00000044c0)=""/97, 0x61}, {&(0x7f0000004540)=""/223, 0xdf}, {&(0x7f0000004640)=""/1, 0x1}, {&(0x7f0000004680)=""/179, 0xb3}], 0x6, &(0x7f00000047c0)=""/105, 0x69}, 0x7f}, {{&(0x7f0000004840)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000004b40)=[{&(0x7f00000048c0)=""/33, 0x21}, {&(0x7f0000004900)=""/91, 0x5b}, {&(0x7f0000004980)=""/73, 0x49}, {&(0x7f0000004a00)=""/26, 0x1a}, {&(0x7f0000004a40)=""/220, 0xdc}], 0x5, &(0x7f0000004bc0)=""/155, 0x9b}, 0x1}, {{0x0, 0x0, &(0x7f0000004e00)=[{&(0x7f0000004c80)=""/188, 0xbc}, {&(0x7f0000004fc0)=""/180, 0xb4}], 0x2, &(0x7f0000004e40)=""/67, 0x43}, 0x1}], 0x40000000000009c, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) creat(0x0, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) clone(0xc75e43cfae22dd4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x100000, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) setsockopt$nfc_llcp_NFC_LLCP_RW(r4, 0x118, 0x0, &(0x7f0000000300)=0xffffffff, 0x4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="aba102ca93ffdc5b1992fc7b933f46a76d96f50a92162d4da2539a45c2fe3918a4234600000000", @ANYRES16=r6], 0x2}}, 0x0) socket(0x10, 0x803, 0x0) [ 47.987346][ T7349] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.996582][ T7349] device bridge_slave_0 entered promiscuous mode [ 48.004330][ T7349] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.018518][ T7349] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.035992][ T7349] device bridge_slave_1 entered promiscuous mode [ 48.078396][ T7349] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.106284][ T7349] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.147988][ T7349] team0: Port device team_slave_0 added [ 48.164866][ T7349] team0: Port device team_slave_1 added 02:16:22 executing program 2: perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9}, 0x0, 0x0, 0x0, 0x0, 0xfeca}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) lstat(&(0x7f0000000f00)='./file0\x00', 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000134000)={0x2, 0x4e23, @broadcast}, 0x10) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) sendto$inet(r0, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x222a6d8102856fd9) socket$inet6(0xa, 0x1000000000002, 0x0) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)=ANY=[@ANYBLOB="70c900"], &(0x7f000095dffc)=0x1) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x1}, &(0x7f0000000040)=0x10) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000004c0)={0x0, 0xfff}, 0x8) r2 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) r3 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f00000001c0)="5c755bb00e32b5f3908b7a908fd86455b6c5cbf577253da3f8458f5d20999bd1a53ca41a5e6173ba85edbe85c4112fccd88794654d4aef715e8de74e2051a561831a59531222ab3c60dcd105449899d623725cde31fe75fc28140fb7babc5191d0657ef9c96df7b81c68f1885a76917a6229f02e7990ca9aacbc864447220c886b71495ead4b0008e14a87af261e70be95d65759dbe2b292b704c67993012152a0fadab652a610c199416c476358e8e577db9e5744b9e8ee2f3c4e248f0a3606", 0xc0, 0xfffffffffffffffb) r4 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, r3, r4}, 0x0, 0x0, 0x0) add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) [ 48.277393][ T7349] device hsr_slave_0 entered promiscuous mode [ 48.315013][ T7349] device hsr_slave_1 entered promiscuous mode [ 48.362700][ T7352] IPVS: ftp: loaded support on port[0] = 21 [ 48.363617][ T7349] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.375716][ T7349] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.383067][ T7349] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.390229][ T7349] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.507584][ T7349] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.545533][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.564978][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.593314][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.602997][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready 02:16:23 executing program 3: ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000800)='./cgroup\x00', 0x200002, 0x0) openat$cgroup_ro(r0, &(0x7f0000000340)='cpuset.memory_pressure\x00', 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x12, 0x4, &(0x7f00000033c0)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x2, 0x1}]}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfb, &(0x7f0000000200)=""/251, 0x0, 0x0, [], 0x0, 0xf}, 0x48) gettid() ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000780)={r1, r2, 0xf, 0x1}, 0x10) r3 = socket$inet6_sctp(0xa, 0x0, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f00000001c0), &(0x7f00000000c0)=0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x34}, 0x98) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_subtree(r5, 0x0, 0x0) [ 48.614839][ T7349] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.633420][ T7355] IPVS: ftp: loaded support on port[0] = 21 [ 48.652653][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.665206][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.672244][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.712006][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.721809][ T44] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.728894][ T44] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.768373][ T3022] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 48.809525][ T3022] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 48.819062][ T3022] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 48.836880][ T3022] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.849211][ T3022] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.863492][ T7349] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 48.889581][ T7352] chnl_net:caif_netlink_parms(): no params data found [ 48.936075][ T7349] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 48.936812][ T7360] IPVS: ftp: loaded support on port[0] = 21 [ 49.037398][ T7352] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.044500][ T7352] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.054407][ T7352] device bridge_slave_0 entered promiscuous mode [ 49.066083][ T7352] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.073283][ T7352] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.081669][ T7352] device bridge_slave_1 entered promiscuous mode 02:16:23 executing program 4: r0 = socket(0x15, 0x80005, 0x0) getsockopt(r0, 0x114, 0x2710, 0x0, &(0x7f000033bffc)) [ 49.137285][ T7355] chnl_net:caif_netlink_parms(): no params data found [ 49.207042][ T7352] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.260456][ T7352] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.271863][ C0] hrtimer: interrupt took 26725 ns [ 49.325835][ T7370] overlayfs: lowerdir is in-use as upperdir/workdir [ 49.361478][ T7352] team0: Port device team_slave_0 added [ 49.368601][ T7352] team0: Port device team_slave_1 added [ 49.384714][ T7360] chnl_net:caif_netlink_parms(): no params data found [ 49.394355][ T7355] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.404394][ T7355] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.427810][ T7371] overlayfs: workdir and upperdir must reside under the same mount [ 49.435509][ T7355] device bridge_slave_0 entered promiscuous mode [ 49.471374][ T7355] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.484750][ T7355] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.504722][ T7355] device bridge_slave_1 entered promiscuous mode 02:16:24 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff}) socket$inet6(0xa, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x0, 0x0, @dev, 0x4611}}}, &(0x7f0000000380)=0x84) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, 0x0, &(0x7f0000000440)) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0xff15, 0x2, 0x0, 0x0, 0x3, 0x8}, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socket$unix(0x1, 0x0, 0x0) getpeername$unix(0xffffffffffffffff, 0x0, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) socket$caif_stream(0x25, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) socket$inet6(0xa, 0x1, 0x8010000000000084) 02:16:24 executing program 0: syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000080)=""/61) perf_event_open(&(0x7f0000001000)={0x0, 0xffffffffffffffcb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$chown(0x12, 0x0, 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0x0) keyctl$reject(0x13, 0x0, 0x200, 0x100, r0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [{}, {}], {}, [{}, {}, {}, {}, {0x8, 0x1}]}, 0x5c, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) [ 49.580610][ T7352] device hsr_slave_0 entered promiscuous mode [ 49.636460][ T7352] device hsr_slave_1 entered promiscuous mode [ 49.678061][ T7352] debugfs: Directory 'hsr0' with parent '/' already present! [ 49.719055][ T7352] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.726175][ T7352] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.733458][ T7352] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.740523][ T7352] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.744995][ T7377] overlayfs: lowerdir is in-use as upperdir/workdir [ 49.759708][ T7373] IPVS: ftp: loaded support on port[0] = 21 [ 49.805459][ T7355] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.815032][ T7360] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.822147][ T7360] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.830426][ T7360] device bridge_slave_0 entered promiscuous mode [ 49.844144][ T7355] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.857623][ T7360] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.865118][ T7360] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.873414][ T7360] device bridge_slave_1 entered promiscuous mode [ 49.900248][ T7380] IPVS: ftp: loaded support on port[0] = 21 02:16:24 executing program 0: syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000080)=""/61) perf_event_open(&(0x7f0000001000)={0x0, 0xffffffffffffffcb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$chown(0x12, 0x0, 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0x0) keyctl$reject(0x13, 0x0, 0x200, 0x100, r0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [{}, {}], {}, [{}, {}, {}, {}, {0x8, 0x1}]}, 0x5c, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) [ 49.957737][ T7355] team0: Port device team_slave_0 added [ 49.967078][ T7360] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.983166][ T7352] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.025536][ T7355] team0: Port device team_slave_1 added [ 50.050585][ T7360] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 50.075122][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.089380][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.089591][ T7382] overlayfs: lowerdir is in-use as upperdir/workdir [ 50.104990][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready 02:16:24 executing program 0: syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000080)=""/61) perf_event_open(&(0x7f0000001000)={0x0, 0xffffffffffffffcb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$chown(0x12, 0x0, 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0x0) keyctl$reject(0x13, 0x0, 0x200, 0x100, r0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [{}, {}], {}, [{}, {}, {}, {}, {0x8, 0x1}]}, 0x5c, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) [ 50.176934][ T7355] device hsr_slave_0 entered promiscuous mode [ 50.225107][ T7355] device hsr_slave_1 entered promiscuous mode [ 50.265025][ T7355] debugfs: Directory 'hsr0' with parent '/' already present! [ 50.283679][ T7360] team0: Port device team_slave_0 added [ 50.290751][ T7387] overlayfs: lowerdir is in-use as upperdir/workdir [ 50.297866][ T7352] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.317438][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 50.325444][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 50.334237][ T7360] team0: Port device team_slave_1 added 02:16:25 executing program 0: syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000080)=""/61) perf_event_open(&(0x7f0000001000)={0x0, 0xffffffffffffffcb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$chown(0x12, 0x0, 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0x0) keyctl$reject(0x13, 0x0, 0x200, 0x100, r0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [{}, {}], {}, [{}, {}, {}, {}, {0x8, 0x1}]}, 0x5c, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) [ 50.418119][ T7360] device hsr_slave_0 entered promiscuous mode [ 50.455012][ T7360] device hsr_slave_1 entered promiscuous mode [ 50.514776][ T7360] debugfs: Directory 'hsr0' with parent '/' already present! [ 50.519485][ T7391] overlayfs: lowerdir is in-use as upperdir/workdir [ 50.532661][ T7352] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 50.546256][ T7352] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 50.581517][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 50.592149][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 50.600455][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.607494][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.615442][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 50.623795][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 50.632086][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.639176][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.647239][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 50.655758][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 50.664147][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 50.672598][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 50.680950][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 50.689546][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 50.698089][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 50.706366][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 50.714485][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 50.722865][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 50.731941][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 50.739770][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 02:16:25 executing program 0: syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000080)=""/61) perf_event_open(&(0x7f0000001000)={0x0, 0xffffffffffffffcb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$chown(0x12, 0x0, 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0x0) keyctl$reject(0x13, 0x0, 0x200, 0x100, r0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [{}, {}], {}, [{}, {}, {}, {}, {0x8, 0x1}]}, 0x5c, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) [ 50.815356][ T7373] chnl_net:caif_netlink_parms(): no params data found [ 50.857627][ T7352] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.905317][ T7380] chnl_net:caif_netlink_parms(): no params data found [ 50.931178][ T7360] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.972134][ T7355] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.989099][ T7373] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.002234][ T7373] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.010680][ T7373] device bridge_slave_0 entered promiscuous mode [ 51.018316][ T7373] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.025493][ T7373] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.033351][ T7373] device bridge_slave_1 entered promiscuous mode [ 51.048352][ T7355] 8021q: adding VLAN 0 to HW filter on device team0 [ 51.060294][ T7360] 8021q: adding VLAN 0 to HW filter on device team0 [ 51.077215][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 51.085309][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 51.092861][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 51.101012][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 51.109182][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 51.117877][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.126924][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.133958][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.142155][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 51.178368][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 51.192241][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.201526][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.208605][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.218714][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 02:16:25 executing program 0: syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000080)=""/61) perf_event_open(&(0x7f0000001000)={0x0, 0xffffffffffffffcb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$chown(0x12, 0x0, 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0x0) keyctl$reject(0x13, 0x0, 0x200, 0x100, r0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [{}, {}], {}, [{}, {}, {}, {}, {0x8, 0x1}]}, 0x5c, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) [ 51.227491][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 51.242969][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.250062][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.262059][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 51.282607][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 51.291271][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.298320][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.307343][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 51.315724][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 51.328283][ T7373] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.353240][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 51.367238][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 51.389630][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 51.402561][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 51.413805][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 51.435541][ T7408] IPVS: ftp: loaded support on port[0] = 21 [ 51.436435][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 51.456898][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 51.496668][ T7373] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.525079][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 51.549738][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 51.567861][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 51.579289][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 51.590426][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 51.607318][ T7380] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.618573][ T7380] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.628004][ T7380] device bridge_slave_0 entered promiscuous mode [ 51.698904][ T7355] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 51.713638][ T7355] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 51.725817][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 51.733991][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 51.742865][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 51.751439][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 51.759899][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 51.768423][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 51.776967][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 51.785221][ T44] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 51.799429][ T7380] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.808621][ T7380] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.823278][ T7380] device bridge_slave_1 entered promiscuous mode [ 51.843642][ T7373] team0: Port device team_slave_0 added [ 51.854377][ T7373] team0: Port device team_slave_1 added [ 51.865665][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 51.877485][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 51.916691][ T7414] overlayfs: lowerdir is in-use as upperdir/workdir [ 51.933404][ T7380] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.949777][ T7355] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 51.997683][ T7373] device hsr_slave_0 entered promiscuous mode [ 52.037240][ T7373] device hsr_slave_1 entered promiscuous mode 02:16:26 executing program 0: syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000080)=""/61) perf_event_open(&(0x7f0000001000)={0x0, 0xffffffffffffffcb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$chown(0x12, 0x0, 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0x0) keyctl$reject(0x13, 0x0, 0x200, 0x100, r0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [{}, {}], {}, [{}, {}, {}, {}, {0x8, 0x1}]}, 0x5c, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) [ 52.070838][ T7407] IPVS: ftp: loaded support on port[0] = 21 [ 52.108611][ T7373] debugfs: Directory 'hsr0' with parent '/' already present! [ 52.120639][ T7360] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 52.147219][ T7380] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 52.171751][ T7420] overlayfs: lowerdir is in-use as upperdir/workdir [ 52.230814][ T7373] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.243560][ T7373] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.266098][ T7373] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 52.281608][ T7373] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 52.301950][ T7373] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 52.737761][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 52.749258][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 52.757588][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 52.766757][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 52.775471][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.782582][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.793470][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 52.802224][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 52.816203][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.823266][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.832335][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 52.841610][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 52.861269][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 52.873441][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 52.890181][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 52.899529][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 52.908308][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 52.916755][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 52.925769][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 52.933991][ T43] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 52.949806][ T7360] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 52.973117][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 52.981541][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 52.990719][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 53.000896][ T7380] team0: Port device team_slave_0 added [ 53.023300][ T7380] team0: Port device team_slave_1 added [ 53.127475][ T7380] device hsr_slave_0 entered promiscuous mode [ 53.149416][ T7380] device hsr_slave_1 entered promiscuous mode 02:16:27 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$SEM_STAT(0x0, 0x3, 0x12, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000004ec0)=[{{&(0x7f0000003b00)=@isdn, 0x80, &(0x7f0000004200)=[{&(0x7f0000003b80)=""/212, 0xd4}, {&(0x7f0000003c80)=""/165, 0xa5}, {&(0x7f0000003d40)=""/173, 0xad}, {&(0x7f0000005080)=""/192, 0x73}, {&(0x7f0000003ec0)=""/160, 0xa0}, {&(0x7f0000003f80)=""/50, 0x32}, {&(0x7f0000003fc0)=""/161, 0xa1}, {&(0x7f0000004080)=""/12, 0xc}, {&(0x7f00000040c0)=""/213, 0xd5}, {&(0x7f00000041c0)=""/25, 0x19}], 0x2e0, &(0x7f00000042c0)=""/8, 0x8}, 0x7fffffff}, {{&(0x7f0000004300)=@rc, 0x80, &(0x7f0000004740)=[{&(0x7f0000004380)=""/237, 0xed}, {&(0x7f0000004480)=""/5, 0xcb}, {&(0x7f00000044c0)=""/97, 0x61}, {&(0x7f0000004540)=""/223, 0xdf}, {&(0x7f0000004640)=""/1, 0x1}, {&(0x7f0000004680)=""/179, 0xb3}], 0x6, &(0x7f00000047c0)=""/105, 0x69}, 0x7f}, {{&(0x7f0000004840)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000004b40)=[{&(0x7f00000048c0)=""/33, 0x21}, {&(0x7f0000004900)=""/91, 0x5b}, {&(0x7f0000004980)=""/73, 0x49}, {&(0x7f0000004a00)=""/26, 0x1a}, {&(0x7f0000004a40)=""/220, 0xdc}], 0x5, &(0x7f0000004bc0)=""/155, 0x9b}, 0x1}, {{0x0, 0x0, &(0x7f0000004e00)=[{&(0x7f0000004c80)=""/188, 0xbc}, {&(0x7f0000004fc0)=""/180, 0xb4}], 0x2, &(0x7f0000004e40)=""/67, 0x43}, 0x1}], 0x40000000000009c, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) creat(0x0, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) clone(0xc75e43cfae22dd4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x100000, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) setsockopt$nfc_llcp_NFC_LLCP_RW(r4, 0x118, 0x0, &(0x7f0000000300)=0xffffffff, 0x4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="aba102ca93ffdc5b1992fc7b933f46a76d96f50a92162d4da2539a45c2fe3918a4234600000000", @ANYRES16=r6], 0x2}}, 0x0) socket(0x10, 0x803, 0x0) 02:16:27 executing program 4: r0 = socket(0x15, 0x80005, 0x0) getsockopt(r0, 0x114, 0x2710, 0x0, &(0x7f000033bffc)) [ 53.204784][ T7380] debugfs: Directory 'hsr0' with parent '/' already present! [ 53.361443][ T7380] 8021q: adding VLAN 0 to HW filter on device bond0 [ 53.382381][ T3022] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 53.391532][ T3022] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 53.426919][ T7380] 8021q: adding VLAN 0 to HW filter on device team0 [ 53.462358][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 53.498812][ T7453] IPVS: ftp: loaded support on port[0] = 21 [ 53.501130][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 53.543167][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.550312][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.724821][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 53.733166][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 53.742659][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 53.751540][ T17] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.758643][ T17] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.795368][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 53.804426][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 53.813710][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 53.822563][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 53.831485][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 53.840210][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 53.849209][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 53.858939][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 53.867493][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 53.876037][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 53.884541][ T7409] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 53.894681][ T7380] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 53.939471][ T7380] 8021q: adding VLAN 0 to HW filter on device batadv0 02:16:28 executing program 2: perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9}, 0x0, 0x0, 0x0, 0x0, 0xfeca}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) lstat(&(0x7f0000000f00)='./file0\x00', 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000134000)={0x2, 0x4e23, @broadcast}, 0x10) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) sendto$inet(r0, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x222a6d8102856fd9) socket$inet6(0xa, 0x1000000000002, 0x0) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)=ANY=[@ANYBLOB="70c900"], &(0x7f000095dffc)=0x1) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x1}, &(0x7f0000000040)=0x10) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000004c0)={0x0, 0xfff}, 0x8) r2 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) r3 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f00000001c0)="5c755bb00e32b5f3908b7a908fd86455b6c5cbf577253da3f8458f5d20999bd1a53ca41a5e6173ba85edbe85c4112fccd88794654d4aef715e8de74e2051a561831a59531222ab3c60dcd105449899d623725cde31fe75fc28140fb7babc5191d0657ef9c96df7b81c68f1885a76917a6229f02e7990ca9aacbc864447220c886b71495ead4b0008e14a87af261e70be95d65759dbe2b292b704c67993012152a0fadab652a610c199416c476358e8e577db9e5744b9e8ee2f3c4e248f0a3606", 0xc0, 0xfffffffffffffffb) r4 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, r3, r4}, 0x0, 0x0, 0x0) add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) 02:16:28 executing program 0: syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000080)=""/61) perf_event_open(&(0x7f0000001000)={0x0, 0xffffffffffffffcb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$chown(0x12, 0x0, 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0x0) keyctl$reject(0x13, 0x0, 0x200, 0x100, r0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [{}, {}], {}, [{}, {}, {}, {}, {0x8, 0x1}]}, 0x5c, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) [ 54.980778][ T7473] debugfs: File '7465' in directory 'proc' already present! 02:16:29 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff}) socket$inet6(0xa, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x0, 0x0, @dev, 0x4611}}}, &(0x7f0000000380)=0x84) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, 0x0, &(0x7f0000000440)) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0xff15, 0x2, 0x0, 0x0, 0x3, 0x8}, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socket$unix(0x1, 0x0, 0x0) getpeername$unix(0xffffffffffffffff, 0x0, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) socket$caif_stream(0x25, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) socket$inet6(0xa, 0x1, 0x8010000000000084) 02:16:29 executing program 4: r0 = socket(0x15, 0x80005, 0x0) getsockopt(r0, 0x114, 0x2710, 0x0, &(0x7f000033bffc)) 02:16:29 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) semctl$SEM_STAT(0x0, 0x3, 0x12, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000004ec0)=[{{&(0x7f0000003b00)=@isdn, 0x80, &(0x7f0000004200)=[{&(0x7f0000003b80)=""/212, 0xd4}, {&(0x7f0000003c80)=""/165, 0xa5}, {&(0x7f0000003d40)=""/173, 0xad}, {&(0x7f0000005080)=""/192, 0x73}, {&(0x7f0000003ec0)=""/160, 0xa0}, {&(0x7f0000003f80)=""/50, 0x32}, {&(0x7f0000003fc0)=""/161, 0xa1}, {&(0x7f0000004080)=""/12, 0xc}, {&(0x7f00000040c0)=""/213, 0xd5}, {&(0x7f00000041c0)=""/25, 0x19}], 0x2e0, &(0x7f00000042c0)=""/8, 0x8}, 0x7fffffff}, {{&(0x7f0000004300)=@rc, 0x80, &(0x7f0000004740)=[{&(0x7f0000004380)=""/237, 0xed}, {&(0x7f0000004480)=""/5, 0xcb}, {&(0x7f00000044c0)=""/97, 0x61}, {&(0x7f0000004540)=""/223, 0xdf}, {&(0x7f0000004640)=""/1, 0x1}, {&(0x7f0000004680)=""/179, 0xb3}], 0x6, &(0x7f00000047c0)=""/105, 0x69}, 0x7f}, {{&(0x7f0000004840)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000004b40)=[{&(0x7f00000048c0)=""/33, 0x21}, {&(0x7f0000004900)=""/91, 0x5b}, {&(0x7f0000004980)=""/73, 0x49}, {&(0x7f0000004a00)=""/26, 0x1a}, {&(0x7f0000004a40)=""/220, 0xdc}], 0x5, &(0x7f0000004bc0)=""/155, 0x9b}, 0x1}, {{0x0, 0x0, &(0x7f0000004e00)=[{&(0x7f0000004c80)=""/188, 0xbc}, {&(0x7f0000004fc0)=""/180, 0xb4}], 0x2, &(0x7f0000004e40)=""/67, 0x43}, 0x1}], 0x40000000000009c, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) creat(0x0, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) write$binfmt_elf32(0xffffffffffffffff, 0x0, 0x0) clone(0xc75e43cfae22dd4, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getpid() openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x100000, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) setsockopt$nfc_llcp_NFC_LLCP_RW(r4, 0x118, 0x0, &(0x7f0000000300)=0xffffffff, 0x4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="aba102ca93ffdc5b1992fc7b933f46a76d96f50a92162d4da2539a45c2fe3918a4234600000000", @ANYRES16=r6], 0x2}}, 0x0) socket(0x10, 0x803, 0x0) 02:16:29 executing program 2: perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9}, 0x0, 0x0, 0x0, 0x0, 0xfeca}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) lstat(&(0x7f0000000f00)='./file0\x00', 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000134000)={0x2, 0x4e23, @broadcast}, 0x10) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) sendto$inet(r0, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x222a6d8102856fd9) socket$inet6(0xa, 0x1000000000002, 0x0) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)=ANY=[@ANYBLOB="70c900"], &(0x7f000095dffc)=0x1) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x1}, &(0x7f0000000040)=0x10) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000004c0)={0x0, 0xfff}, 0x8) r2 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) r3 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f00000001c0)="5c755bb00e32b5f3908b7a908fd86455b6c5cbf577253da3f8458f5d20999bd1a53ca41a5e6173ba85edbe85c4112fccd88794654d4aef715e8de74e2051a561831a59531222ab3c60dcd105449899d623725cde31fe75fc28140fb7babc5191d0657ef9c96df7b81c68f1885a76917a6229f02e7990ca9aacbc864447220c886b71495ead4b0008e14a87af261e70be95d65759dbe2b292b704c67993012152a0fadab652a610c199416c476358e8e577db9e5744b9e8ee2f3c4e248f0a3606", 0xc0, 0xfffffffffffffffb) r4 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, r3, r4}, 0x0, 0x0, 0x0) add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) 02:16:29 executing program 3: ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000800)='./cgroup\x00', 0x200002, 0x0) openat$cgroup_ro(r0, &(0x7f0000000340)='cpuset.memory_pressure\x00', 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x12, 0x4, &(0x7f00000033c0)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x2, 0x1}]}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfb, &(0x7f0000000200)=""/251, 0x0, 0x0, [], 0x0, 0xf}, 0x48) gettid() ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000780)={r1, r2, 0xf, 0x1}, 0x10) r3 = socket$inet6_sctp(0xa, 0x0, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f00000001c0), &(0x7f00000000c0)=0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x34}, 0x98) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_subtree(r5, 0x0, 0x0) 02:16:29 executing program 0: syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x0) ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000080)=""/61) perf_event_open(&(0x7f0000001000)={0x0, 0xffffffffffffffcb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) keyctl$chown(0x12, 0x0, 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000000140)='keyring\x00', 0x0, 0x0, 0x0, 0x0) keyctl$reject(0x13, 0x0, 0x200, 0x100, r0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mkdir(&(0x7f00000009c0)='./file1\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='system.posix_acl_default\x00', &(0x7f0000000c40)={{}, {}, [{}, {}], {}, [{}, {}, {}, {}, {0x8, 0x1}]}, 0x5c, 0x0) mount$overlay(0x40000a, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './file1'}, 0x5c}], [], 0xf603000000000000}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='cgroup2\x00', 0x0, 0x0) [ 55.374392][ T7504] IPVS: ftp: loaded support on port[0] = 21 02:16:30 executing program 2: perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9}, 0x0, 0x0, 0x0, 0x0, 0xfeca}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) lstat(&(0x7f0000000f00)='./file0\x00', 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000134000)={0x2, 0x4e23, @broadcast}, 0x10) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) sendto$inet(r0, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x222a6d8102856fd9) socket$inet6(0xa, 0x1000000000002, 0x0) add_key$keyring(0x0, &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f000095dff8)=ANY=[@ANYBLOB="70c900"], &(0x7f000095dffc)=0x1) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x1}, &(0x7f0000000040)=0x10) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000004c0)={0x0, 0xfff}, 0x8) r2 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) r3 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f00000001c0)="5c755bb00e32b5f3908b7a908fd86455b6c5cbf577253da3f8458f5d20999bd1a53ca41a5e6173ba85edbe85c4112fccd88794654d4aef715e8de74e2051a561831a59531222ab3c60dcd105449899d623725cde31fe75fc28140fb7babc5191d0657ef9c96df7b81c68f1885a76917a6229f02e7990ca9aacbc864447220c886b71495ead4b0008e14a87af261e70be95d65759dbe2b292b704c67993012152a0fadab652a610c199416c476358e8e577db9e5744b9e8ee2f3c4e248f0a3606", 0xc0, 0xfffffffffffffffb) r4 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, r3, r4}, 0x0, 0x0, 0x0) add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="c3", 0x1, 0xffffffffffffffff) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) 02:16:30 executing program 4: r0 = socket(0x15, 0x80005, 0x0) getsockopt(r0, 0x114, 0x2710, 0x0, &(0x7f000033bffc)) 02:16:30 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff}) socket$inet6(0xa, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x0, 0x0, @dev, 0x4611}}}, &(0x7f0000000380)=0x84) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, 0x0, &(0x7f0000000440)) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0xff15, 0x2, 0x0, 0x0, 0x3, 0x8}, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socket$unix(0x1, 0x0, 0x0) getpeername$unix(0xffffffffffffffff, 0x0, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) socket$caif_stream(0x25, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) socket$inet6(0xa, 0x1, 0x8010000000000084) 02:16:30 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff}) socket$inet6(0xa, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x0, 0x0, @dev, 0x4611}}}, &(0x7f0000000380)=0x84) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, 0x0, &(0x7f0000000440)) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0xff15, 0x2, 0x0, 0x0, 0x3, 0x8}, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socket$unix(0x1, 0x0, 0x0) getpeername$unix(0xffffffffffffffff, 0x0, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) socket$caif_stream(0x25, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) socket$inet6(0xa, 0x1, 0x8010000000000084) 02:16:30 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff}) socket$inet6(0xa, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x0, 0x0, @dev, 0x4611}}}, &(0x7f0000000380)=0x84) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, 0x0, &(0x7f0000000440)) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0xff15, 0x2, 0x0, 0x0, 0x3, 0x8}, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socket$unix(0x1, 0x0, 0x0) getpeername$unix(0xffffffffffffffff, 0x0, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) socket$caif_stream(0x25, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) socket$inet6(0xa, 0x1, 0x8010000000000084) [ 56.096929][ T7531] ================================================================== [ 56.100658][ T7497] caif:caif_disconnect_client(): nothing to disconnect [ 56.105130][ T7531] BUG: KCSAN: data-race in __splice_from_pipe / pipe_poll [ 56.105133][ T7531] [ 56.105146][ T7531] read to 0xffff888102deeb78 of 4 bytes by task 7528 on cpu 0: [ 56.105160][ T7531] pipe_poll+0x84/0x1d0 [ 56.105174][ T7531] do_select+0x7d0/0x1020 [ 56.105188][ T7531] core_sys_select+0x38b/0x520 [ 56.105202][ T7531] __x64_sys_pselect6+0x22a/0x280 [ 56.105219][ T7531] do_syscall_64+0xcf/0x2f0 [ 56.105237][ T7531] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 56.105239][ T7531] [ 56.105252][ T7531] write to 0xffff888102deeb78 of 4 bytes by task 7531 on cpu 1: [ 56.105266][ T7531] __splice_from_pipe+0x3ce/0x480 [ 56.105280][ T7531] do_vmsplice.part.0+0x1c5/0x210 [ 56.105293][ T7531] __do_sys_vmsplice+0x15f/0x1c0 [ 56.105307][ T7531] __x64_sys_vmsplice+0x5e/0x80 [ 56.105321][ T7531] do_syscall_64+0xcf/0x2f0 [ 56.105336][ T7531] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 56.105338][ T7531] [ 56.105341][ T7531] Reported by Kernel Concurrency Sanitizer on: [ 56.105356][ T7531] CPU: 1 PID: 7531 Comm: syz-executor.4 Not tainted 5.3.0+ #0 [ 56.105363][ T7531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 56.105367][ T7531] ================================================================== [ 56.105373][ T7531] Kernel panic - not syncing: panic_on_warn set ... [ 56.105386][ T7531] CPU: 1 PID: 7531 Comm: syz-executor.4 Not tainted 5.3.0+ #0 [ 56.105411][ T7531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 56.255711][ T7531] Call Trace: [ 56.259006][ T7531] dump_stack+0xf5/0x159 [ 56.263251][ T7531] panic+0x209/0x639 [ 56.267148][ T7531] ? vprintk_func+0x8d/0x140 [ 56.271739][ T7531] kcsan_report.cold+0x57/0xeb [ 56.276496][ T7531] __kcsan_setup_watchpoint+0x342/0x500 [ 56.282031][ T7531] __tsan_write4+0x32/0x40 [ 56.286445][ T7531] __splice_from_pipe+0x3ce/0x480 [ 56.291464][ T7531] ? iter_to_pipe+0x3f0/0x3f0 [ 56.296139][ T7531] do_vmsplice.part.0+0x1c5/0x210 [ 56.301162][ T7531] __do_sys_vmsplice+0x15f/0x1c0 [ 56.306098][ T7531] ? __tsan_read8+0x2c/0x30 [ 56.310597][ T7531] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 56.316308][ T7531] ? _copy_to_user+0x84/0xb0 [ 56.320927][ T7531] __x64_sys_vmsplice+0x5e/0x80 [ 56.325802][ T7531] do_syscall_64+0xcf/0x2f0 [ 56.330309][ T7531] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 56.336184][ T7531] RIP: 0033:0x459a59 [ 56.340072][ T7531] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 56.360614][ T7531] RSP: 002b:00007fe7a40e9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 56.369009][ T7531] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459a59 [ 56.376970][ T7531] RDX: 0000000000000001 RSI: 0000000020000000 RDI: 0000000000000007 [ 56.384930][ T7531] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 56.392889][ T7531] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe7a40ea6d4 [ 56.400846][ T7531] R13: 00000000004c94e3 R14: 00000000004e0c68 R15: 00000000ffffffff [ 56.410171][ T7531] Kernel Offset: disabled [ 56.414495][ T7531] Rebooting in 86400 seconds..