last executing test programs: 506.780263ms ago: executing program 0 (id=1): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ip_tables_targets\x00') preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000140)=""/220, 0xdc}], 0x1, 0x96, 0x0) 447.217816ms ago: executing program 0 (id=5): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r1) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_open_procfs$namespace(r0, &(0x7f0000000180)='ns/time\x00') 394.738601ms ago: executing program 3 (id=4): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000000000b6000040"]) 203.824079ms ago: executing program 3 (id=6): r0 = syz_usb_connect$cdc_ncm(0x2, 0x6e, &(0x7f0000000480)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6, 0x24, 0x1a, 0x0, 0x15}}, {{0x9, 0x5, 0x81, 0x3, 0x200, 0xff}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x20}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x0, 0xf}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0xc, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x0, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) 197.257053ms ago: executing program 1 (id=2): syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000319021508fd070100e56a010203010902240001080a40040904000702b95fc3030905880320000602040905830200738f"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) 139.850102ms ago: executing program 2 (id=3): r0 = getpgrp(0x0) r1 = syz_pidfd_open(r0, 0x0) r2 = syz_clone(0x20002000, 0x0, 0x0, 0x0, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r0, r2, 0x7, r1, &(0x7f0000000400)={0xffffffffffffffff, r1, 0x3}) 73.302331ms ago: executing program 2 (id=7): r0 = socket(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0xfffffffd, @mcast2={0xff, 0x5}, 0x1ff}, 0x1c) connect$inet(r0, &(0x7f0000000240)={0x2, 0x4e22, @empty}, 0x10) 72.772502ms ago: executing program 2 (id=8): sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="4400f1a1", @ANYRES16=0x0, @ANYBLOB="0100000000000000000003000000300001802c00040014000100020000007f00000100000000000000001400020002"], 0x44}}, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x40481c0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a040007000000b6f1ffff0000854105001a"], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e000000030000000000000405000600000000000a0000000000000400000000000000000000002100000000000100000000000002000100010000000000010200fd0000050005"], 0x70}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) 349.625µs ago: executing program 2 (id=9): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in=@multicast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0xee01}, {0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x0) 0s ago: executing program 2 (id=10): memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000440)=ANY=[@ANYBLOB="b0000000000000ab284dc9a94095f54e34f11a5a480d2115805745f8a24d"], 0xb0) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) chdir(&(0x7f0000001100)='./file0\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.103' (ED25519) to the list of known hosts. [ 49.734351][ T5846] cgroup: Unknown subsys name 'net' [ 49.918789][ T5846] cgroup: Unknown subsys name 'cpuset' [ 49.925847][ T5846] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 51.031214][ T5846] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 54.404787][ T5859] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 54.414640][ T5862] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 54.422250][ T5862] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 54.430271][ T5862] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 54.437813][ T5862] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 54.440504][ T5868] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 54.445140][ T5862] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 54.452536][ T5872] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 54.459949][ T5862] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 54.466670][ T5872] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 54.473280][ T5862] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 54.480664][ T5872] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 54.487404][ T5862] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 54.498238][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 54.502334][ T5862] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 54.507921][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 54.521979][ T5859] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 54.529986][ T5859] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 54.537887][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 54.545501][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 54.812214][ T5864] chnl_net:caif_netlink_parms(): no params data found [ 54.846371][ T5860] chnl_net:caif_netlink_parms(): no params data found [ 54.865562][ T5856] chnl_net:caif_netlink_parms(): no params data found [ 54.946707][ T5866] chnl_net:caif_netlink_parms(): no params data found [ 54.977839][ T5864] bridge0: port 1(bridge_slave_0) entered blocking state [ 54.985000][ T5864] bridge0: port 1(bridge_slave_0) entered disabled state [ 54.992632][ T5864] bridge_slave_0: entered allmulticast mode [ 54.999368][ T5864] bridge_slave_0: entered promiscuous mode [ 55.015845][ T5860] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.022996][ T5860] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.030350][ T5860] bridge_slave_0: entered allmulticast mode [ 55.037016][ T5860] bridge_slave_0: entered promiscuous mode [ 55.050111][ T5864] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.057271][ T5864] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.064377][ T5864] bridge_slave_1: entered allmulticast mode [ 55.071403][ T5864] bridge_slave_1: entered promiscuous mode [ 55.083351][ T5860] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.090558][ T5860] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.097805][ T5860] bridge_slave_1: entered allmulticast mode [ 55.104218][ T5860] bridge_slave_1: entered promiscuous mode [ 55.110734][ T5856] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.118135][ T5856] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.125320][ T5856] bridge_slave_0: entered allmulticast mode [ 55.131957][ T5856] bridge_slave_0: entered promiscuous mode [ 55.154423][ T5856] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.161641][ T5856] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.168832][ T5856] bridge_slave_1: entered allmulticast mode [ 55.175257][ T5856] bridge_slave_1: entered promiscuous mode [ 55.203844][ T5864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.220913][ T5860] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.237722][ T5864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.262093][ T5860] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.272497][ T5856] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.288228][ T5866] bridge0: port 1(bridge_slave_0) entered blocking state [ 55.295346][ T5866] bridge0: port 1(bridge_slave_0) entered disabled state [ 55.302759][ T5866] bridge_slave_0: entered allmulticast mode [ 55.309694][ T5866] bridge_slave_0: entered promiscuous mode [ 55.322891][ T5856] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.340747][ T5864] team0: Port device team_slave_0 added [ 55.346643][ T5866] bridge0: port 2(bridge_slave_1) entered blocking state [ 55.354007][ T5866] bridge0: port 2(bridge_slave_1) entered disabled state [ 55.361301][ T5866] bridge_slave_1: entered allmulticast mode [ 55.368570][ T5866] bridge_slave_1: entered promiscuous mode [ 55.386584][ T5864] team0: Port device team_slave_1 added [ 55.399544][ T5860] team0: Port device team_slave_0 added [ 55.406487][ T5856] team0: Port device team_slave_0 added [ 55.425096][ T5860] team0: Port device team_slave_1 added [ 55.439072][ T5856] team0: Port device team_slave_1 added [ 55.451130][ T5864] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 55.458749][ T5864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.484769][ T5864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 55.498473][ T5866] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 55.510021][ T5866] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 55.530271][ T5864] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 55.537261][ T5864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.563332][ T5864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 55.586080][ T5860] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 55.593227][ T5860] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.619141][ T5860] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 55.636459][ T5856] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 55.643475][ T5856] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.669474][ T5856] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 55.686704][ T5860] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 55.694076][ T5860] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.720082][ T5860] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 55.741362][ T5856] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 55.748398][ T5856] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.774432][ T5856] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 55.786485][ T5866] team0: Port device team_slave_0 added [ 55.810080][ T5864] hsr_slave_0: entered promiscuous mode [ 55.816253][ T5864] hsr_slave_1: entered promiscuous mode [ 55.824364][ T5866] team0: Port device team_slave_1 added [ 55.875072][ T5856] hsr_slave_0: entered promiscuous mode [ 55.881188][ T5856] hsr_slave_1: entered promiscuous mode [ 55.887279][ T5856] debugfs: 'hsr0' already exists in 'hsr' [ 55.893019][ T5856] Cannot create hsr debugfs directory [ 55.904724][ T5866] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 55.912413][ T5866] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 55.938993][ T5866] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 55.963448][ T5860] hsr_slave_0: entered promiscuous mode [ 55.969542][ T5860] hsr_slave_1: entered promiscuous mode [ 55.975401][ T5860] debugfs: 'hsr0' already exists in 'hsr' [ 55.981461][ T5860] Cannot create hsr debugfs directory [ 55.987551][ T5866] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 55.994492][ T5866] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 56.020637][ T5866] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 56.103456][ T5866] hsr_slave_0: entered promiscuous mode [ 56.110027][ T5866] hsr_slave_1: entered promiscuous mode [ 56.115834][ T5866] debugfs: 'hsr0' already exists in 'hsr' [ 56.121641][ T5866] Cannot create hsr debugfs directory [ 56.285190][ T5864] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 56.294108][ T5864] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 56.309363][ T5864] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 56.318994][ T5864] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 56.341940][ T5856] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 56.350816][ T5856] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 56.360177][ T5856] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 56.373653][ T5856] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 56.404086][ T5860] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 56.431447][ T5860] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 56.449878][ T5860] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 56.466092][ T5860] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 56.497569][ T5866] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 56.506445][ T5866] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 56.516226][ T5866] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 56.532961][ T5866] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 56.586616][ T5864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.594066][ T5862] Bluetooth: hci3: command tx timeout [ 56.596899][ T51] Bluetooth: hci1: command tx timeout [ 56.599581][ T5872] Bluetooth: hci0: command tx timeout [ 56.610445][ T51] Bluetooth: hci2: command tx timeout [ 56.627956][ T5856] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.651962][ T5864] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.665352][ T5856] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.682889][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.690037][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.715313][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.722436][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.731739][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.738830][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.755875][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.762980][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.787888][ T5866] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.818892][ T5860] 8021q: adding VLAN 0 to HW filter on device bond0 [ 56.838567][ T5866] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.848750][ T5856] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 56.859939][ T5856] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 56.894086][ T5860] 8021q: adding VLAN 0 to HW filter on device team0 [ 56.910445][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.917598][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.938849][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.945980][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 56.956195][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 56.963350][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 56.974311][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 56.981448][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 57.099668][ T5856] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.116647][ T5864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.204545][ T5864] veth0_vlan: entered promiscuous mode [ 57.224873][ T5856] veth0_vlan: entered promiscuous mode [ 57.241292][ T5856] veth1_vlan: entered promiscuous mode [ 57.262600][ T5864] veth1_vlan: entered promiscuous mode [ 57.321069][ T5860] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.335966][ T5856] veth0_macvtap: entered promiscuous mode [ 57.347100][ T5864] veth0_macvtap: entered promiscuous mode [ 57.354664][ T5856] veth1_macvtap: entered promiscuous mode [ 57.363820][ T5866] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 57.374264][ T5864] veth1_macvtap: entered promiscuous mode [ 57.405371][ T5856] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.413842][ T5864] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.439188][ T5860] veth0_vlan: entered promiscuous mode [ 57.452478][ T5864] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.465902][ T5856] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.475694][ T5866] veth0_vlan: entered promiscuous mode [ 57.485408][ T59] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.494774][ T59] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.504655][ T5860] veth1_vlan: entered promiscuous mode [ 57.524777][ T59] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.534298][ T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.552079][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.561416][ T49] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.578946][ T49] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.587854][ T49] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.604070][ T5866] veth1_vlan: entered promiscuous mode [ 57.637625][ T5860] veth0_macvtap: entered promiscuous mode [ 57.644751][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.646174][ T5860] veth1_macvtap: entered promiscuous mode [ 57.659058][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.700028][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.705305][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.711824][ T5860] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.726686][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.730935][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.741552][ T5866] veth0_macvtap: entered promiscuous mode [ 57.757682][ T5860] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.775943][ T5866] veth1_macvtap: entered promiscuous mode [ 57.791174][ T49] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.805004][ T5864] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 57.805871][ T999] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.836698][ T5866] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 57.845075][ T999] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.854656][ T49] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.864099][ T49] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.882123][ T5866] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 57.901081][ T49] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.949906][ T36] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.966058][ T36] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 57.999343][ T36] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.010307][ T36] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 58.025516][ T5949] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 58.057396][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.065235][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.095999][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.111249][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.122455][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.157936][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.212974][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 58.221650][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 58.385536][ T5964] ------------[ cut here ]------------ [ 58.391283][ T5964] UBSAN: shift-out-of-bounds in fs/9p/vfs_super.c:57:22 [ 58.398928][ T5964] shift exponent 32 is too large for 32-bit type 'int' [ 58.405802][ T5964] CPU: 1 UID: 0 PID: 5964 Comm: syz.2.10 Not tainted syzkaller #0 PREEMPT(full) [ 58.405816][ T5964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 58.405824][ T5964] Call Trace: [ 58.405829][ T5964] [ 58.405833][ T5964] dump_stack_lvl+0x189/0x250 [ 58.405852][ T5964] ? __pfx_dump_stack_lvl+0x10/0x10 [ 58.405866][ T5964] ? __pfx__printk+0x10/0x10 [ 58.405881][ T5964] ubsan_epilogue+0xa/0x40 [ 58.405891][ T5964] __ubsan_handle_shift_out_of_bounds+0x386/0x410 [ 58.405904][ T5964] ? __pfx_v9fs_set_super+0x10/0x10 [ 58.405915][ T5964] v9fs_get_tree+0x957/0xa90 [ 58.405927][ T5964] ? __pfx_v9fs_get_tree+0x10/0x10 [ 58.405938][ T5964] vfs_get_tree+0x8f/0x2b0 [ 58.405948][ T5964] do_new_mount+0x2a2/0xa30 [ 58.405959][ T5964] ? ns_capable+0x8a/0xf0 [ 58.405970][ T5964] ? __pfx_do_new_mount+0x10/0x10 [ 58.405979][ T5964] ? path_mount+0x61c/0xfe0 [ 58.405988][ T5964] ? user_path_at+0x44/0x60 [ 58.406001][ T5964] __se_sys_mount+0x317/0x410 [ 58.406012][ T5964] ? __pfx___se_sys_mount+0x10/0x10 [ 58.406023][ T5964] ? rcu_is_watching+0x15/0xb0 [ 58.406032][ T5964] ? __x64_sys_mount+0x20/0xc0 [ 58.406042][ T5964] do_syscall_64+0xfa/0xfa0 [ 58.406055][ T5964] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.406063][ T5964] ? clear_bhb_loop+0x60/0xb0 [ 58.406073][ T5964] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.406082][ T5964] RIP: 0033:0x7f25ca58ebe9 [ 58.406099][ T5964] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 58.406108][ T5964] RSP: 002b:00007f25cb45f038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 58.406119][ T5964] RAX: ffffffffffffffda RBX: 00007f25ca7b5fa0 RCX: 00007f25ca58ebe9 [ 58.406126][ T5964] RDX: 0000200000000b80 RSI: 0000200000000040 RDI: 0000000000000000 [ 58.406132][ T5964] RBP: 00007f25ca611e19 R08: 0000200000000000 R09: 0000000000000000 [ 58.406138][ T5964] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 58.406144][ T5964] R13: 00007f25ca7b6038 R14: 00007f25ca7b5fa0 R15: 00007ffefb571f58 [ 58.406153][ T5964] [ 58.406157][ T5964] ---[ end trace ]--- [ 58.436886][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 58.439882][ T43] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 58.450213][ T5964] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 58.450231][ T5964] CPU: 0 UID: 0 PID: 5964 Comm: syz.2.10 Not tainted syzkaller #0 PREEMPT(full) [ 58.450251][ T5964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 58.450264][ T5964] Call Trace: [ 58.450271][ T5964] [ 58.450284][ T5964] dump_stack_lvl+0x99/0x250 [ 58.450312][ T5964] ? __asan_memcpy+0x40/0x70 [ 58.450334][ T5964] ? __pfx_dump_stack_lvl+0x10/0x10 [ 58.450363][ T5964] ? __pfx__printk+0x10/0x10 [ 58.450391][ T5964] vpanic+0x281/0x750 [ 58.450412][ T5964] ? __pfx_vpanic+0x10/0x10 [ 58.450436][ T5964] panic+0xb9/0xc0 [ 58.450452][ T5964] ? __pfx_panic+0x10/0x10 [ 58.450472][ T5964] ? __pfx__printk+0x10/0x10 [ 58.450496][ T5964] check_panic_on_warn+0x89/0xb0 [ 58.450519][ T5964] __ubsan_handle_shift_out_of_bounds+0x386/0x410 [ 58.450543][ T5964] ? __pfx_v9fs_set_super+0x10/0x10 [ 58.450563][ T5964] v9fs_get_tree+0x957/0xa90 [ 58.450583][ T5964] ? __pfx_v9fs_get_tree+0x10/0x10 [ 58.450604][ T5964] vfs_get_tree+0x8f/0x2b0 [ 58.450623][ T5964] do_new_mount+0x2a2/0xa30 [ 58.450643][ T5964] ? ns_capable+0x8a/0xf0 [ 58.450660][ T5964] ? __pfx_do_new_mount+0x10/0x10 [ 58.450677][ T5964] ? path_mount+0x61c/0xfe0 [ 58.450694][ T5964] ? user_path_at+0x44/0x60 [ 58.450718][ T5964] __se_sys_mount+0x317/0x410 [ 58.450739][ T5964] ? __pfx___se_sys_mount+0x10/0x10 [ 58.450758][ T5964] ? rcu_is_watching+0x15/0xb0 [ 58.450775][ T5964] ? __x64_sys_mount+0x20/0xc0 [ 58.450794][ T5964] do_syscall_64+0xfa/0xfa0 [ 58.450816][ T5964] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.450831][ T5964] ? clear_bhb_loop+0x60/0xb0 [ 58.450849][ T5964] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.450865][ T5964] RIP: 0033:0x7f25ca58ebe9 [ 58.450881][ T5964] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 58.450897][ T5964] RSP: 002b:00007f25cb45f038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 58.450916][ T5964] RAX: ffffffffffffffda RBX: 00007f25ca7b5fa0 RCX: 00007f25ca58ebe9 [ 58.450929][ T5964] RDX: 0000200000000b80 RSI: 0000200000000040 RDI: 0000000000000000 [ 58.450941][ T5964] RBP: 00007f25ca611e19 R08: 0000200000000000 R09: 0000000000000000 [ 58.450952][ T5964] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 58.450963][ T5964] R13: 00007f25ca7b6038 R14: 00007f25ca7b5fa0 R15: 00007ffefb571f58 [ 58.450982][ T5964] [ 58.453646][ T5964] Kernel Offset: disabled