last executing test programs: 59.693317964s ago: executing program 1 (id=1013): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000003c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEV(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=ANY=[@ANYBLOB="34010000", @ANYRES16=r2, @ANYBLOB="010025bd7000fddbdf251a00000058002e800c0004000203aaaaaaaaaaaa050005000100000006000300a2aa000006000100040000000c0004000200aaaaaaaaaaaa0500050001000000060001006a0e000006000100050000000c0004000203aaaaaaaaaaaa08000300", @ANYRES32, @ANYBLOB='\b\x00', @ANYRES32, @ANYBLOB="08000300", @ANYRES32=r3, @ANYBLOB='\\\x00.'], 0x134}}, 0x40080) 59.542226958s ago: executing program 1 (id=1015): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r2, @ANYBLOB="05005b"], 0x24}}, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)={0x1c, r8, 0x1, 0x1, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @void}}}, 0x1c}}, 0x4000) 59.392475659s ago: executing program 1 (id=1018): r0 = socket$inet6(0xa, 0x2, 0x3a) sendto$inet6(r0, &(0x7f0000000000)="800037bbfa9ba1ce", 0x8, 0x4000, &(0x7f0000001100)={0xa, 0x0, 0x0, @loopback}, 0x1c) recvmmsg(r0, &(0x7f0000001140), 0x0, 0x10102, 0x0) 59.154691853s ago: executing program 1 (id=1022): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="600000000001050500000000000000000a7f00003c0002802c00018014000300ff01e7d5c4b4e215944100000000000114000400ff0200000004000000000000000000010c0002800500010000000000100001800c00024605f027e37f0346652be5cf9a7c830a7fa57032946137d6e4a1ef444aed281e3fa8cdb4d002bedfcc614d359ff51d09e0cc725e1337a9407587b05a86357bac7486772cddb03a4531a55a5e60c2a89236e692af00"/186], 0x60}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000080)=ANY=[@ANYBLOB="180000003f00010327bd7000fbdbdf2503"], 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x20000800) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000200)=@name={0x1e, 0x2, 0x0, {{0x42}, 0x4}}, 0x10) bind$tipc(r1, &(0x7f0000000000)=@id={0x1e, 0x3, 0x3, {0x4e20, 0x2}}, 0x34) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000340)={0x8000044, 0x2}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000140)={0x10000042, 0x0, 0x2}, 0x10) bind$tipc(0xffffffffffffffff, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$tipc(r5, &(0x7f0000000500)={&(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x1, {0x42, 0x1, 0x2}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x20000000}, 0x8d4) 58.834177016s ago: executing program 1 (id=1028): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000010400)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f", 0xcd}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}, {&(0x7f0000000740)=""/105, 0xfffffe0b}], 0x2}, 0x0) 58.665697589s ago: executing program 1 (id=1031): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x4e20, @empty}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000005c0)='cpu.stat\x00', 0x275a, 0x0) preadv(r2, &(0x7f00000004c0)=[{&(0x7f0000000280)=""/96, 0x46}, {0x0, 0xa00}], 0x2, 0xa, 0x6c8) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r4 = socket$tipc(0x1e, 0x2, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r5, &(0x7f0000000580)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x1, {{0x42, 0x3}, 0x2}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000880}, 0x4004089) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r3, &(0x7f0000000340)=[{&(0x7f00000003c0)="89e5ee0c7cdad9fcb47380c988cae912d248aa378d514c474d64fb", 0x1b}, {&(0x7f0000000440)="448b7c0acf8bc0cefe8360", 0xb}], 0x2) 43.170659587s ago: executing program 32 (id=1031): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f00000002c0)={0x2, 0x4e20, @empty}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000005c0)='cpu.stat\x00', 0x275a, 0x0) preadv(r2, &(0x7f00000004c0)=[{&(0x7f0000000280)=""/96, 0x46}, {0x0, 0xa00}], 0x2, 0xa, 0x6c8) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r4 = socket$tipc(0x1e, 0x2, 0x0) r5 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r5, &(0x7f0000000580)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x1, {{0x42, 0x3}, 0x2}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000880}, 0x4004089) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r3, &(0x7f0000000340)=[{&(0x7f00000003c0)="89e5ee0c7cdad9fcb47380c988cae912d248aa378d514c474d64fb", 0x1b}, {&(0x7f0000000440)="448b7c0acf8bc0cefe8360", 0xb}], 0x2) 3.210173788s ago: executing program 2 (id=1604): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000012c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd7000ffdbdf2521000000", @ANYRES32=r3, @ANYBLOB="14002c"], 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) 2.814084203s ago: executing program 3 (id=1610): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_PAN_ID(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)={0x24, r1, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_PAN_ID={0x6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}]}, 0x24}, 0x1, 0x0, 0x0, 0x40004004}, 0x20040044) 1.497516458s ago: executing program 0 (id=1611): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000300)={'wpan1\x00', 0x0}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000019c0), r2) sendmsg$NL802154_CMD_DEL_SEC_KEY(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x24, r3, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_SEC_KEY={0x8, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x34000000}, 0x20040002) 1.096887971s ago: executing program 2 (id=1612): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x3) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x14e22, 0x0, @ipv4}, 0x1c) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x201006) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r6, 0x0) r7 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c00000012000301000000000000000000009db7000000000000010004000000000000000000000000000000000000000000000000000000691d0f76e77044d1eb94e56239e4"], 0x4c}, 0x1, 0x0, 0x0, 0x4004040}, 0x8014) 1.077724701s ago: executing program 3 (id=1613): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x3, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f0000002c00)=[{&(0x7f0000001500)='\x00', 0x1}, {&(0x7f0000002800)="cf", 0x1}, {&(0x7f0000000380)='\b', 0x1}, {&(0x7f0000000180)="8a", 0x1}, {&(0x7f00000005c0)="f5", 0x1}], 0x5}}, {{0x0, 0x0, &(0x7f0000002f00)=[{&(0x7f0000001580)="ce", 0x1}, {0x0}, {&(0x7f0000002e40)="d4", 0x1}], 0x3}}, {{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000003000)="e1", 0x1}, {&(0x7f00000010c0)="fa", 0x1}, {&(0x7f0000001680)="d8", 0x1}, {&(0x7f0000001600)="f2", 0x1}, {&(0x7f0000000580)="b8", 0x1}, {&(0x7f00000002c0)='y', 0x1}, {&(0x7f0000000280)="87", 0x1}], 0x7}}, {{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000880)="87", 0x1}, {&(0x7f0000000900)="11", 0x1}], 0x2}}], 0x4, 0x4000000) sendmmsg$inet(r0, &(0x7f0000005780)=[{{0x0, 0x0, &(0x7f00000027c0)=[{&(0x7f00000006c0)="fa", 0x1}], 0x1}}], 0x1, 0x8014) setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000000000)=0x7fffffff, 0x4) 1.076244442s ago: executing program 0 (id=1614): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x20, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SSID={0x4}]}, 0x20}}, 0x0) 929.514222ms ago: executing program 3 (id=1616): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000010400)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be521634", 0xc}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}, {&(0x7f0000000740)=""/105, 0xfffffe0b}], 0x2}, 0x0) 853.695524ms ago: executing program 0 (id=1617): recvmmsg(0xffffffffffffffff, &(0x7f0000004740)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5}, 0x60}], 0x1, 0x22, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000080)=0xa3e, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) write$tun(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbbaaaaaaaaaabb86dd6d002000001011ff00000000000100070000000000000000ff0200000000000000000000000000014f194e20"], 0xfdef) 852.252376ms ago: executing program 2 (id=1618): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x20, 0x3, 0x8, 0x3, 0x0, 0x0, {}, [@CTA_TIMEOUT_DATA={0x4, 0x4, 0x0, 0x1, @sctp}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x20}}, 0x0) 821.185458ms ago: executing program 4 (id=1619): r0 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x7, 0x30}, 0xc) sendto$inet(r0, &(0x7f00000000c0)='}', 0x1, 0x0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) sendto$inet(r0, &(0x7f0000000500)='b', 0x1, 0x8800, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000300)="ab", 0x34000, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) 793.079158ms ago: executing program 3 (id=1620): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)={0x28, r1, 0x1, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x1}, @NL80211_ATTR_KEY_DEFAULT={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x8c0) 663.907284ms ago: executing program 2 (id=1621): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000012c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd7000ffdbdf2521000000", @ANYRES32=r3, @ANYBLOB="14002c"], 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) 598.865596ms ago: executing program 4 (id=1622): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a54000000030a0fdb00000000000000000a0060050900030073797a30000000000900010073797a310000000014000480080002403cb140bb08000140000000030a000700726f757465000000080005400000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20000000, &(0x7f0000000380)={0xa, 0x4e21, 0x10001, @empty, 0x2}, 0x1c) 446.392105ms ago: executing program 4 (id=1623): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000300)={'wpan1\x00', 0x0}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000019c0), r2) sendmsg$NL802154_CMD_DEL_SEC_KEY(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x24, r3, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_SEC_KEY={0x8, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x34000000}, 0x20040002) 308.808966ms ago: executing program 2 (id=1624): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x3, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f0000002c00)=[{&(0x7f0000001500)='\x00', 0x1}, {&(0x7f0000002800)="cf", 0x1}, {&(0x7f0000000380)='\b', 0x1}, {&(0x7f0000000180)="8a", 0x1}, {&(0x7f00000005c0)="f5", 0x1}], 0x5}}, {{0x0, 0x0, &(0x7f0000002f00)=[{&(0x7f0000001580)="ce", 0x1}, {0x0}, {&(0x7f0000002e40)="d4", 0x1}], 0x3}}, {{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000003000)="e1", 0x1}, {&(0x7f00000010c0)="fa", 0x1}, {&(0x7f0000001680)="d8", 0x1}, {&(0x7f0000001600)="f2", 0x1}, {&(0x7f0000000580)="b8", 0x1}, {&(0x7f00000002c0)='y', 0x1}, {&(0x7f0000000280)="87", 0x1}], 0x7}}, {{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000880)="87", 0x1}, {&(0x7f0000000900)="11", 0x1}], 0x2}}], 0x4, 0x4000000) sendmmsg$inet(r0, &(0x7f0000005780)=[{{0x0, 0x0, &(0x7f00000027c0)=[{&(0x7f00000006c0)="fa", 0x1}], 0x1}}], 0x1, 0x8014) setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000000000)=0x7fffffff, 0x4) 307.036468ms ago: executing program 0 (id=1625): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) close(r0) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0xc004743e, 0x110e22fff6) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x2, &(0x7f0000000040)=[{0x20, 0x4, 0x0, 0xffdff036}, {0x6, 0x0, 0x0, 0x2}]}) ioctl$TUNGETVNETLE(r0, 0x40107447, &(0x7f0000000180)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x4004743d, 0x110e22fff6) write$cgroup_type(r1, &(0x7f0000000280), 0x9) 294.474724ms ago: executing program 3 (id=1626): r0 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000340)={0x87, {{0xa, 0x4e24, 0x2, @mcast2, 0x480}}, 0x229f6167fdbb3ac0}, 0x20000) 290.871011ms ago: executing program 4 (id=1627): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r0, &(0x7f0000002900)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000200)=']', 0x1}, {&(0x7f0000000300)='w', 0x1}], 0x2}}, {{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000003c0)='+', 0x1}, {&(0x7f0000000140)="88", 0x1}, {&(0x7f0000000480)='vE', 0x2}], 0x3}}, {{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f00000006c0)="85", 0x1}, {&(0x7f0000000780)="0e", 0x1}, {&(0x7f0000000840)="e3", 0x1}, {&(0x7f0000000900)='\v', 0x1}, {&(0x7f0000000940)=']', 0x1}], 0x5}}, {{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000c40)="aa", 0x1}, {&(0x7f0000000540)="94b0440d", 0x4}], 0x2}}, {{0x0, 0x0, &(0x7f0000001240)=[{0x0}, {&(0x7f0000000e00)='C', 0x1}, {&(0x7f0000000e40)='-', 0x1}, {&(0x7f0000002a80)='\n', 0x1}, {&(0x7f0000000fc0)="ee0c1d4dfaca59a01d9997055f8c334db67d48cabb8808a613758d54333412c384b842619547bd5482b34e97272b53b13c06620fb120ed8871df31e5ba0a6f61e9", 0x41}], 0x5}}], 0x5, 0x4000000) setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000000000)=0x7fffffff, 0x4) 156.880195ms ago: executing program 0 (id=1628): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000010400)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be5216344841", 0xe}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}, {&(0x7f0000000740)=""/105, 0xfffffe0b}], 0x2}, 0x0) 155.229997ms ago: executing program 4 (id=1629): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025", 0x1d}], 0x1) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000400)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000200000000000006040000000000f93132", 0x39}], 0x1) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) 75.73297ms ago: executing program 3 (id=1630): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x34, r1, 0x27ec680ebebeb2e1, 0x70bd27, 0x25dfdbfd, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fffffffffffffff}]}, 0x34}, 0x1, 0x0, 0x0, 0xc1}, 0x4) 74.89285ms ago: executing program 2 (id=1631): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001900)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a2c0000000b0a010400000000000000000a0000090900010073797a310000"], 0x80}, 0x1, 0x0, 0x0, 0x40091}, 0x40) 34.330989ms ago: executing program 0 (id=1632): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$nci(r0, &(0x7f0000000280)=@NCI_OP_RF_DISCOVER_MAP_RSP={0x1, 0x1, 0x2, 0x0, 0x5}, 0x4) 0s ago: executing program 4 (id=1633): recvmmsg(0xffffffffffffffff, &(0x7f0000004740)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5}, 0x60}], 0x1, 0x22, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_udp_int(r0, 0x11, 0x68, &(0x7f0000000080)=0xa3e, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) write$tun(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="0a000000bbbbbbbbbbbbaaaaaaaaaabb86dd6d002000001011ff00000000000100070000000000000000ff0200000000000000000000000000014f194e20"], 0xfdef) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.184' (ED25519) to the list of known hosts. [ 92.020888][ T5595] cgroup: Unknown subsys name 'net' [ 92.274457][ T5595] cgroup: Unknown subsys name 'cpuset' [ 92.346613][ T5595] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 94.426883][ T5595] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 97.134697][ T5614] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 97.160855][ T5614] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 97.187382][ T5614] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 97.189761][ T5614] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 97.190780][ T5622] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 97.194969][ T5622] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 97.198098][ T5622] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 97.242875][ T61] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 97.251001][ T61] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 97.263469][ T61] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 97.265297][ T61] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.343251][ T5619] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 97.354178][ T5619] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 97.365532][ T5619] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 97.387743][ T5619] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 97.416413][ T5619] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 97.417767][ T5619] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 97.447210][ T5619] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 97.481713][ T61] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 97.483854][ T4924] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 97.691186][ T200] cfg80211: failed to load regulatory.db [ 99.318890][ T4924] Bluetooth: hci0: command tx timeout [ 99.398678][ T4924] Bluetooth: hci2: command tx timeout [ 99.637310][ T4924] Bluetooth: hci1: command tx timeout [ 99.715967][ T4924] Bluetooth: hci3: command tx timeout [ 99.785035][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.789367][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.790228][ T5610] bridge_slave_0: entered allmulticast mode [ 99.800631][ T5610] bridge_slave_0: entered promiscuous mode [ 99.863277][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.863603][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.863913][ T5610] bridge_slave_1: entered allmulticast mode [ 99.871753][ T5610] bridge_slave_1: entered promiscuous mode [ 100.057251][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.057742][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.058336][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.058690][ T5608] bridge_slave_0: entered allmulticast mode [ 100.061433][ T5608] bridge_slave_0: entered promiscuous mode [ 100.144337][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.144772][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.145020][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.145447][ T5608] bridge_slave_1: entered allmulticast mode [ 100.172108][ T5608] bridge_slave_1: entered promiscuous mode [ 100.363872][ T5607] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.364194][ T5607] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.364472][ T5607] bridge_slave_0: entered allmulticast mode [ 100.372543][ T5607] bridge_slave_0: entered promiscuous mode [ 100.462459][ T5607] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.462815][ T5607] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.463155][ T5607] bridge_slave_1: entered allmulticast mode [ 100.467546][ T5607] bridge_slave_1: entered promiscuous mode [ 100.497173][ T5610] team0: Port device team_slave_0 added [ 100.503485][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.510874][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.511166][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.511466][ T5611] bridge_slave_0: entered allmulticast mode [ 100.550811][ T5611] bridge_slave_0: entered promiscuous mode [ 100.591385][ T5610] team0: Port device team_slave_1 added [ 100.603171][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.622192][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.622544][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.622883][ T5611] bridge_slave_1: entered allmulticast mode [ 100.650777][ T5611] bridge_slave_1: entered promiscuous mode [ 100.750108][ T5607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.819357][ T5607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.821470][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.821484][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.821504][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.841585][ T5608] team0: Port device team_slave_0 added [ 100.892274][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.921817][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.921831][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.921851][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.925593][ T5608] team0: Port device team_slave_1 added [ 100.950210][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.077606][ T5607] team0: Port device team_slave_0 added [ 101.144333][ T5607] team0: Port device team_slave_1 added [ 101.153504][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.153521][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.153549][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.199677][ T5611] team0: Port device team_slave_0 added [ 101.251886][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.251900][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.251921][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.255558][ T5611] team0: Port device team_slave_1 added [ 101.397083][ T4924] Bluetooth: hci0: command tx timeout [ 101.476186][ T4924] Bluetooth: hci2: command tx timeout [ 101.717157][ T4924] Bluetooth: hci1: command tx timeout [ 101.722648][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.722667][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.722697][ T5607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.787797][ T5610] hsr_slave_0: entered promiscuous mode [ 101.789809][ T5610] hsr_slave_1: entered promiscuous mode [ 101.796050][ T4924] Bluetooth: hci3: command tx timeout [ 101.831518][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.831532][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.831552][ T5607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.843663][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.843956][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.844042][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.968270][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.968287][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.968308][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.091204][ T5608] hsr_slave_0: entered promiscuous mode [ 102.092858][ T5608] hsr_slave_1: entered promiscuous mode [ 102.094387][ T5608] debugfs: 'hsr0' already exists in 'hsr' [ 102.094484][ T5608] Cannot create hsr debugfs directory [ 102.228339][ T5607] hsr_slave_0: entered promiscuous mode [ 102.230032][ T5607] hsr_slave_1: entered promiscuous mode [ 102.231434][ T5607] debugfs: 'hsr0' already exists in 'hsr' [ 102.231460][ T5607] Cannot create hsr debugfs directory [ 102.340091][ T5611] hsr_slave_0: entered promiscuous mode [ 102.342145][ T5611] hsr_slave_1: entered promiscuous mode [ 102.343450][ T5611] debugfs: 'hsr0' already exists in 'hsr' [ 102.343482][ T5611] Cannot create hsr debugfs directory [ 103.243544][ T5610] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 103.311247][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.329187][ T5610] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 103.363981][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.378210][ T5610] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 103.422917][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.457691][ T5610] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 103.476074][ T4924] Bluetooth: hci0: command tx timeout [ 103.488914][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.555962][ T4924] Bluetooth: hci2: command tx timeout [ 103.630814][ T5607] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 103.672644][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.694121][ T5607] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 103.723527][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.741279][ T5607] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 103.772161][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.796190][ T4924] Bluetooth: hci1: command tx timeout [ 103.810470][ T5607] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 103.831722][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.880007][ T4924] Bluetooth: hci3: command tx timeout [ 104.040006][ T5611] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 104.075157][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.103108][ T5611] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 104.138038][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.164192][ T5611] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 104.193017][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.230684][ T5611] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 104.272682][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.483739][ T5608] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 104.525486][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.540323][ T5608] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 104.580512][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.617938][ T5608] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 104.642469][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.670458][ T5608] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 104.703036][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.878633][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.009475][ T5607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.032704][ T5610] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.111613][ T3318] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.111797][ T3318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.185041][ T3318] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.185186][ T3318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.239615][ T5607] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.279878][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.307059][ T3318] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.307270][ T3318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.373252][ T68] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.373382][ T68] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.459094][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.524031][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.536919][ T2170] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.537098][ T2170] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.556264][ T4924] Bluetooth: hci0: command tx timeout [ 105.635992][ T4924] Bluetooth: hci2: command tx timeout [ 105.644502][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.644649][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.775692][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.878213][ T4924] Bluetooth: hci1: command tx timeout [ 105.893957][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.894141][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.956127][ T4924] Bluetooth: hci3: command tx timeout [ 106.024947][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.025132][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.123838][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.402120][ T5607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.736391][ T5610] veth0_vlan: entered promiscuous mode [ 107.837798][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.899599][ T5610] veth1_vlan: entered promiscuous mode [ 107.939632][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.987837][ T5607] veth0_vlan: entered promiscuous mode [ 108.061858][ T5607] veth1_vlan: entered promiscuous mode [ 108.138571][ T5610] veth0_macvtap: entered promiscuous mode [ 108.205222][ T5610] veth1_macvtap: entered promiscuous mode [ 108.217689][ T5611] veth0_vlan: entered promiscuous mode [ 108.295561][ T5608] veth0_vlan: entered promiscuous mode [ 108.309779][ T5611] veth1_vlan: entered promiscuous mode [ 108.348582][ T5607] veth0_macvtap: entered promiscuous mode [ 108.368798][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.412086][ T5608] veth1_vlan: entered promiscuous mode [ 108.431544][ T5607] veth1_macvtap: entered promiscuous mode [ 108.452021][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.528358][ T57] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.545406][ T57] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.588591][ T57] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.594001][ T57] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.627171][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.740674][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.743565][ T5611] veth0_macvtap: entered promiscuous mode [ 108.840392][ T2170] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.860523][ T5611] veth1_macvtap: entered promiscuous mode [ 108.879120][ T2170] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.953105][ T2170] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.956775][ T5608] veth0_macvtap: entered promiscuous mode [ 109.023556][ T2170] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.134435][ T5608] veth1_macvtap: entered promiscuous mode [ 109.372981][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.414842][ T93] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.414864][ T93] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.560828][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.633737][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.682930][ T93] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.709089][ T93] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.712840][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.717071][ T93] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.762188][ T93] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.762768][ T2170] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.762784][ T2170] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.834889][ T68] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.850378][ T68] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.937647][ T68] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.010890][ T68] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.200242][ T2170] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.200262][ T2170] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.991363][ T3275] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.991390][ T3275] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.400942][ T176] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.400962][ T176] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.541741][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.541760][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.901959][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.901981][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.248906][ T3275] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.248927][ T3275] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.953080][ T5794] netlink: 168 bytes leftover after parsing attributes in process `syz.1.15'. [ 115.419894][ T5811] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 116.270600][ T5824] netlink: 156 bytes leftover after parsing attributes in process `syz.0.29'. [ 117.283451][ T5615] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 117.367384][ T5834] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 117.519396][ T5615] usb 3-1: Using ep0 maxpacket: 32 [ 117.566175][ T5615] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 117.566209][ T5615] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 117.566259][ T5615] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 117.566282][ T5615] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.705396][ T5615] usb 3-1: config 0 descriptor?? [ 118.411360][ T5615] ft260 0003:0403:6030.0001: unknown main item tag 0x0 [ 118.411399][ T5615] ft260 0003:0403:6030.0001: unknown main item tag 0x0 [ 118.574828][ T5615] ft260 0003:0403:6030.0001: chip code: 0000 0000 [ 118.659698][ T32] IPVS: starting estimator thread 0... [ 118.664045][ T5851] netlink: 156 bytes leftover after parsing attributes in process `syz.3.38'. [ 118.786623][ T5615] ft260 0003:0403:6030.0001: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.2-1/input0 [ 118.811077][ T5853] IPVS: using max 8 ests per chain, 19200 per kthread [ 118.978649][ T5615] ft260 0003:0403:6030.0001: failed to retrieve status: -32, no wakeup [ 118.980941][ T5615] ft260 0003:0403:6030.0001: failed to retrieve status: -5 [ 119.185896][ T5615] ft260 0003:0403:6030.0001: failed to reset I2C controller: -71 [ 119.920996][ T5615] usb 3-1: USB disconnect, device number 2 [ 120.110319][ T5866] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 120.526212][ T5874] netlink: 156 bytes leftover after parsing attributes in process `syz.3.47'. [ 121.976203][ T32] IPVS: starting estimator thread 0... [ 122.025980][ T5615] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 122.076011][ T5898] IPVS: using max 11 ests per chain, 26400 per kthread [ 122.297400][ T5902] netlink: 68 bytes leftover after parsing attributes in process `syz.0.54'. [ 122.306466][ T5615] usb 3-1: Using ep0 maxpacket: 32 [ 122.344344][ T5900] syz.3.57 (5900) used greatest stack depth: 17576 bytes left [ 122.350425][ T5615] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 122.350450][ T5615] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 122.350479][ T5615] usb 3-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 122.350496][ T5615] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.457822][ T5615] usb 3-1: config 0 descriptor?? [ 122.695523][ T5913] Zero length message leads to an empty skb [ 122.946758][ T5615] ft260 0003:0403:6030.0002: unknown main item tag 0x0 [ 122.946794][ T5615] ft260 0003:0403:6030.0002: unknown main item tag 0x0 [ 123.091389][ T5615] ft260 0003:0403:6030.0002: chip code: 0000 0000 [ 123.292226][ T5615] ft260 0003:0403:6030.0002: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.2-1/input0 [ 123.495488][ T5615] ft260 0003:0403:6030.0002: failed to retrieve status: -32, no wakeup [ 123.509576][ T5615] ft260 0003:0403:6030.0002: failed to retrieve status: -5 [ 123.707924][ T5615] ft260 0003:0403:6030.0002: failed to reset I2C controller: -71 [ 123.886454][ T5615] usb 3-1: USB disconnect, device number 3 [ 124.481525][ T5928] netlink: 68 bytes leftover after parsing attributes in process `syz.1.67'. [ 125.695536][ T5955] netlink: 68 bytes leftover after parsing attributes in process `syz.3.79'. [ 126.278159][ T5966] netlink: 12 bytes leftover after parsing attributes in process `syz.1.85'. [ 126.573934][ T4924] block nbd0: Receive control failed (result -1) [ 127.275051][ T5987] netlink: 8 bytes leftover after parsing attributes in process `syz.0.90'. [ 127.320721][ T5989] netlink: 68 bytes leftover after parsing attributes in process `syz.1.91'. [ 128.495582][ T6014] netlink: 8 bytes leftover after parsing attributes in process `syz.2.102'. [ 128.684189][ T6017] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 129.809973][ T6047] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 130.189034][ T6051] netlink: 68 bytes leftover after parsing attributes in process `syz.0.116'. [ 130.949564][ T6070] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 131.122679][ T6075] netlink: 12 bytes leftover after parsing attributes in process `syz.3.125'. [ 131.992005][ T6098] netlink: 68 bytes leftover after parsing attributes in process `syz.1.133'. [ 132.282265][ T6101] netlink: 200 bytes leftover after parsing attributes in process `syz.3.134'. [ 132.349878][ T6104] netlink: 200 bytes leftover after parsing attributes in process `syz.1.136'. [ 132.561031][ T6108] netlink: 84 bytes leftover after parsing attributes in process `syz.1.137'. [ 132.561160][ T6108] netlink: 88 bytes leftover after parsing attributes in process `syz.1.137'. [ 133.416094][ T5615] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 133.576490][ T5615] usb 2-1: Using ep0 maxpacket: 16 [ 133.581013][ T5615] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 133.581090][ T5615] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 133.581111][ T5615] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 133.581126][ T5615] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 133.585587][ T5615] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 133.585609][ T5615] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 133.585624][ T5615] usb 2-1: Manufacturer: syz [ 133.728196][ T6131] netlink: 200 bytes leftover after parsing attributes in process `syz.2.145'. [ 133.767113][ T5615] usb 2-1: config 0 descriptor?? [ 133.915043][ T6135] netlink: 200 bytes leftover after parsing attributes in process `syz.2.146'. [ 135.206392][ T6150] netlink: 200 bytes leftover after parsing attributes in process `syz.0.154'. [ 135.366589][ T6161] netlink: 84 bytes leftover after parsing attributes in process `syz.0.156'. [ 136.381458][ T5837] usb 2-1: USB disconnect, device number 2 [ 137.009900][ T6180] __nla_validate_parse: 1 callbacks suppressed [ 137.009921][ T6180] netlink: 200 bytes leftover after parsing attributes in process `syz.0.164'. [ 137.232559][ T6186] netlink: 168 bytes leftover after parsing attributes in process `syz.2.167'. [ 137.890521][ T6207] netlink: 8 bytes leftover after parsing attributes in process `syz.0.174'. [ 138.064387][ T6211] netlink: 168 bytes leftover after parsing attributes in process `syz.0.176'. [ 138.362332][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.362484][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 139.236937][ T6233] netlink: 8 bytes leftover after parsing attributes in process `syz.1.184'. [ 139.731767][ T6247] netlink: 168 bytes leftover after parsing attributes in process `syz.3.186'. [ 140.613794][ T6269] netlink: 168 bytes leftover after parsing attributes in process `syz.3.200'. [ 140.989885][ T6281] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 141.394579][ T6298] netlink: 168 bytes leftover after parsing attributes in process `syz.1.210'. [ 142.191393][ T6315] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 142.564331][ T6326] netlink: 168 bytes leftover after parsing attributes in process `syz.3.221'. [ 142.986341][ T6345] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 143.090064][ T6347] netlink: 8 bytes leftover after parsing attributes in process `syz.1.228'. [ 143.292054][ T6351] netlink: 8 bytes leftover after parsing attributes in process `syz.2.230'. [ 143.433144][ T6355] netlink: 164 bytes leftover after parsing attributes in process `syz.2.233'. [ 143.473488][ T6357] netlink: 120 bytes leftover after parsing attributes in process `syz.1.232'. [ 143.833867][ T6369] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 143.994771][ T6374] netlink: 168 bytes leftover after parsing attributes in process `syz.2.240'. [ 144.090114][ T6378] netlink: 8 bytes leftover after parsing attributes in process `syz.1.242'. [ 144.163427][ T6380] netlink: 164 bytes leftover after parsing attributes in process `syz.1.243'. [ 144.195425][ T6376] netlink: 8 bytes leftover after parsing attributes in process `syz.3.237'. [ 144.711282][ T6394] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 147.736495][ T6398] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 148.139649][ T6427] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 148.313160][ T6431] netlink: 156 bytes leftover after parsing attributes in process `syz.2.263'. [ 148.895729][ T6454] warning: `syz.2.269' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 149.381572][ T6463] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 151.497950][ T6442] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 152.316164][ T6486] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 153.193570][ T6501] netlink: 'syz.2.288': attribute type 2 has an invalid length. [ 153.193594][ T6501] netlink: 16 bytes leftover after parsing attributes in process `syz.2.288'. [ 153.193614][ T6501] nbd: must specify at least one socket [ 153.321657][ T6503] syz.3.287 uses obsolete (PF_INET,SOCK_PACKET) [ 153.763680][ T6512] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 155.051009][ T6532] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 156.785653][ T6592] netlink: 156 bytes leftover after parsing attributes in process `syz.2.313'. [ 157.539627][ T4924] Bluetooth: hci3: link tx timeout [ 157.543280][ T4924] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 157.577449][ T6608] netlink: 8 bytes leftover after parsing attributes in process `syz.2.318'. [ 158.496329][ T4924] Bluetooth: hci3: link tx timeout [ 158.496350][ T4924] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 159.088230][ T6664] netlink: 156 bytes leftover after parsing attributes in process `syz.3.333'. [ 159.637180][ T4924] Bluetooth: hci3: command 0x0406 tx timeout [ 160.017605][ T6688] netlink: 200 bytes leftover after parsing attributes in process `syz.2.344'. [ 160.659715][ T6708] netlink: 12 bytes leftover after parsing attributes in process `syz.2.350'. [ 161.282334][ T6736] netlink: 200 bytes leftover after parsing attributes in process `syz.0.355'. [ 161.608244][ T6742] netlink: 16 bytes leftover after parsing attributes in process `syz.3.358'. [ 161.768709][ T6749] netlink: 12 bytes leftover after parsing attributes in process `syz.1.361'. [ 162.200367][ T6764] netlink: 12 bytes leftover after parsing attributes in process `syz.1.366'. [ 162.771349][ T6777] netlink: 16 bytes leftover after parsing attributes in process `syz.0.370'. [ 163.508077][ T6810] netlink: 12 bytes leftover after parsing attributes in process `syz.3.376'. [ 163.789429][ T6824] netlink: 16 bytes leftover after parsing attributes in process `syz.3.382'. [ 163.985985][ T5341] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 164.169649][ T5341] usb 1-1: Using ep0 maxpacket: 16 [ 164.173235][ T5341] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 164.173312][ T5341] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 164.173342][ T5341] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 164.173364][ T5341] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 164.233334][ T5341] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 164.233393][ T5341] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 164.233412][ T5341] usb 1-1: Manufacturer: syz [ 164.303172][ T5341] usb 1-1: config 0 descriptor?? [ 165.468101][ T6868] netlink: 8 bytes leftover after parsing attributes in process `syz.2.399'. [ 165.485015][ T6869] netlink: 136 bytes leftover after parsing attributes in process `syz.3.400'. [ 166.562547][ T6894] netlink: 136 bytes leftover after parsing attributes in process `syz.1.410'. [ 166.705521][ T5341] usb 1-1: USB disconnect, device number 2 [ 167.036937][ T6908] netlink: 8 bytes leftover after parsing attributes in process `syz.0.417'. [ 167.604336][ T6928] netlink: 8 bytes leftover after parsing attributes in process `syz.0.427'. [ 167.650149][ T6929] netlink: 136 bytes leftover after parsing attributes in process `syz.1.426'. [ 167.677830][ T5615] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 167.827284][ T5615] usb 3-1: Using ep0 maxpacket: 16 [ 167.830060][ T5615] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 167.830118][ T5615] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 167.830147][ T5615] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 167.830169][ T5615] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 167.832433][ T5615] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 167.832463][ T5615] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 167.832485][ T5615] usb 3-1: Manufacturer: syz [ 167.932901][ T5615] usb 3-1: config 0 descriptor?? [ 168.273559][ T6948] netlink: 84 bytes leftover after parsing attributes in process `syz.1.435'. [ 168.273666][ T6948] netlink: 80 bytes leftover after parsing attributes in process `syz.1.435'. [ 168.376780][ T6952] netlink: 'syz.0.438': attribute type 1 has an invalid length. [ 168.376804][ T6952] netlink: 44 bytes leftover after parsing attributes in process `syz.0.438'. [ 168.470787][ T6954] netlink: 208 bytes leftover after parsing attributes in process `syz.1.439'. [ 168.961035][ T6974] netlink: 176 bytes leftover after parsing attributes in process `syz.3.447'. [ 168.961145][ T6974] netlink: 'syz.3.447': attribute type 1 has an invalid length. [ 169.130303][ T6978] netlink: 'syz.0.450': attribute type 1 has an invalid length. [ 169.130327][ T6978] netlink: 44 bytes leftover after parsing attributes in process `syz.0.450'. [ 170.344201][ T7022] netlink: 200 bytes leftover after parsing attributes in process `syz.0.470'. [ 170.409496][ T5837] usb 3-1: USB disconnect, device number 4 [ 170.710988][ T7030] netlink: 8 bytes leftover after parsing attributes in process `syz.3.474'. [ 171.406087][ T5837] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 171.555986][ T5837] usb 1-1: Using ep0 maxpacket: 16 [ 171.559111][ T5837] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 171.559166][ T5837] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 171.559206][ T5837] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 171.559228][ T5837] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 171.561275][ T5837] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 171.561310][ T5837] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 171.561330][ T5837] usb 1-1: Manufacturer: syz [ 171.704607][ T5837] usb 1-1: config 0 descriptor?? [ 173.096633][ T7106] __nla_validate_parse: 10 callbacks suppressed [ 173.096653][ T7106] netlink: 8 bytes leftover after parsing attributes in process `syz.1.508'. [ 173.098265][ T7104] netlink: 'syz.3.506': attribute type 1 has an invalid length. [ 173.098284][ T7104] netlink: 44 bytes leftover after parsing attributes in process `syz.3.506'. [ 173.212535][ T7108] netlink: 8 bytes leftover after parsing attributes in process `syz.2.509'. [ 173.818169][ T7128] netlink: 8 bytes leftover after parsing attributes in process `syz.3.518'. [ 174.179133][ T5837] usb 1-1: USB disconnect, device number 3 [ 175.228896][ T5615] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 175.425962][ T5615] usb 4-1: Using ep0 maxpacket: 16 [ 175.428000][ T5615] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 175.428065][ T5615] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 175.428094][ T5615] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 175.428116][ T5615] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 175.429305][ T5615] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 175.429333][ T5615] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 175.429354][ T5615] usb 4-1: Manufacturer: syz [ 175.534879][ T5615] usb 4-1: config 0 descriptor?? [ 175.919266][ T7179] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 176.933350][ T7201] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 177.027991][ T7203] netlink: 28 bytes leftover after parsing attributes in process `syz.1.552'. [ 177.999512][ T7226] netlink: 8 bytes leftover after parsing attributes in process `syz.0.562'. [ 178.101470][ T32] usb 4-1: USB disconnect, device number 2 [ 178.132111][ T7228] netlink: 28 bytes leftover after parsing attributes in process `syz.1.563'. [ 178.792441][ T7253] netlink: 28 bytes leftover after parsing attributes in process `syz.2.574'. [ 180.664565][ T7305] netlink: 12 bytes leftover after parsing attributes in process `syz.2.595'. [ 181.147021][ T7319] netlink: 'syz.1.602': attribute type 2 has an invalid length. [ 181.147045][ T7319] netlink: 16 bytes leftover after parsing attributes in process `syz.1.602'. [ 181.147063][ T7319] nbd: must specify at least one socket [ 181.500371][ T7329] netlink: 12 bytes leftover after parsing attributes in process `syz.2.606'. [ 182.022610][ T7344] netlink: 32 bytes leftover after parsing attributes in process `syz.3.611'. [ 182.022636][ T7344] openvswitch: netlink: Flow key attr not present in new flow. [ 182.360936][ T7356] netlink: 12 bytes leftover after parsing attributes in process `syz.2.617'. [ 182.779216][ T7371] netlink: 32 bytes leftover after parsing attributes in process `syz.2.623'. [ 182.779261][ T7371] openvswitch: netlink: Flow key attr not present in new flow. [ 183.195249][ T7381] netlink: 44 bytes leftover after parsing attributes in process `syz.3.628'. [ 183.242696][ T7383] netlink: 172 bytes leftover after parsing attributes in process `syz.0.629'. [ 183.539945][ T7394] netlink: 32 bytes leftover after parsing attributes in process `syz.3.634'. [ 183.539969][ T7394] openvswitch: netlink: Flow key attr not present in new flow. [ 183.868509][ T7403] netlink: 44 bytes leftover after parsing attributes in process `syz.0.639'. [ 184.036141][ T7407] netlink: 172 bytes leftover after parsing attributes in process `syz.0.641'. [ 184.320032][ T7417] netlink: 20 bytes leftover after parsing attributes in process `syz.3.646'. [ 184.320057][ T7417] openvswitch: netlink: Flow actions attr not present in new flow. [ 184.508118][ T7421] netlink: 44 bytes leftover after parsing attributes in process `syz.2.649'. [ 184.639707][ T7428] netlink: 172 bytes leftover after parsing attributes in process `syz.0.652'. [ 185.183775][ T7450] netlink: 172 bytes leftover after parsing attributes in process `syz.3.662'. [ 185.848203][ T7477] netlink: 172 bytes leftover after parsing attributes in process `syz.2.675'. [ 186.548547][ T7503] openvswitch: netlink: Flow actions attr not present in new flow. [ 186.996056][ T9] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 187.146401][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 187.149717][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 187.149772][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 187.149802][ T9] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 187.149824][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 187.152184][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 187.152215][ T9] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 187.152237][ T9] usb 3-1: Manufacturer: syz [ 187.255537][ T9] usb 3-1: config 0 descriptor?? [ 187.411170][ T7530] openvswitch: netlink: Flow actions attr not present in new flow. [ 188.541015][ T7562] netlink: 'syz.0.714': attribute type 2 has an invalid length. [ 188.541038][ T7562] __nla_validate_parse: 6 callbacks suppressed [ 188.541050][ T7562] netlink: 16 bytes leftover after parsing attributes in process `syz.0.714'. [ 188.541070][ T7562] nbd: must specify at least one socket [ 189.728711][ T32] usb 3-1: USB disconnect, device number 5 [ 190.780444][ T7624] netlink: 156 bytes leftover after parsing attributes in process `syz.1.741'. [ 192.803700][ T7688] netlink: 156 bytes leftover after parsing attributes in process `syz.1.770'. [ 194.641469][ T5837] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 194.745548][ T7755] openvswitch: netlink: Flow actions attr not present in new flow. [ 194.915885][ T5837] usb 1-1: Using ep0 maxpacket: 16 [ 194.920454][ T5837] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 194.920506][ T5837] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 194.920526][ T5837] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 194.920541][ T5837] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 194.921866][ T5837] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 194.921896][ T5837] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 194.921911][ T5837] usb 1-1: Manufacturer: syz [ 195.020923][ T5837] usb 1-1: config 0 descriptor?? [ 197.214031][ T7832] netlink: 176 bytes leftover after parsing attributes in process `syz.3.829'. [ 197.322863][ T11] usb 1-1: USB disconnect, device number 4 [ 197.481293][ T7838] netlink: 52 bytes leftover after parsing attributes in process `syz.1.831'. [ 199.599614][ T7912] netlink: 172 bytes leftover after parsing attributes in process `syz.1.866'. [ 199.811615][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.811720][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 200.360347][ T7933] netlink: 172 bytes leftover after parsing attributes in process `syz.2.876'. [ 201.364690][ T7975] netlink: 52 bytes leftover after parsing attributes in process `syz.0.895'. [ 201.611086][ T7982] netlink: 192 bytes leftover after parsing attributes in process `syz.1.898'. [ 201.820210][ T7990] netlink: 112 bytes leftover after parsing attributes in process `syz.3.902'. [ 202.250911][ T8005] netlink: 192 bytes leftover after parsing attributes in process `syz.0.909'. [ 202.857407][ T8028] netlink: 112 bytes leftover after parsing attributes in process `syz.3.920'. [ 204.883159][ T8099] netlink: 44 bytes leftover after parsing attributes in process `syz.2.949'. [ 205.341213][ T11] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 205.515973][ T11] usb 4-1: Using ep0 maxpacket: 16 [ 205.519259][ T11] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 205.519315][ T11] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 205.519344][ T11] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 205.519374][ T11] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 205.596690][ T11] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 205.596725][ T11] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 205.596748][ T11] usb 4-1: Manufacturer: syz [ 205.604653][ T11] usb 4-1: config 0 descriptor?? [ 208.132779][ T823] usb 4-1: USB disconnect, device number 3 [ 209.422149][ T8237] netlink: 184 bytes leftover after parsing attributes in process `syz.1.1013'. [ 209.948127][ T8257] netlink: 184 bytes leftover after parsing attributes in process `syz.2.1023'. [ 210.491142][ T5616] Bluetooth: hci3: link tx timeout [ 210.491165][ T5616] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 210.692093][ T8285] netlink: 184 bytes leftover after parsing attributes in process `syz.2.1034'. [ 210.818667][ T8277] tipc: Started in network mode [ 210.818703][ T8277] tipc: Node identity d2df54e0810e, cluster identity 4711 [ 210.819131][ T8277] tipc: Enabled bearer , priority 0 [ 211.251724][ T8277] syzkaller0: entered promiscuous mode [ 211.251756][ T8277] syzkaller0: entered allmulticast mode [ 211.270411][ T8277] tipc: Resetting bearer [ 211.406135][ T8275] tipc: Resetting bearer [ 211.728514][ T4924] Bluetooth: hci3: link tx timeout [ 211.728536][ T4924] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 211.954728][ T8308] netlink: 184 bytes leftover after parsing attributes in process `syz.0.1044'. [ 212.519990][ T4924] Bluetooth: hci3: command 0x0406 tx timeout [ 222.436219][ T5622] Bluetooth: hci0: command 0x0406 tx timeout [ 222.436261][ T5622] Bluetooth: hci2: command 0x0406 tx timeout [ 222.436284][ T5622] Bluetooth: hci1: command 0x0406 tx timeout [ 225.668625][ T8275] tipc: Disabling bearer [ 225.818086][ T11] tipc: Node number set to 1406227680 [ 226.227420][ T823] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 226.394166][ T61] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 226.446480][ T823] usb 1-1: Using ep0 maxpacket: 16 [ 226.447265][ T61] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 226.449565][ T61] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 226.474747][ T61] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 226.502692][ T823] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 226.502763][ T823] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 226.502792][ T823] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 226.502814][ T823] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 226.531105][ T61] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 226.599910][ T823] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 226.599950][ T823] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 226.599970][ T823] usb 1-1: Manufacturer: syz [ 226.905290][ T823] usb 1-1: config 0 descriptor?? [ 227.752383][ T8360] netlink: 'syz.3.1060': attribute type 4 has an invalid length. [ 227.800665][ T8363] netlink: 'syz.3.1060': attribute type 4 has an invalid length. [ 228.616938][ T8376] netlink: 4596 bytes leftover after parsing attributes in process `syz.2.1067'. [ 228.916323][ T4924] Bluetooth: hci4: command tx timeout [ 229.103405][ T32] usb 1-1: USB disconnect, device number 5 [ 229.662403][ T8329] bridge0: port 1(bridge_slave_0) entered blocking state [ 229.662871][ T8329] bridge0: port 1(bridge_slave_0) entered disabled state [ 229.663158][ T8329] bridge_slave_0: entered allmulticast mode [ 229.668538][ T8329] bridge_slave_0: entered promiscuous mode [ 229.706823][ T8329] bridge0: port 2(bridge_slave_1) entered blocking state [ 229.707274][ T8329] bridge0: port 2(bridge_slave_1) entered disabled state [ 229.707606][ T8329] bridge_slave_1: entered allmulticast mode [ 229.730485][ T8329] bridge_slave_1: entered promiscuous mode [ 229.996589][ T8329] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 230.049736][ T5616] block nbd1: Receive control failed (result -32) [ 230.053673][ T4924] block nbd1: Receive control failed (result -32) [ 230.090590][ T8329] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 230.266533][ T8329] team0: Port device team_slave_0 added [ 230.273836][ T8329] team0: Port device team_slave_1 added [ 230.600785][ T8417] raw_sendmsg: syz.0.1082 forgot to set AF_INET. Fix it! [ 230.771169][ T8329] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 230.771187][ T8329] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 230.771215][ T8329] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 230.832132][ T8329] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 230.832161][ T8329] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 230.832193][ T8329] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 230.996060][ T5616] Bluetooth: hci4: command tx timeout [ 231.162290][ T8329] hsr_slave_0: entered promiscuous mode [ 231.164598][ T8329] hsr_slave_1: entered promiscuous mode [ 231.189889][ T8329] debugfs: 'hsr0' already exists in 'hsr' [ 231.189919][ T8329] Cannot create hsr debugfs directory [ 232.442353][ T4924] block nbd2: Receive control failed (result -32) [ 232.442357][ T5616] block nbd2: Receive control failed (result -32) [ 232.552224][ T8329] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 232.606619][ T8329] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 232.621776][ T8329] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 232.675188][ T8329] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 232.693330][ T8329] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 232.788756][ T8329] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 232.790284][ T8329] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 232.879609][ T8329] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 233.080169][ T5616] Bluetooth: hci4: command tx timeout [ 233.910794][ T8329] 8021q: adding VLAN 0 to HW filter on device bond0 [ 234.069661][ T8329] 8021q: adding VLAN 0 to HW filter on device team0 [ 234.155707][ T3275] bridge0: port 1(bridge_slave_0) entered blocking state [ 234.160934][ T3275] bridge0: port 1(bridge_slave_0) entered forwarding state [ 234.305179][ T68] bridge0: port 2(bridge_slave_1) entered blocking state [ 234.376006][ T68] bridge0: port 2(bridge_slave_1) entered forwarding state [ 235.156968][ T4924] Bluetooth: hci4: command tx timeout [ 236.394562][ T8329] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 237.559654][ T8329] veth0_vlan: entered promiscuous mode [ 237.598834][ T8329] veth1_vlan: entered promiscuous mode [ 237.924375][ T8329] veth0_macvtap: entered promiscuous mode [ 237.983548][ T8329] veth1_macvtap: entered promiscuous mode [ 238.128249][ T8329] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 238.305247][ T8329] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 238.426151][ T3377] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 238.426204][ T3377] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 238.426245][ T3377] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 238.426292][ T3377] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 239.764137][ T1479] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 239.764159][ T1479] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 239.907484][ T2170] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 239.907505][ T2170] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 242.819136][ T8747] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1223'. [ 243.414357][ T8770] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1236'. [ 243.991969][ T8797] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1248'. [ 244.901754][ T8826] netlink: 200 bytes leftover after parsing attributes in process `syz.3.1262'. [ 245.426981][ T8850] netlink: 200 bytes leftover after parsing attributes in process `syz.0.1274'. [ 245.966106][ T8871] netlink: 200 bytes leftover after parsing attributes in process `syz.4.1284'. [ 246.397889][ T8888] nbd: must specify at least one socket [ 246.622477][ T8896] netlink: 192 bytes leftover after parsing attributes in process `syz.3.1295'. [ 246.986139][ T5837] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 247.129373][ T5837] usb 1-1: device descriptor read/64, error -71 [ 247.416697][ T5837] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 247.555977][ T5837] usb 1-1: device descriptor read/64, error -71 [ 247.667318][ T5837] usb usb1-port1: attempt power cycle [ 248.096442][ T5837] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 248.102928][ T8953] netlink: 192 bytes leftover after parsing attributes in process `syz.2.1323'. [ 248.118583][ T5837] usb 1-1: device descriptor read/8, error -71 [ 248.396136][ T5837] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 248.421236][ T5837] usb 1-1: device descriptor read/8, error -71 [ 248.527881][ T5837] usb usb1-port1: unable to enumerate USB device [ 250.389018][ T5837] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 250.535942][ T5837] usb 4-1: device descriptor read/64, error -71 [ 250.629744][ T9045] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1368'. [ 250.836129][ T5837] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 251.040794][ T5837] usb 4-1: device descriptor read/64, error -71 [ 251.149509][ T5837] usb usb4-port1: attempt power cycle [ 251.580257][ T5837] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 251.597942][ T5837] usb 4-1: device descriptor read/8, error -71 [ 251.678235][ T9070] block nbd3: server does not support multiple connections per device. [ 251.713048][ T9070] block nbd3: shutting down sockets [ 251.867390][ T5837] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 251.886732][ T5837] usb 4-1: device descriptor read/8, error -71 [ 251.997501][ T5837] usb usb4-port1: unable to enumerate USB device [ 252.095566][ T9088] netlink: 'syz.0.1387': attribute type 4 has an invalid length. [ 252.161597][ T9092] netlink: 'syz.0.1387': attribute type 4 has an invalid length. [ 252.366472][ T9094] block nbd3: server does not support multiple connections per device. [ 252.370290][ T9094] block nbd3: shutting down sockets [ 252.807024][ T9117] netlink: 'syz.2.1401': attribute type 4 has an invalid length. [ 252.860709][ T9120] netlink: 'syz.2.1401': attribute type 4 has an invalid length. [ 253.570249][ T9143] netlink: 'syz.2.1414': attribute type 4 has an invalid length. [ 253.630130][ T9146] netlink: 'syz.2.1414': attribute type 4 has an invalid length. [ 254.116089][ T5597] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 254.246353][ T5597] usb 4-1: device descriptor read/64, error -71 [ 254.364136][ T9167] netlink: 'syz.2.1426': attribute type 4 has an invalid length. [ 254.408413][ T9167] netlink: 'syz.2.1426': attribute type 4 has an invalid length. [ 254.499575][ T5597] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 254.627774][ T5597] usb 4-1: device descriptor read/64, error -71 [ 254.736570][ T5597] usb usb4-port1: attempt power cycle [ 254.830257][ T9184] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1433'. [ 254.983634][ T9190] netlink: 'syz.0.1436': attribute type 4 has an invalid length. [ 255.015642][ T9190] netlink: 'syz.0.1436': attribute type 4 has an invalid length. [ 255.076232][ T5597] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 255.097244][ T5597] usb 4-1: device descriptor read/8, error -71 [ 255.137152][ T9196] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1438'. [ 255.348102][ T5597] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 255.369333][ T5597] usb 4-1: device descriptor read/8, error -71 [ 255.478872][ T5597] usb usb4-port1: unable to enumerate USB device [ 256.525436][ T9249] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1463'. [ 256.594299][ T9251] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1464'. [ 256.977567][ T4924] block nbd3: Receive control failed (result -32) [ 257.140953][ T9272] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1474'. [ 257.744357][ T9294] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1484'. [ 257.835942][ T32] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 257.986034][ T32] usb 4-1: device descriptor read/64, error -71 [ 257.989215][ T9303] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1489'. [ 257.989252][ T9303] netlink: 59 bytes leftover after parsing attributes in process `syz.0.1489'. [ 258.225916][ T32] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 258.367659][ T32] usb 4-1: device descriptor read/64, error -71 [ 258.447285][ T9318] netlink: 'syz.4.1496': attribute type 4 has an invalid length. [ 258.474132][ T9318] netlink: 'syz.4.1496': attribute type 4 has an invalid length. [ 258.484489][ T32] usb usb4-port1: attempt power cycle [ 258.838509][ T32] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 258.874091][ T32] usb 4-1: device descriptor read/8, error -71 [ 259.127104][ T32] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 259.155500][ T32] usb 4-1: device descriptor read/8, error -71 [ 259.263426][ T32] usb usb4-port1: unable to enumerate USB device [ 259.363766][ T9347] netlink: 'syz.2.1508': attribute type 4 has an invalid length. [ 260.181936][ T9370] netlink: 'syz.0.1518': attribute type 4 has an invalid length. [ 261.253413][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 261.253529][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 261.334370][ T9418] netlink: 'syz.4.1539': attribute type 4 has an invalid length. [ 262.211759][ T9440] netlink: 'syz.0.1548': attribute type 4 has an invalid length. [ 263.240680][ T9478] netlink: 'syz.2.1566': attribute type 4 has an invalid length. [ 263.955286][ T9507] netlink: 'syz.3.1578': attribute type 4 has an invalid length. [ 264.746143][ T823] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 264.897101][ T823] usb 1-1: Using ep0 maxpacket: 16 [ 264.899095][ T823] usb 1-1: config 0 has an invalid descriptor of length 122, skipping remainder of the config [ 264.899123][ T823] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 264.903462][ T823] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 264.903497][ T823] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 264.903512][ T823] usb 1-1: Manufacturer: syz [ 264.974399][ T9541] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1595'. [ 265.011902][ T9544] syzkaller1: entered promiscuous mode [ 265.011925][ T9544] syzkaller1: entered allmulticast mode [ 265.012605][ T823] usb 1-1: config 0 descriptor?? [ 265.800040][ T9567] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1604'. [ 267.500946][ T5837] usb 1-1: USB disconnect, device number 10 [ 268.340077][ T9602] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1621'. [ 268.958308][ T9618] netlink: 'syz.4.1629': attribute type 4 has an invalid length. [ 269.005136][ T9622] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1631'. [ 269.049149][ T9620] nbd3: detected capacity change from 0 to 18014398509481983 [ 269.057233][ T58] [ 269.057245][ T58] ====================================================== [ 269.057254][ T58] WARNING: possible circular locking dependency detected [ 269.057273][ T58] syzkaller #0 Not tainted [ 269.057285][ T58] ------------------------------------------------------ [ 269.057294][ T58] kworker/0:1H/58 is trying to acquire lock: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 269.057306][ T58] ffff88823bf02f60 (&nsock->tx_lock){+.+.}-{4:4}, at: nbd_queue_rq+0x373/0x1150 [ 269.057375][ T58] [ 269.057375][ T58] but task is already holding lock: [ 269.057383][ T58] ffff888027a751f0 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc1/0x1150 [ 269.057431][ T58] [ 269.057431][ T58] which lock already depends on the new lock. [ 269.057431][ T58] [ 269.057439][ T58] [ 269.057439][ T58] the existing dependency chain (in reverse order) is: [ 269.057447][ T58] [ 269.057447][ T58] -> #6 (&cmd->lock){+.+.}-{4:4}: [ 269.057474][ T58] mutex_lock_nested+0x5a/0x1d0 [ 269.057506][ T58] nbd_queue_rq+0xc1/0x1150 [ 269.057527][ T58] blk_mq_dispatch_rq_list+0x4af/0x1a00 [ 269.057549][ T58] __blk_mq_sched_dispatch_requests+0xd45/0x1590 [ 269.057574][ T58] blk_mq_sched_dispatch_requests+0xda/0x1a0 [ 269.057599][ T58] blk_mq_run_work_fn+0x16f/0x300 [ 269.057627][ T58] process_one_work+0x93a/0x12b0 [ 269.057656][ T58] worker_thread+0xb05/0x10d0 [ 269.057686][ T58] kthread+0x388/0x470 [ 269.057707][ T58] ret_from_fork+0x514/0xb70 [ 269.057730][ T58] ret_from_fork_asm+0x1a/0x30 [ 269.057755][ T58] [ 269.057755][ T58] -> #5 (set->srcu){.+.+}-{0:0}: [ 269.057793][ T58] __synchronize_srcu+0xc9/0x2f0 [ 269.057820][ T58] elevator_switch+0x1e8/0x7b0 [ 269.057839][ T58] elevator_change+0x2fa/0x480 [ 269.057859][ T58] elevator_set_default+0x375/0x440 [ 269.057879][ T58] blk_register_queue+0x3f3/0x4e0 [ 269.057909][ T58] __add_disk+0x6cb/0xe30 [ 269.057935][ T58] add_disk_fwnode+0xfb/0x4b0 [ 269.057961][ T58] nbd_dev_add+0x733/0xb60 [ 269.057981][ T58] nbd_init+0x15f/0x1e0 [ 269.058006][ T58] do_one_initcall+0x250/0x870 [ 269.058027][ T58] do_initcall_level+0x10a/0x1a0 [ 269.058051][ T58] do_initcalls+0x59/0xa0 [ 269.058073][ T58] kernel_init_freeable+0x29d/0x3e0 [ 269.058096][ T58] kernel_init+0x1d/0x1d0 [ 269.058124][ T58] ret_from_fork+0x514/0xb70 [ 269.058147][ T58] ret_from_fork_asm+0x1a/0x30 [ 269.058171][ T58] [ 269.058171][ T58] -> #4 (&q->elevator_lock){+.+.}-{4:4}: [ 269.058199][ T58] mutex_lock_nested+0x5a/0x1d0 [ 269.058229][ T58] elevator_change+0x1af/0x480 [ 269.058249][ T58] elevator_set_none+0xb5/0x140 [ 269.058269][ T58] blk_mq_update_nr_hw_queues+0x60f/0x1a20 [ 269.058297][ T58] nbd_start_device+0x189/0xb30 [ 269.058320][ T58] nbd_genl_connect+0x1599/0x1c00 [ 269.058342][ T58] genl_family_rcv_msg_doit+0x233/0x340 [ 269.058364][ T58] genl_rcv_msg+0x614/0x7a0 [ 269.058384][ T58] netlink_rcv_skb+0x226/0x4a0 [ 269.058409][ T58] genl_rcv+0x28/0x40 [ 269.058426][ T58] netlink_unicast+0x7f5/0x990 [ 269.058449][ T58] netlink_sendmsg+0x813/0xb40 [ 269.058476][ T58] sock_sendmsg_nosec+0x13a/0x180 [ 269.058494][ T58] ____sys_sendmsg+0x565/0x870 [ 269.058521][ T58] ___sys_sendmsg+0x2a5/0x360 [ 269.058547][ T58] __x64_sys_sendmsg+0x1b7/0x290 [ 269.058573][ T58] do_syscall_64+0x174/0x580 [ 269.058598][ T58] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 269.058618][ T58] [ 269.058618][ T58] -> #3 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 269.058652][ T58] blk_alloc_queue+0x54c/0x690 [ 269.058672][ T58] __blk_mq_alloc_disk+0x194/0x390 [ 269.058696][ T58] nbd_dev_add+0x494/0xb60 [ 269.058717][ T58] nbd_init+0x15f/0x1e0 [ 269.058740][ T58] do_one_initcall+0x250/0x870 [ 269.058761][ T58] do_initcall_level+0x10a/0x1a0 [ 269.058792][ T58] do_initcalls+0x59/0xa0 [ 269.058814][ T58] kernel_init_freeable+0x29d/0x3e0 [ 269.058837][ T58] kernel_init+0x1d/0x1d0 [ 269.058866][ T58] ret_from_fork+0x514/0xb70 [ 269.058888][ T58] ret_from_fork_asm+0x1a/0x30 [ 269.058911][ T58] [ 269.058911][ T58] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 269.058939][ T58] fs_reclaim_acquire+0x71/0x100 [ 269.058961][ T58] __kmalloc_noprof+0xb9/0x790 [ 269.058981][ T58] tls_sw_sendmsg+0x599/0x2860 [ 269.059007][ T58] sock_sendmsg_nosec+0x90/0x180 [ 269.059025][ T58] sock_sendmsg+0x1ca/0x2d0 [ 269.059041][ T58] splice_to_socket+0xb61/0x12a0 [ 269.059065][ T58] direct_splice_actor+0x104/0x160 [ 269.059089][ T58] splice_direct_to_actor+0x586/0xcc0 [ 269.059113][ T58] do_splice_direct+0x19b/0x2a0 [ 269.059136][ T58] do_sendfile+0x540/0x7e0 [ 269.059154][ T58] __se_sys_sendfile64+0x144/0x1a0 [ 269.059185][ T58] do_syscall_64+0x174/0x580 [ 269.059209][ T58] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 269.059229][ T58] [ 269.059229][ T58] -> #1 (sk_lock-AF_INET6-NBD){+.+.}-{0:0}: [ 269.059258][ T58] lock_sock_nested+0x41/0x130 [ 269.059278][ T58] inet_shutdown+0x6a/0x390 [ 269.059300][ T58] nbd_mark_nsock_dead+0x2cb/0x550 [ 269.059323][ T58] recv_work+0x1d0c/0x1e40 [ 269.059347][ T58] process_one_work+0x93a/0x12b0 [ 269.059374][ T58] worker_thread+0xb05/0x10d0 [ 269.059404][ T58] kthread+0x388/0x470 [ 269.059425][ T58] ret_from_fork+0x514/0xb70 [ 269.059448][ T58] ret_from_fork_asm+0x1a/0x30 [ 269.059471][ T58] [ 269.059471][ T58] -> #0 (&nsock->tx_lock){+.+.}-{4:4}: [ 269.059500][ T58] __lock_acquire+0x1520/0x2ce0 [ 269.059526][ T58] lock_acquire+0x106/0x350 [ 269.059551][ T58] mutex_lock_nested+0x5a/0x1d0 [ 269.059581][ T58] nbd_queue_rq+0x373/0x1150 [ 269.059603][ T58] blk_mq_dispatch_rq_list+0x4af/0x1a00 [ 269.059625][ T58] __blk_mq_sched_dispatch_requests+0xd45/0x1590 [ 269.059650][ T58] blk_mq_sched_dispatch_requests+0xda/0x1a0 [ 269.059676][ T58] blk_mq_run_work_fn+0x16f/0x300 [ 269.059722][ T58] process_one_work+0x93a/0x12b0 [ 269.059751][ T58] worker_thread+0xb05/0x10d0 [ 269.059790][ T58] kthread+0x388/0x470 [ 269.059811][ T58] ret_from_fork+0x514/0xb70 [ 269.059833][ T58] ret_from_fork_asm+0x1a/0x30 [ 269.059857][ T58] [ 269.059857][ T58] other info that might help us debug this: [ 269.059857][ T58] [ 269.059864][ T58] Chain exists of: [ 269.059864][ T58] &nsock->tx_lock --> set->srcu --> &cmd->lock [ 269.059864][ T58] [ 269.059899][ T58] Possible unsafe locking scenario: [ 269.059899][ T58] [ 269.059905][ T58] CPU0 CPU1 [ 269.059912][ T58] ---- ---- [ 269.059919][ T58] lock(&cmd->lock); [ 269.059933][ T58] lock(set->srcu); [ 269.059949][ T58] lock(&cmd->lock); [ 269.059964][ T58] lock(&nsock->tx_lock); [ 269.059979][ T58] [ 269.059979][ T58] *** DEADLOCK *** [ 269.059979][ T58] [ 269.059985][ T58] 4 locks held by kworker/0:1H/58: [ 269.059997][ T58] #0: ffff88801e2d1138 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 269.060056][ T58] #1: ffffc9000124fc60 ((work_completion)(&(&hctx->run_work)->work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 [ 269.060118][ T58] #2: ffff888026d28598 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_work_fn+0x147/0x300 [ 269.060178][ T58] #3: ffff888027a751f0 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc1/0x1150 [ 269.060230][ T58] [ 269.060230][ T58] stack backtrace: [ 269.060259][ T58] CPU: 0 UID: 0 PID: 58 Comm: kworker/0:1H Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 269.060373][ T58] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 269.060392][ T58] Workqueue: kblockd blk_mq_run_work_fn [ 269.060439][ T58] Call Trace: [ 269.060453][ T58] [ 269.060463][ T58] dump_stack_lvl+0xe8/0x150 [ 269.060487][ T58] print_circular_bug+0x2e1/0x300 [ 269.060519][ T58] check_noncircular+0x12e/0x150 [ 269.060566][ T58] __lock_acquire+0x1520/0x2ce0 [ 269.060608][ T58] ? nbd_queue_rq+0x373/0x1150 [ 269.060633][ T58] lock_acquire+0x106/0x350 [ 269.060662][ T58] ? nbd_queue_rq+0x373/0x1150 [ 269.060690][ T58] ? nbd_queue_rq+0x373/0x1150 [ 269.060718][ T58] ? nbd_queue_rq+0x373/0x1150 [ 269.060742][ T58] mutex_lock_nested+0x5a/0x1d0 [ 269.060778][ T58] ? nbd_queue_rq+0x373/0x1150 [ 269.060807][ T58] nbd_queue_rq+0x373/0x1150 [ 269.060836][ T58] ? do_raw_spin_lock+0x12b/0x2f0 [ 269.060862][ T58] ? __pfx_nbd_queue_rq+0x10/0x10 [ 269.060892][ T58] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 269.060924][ T58] blk_mq_dispatch_rq_list+0x4af/0x1a00 [ 269.061033][ T58] ? sbitmap_get+0x229/0x390 [ 269.061060][ T58] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 269.061085][ T58] ? __blk_mq_alloc_driver_tag+0x2e7/0x6e0 [ 269.061113][ T58] __blk_mq_sched_dispatch_requests+0xd45/0x1590 [ 269.061151][ T58] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 269.061182][ T58] ? blk_mq_run_work_fn+0x147/0x300 [ 269.061215][ T58] ? blk_mq_run_work_fn+0x147/0x300 [ 269.061258][ T58] blk_mq_sched_dispatch_requests+0xda/0x1a0 [ 269.061288][ T58] ? blk_mq_run_work_fn+0x147/0x300 [ 269.061327][ T58] blk_mq_run_work_fn+0x16f/0x300 [ 269.061369][ T58] ? process_one_work+0x8cd/0x12b0 [ 269.061400][ T58] process_one_work+0x93a/0x12b0 [ 269.061475][ T58] ? __pfx_process_one_work+0x10/0x10 [ 269.061504][ T58] ? do_raw_spin_lock+0x12b/0x2f0 [ 269.061557][ T58] ? assign_work+0x3cf/0x5d0 [ 269.061592][ T58] worker_thread+0xb05/0x10d0 [ 269.061631][ T58] ? __kthread_parkme+0x71/0x1f0 [ 269.061657][ T58] kthread+0x388/0x470 [ 269.061689][ T58] ? __pfx_worker_thread+0x10/0x10 [ 269.061722][ T58] ? __pfx_kthread+0x10/0x10 [ 269.061748][ T58] ret_from_fork+0x514/0xb70 [ 269.061775][ T58] ? __pfx_ret_from_fork+0x10/0x10 [ 269.061808][ T58] ? __switch_to+0xc89/0x1420 [ 269.061830][ T58] ? __pfx_kthread+0x10/0x10 [ 269.061854][ T58] ret_from_fork_asm+0x1a/0x30 [ 269.061888][ T58] [ 269.061954][ T58] block nbd3: Dead connection, failed to find a fallback [ 269.061975][ T58] block nbd3: shutting down sockets [ 269.061990][ T58] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 269.062061][ T58] Buffer I/O error on dev nbd3, logical block 0, async page read [ 269.521394][ T58] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 269.521459][ T58] Buffer I/O error on dev nbd3, logical block 1, async page read [ 269.521576][ T58] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 269.521626][ T58] Buffer I/O error on dev nbd3, logical block 2, async page read [ 269.521733][ T58] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 269.521783][ T58] Buffer I/O error on dev nbd3, logical block 3, async page read [ 269.531252][ T58] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 269.531330][ T58] Buffer I/O error on dev nbd3, logical block 0, async page read [ 269.543975][ T58] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 269.544045][ T58] Buffer I/O error on dev nbd3, logical block 1, async page read [ 269.588589][ T58] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x0 phys_seg 2 prio class 2 [ 269.588656][ T58] Buffer I/O error on dev nbd3, logical block 2, async page read [ 269.588700][ T58] Buffer I/O error on dev nbd3, logical block 3, async page read [ 269.593382][ T58] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 269.593447][ T58] Buffer I/O error on dev nbd3, logical block 0, async page read [ 269.593489][ T58] Buffer I/O error on dev nbd3, logical block 1, async page read [ 269.616342][ T33] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 269.619484][ T33] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 269.652883][ T8392] ldm_validate_partition_table(): Disk read failed. [ 269.673337][ T8392] Dev nbd3: unable to read RDB block 0 [ 269.714100][ T8392] nbd3: unable to read partition table [ 269.801821][ T8392] ldm_validate_partition_table(): Disk read failed. [ 269.840496][ T8392] Dev nbd3: unable to read RDB block 0 [ 269.874672][ T8392] nbd3: unable to read partition table [ 271.858096][ T1479] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 272.077826][ T1479] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 272.277496][ T1479] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 272.487493][ T1479] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 272.866750][ T1479] bridge_slave_1: left allmulticast mode [ 272.866781][ T1479] bridge_slave_1: left promiscuous mode [ 272.867009][ T1479] bridge0: port 2(bridge_slave_1) entered disabled state [ 273.046754][ T1479] bridge_slave_0: left allmulticast mode [ 273.046778][ T1479] bridge_slave_0: left promiscuous mode [ 273.046941][ T1479] bridge0: port 1(bridge_slave_0) entered disabled state [ 273.696703][ T1479] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 273.776661][ T1479] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 273.797838][ T1479] bond0 (unregistering): Released all slaves [ 273.837962][ T5270] 8021q: adding VLAN 0 to HW filter on device eth1 [ 274.217311][ T5270] 8021q: adding VLAN 0 to HW filter on device eth2 [ 274.638836][ T5270] 8021q: adding VLAN 0 to HW filter on device eth3 [ 274.945992][ T1479] hsr_slave_0: left promiscuous mode [ 274.986087][ T1479] hsr_slave_1: left promiscuous mode [ 274.986903][ T1479] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 274.986926][ T1479] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 275.026780][ T1479] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 275.026798][ T1479] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 275.086523][ T1479] veth1_macvtap: left promiscuous mode [ 275.086591][ T1479] veth0_macvtap: left promiscuous mode [ 275.086784][ T1479] veth1_vlan: left promiscuous mode [ 275.086905][ T1479] veth0_vlan: left promiscuous mode [ 275.616597][ T1479] team0 (unregistering): Port device team_slave_1 removed [ 275.656621][ T1479] team0 (unregistering): Port device team_slave_0 removed [ 275.771705][ T5270] 8021q: adding VLAN 0 to HW filter on device eth4