last executing test programs: 1m10.530796505s ago: executing program 0 (id=173): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f00000002c0)=0xb, 0x4) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b4560a067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03a98000000ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) 1m2.261672068s ago: executing program 0 (id=174): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x6, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xa}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0x1f400, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 59.805698607s ago: executing program 1 (id=175): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x90) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0xa, &(0x7f0000000040)={0x0, 0xc8a1, 0x7581, 0x8, 0x315}) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') preadv(r0, &(0x7f00000005c0)=[{&(0x7f0000000280)=""/196, 0xc4}], 0x1, 0x8, 0xffffffff) 52.656559884s ago: executing program 0 (id=176): prctl$PR_SET_IO_FLUSHER(0x43, 0xfffffffffffffffd) r0 = memfd_create(&(0x7f0000000400)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\xd1x4]PZ\x9e\xd5Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\x97\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev\x15h$\x01\xdd\xe5\xce\xf8*\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xa2\xab\xf6\x84\xe0\xcf1\x9a', 0x0) socket(0x1d, 0x5, 0x6) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r1 = socket$unix(0x1, 0x1, 0x0) listen(r1, 0x0) 46.298866142s ago: executing program 1 (id=177): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x1, 0x4, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f00000002c0)=0x20, 0x4) setsockopt$sock_attach_bpf(r1, 0x1, 0x34, &(0x7f00000000c0)=r0, 0x4) listen(r1, 0xfffffffd) close(r1) 34.779724646s ago: executing program 0 (id=178): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000000000)=0x1000, 0x4) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xd}}, 0x101}, 0x1c) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000380)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)='=', 0x1}], 0x1}}], 0x1, 0x48819) recvfrom$inet6(r0, &(0x7f00000002c0)=""/129, 0x81, 0x2, 0x0, 0x0) 31.753886992s ago: executing program 1 (id=179): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0xfffffffe, @empty, 0x7}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f00000004c0)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x4e21, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000040)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x5a}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "f900f5", 0x14, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x4, 0x0, 0x7}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000b80)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "560400", 0x14, 0x6, 0x0, @local, @local, {[], {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x0, 0x0, 0x7}}}}}}}, 0x0) 24.383159082s ago: executing program 1 (id=180): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0xc, &(0x7f0000000040)={0x0, 0xc8a1, 0xdb00, 0x8, 0x29}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x7, 0x2, 0x180, 0x4, 0x14, 0xf1, 0x50, 0x12, 0x5, 0x0, 0x29, 0x0, 0x6, 0x0, 0xbda], 0x4, 0x43100}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1600000004"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 19.611783547s ago: executing program 0 (id=181): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ff2000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89d, 0xc000, 0xa, 0x20002f7}) r0 = socket(0x40000000015, 0x5, 0x0) bind$inet(r0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) getsockopt(r0, 0x200000000114, 0x8, &(0x7f0000019580)=""/102400, &(0x7f0000000000)=0x19000) 9.640037853s ago: executing program 0 (id=182): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) setxattr$trusted_overlay_upper(0x0, 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="00fbf40208de47b8ff9d6748d0cfe067ceecce19a1e77cea838f4d9195d502fe050ff6605669d6842b3a7aef92e027d0453e1988ccacd5ba002aca94aa808af5cb373490bb10c8fa90171c08da573a9cca85a0b80705fef230286f98f73ed4e7077b50abb79fb4100455e18848eac17d76e553985400302bac2c326fb79951b48423c8909c0a7d172b398ca2aa26e3b1d68cb540a447c833e8f96d7de6f80db6cbedd4106deb1c76f8f7e2e88745582f9775328d376d394bc4965264f6e3019684b847e28a0f5203d1a60c7ca5ac32049d7de58a4044f3219d6d0012b648271939e53d9a12b41134c5117b8d2b06a2553e79c954bd08d07453998ca1825566732ad06c6a2bf331a6ec79c62e0ee9992583e485f2a677aaf8fdc87884c717bd4c2e5ffc721228ef75e65c39f63db9b78cf767ea57aea0226be630dc3e0c8ef614240a599ab6cc911562b027b7f20603603ec99a8097dfd43ca1ad44a7e89e1683f7162b738fbbb7b8b14739e974d6b689b18a76748d9d812d77aa09bae974fcd6dde55074a39036a4df8596cab7187310aab101fe818276a9fa831e3adcdd91c90e710e8a6ab5369a8bf021d7c26340463b98f132d3d7a913c85125a2bf0e606667214aad84b3edac14e2a21ac7c6f8d2155904b32a92aa379228c8cbd52e9b97f577158e383950e76811ae48c088a31a36c67a1147d84a1ce0dff9ad71e97786e399544a08595b00af374f673883e39c5466e4417e85134854835deb9cafcfef92e68107bf98bd97d5e15193b5cbf0e806688559e58df6f5fa663cbb0f5b94976f3d6355fe2023b1458c5fb1cb72fe8c7a5a476eb251879b20add33df597ae1e488f5e3b6c3f89b28459ace10f316fe6635ee41741a95c35bd99c4236d0424481f878c757a9d94e184e1808ee623efec69bd0d20b9e2aabf71b7805f07bbd10a1f2b3bf6cab9b706650a4b18cbf4fa9aa365abab55ef56efa291ef1407ead2d93d796cd93a4e2754ca680636a615efe8ae51e3c7246a0686001513cdc7f4f9678aaeaab9384d5a3ad49ca5dff70fba3e411c5bc764c4ef908cb0d9e231b9f620012ed430dc34ac4214c3c781f3c9180ffbeeda76eb8d7010d24024c015268cb741a41f97019c454b3a1967559c486f51d089e4ee60000398ceb36c6c7871c14cb2ba5b05d6f308dcdde42acd4403970ef7c1bb0675f367c2b1b1d2103892215dcf95774ad22de20732e5285de7c47362e4f8"], 0x3f4, 0x0) mount(0x0, &(0x7f0000000200)='./dev\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000001000)="0400000032000000") ioctl(r0, 0xc138fd01, &(0x7f0000002000)="0400000032000000000000006c01") 9.583624252s ago: executing program 1 (id=183): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000040000000000a40000000160a01080000000000000000020000000900020073797a30000000000900010073797a3000000000140003800800024000000000080001400000000014000000110001"], 0x68}}, 0x20000000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)={0x14, 0x17, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x20048000}, 0x8094) recvmmsg(r1, &(0x7f0000003080)=[{{0x0, 0x0, 0x0}, 0x401}], 0x1, 0x2, 0x0) 0s ago: executing program 1 (id=184): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') preadv(r0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/216, 0xd8}], 0x1, 0xa3, 0xd) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f00000000c0)=ANY=[], 0x6a) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:49004' (ED25519) to the list of known hosts. syzkaller login: [ 592.958420][ T3204] cgroup: Unknown subsys name 'net' [ 593.762147][ T3204] cgroup: Unknown subsys name 'cpuset' [ 593.982286][ T3204] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 687.159132][ T3204] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 891.641836][ T3218] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 891.737359][ T3218] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 894.299567][ T3217] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 894.397704][ T3217] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 908.795937][ T3218] hsr_slave_0: entered promiscuous mode [ 908.831951][ T3218] hsr_slave_1: entered promiscuous mode [ 910.053294][ T3217] hsr_slave_0: entered promiscuous mode [ 910.100990][ T3217] hsr_slave_1: entered promiscuous mode [ 910.122733][ T3217] debugfs: 'hsr0' already exists in 'hsr' [ 910.126656][ T3217] Cannot create hsr debugfs directory [ 924.118139][ T3218] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 924.426971][ T3218] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 924.473460][ T3218] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 924.820714][ T3218] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 925.116988][ T3218] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 925.287435][ T3218] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 925.653157][ T3218] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 926.187835][ T3218] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 929.946069][ T3217] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 930.318645][ T3217] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 930.498003][ T3217] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 930.957041][ T3217] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 931.093067][ T3217] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 931.393306][ T3217] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 932.050601][ T3217] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 932.511206][ T3217] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 957.242045][ T3218] 8021q: adding VLAN 0 to HW filter on device bond0 [ 963.718997][ T3217] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1041.101611][ T3218] veth0_vlan: entered promiscuous mode [ 1042.374866][ T3218] veth1_vlan: entered promiscuous mode [ 1046.530446][ T3218] veth0_macvtap: entered promiscuous mode [ 1047.682004][ T3217] veth0_vlan: entered promiscuous mode [ 1047.837722][ T3218] veth1_macvtap: entered promiscuous mode [ 1049.727343][ T3217] veth1_vlan: entered promiscuous mode [ 1053.955096][ T3236] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1054.031599][ T3205] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1054.742425][ T3364] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1054.882801][ T3205] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1056.917753][ T3217] veth0_macvtap: entered promiscuous mode [ 1058.409717][ T3217] veth1_macvtap: entered promiscuous mode [ 1063.959773][ T3218] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 1064.840948][ T3236] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1065.000783][ T3205] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1065.147114][ T3236] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1065.160051][ T3236] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1209.957378][ T3888] syz_tun: entered allmulticast mode [ 1210.427643][ T3888] syz_tun: left allmulticast mode [ 1237.268892][ T3900] input: syz0 as /devices/virtual/input/input0 [ 1275.271152][ T3919] input: syz0 as /devices/virtual/input/input1 [ 1385.750810][ T3966] Mass Storage Function, version: 2009/09/11 [ 1385.853745][ T3966] LUN: removable file: (no medium) [ 1386.791160][ T3968] LUN: removable file: (no medium) [ 1404.765052][ T3974] tls_set_device_offload_rx: netdev not found [ 1527.629802][ T4018] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 1609.620646][ T4046] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 1609.623465][ T4046] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 1610.449800][ T4046] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz0] on syz0 [ 1651.203369][ C1] vcan0: j1939_tp_rxtimer: 0xffffaf8020b90000: rx timeout, send abort [ 1651.709612][ C1] vcan0: j1939_tp_rxtimer: 0xffffaf8020b90000: abort rx timeout. Force session deactivation [ 1675.653191][ T4081] input: syz1 as /devices/virtual/input/input2 [ 1687.520620][ T4092] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 1703.596658][ T4097] Illegal XDP return value 187437 on prog (id 14) dev syz_tun, expect packet loss! [ 1841.079702][ T4153] Zero length message leads to an empty skb [ 1902.887964][ T4176] fuse: Bad value for 'fd' [ 2049.890429][ T4231] mmap: syz.1.146 (4231) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 2053.378201][ T4234] ubi31: attaching mtd0 [ 2053.382925][ T4234] ubi31 error: ubi_attach_mtd_dev: bad VID header (86014) or data offsets (86078) [ 2064.981724][ T4239] netlink: 4 bytes leftover after parsing attributes in process `syz.0.152'. [ 2169.034766][ T31] audit: type=1326 audit(2167.600:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4279 comm="syz.1.161" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fff94534142 code=0x7ffc0000 [ 2169.152688][ T31] audit: type=1326 audit(2167.670:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4279 comm="syz.1.161" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fff94534142 code=0x7ffc0000 [ 2169.198110][ T31] audit: type=1326 audit(2167.760:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4279 comm="syz.1.161" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fff94534142 code=0x7ffc0000 [ 2169.227039][ T31] audit: type=1326 audit(2167.780:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4279 comm="syz.1.161" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fff94534142 code=0x7ffc0000 [ 2169.250086][ T31] audit: type=1326 audit(2167.790:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4279 comm="syz.1.161" exe="/syz-executor" sig=0 arch=c00000f3 syscall=63 compat=0 ip=0x7fff94534142 code=0x7ffc0000 [ 2169.395736][ T31] audit: type=1326 audit(2167.960:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4279 comm="syz.1.161" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fff94534142 code=0x7ffc0000 [ 2169.468896][ T31] audit: type=1326 audit(2167.990:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4279 comm="syz.1.161" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fff94534142 code=0x7ffc0000 [ 2169.767199][ T31] audit: type=1326 audit(2168.300:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4279 comm="syz.1.161" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fff94534142 code=0x7ffc0000 [ 2169.818392][ T31] audit: type=1326 audit(2168.350:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4279 comm="syz.1.161" exe="/syz-executor" sig=0 arch=c00000f3 syscall=98 compat=0 ip=0x7fff94534142 code=0x7ffc0000 [ 2169.857418][ T31] audit: type=1326 audit(2168.380:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4279 comm="syz.1.161" exe="/syz-executor" sig=0 arch=c00000f3 syscall=64 compat=0 ip=0x7fff94534142 code=0x7ffc0000 [ 2240.196430][ T31] kauditd_printk_skb: 9 callbacks suppressed [ 2240.197729][ T31] audit: type=1800 audit(2238.700:21): pid=4302 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.170" name="bcdUSB" dev="configfs" ino=3564 res=0 errno=0 [ 2275.758583][ T4315] process 'syz.0.176' launched '/dev/fd/3' with NULL argv: empty string added [ 2291.103841][ T4323] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 2326.397845][ T4335] [ 2326.399022][ T4335] ====================================================== [ 2326.400165][ T4335] WARNING: possible circular locking dependency detected [ 2326.402074][ T4335] syzkaller #0 Not tainted [ 2326.403117][ T4335] ------------------------------------------------------ [ 2326.404255][ T4335] syz.1.184/4335 is trying to acquire lock: [ 2326.405405][ T4335] ffffffff88bb84c0 (pcpu_alloc_mutex){+.+.}-{4:4}, at: pcpu_alloc_noprof+0xd5e/0x2472 [ 2326.409259][ T4335] [ 2326.409259][ T4335] but task is already holding lock: [ 2326.410315][ T4335] ffffaf801a879670 (&q->blkcg_mutex){+.+.}-{4:4}, at: blkg_conf_prep+0xa4/0xf44 [ 2326.413458][ T4335] [ 2326.413458][ T4335] which lock already depends on the new lock. [ 2326.413458][ T4335] [ 2326.414767][ T4335] [ 2326.414767][ T4335] the existing dependency chain (in reverse order) is: [ 2326.416175][ T4335] [ 2326.416175][ T4335] -> #3 (&q->blkcg_mutex){+.+.}-{4:4}: [ 2326.418604][ T4335] lock_acquire+0x23c/0x4f0 [ 2326.420017][ T4335] __mutex_lock+0x164/0x1924 [ 2326.421323][ T4335] mutex_lock_nested+0x14/0x1c [ 2326.423073][ T4335] blkcg_activate_policy+0x304/0x8a8 [ 2326.424595][ T4335] blk_throtl_init+0x2f4/0x4c4 [ 2326.425960][ T4335] tg_set_conf.isra.0+0x22e/0x4a8 [ 2326.427310][ T4335] tg_set_conf_uint+0x28/0x36 [ 2326.428588][ T4335] cgroup_file_write+0x190/0x70e [ 2326.430030][ T4335] kernfs_fop_write_iter+0x37c/0x530 [ 2326.431555][ T4335] vfs_write+0x81a/0x1020 [ 2326.432812][ T4335] ksys_write+0x126/0x244 [ 2326.434221][ T4335] __riscv_sys_write+0x6e/0xa0 [ 2326.435660][ T4335] syscall_handler+0x92/0x114 [ 2326.436984][ T4335] do_trap_ecall_u+0x4ca/0x658 [ 2326.438467][ T4335] handle_exception+0x168/0x174 [ 2326.440077][ T4335] [ 2326.440077][ T4335] -> #2 (&q->q_usage_counter(io)#17){++++}-{0:0}: [ 2326.442739][ T4335] lock_acquire+0x23c/0x4f0 [ 2326.444201][ T4335] blk_alloc_queue+0x5b4/0x6f4 [ 2326.445588][ T4335] blk_mq_alloc_queue+0x15e/0x250 [ 2326.446986][ T4335] __blk_mq_alloc_disk+0x2a/0xd8 [ 2326.448449][ T4335] loop_add+0x43a/0xa90 [ 2326.449775][ T4335] loop_init+0x304/0x33c [ 2326.451234][ T4335] do_one_initcall+0x18a/0xc82 [ 2326.452482][ T4335] kernel_init_freeable+0x6d2/0x7b8 [ 2326.454049][ T4335] kernel_init+0x30/0x244 [ 2326.455489][ T4335] ret_from_fork_kernel+0x94/0xe74 [ 2326.456806][ T4335] ret_from_fork_kernel_asm+0x16/0x18 [ 2326.458403][ T4335] [ 2326.458403][ T4335] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 2326.460485][ T4335] lock_acquire+0x23c/0x4f0 [ 2326.461854][ T4335] fs_reclaim_acquire+0xbe/0xf6 [ 2326.463345][ T4335] prepare_alloc_pages+0x146/0x51c [ 2326.464840][ T4335] __alloc_frozen_pages_noprof+0x164/0x2e58 [ 2326.466402][ T4335] __alloc_pages_noprof+0xe/0xce [ 2326.467967][ T4335] pcpu_populate_chunk+0x16c/0xe7e [ 2326.469403][ T4335] pcpu_alloc_noprof+0x804/0x2472 [ 2326.470884][ T4335] bpf_map_alloc_percpu+0xb0/0xf8 [ 2326.472345][ T4335] htab_map_alloc+0xfce/0x14d0 [ 2326.473716][ T4335] map_create_alloc.constprop.0+0x588/0x1aca [ 2326.475263][ T4335] map_create+0x132/0xb9c [ 2326.476627][ T4335] __sys_bpf+0x63a/0x53da [ 2326.478075][ T4335] __riscv_sys_bpf+0xaa/0x144 [ 2326.479572][ T4335] syscall_handler+0x92/0x114 [ 2326.480846][ T4335] do_trap_ecall_u+0x4ca/0x658 [ 2326.482272][ T4335] handle_exception+0x168/0x174 [ 2326.483776][ T4335] [ 2326.483776][ T4335] -> #0 (pcpu_alloc_mutex){+.+.}-{4:4}: [ 2326.486039][ T4335] check_noncircular+0x138/0x14c [ 2326.487552][ T4335] __lock_acquire+0xe9c/0x25aa [ 2326.489066][ T4335] lock_acquire+0x23c/0x4f0 [ 2326.490536][ T4335] __mutex_lock+0x164/0x1924 [ 2326.491778][ T4335] _mutex_lock_killable+0x16/0x1e [ 2326.493032][ T4335] pcpu_alloc_noprof+0xd5e/0x2472 [ 2326.494517][ T4335] percpu_ref_init+0x34/0x362 [ 2326.495735][ T4335] blkg_alloc+0xcc/0x986 [ 2326.497087][ T4335] blkg_conf_prep+0x404/0xf44 [ 2326.498473][ T4335] tg_set_conf.isra.0+0x1e2/0x4a8 [ 2326.499643][ T4335] tg_set_conf_uint+0x28/0x36 [ 2326.500907][ T4335] cgroup_file_write+0x190/0x70e [ 2326.502413][ T4335] kernfs_fop_write_iter+0x37c/0x530 [ 2326.504232][ T4335] vfs_write+0x81a/0x1020 [ 2326.505494][ T4335] ksys_write+0x126/0x244 [ 2326.506822][ T4335] __riscv_sys_write+0x6e/0xa0 [ 2326.508247][ T4335] syscall_handler+0x92/0x114 [ 2326.509790][ T4335] do_trap_ecall_u+0x4ca/0x658 [ 2326.511428][ T4335] handle_exception+0x168/0x174 [ 2326.512929][ T4335] [ 2326.512929][ T4335] other info that might help us debug this: [ 2326.512929][ T4335] [ 2326.514331][ T4335] Chain exists of: [ 2326.514331][ T4335] pcpu_alloc_mutex --> &q->q_usage_counter(io)#17 --> &q->blkcg_mutex [ 2326.514331][ T4335] [ 2326.517710][ T4335] Possible unsafe locking scenario: [ 2326.517710][ T4335] [ 2326.518760][ T4335] CPU0 CPU1 [ 2326.519662][ T4335] ---- ---- [ 2326.520620][ T4335] lock(&q->blkcg_mutex); [ 2326.522069][ T4335] lock(&q->q_usage_counter(io)#17); [ 2326.524211][ T4335] lock(&q->blkcg_mutex); [ 2326.525959][ T4335] lock(pcpu_alloc_mutex); [ 2326.527425][ T4335] [ 2326.527425][ T4335] *** DEADLOCK *** [ 2326.527425][ T4335] [ 2326.528711][ T4335] locks held by syz.1.184/4335: 6, last CPU#1: [ 2326.529888][ T4335] #0: ffffaf80197670b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x28c/0x32c [ 2326.532606][ T4335] #1: ffffaf801dadc460 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0xa7a/0x1020 [ 2326.534546][ T4335] #2: ffffaf802b86c480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x29c/0x530 [ 2326.536824][ T4335] #3: ffffaf80309dd3c8 (kn->active#13){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2f6/0x530 [ 2326.540072][ T4335] #4: ffffaf801a8794f0 (&q->rq_qos_mutex){+.+.}-{4:4}, at: blkg_conf_open_bdev+0x22a/0x3c4 [ 2326.542857][ T4335] #5: ffffaf801a879670 (&q->blkcg_mutex){+.+.}-{4:4}, at: blkg_conf_prep+0xa4/0xf44 [ 2326.544612][ T4335] [ 2326.544612][ T4335] stack backtrace: [ 2326.545647][ T4335] CPU: 1 UID: 0 PID: 4335 Comm: syz.1.184 Not tainted syzkaller #0 PREEMPT [ 2326.546248][ T4335] Hardware name: riscv-virtio,qemu (DT) [ 2326.546852][ T4335] Call Trace: [ 2326.547242][ T4335] [] dump_backtrace+0x2e/0x3c [ 2326.547935][ T4335] [] show_stack+0x30/0x3c [ 2326.548263][ T4335] [] dump_stack_lvl+0x114/0x1aa [ 2326.548589][ T4335] [] dump_stack+0x1c/0x24 [ 2326.548869][ T4335] [] print_circular_bug+0x250/0x29c [ 2326.549341][ T4335] [] check_noncircular+0x138/0x14c [ 2326.549761][ T4335] [] __lock_acquire+0xe9c/0x25aa [ 2326.550151][ T4335] [] lock_acquire+0x23c/0x4f0 [ 2326.550641][ T4335] [] __mutex_lock+0x164/0x1924 [ 2326.551010][ T4335] [] _mutex_lock_killable+0x16/0x1e [ 2326.551413][ T4335] [] pcpu_alloc_noprof+0xd5e/0x2472 [ 2326.551913][ T4335] [] percpu_ref_init+0x34/0x362 [ 2326.552459][ T4335] [] blkg_alloc+0xcc/0x986 [ 2326.553050][ T4335] [] blkg_conf_prep+0x404/0xf44 [ 2326.553656][ T4335] [] tg_set_conf.isra.0+0x1e2/0x4a8 [ 2326.554023][ T4335] [] tg_set_conf_uint+0x28/0x36 [ 2326.554339][ T4335] [] cgroup_file_write+0x190/0x70e [ 2326.554847][ T4335] [] kernfs_fop_write_iter+0x37c/0x530 SYZFAIL: failed to recv rpc [ 2326.555281][ T4335] [] vfs_write+0x81a/0x1020 [ 2326.555606][ T4335] [] ksys_write+0x126/0x244 [ 2326.556143][ T4335] [] __riscv_sys_write+0x6e/0xa0 [ 2326.556711][ T4335] [] syscall_handler+0x92/0x114 [ 2326.557366][ T4335] [] do_trap_ecall_u+0x4ca/0x658 [ 2326.558105][ T4335] [] handle_exception+0x168/0x174 fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 2339.038068][ T3236] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2341.079611][ T3236] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2342.301839][ T3236] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2344.329318][ T3236] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0