last executing test programs: 1.331875283s ago: executing program 1 (id=2): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x80003, 0x6) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x1, 0x7}}, 0xe8) socket$key(0xf, 0x3, 0x2) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4e20, 0xffffffff, @empty, 0x5}, 0x1c) 1.16384863s ago: executing program 1 (id=5): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f00000086c0)=[{{0x0, 0x0, 0x0}, 0x8101}, {{0x0, 0x0, 0x0}, 0x10000}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000000)=""/188, 0xbc}, {&(0x7f0000000840)=""/245, 0xf5}, {&(0x7f0000000280)=""/47, 0x2f}, {&(0x7f0000000440)=""/84, 0x54}, {&(0x7f0000001940)=""/4096, 0x1000}, {&(0x7f0000000140)=""/16, 0x10}, {&(0x7f00000006c0)=""/243, 0xf3}, {&(0x7f0000000340)=""/187, 0xbb}], 0x8}, 0x80000000}], 0x4, 0x20, 0x0) 660.586625ms ago: executing program 0 (id=1): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) sendmmsg$inet(r0, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f00000006c0)="0d18687da3e7f33aed145cf8ff2d1e5a18c0d5f9856f4824f41040f6987d0b531da10713ed151bc4867681f28e033aef683334d03864ed30590dd4ea64a20ecbbc1346c9f42510d91eec0632885b7da95ca85f4b1435c5c1e993a85257df5f19bdfc5e038a16e6a8aef907e347081fdb93cee93217e11f19cde423e6138bd1b79ee615527ccaf8049959ac6e32af46d777ccb8c26ca925f69590df13a81aee3213e80ba5cacf1f930b3cc49093d11594ef13325790b55efbdc2dd99ed1c3c609a49cc15187", 0xc5}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000c40)="5c5eafd3ae55a73702d6befaee97f47f4be65587e1fca708cee084691e4587d887a5eaab43ac5edc4886496910cd7a153cd84b93208c7b1a625b3ea990092389b19dab4f61e30e000b4d7e51ffc9a5accbe20844356dd0ce192542d5e58d80657b3b5fb7a3d39337df9305959f", 0x6d}], 0x1}}, {{0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000001800)="353a35d6094e4ee7d764b6993f65136c5d6b84d9b1324a0b25e094700c9a66f9181738098f32e3e48859c3878d53a9752474da0d6af299d849d48f2fa2c8c807d7a1521da940585790ff1e6f9da83e32b751d1af9cfac640c1361f5ae8b99c187dafe9ea854120f6eaab11e7fdeb3f2152ebdbc21520ca01f64bb821576deef4ed6696cdddc1768b5b4fbd68a687cb6ba52ecf5cc6f8f05062f26de19d6aaaeb6cbca00e46685f77d2b3e8dd9d0d099e799cd5a76c67ab283f790366f7f744508edc9e48fa101b89215bd330c4e706c1f09d781a5a50aef5e424a7a88b3241a338ca7411cda28aa167b5628b79e8a7d588efb69636181b9c54f6d296386c95f8a08e27d5792dcb20fa3b5b4f60c71f310b31bb1ab4a825c2dc10fac150a17d92bb51849d9eea53c78d427d8d1036dc906084046fcae09499c220ef50c2c7c475f392bc288eb5efb8032d1ade92e88e50a05a95dd5c6cbbdfb086fa53bca14d40c8c3f7149b39b16b7c7370978389366174db5fbc99dbe958f8c1690cd695dfbe6c384162a412c8d3cfd7cf223f9df4c67b92514111891f53d4e19826797302e1a87e7a627c52740bb3bd311771a68d349c0a68ef6f2a765f8220323add67b2b6695ca41adcda387a4264bcd94c8578a9ccca3b55ebcda45369b56068cfeec34abc2cbd94b9b12d057fa9d4328d57073f40e5ae64443e4a10ed400575bbd1168a170a0134b9ad28735dbd9603a9e417cce864f2141a92f57e1fdfcff4776f94a794d6db8d3e9e0ecc783956c7ab15a8d5639d3df1ac9da6057af913a563bd55b657f37cbf4cae2919aea6ff8a748eb4c036361b8866cc062bbad019f43d02b0c38bd6309f2baa53924466203ab8d00daaac4c9da846e645d64c10e47c32e9824e79ade4eeee7cbf71b1bb48f760800b04334745ab553dea12a85f0671eb07a4cc67ceaffa8269e0b052f25136cfb8a6b9327a2d165c42933642d3171ad00ebf0be485f5ed319021600a94072f251c8905a2451eba3ba7db2ec5fb8613463a796610629719166259ffa3261e06f09b5a69798b88848da9028ff7ed8a729c384374fce0f4f5cda3b61cc4d61da382c5708f26edb16e9b65d667ed61248dfbed35a6a886adec25361c17d9f30f94db7e3085440df135ddec94f3f01fe2e2f9edb9e19fd8ae0b93363f0dbadc858d8e0a93dea50e89b2d7674b7e0f813c38f70a87554f5d0b95b531ec006716207abc5c34bcf447f0e547516d2fa23e2871db3662c8fb30e93b939aaed219ca9ef4b30f79e3d27e1caece83168292a10c0abf24f5fe97ef6fd46045f6ee3fc33d995a79584426fdac0c663d4991364d450dd71cf86e7d298ec8500eae0fa9b26b9ba3077033e643428ec81ae9192174a0dec405dbf63de3a7c2cc037bab06941dc5b13a00f5f861a4a8a335b52de03c4c977af27c02e7f4ee05d602b5b64c2904fc182a6cdf7f64d0641f4302383cf610fb0a357cd9ebcb078e49d3df19cca93a701373970270e4db98bac98a85cc3a5cdf829fc8ecb102a1aae70bf2149cc551703a012cf9c74e3df24ade472c4dc052415ea494aae8a7424360ffdba83ba584e61d0fd66fba41712628abb00cdf370a97e95004c892cfd42e84561ee569f905d487830cc665392295d9399f28cc2c6f01b209c5d1d64e3d685df89cc428922b819974e42b35b277d5a06671b0bf59b77b9b0a3ce41a579cd8b6b9d08df85787fedde4c7a4ba1ad2d5ae95e5fb208d2f9e842655e9e0cb", 0x4e2}], 0x1}}], 0x3, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000002240)=""/4096, 0x1000, 0x0, 0x0}, &(0x7f0000000040)=0x40) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 499.232144ms ago: executing program 0 (id=6): r0 = semget$private(0x0, 0x4000000009, 0x42a) semop(r0, &(0x7f00000002c0)=[{0x0, 0xff}, {0x0, 0x9b6a}], 0x2) semtimedop(r0, &(0x7f0000000000)=[{0x4, 0xf801, 0x1000}, {0x4, 0x3, 0x1000}], 0x2, 0x0) 323.907421ms ago: executing program 2 (id=3): r0 = syz_open_dev$sg(0x0, 0x0, 0x22c01) setreuid(0x0, 0xee00) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="000000000500000052"]) 259.972248ms ago: executing program 1 (id=7): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000100)={0x0, 0x0, 0x800, 0x0, 0xffffffffffffffff}) r2 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000280)={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x52, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000300)={0x0, 0x0, r3, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB(r1, 0xc01c64ad, &(0x7f0000000040)={r4}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000140)={r4, 0xffffffff, 0x1ff, 0x9, 0x3, [], [0xc0, 0x4, 0x7, 0x42], [0x8, 0x81, 0x53cc, 0x35], [0x5, 0x8, 0x7, 0x7fff]}) dup3(r1, r0, 0x0) 101.859396ms ago: executing program 2 (id=8): openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80082) epoll_create(0x1) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb2361000000010902"], 0x0) r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) io_setup(0xe, &(0x7f0000000000)=0x0) eventfd2(0x347e, 0x800) syz_io_uring_setup(0x5135, &(0x7f0000000100)={0x0, 0x0, 0x13580}, 0x0, 0x0) io_submit(r1, 0x2, &(0x7f00000014c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x7, 0x6, r0, 0x0, 0x0, 0x4}, 0x0]) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 100.451011ms ago: executing program 1 (id=15): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000300), 0x40100001, 0x189002) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={0x0}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000580)={0x0, 0x0, r2, r3, 0x3, 0x707a, 0x8001, 0x804, {0x1200ac7c, 0x1, 0x3, 0x3, 0xf47, 0x1, 0x2, 0x5, 0x412f, 0xe1d4, 0x4, 0x7f, 0x400a, 0xffffffff, "fe97b17e0600000000000000000000000400"}}) 0s ago: executing program 3 (id=4): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) accept4(r1, 0x0, 0x0, 0x0) r2 = openat$binfmt_format(0xffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_GET(r3, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000940)={0x14, 0x0, 0x705, 0x70bd23, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x20004000}, 0x4000) munmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000) mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x930, 0x0, 0x24132, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) memfd_secret(0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='source', &(0x7f00000000c0)='%.,:', 0x0) mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000003) write$binfmt_format(r2, &(0x7f0000000100)='-1\x00', 0x2) close_range(r2, 0xffffffffffffffff, 0x0) sendmmsg$unix(r0, &(0x7f0000000b40), 0x1, 0x0) close(r0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.163' (ED25519) to the list of known hosts. [ 85.200676][ T5822] cgroup: Unknown subsys name 'net' [ 85.375163][ T5822] cgroup: Unknown subsys name 'cpuset' [ 85.384765][ T5822] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 87.150001][ T5822] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 89.769455][ T5834] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 89.777879][ T5834] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 89.785911][ T5834] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 89.802211][ T5834] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 89.811565][ T5838] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 89.819256][ T5838] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 89.828270][ T5838] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 89.836527][ T5838] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 89.856516][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 89.865785][ T5156] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 89.874946][ T5156] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 89.883695][ T5156] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 89.891815][ T5844] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 89.899960][ T5156] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 89.906808][ T5839] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 89.921364][ T5156] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 89.933502][ T5834] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 89.981691][ T5834] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 89.995034][ T5839] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 90.004259][ T5839] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 90.480567][ T5831] chnl_net:caif_netlink_parms(): no params data found [ 90.648855][ T5840] chnl_net:caif_netlink_parms(): no params data found [ 90.747078][ T5836] chnl_net:caif_netlink_parms(): no params data found [ 90.779279][ T5831] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.787062][ T5831] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.795097][ T5831] bridge_slave_0: entered allmulticast mode [ 90.802625][ T5831] bridge_slave_0: entered promiscuous mode [ 90.817197][ T5831] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.824389][ T5831] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.831791][ T5831] bridge_slave_1: entered allmulticast mode [ 90.839039][ T5831] bridge_slave_1: entered promiscuous mode [ 90.853009][ T5835] chnl_net:caif_netlink_parms(): no params data found [ 90.959583][ T5831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.972755][ T5831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.010478][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.017862][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.025418][ T5840] bridge_slave_0: entered allmulticast mode [ 91.033306][ T5840] bridge_slave_0: entered promiscuous mode [ 91.072520][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.079683][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.089268][ T5840] bridge_slave_1: entered allmulticast mode [ 91.097214][ T5840] bridge_slave_1: entered promiscuous mode [ 91.126569][ T5831] team0: Port device team_slave_0 added [ 91.136270][ T5831] team0: Port device team_slave_1 added [ 91.207931][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.250077][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.260005][ T5836] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.268469][ T5836] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.277311][ T5836] bridge_slave_0: entered allmulticast mode [ 91.285637][ T5836] bridge_slave_0: entered promiscuous mode [ 91.294738][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.301819][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.328122][ T5831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.369198][ T5836] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.376522][ T5836] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.384183][ T5836] bridge_slave_1: entered allmulticast mode [ 91.392596][ T5836] bridge_slave_1: entered promiscuous mode [ 91.399751][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.408833][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.437091][ T5831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.497330][ T5835] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.506851][ T5835] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.514385][ T5835] bridge_slave_0: entered allmulticast mode [ 91.522601][ T5835] bridge_slave_0: entered promiscuous mode [ 91.537993][ T5840] team0: Port device team_slave_0 added [ 91.547793][ T5840] team0: Port device team_slave_1 added [ 91.576640][ T5836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.587375][ T5835] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.595016][ T5835] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.602324][ T5835] bridge_slave_1: entered allmulticast mode [ 91.609709][ T5835] bridge_slave_1: entered promiscuous mode [ 91.642948][ T5836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.705620][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.715040][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.742310][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.771450][ T5831] hsr_slave_0: entered promiscuous mode [ 91.778170][ T5831] hsr_slave_1: entered promiscuous mode [ 91.811279][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.818272][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.844726][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.875673][ T5836] team0: Port device team_slave_0 added [ 91.884419][ T5835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.897049][ T5835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.923726][ T5836] team0: Port device team_slave_1 added [ 92.008980][ T5835] team0: Port device team_slave_0 added [ 92.017865][ T5835] team0: Port device team_slave_1 added [ 92.024333][ T5844] Bluetooth: hci1: command tx timeout [ 92.024340][ T51] Bluetooth: hci0: command tx timeout [ 92.024647][ T5839] Bluetooth: hci2: command tx timeout [ 92.079916][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.087371][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.113827][ T5836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.125167][ T5839] Bluetooth: hci3: command tx timeout [ 92.127496][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.137841][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.164353][ T981] cfg80211: failed to load regulatory.db [ 92.177135][ T5836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.209060][ T5840] hsr_slave_0: entered promiscuous mode [ 92.215566][ T5840] hsr_slave_1: entered promiscuous mode [ 92.223364][ T5840] debugfs: 'hsr0' already exists in 'hsr' [ 92.229203][ T5840] Cannot create hsr debugfs directory [ 92.284125][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.291113][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.317538][ T5835] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.333094][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.340082][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.366645][ T5835] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.480937][ T5836] hsr_slave_0: entered promiscuous mode [ 92.487533][ T5836] hsr_slave_1: entered promiscuous mode [ 92.494602][ T5836] debugfs: 'hsr0' already exists in 'hsr' [ 92.500379][ T5836] Cannot create hsr debugfs directory [ 92.621158][ T5835] hsr_slave_0: entered promiscuous mode [ 92.627676][ T5835] hsr_slave_1: entered promiscuous mode [ 92.634004][ T5835] debugfs: 'hsr0' already exists in 'hsr' [ 92.639762][ T5835] Cannot create hsr debugfs directory [ 92.834349][ T5831] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 92.847759][ T5831] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 92.886486][ T5831] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 92.927392][ T5831] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 93.028357][ T5840] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 93.062434][ T5840] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 93.077790][ T5840] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 93.104799][ T5840] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 93.175823][ T5836] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 93.196767][ T5836] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 93.219631][ T5836] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 93.240361][ T5836] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 93.316169][ T5835] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 93.343136][ T5835] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 93.355627][ T5835] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 93.389698][ T5835] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 93.414092][ T5831] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.463041][ T5831] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.504562][ T3018] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.512130][ T3018] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.535710][ T971] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.542908][ T971] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.609892][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.687807][ T5840] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.706446][ T971] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.713776][ T971] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.743249][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.758817][ T3513] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.766039][ T3513] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.810840][ T5835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.846183][ T5836] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.891277][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.898439][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.919389][ T5835] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.956066][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.963309][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.978205][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.985421][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.015807][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.023023][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.102001][ T5839] Bluetooth: hci1: command tx timeout [ 94.104474][ T5844] Bluetooth: hci2: command tx timeout [ 94.107479][ T51] Bluetooth: hci0: command tx timeout [ 94.118831][ T5831] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.182314][ T51] Bluetooth: hci3: command tx timeout [ 94.348937][ T5831] veth0_vlan: entered promiscuous mode [ 94.403077][ T5831] veth1_vlan: entered promiscuous mode [ 94.510444][ T5831] veth0_macvtap: entered promiscuous mode [ 94.555319][ T5831] veth1_macvtap: entered promiscuous mode [ 94.567378][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.619409][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.656016][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.694623][ T3018] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.716611][ T3018] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.727990][ T3018] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.748157][ T3018] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.802907][ T5835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.857250][ T5840] veth0_vlan: entered promiscuous mode [ 94.879055][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.922084][ T5840] veth1_vlan: entered promiscuous mode [ 94.946584][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.980516][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.058929][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.068620][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.090900][ T5835] veth0_vlan: entered promiscuous mode [ 95.115400][ T5835] veth1_vlan: entered promiscuous mode [ 95.156732][ T5840] veth0_macvtap: entered promiscuous mode [ 95.167874][ T5836] veth0_vlan: entered promiscuous mode [ 95.177491][ T5831] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 95.190623][ T5840] veth1_macvtap: entered promiscuous mode [ 95.242567][ T5836] veth1_vlan: entered promiscuous mode [ 95.287902][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.314224][ T5835] veth0_macvtap: entered promiscuous mode [ 95.342725][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.355772][ T5835] veth1_macvtap: entered promiscuous mode [ 95.375350][ T971] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.427753][ T971] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.452548][ T971] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.472022][ T37] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.494389][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.516862][ T5836] veth0_macvtap: entered promiscuous mode [ 95.538213][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.568232][ T5836] veth1_macvtap: entered promiscuous mode [ 95.610031][ T36] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.623118][ T36] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.641072][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.650754][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.658124][ T3513] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.667156][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.700115][ T3513] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.729602][ T3018] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.733796][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.738488][ T3018] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.776841][ T3513] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.791959][ T3513] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.803744][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.813394][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.969246][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.989408][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.062102][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.081940][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.181784][ T51] Bluetooth: hci2: command tx timeout [ 96.192346][ T51] Bluetooth: hci0: command tx timeout [ 96.192401][ T3018] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.197856][ T5839] Bluetooth: hci1: command tx timeout [ 96.235814][ T3018] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.272179][ T5839] Bluetooth: hci3: command tx timeout [ 96.383894][ T3018] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.425878][ T3018] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.655061][ T5943] [ 96.657431][ T5943] ============================================ [ 96.663576][ T5943] WARNING: possible recursive locking detected [ 96.669734][ T5943] 6.16.0-rc4-next-20250702-syzkaller #0 Not tainted [ 96.676316][ T5943] -------------------------------------------- [ 96.682476][ T5943] syz.3.4/5943 is trying to acquire lock: [ 96.688188][ T5943] ffff88807f5a6988 (&sb->s_type->i_mutex_key#17){+.+.}-{4:4}, at: __simple_recursive_removal+0x95/0x510 [ 96.699352][ T5943] [ 96.699352][ T5943] but task is already holding lock: [ 96.706737][ T5943] ffff888023165a70 (&sb->s_type->i_mutex_key#17){+.+.}-{4:4}, at: bm_entry_write+0x289/0x540 [ 96.716970][ T5943] [ 96.716970][ T5943] other info that might help us debug this: [ 96.725034][ T5943] Possible unsafe locking scenario: [ 96.725034][ T5943] [ 96.732486][ T5943] CPU0 [ 96.735768][ T5943] ---- [ 96.739046][ T5943] lock(&sb->s_type->i_mutex_key#17); [ 96.744522][ T5943] lock(&sb->s_type->i_mutex_key#17); [ 96.749995][ T5943] [ 96.749995][ T5943] *** DEADLOCK *** [ 96.749995][ T5943] [ 96.758141][ T5943] May be due to missing lock nesting notation [ 96.758141][ T5943] [ 96.766464][ T5943] 3 locks held by syz.3.4/5943: [ 96.771312][ T5943] #0: ffff888030d2beb8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x247/0x320 [ 96.780411][ T5943] #1: ffff8880238a0428 (sb_writers#11){.+.+}-{0:0}, at: vfs_write+0x211/0xa90 [ 96.789655][ T5943] #2: ffff888023165a70 (&sb->s_type->i_mutex_key#17){+.+.}-{4:4}, at: bm_entry_write+0x289/0x540 [ 96.800296][ T5943] [ 96.800296][ T5943] stack backtrace: [ 96.806200][ T5943] CPU: 0 UID: 0 PID: 5943 Comm: syz.3.4 Not tainted 6.16.0-rc4-next-20250702-syzkaller #0 PREEMPT(full) [ 96.806222][ T5943] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 96.806239][ T5943] Call Trace: [ 96.806248][ T5943] [ 96.806256][ T5943] dump_stack_lvl+0x189/0x250 [ 96.806278][ T5943] ? __pfx_dump_stack_lvl+0x10/0x10 [ 96.806296][ T5943] ? __pfx__printk+0x10/0x10 [ 96.806317][ T5943] ? print_lock_name+0xde/0x100 [ 96.806337][ T5943] print_deadlock_bug+0x28b/0x2a0 [ 96.806354][ T5943] validate_chain+0x1a3f/0x2140 [ 96.806373][ T5943] ? lockdep_unlock+0x89/0x120 [ 96.806393][ T5943] ? validate_chain+0x897/0x2140 [ 96.806412][ T5943] __lock_acquire+0xab9/0xd20 [ 96.806437][ T5943] ? __simple_recursive_removal+0x95/0x510 [ 96.806456][ T5943] lock_acquire+0x120/0x360 [ 96.806477][ T5943] ? __simple_recursive_removal+0x95/0x510 [ 96.806500][ T5943] down_write+0x96/0x1f0 [ 96.806523][ T5943] ? __simple_recursive_removal+0x95/0x510 [ 96.806541][ T5943] ? __pfx_down_write+0x10/0x10 [ 96.806566][ T5943] __simple_recursive_removal+0x95/0x510 [ 96.806588][ T5943] bm_entry_write+0x4f7/0x540 [ 96.806611][ T5943] ? __pfx_bm_entry_write+0x10/0x10 [ 96.806633][ T5943] ? __pfx_bm_entry_write+0x10/0x10 [ 96.806654][ T5943] vfs_write+0x27e/0xa90 [ 96.806675][ T5943] ? __pfx_vfs_write+0x10/0x10 [ 96.806693][ T5943] ? __fget_files+0x2a/0x420 [ 96.806715][ T5943] ? __fget_files+0x3a0/0x420 [ 96.806735][ T5943] ? __fget_files+0x2a/0x420 [ 96.806759][ T5943] ksys_write+0x145/0x250 [ 96.806777][ T5943] ? __pfx_ksys_write+0x10/0x10 [ 96.806797][ T5943] ? do_syscall_64+0xbe/0x3b0 [ 96.806819][ T5943] do_syscall_64+0xfa/0x3b0 [ 96.806839][ T5943] ? lockdep_hardirqs_on+0x9c/0x150 [ 96.806858][ T5943] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.806873][ T5943] ? clear_bhb_loop+0x60/0xb0 [ 96.806890][ T5943] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.806905][ T5943] RIP: 0033:0x7fde0f98e929 [ 96.806925][ T5943] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 96.806938][ T5943] RSP: 002b:00007fde10888038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 96.806954][ T5943] RAX: ffffffffffffffda RBX: 00007fde0fbb5fa0 RCX: 00007fde0f98e929 [ 96.806966][ T5943] RDX: 0000000000000002 RSI: 0000200000000100 RDI: 0000000000000006 [ 96.806976][ T5943] RBP: 00007fde0fa10b39 R08: 0000000000000000 R09: 0000000000000000 [ 96.806986][ T5943] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.806995][ T5943] R13: 0000000000000000 R14: 00007fde0fbb5fa0 R15: 00007ffda44f07e8 [ 96.807012][ T5943] [ 97.068404][ C0] vkms_vblank_simulate: vblank timer overrun [ 97.080732][ T981] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 97.241296][ T981] usb 3-1: Using ep0 maxpacket: 8 [ 97.247739][ T981] usb 3-1: config 0 has no interfaces? [ 97.254284][ T981] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 97.263621][ T981] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.273888][ T981] usb 3-1: config 0 descriptor?? [ 97.539450][ T5930] usb 3-1: USB disconnect, device number 2 [ 98.271649][ T51] Bluetooth: hci0: command tx timeout [ 98.271654][ T5844] Bluetooth: hci2: command tx timeout [ 98.274936][ T5839] Bluetooth: hci1: command tx timeout [ 98.341373][ T5839] Bluetooth: hci3: command tx timeout