last executing test programs: 296.90236ms ago: executing program 2 (id=3): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r0, &(0x7f0000005dc0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x15}, 0xa) syz_open_dev$dvb_demux(&(0x7f0000000280), 0x0, 0x101800) r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) sendto$inet_nvme_of_msg(r1, &(0x7f0000000080)={@data_h2c={{0x6, 0xc, 0x18, 0xb, 0x342e}, 0x99a, 0x80, 0x8, 0x7, "6b90c52e"}, @void}, 0x80, 0x0, 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000000), 0x0, 0x200) syz_emit_vhci(&(0x7f0000003980)=@HCI_EVENT_PKT={0x4, @hci_ev_auth_complete={{0x6, 0x3}, {0x6, 0xc8}}}, 0x6) 103.765906ms ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="d8000000180081054e81f782db44b904021d005c06007c09e8fe81a10a0015400100142603600e1208000b0000000401a800080008000a400600000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360d070100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$GTP_CMD_ECHOREQ(r0, &(0x7f0000000180)={0xffffffffffffffff, 0x0, &(0x7f0000000300)={&(0x7f00000020c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="04002abd7000fedbdf250300000008000500ac1414bb08000100", @ANYRES32=0x0, @ANYBLOB='\b\x00\a\x00', @ANYRES32, @ANYBLOB="08000200010000000800040064010102ff50d7079ce92518127e74da22e372278574a5acba24b440a9d212"], 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0) write(r3, &(0x7f0000000140)='10', 0x2) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='100\x00', 0x3) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r5, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) gettid() r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x0) read(r7, &(0x7f0000000200)=""/209, 0xd1) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r7, 0x4040534e, &(0x7f0000000180)={0x335, @tick=0xe, 0x42, {}, 0x2}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc00000019"], 0xfc}}, 0x0) socket$key(0xf, 0x3, 0x2) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0xa, 0x0, &(0x7f0000000340)="e02753e868a100000000", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) syz_usb_connect$uac2(0x5, 0x83, &(0x7f0000000880)=ANY=[@ANYBLOB="120100020000000882052500400001020301090271"], 0x0) close_range(r6, 0xffffffffffffffff, 0x0) dup(r3) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000042c0)='fdinfo/3\x00') finit_module(r8, &(0x7f00000001c0)=',/}^&/\x00', 0x3) 36.896878ms ago: executing program 2 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="d8000000180081054e81f782db44b904021d005c06007c09e8fe81a10a0015400100142603600e1208000b0000000401a800080008000a400600000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360d070100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$GTP_CMD_ECHOREQ(r0, &(0x7f0000000180)={0xffffffffffffffff, 0x0, &(0x7f0000000300)={&(0x7f00000020c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="04002abd7000fedbdf250300000008000500ac1414bb08000100", @ANYRES32=0x0, @ANYBLOB='\b\x00\a\x00', @ANYRES32, @ANYBLOB="08000200010000000800040064010102ff50d7079ce92518127e74da22e372278574a5acba24b440a9d212"], 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0) write(r3, &(0x7f0000000140)='10', 0x2) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='100\x00', 0x3) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r5, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) gettid() r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000840), 0x0) read(r7, &(0x7f0000000200)=""/209, 0xd1) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r7, 0x4040534e, &(0x7f0000000180)={0x335, @tick=0xe, 0x42, {}, 0x2}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc00000019"], 0xfc}}, 0x0) socket$key(0xf, 0x3, 0x2) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0xa, 0x0, &(0x7f0000000340)="e02753e868a100000000", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) syz_usb_connect$uac2(0x5, 0x83, &(0x7f0000000880)=ANY=[@ANYBLOB="120100020000000882052500400001020301090271"], 0x0) close_range(r6, 0xffffffffffffffff, 0x0) dup(r3) read$FUSE(0xffffffffffffffff, &(0x7f0000000080)={0x2020}, 0x2020) finit_module(0xffffffffffffffff, &(0x7f00000001c0)=',/}^&/\x00', 0x3) 0s ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="d8000000180081054e81f782db44b904021d005c06007c09e8fe81a10a0015400100142603600e1208000b0000000401a800080008000a400600000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360d070100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$GTP_CMD_ECHOREQ(r0, &(0x7f0000000180)={0xffffffffffffffff, 0x0, &(0x7f0000000300)={&(0x7f00000020c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="04002abd7000fedbdf250300000008000500ac1414bb08000100", @ANYRES32=0x0, @ANYBLOB='\b\x00\a\x00', @ANYRES32, @ANYBLOB="08000200010000000800040064010102ff50d7079ce92518127e74da22e372278574a5acba24b440a9d212"], 0x3c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/probability\x00', 0x1, 0x0) write(r3, &(0x7f0000000140)='10', 0x2) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/failslab/times\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='100\x00', 0x3) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) kernel console output (not intermixed with test programs): [ 39.036418][ T41] audit: type=1400 audit(1785306108.284:116): avc: denied { write } for pid=5643 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 39.092485][ T41] audit: type=1400 audit(1785306108.344:117): avc: denied { write } for pid=5646 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 39.400233][ T41] audit: type=1400 audit(1785306108.654:118): avc: denied { write } for pid=5649 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 39.445978][ T41] audit: type=1400 audit(1785306108.694:119): avc: denied { write } for pid=5652 comm="rm" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 39.544203][ T41] audit: type=1400 audit(1785306108.794:120): avc: denied { write } for pid=5655 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1841 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:46220' (ED25519) to the list of known hosts. [ 42.435267][ T5677] cgroup: Unknown subsys name 'net' [ 42.603780][ T5677] cgroup: Unknown subsys name 'cpuset' [ 42.609075][ T5677] cgroup: Unknown subsys name 'rlimit' [ 42.823324][ T5721] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 43.510456][ T5677] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 46.843998][ T41] kauditd_printk_skb: 37 callbacks suppressed [ 46.844013][ T41] audit: type=1400 audit(1785306116.094:158): avc: denied { execmem } for pid=5728 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 46.971405][ T41] audit: type=1400 audit(1785306116.224:159): avc: denied { create } for pid=5732 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 46.982022][ T41] audit: type=1400 audit(1785306116.224:160): avc: denied { read write } for pid=5732 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 46.988800][ T41] audit: type=1400 audit(1785306116.224:161): avc: denied { open } for pid=5732 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 46.995726][ T41] audit: type=1400 audit(1785306116.224:162): avc: denied { ioctl } for pid=5732 comm="syz-executor" path="socket:[2922]" dev="sockfs" ino=2922 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 47.004918][ T5741] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 47.007500][ T5741] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 47.012023][ T5748] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 47.016094][ T5748] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 47.020211][ T5741] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 47.020677][ T5748] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 47.025136][ T5741] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 47.027617][ T5748] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 47.029083][ T5741] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 47.030993][ T5748] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 47.032317][ T5751] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 47.032591][ T5750] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 47.034442][ T5751] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 47.034498][ T5750] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 47.034835][ T5741] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 47.034980][ T5750] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 47.036384][ T5741] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 47.044736][ T41] audit: type=1400 audit(1785306116.294:163): avc: denied { read } for pid=5735 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 47.046589][ T5741] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 47.047325][ T5092] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 47.050761][ T41] audit: type=1400 audit(1785306116.294:164): avc: denied { open } for pid=5735 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 47.055341][ T5092] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 47.059137][ T41] audit: type=1400 audit(1785306116.294:165): avc: denied { mounton } for pid=5735 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 47.089756][ T41] audit: type=1400 audit(1785306116.294:166): avc: denied { module_request } for pid=5735 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 47.096022][ T41] audit: type=1400 audit(1785306116.324:167): avc: denied { sys_module } for pid=5739 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 47.671868][ T5735] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.674736][ T5735] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.676915][ T5735] bridge_slave_0: entered allmulticast mode [ 47.679454][ T5735] bridge_slave_0: entered promiscuous mode [ 47.684325][ T5735] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.686526][ T5735] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.689131][ T5735] bridge_slave_1: entered allmulticast mode [ 47.691727][ T5735] bridge_slave_1: entered promiscuous mode [ 47.741850][ T5739] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.744154][ T5739] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.746349][ T5739] bridge_slave_0: entered allmulticast mode [ 47.748773][ T5739] bridge_slave_0: entered promiscuous mode [ 47.774598][ T5739] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.777383][ T5739] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.780731][ T5739] bridge_slave_1: entered allmulticast mode [ 47.784311][ T5739] bridge_slave_1: entered promiscuous mode [ 47.792006][ T5735] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.801243][ T5732] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.803425][ T5732] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.805779][ T5732] bridge_slave_0: entered allmulticast mode [ 47.808271][ T5732] bridge_slave_0: entered promiscuous mode [ 47.827426][ T5735] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.839019][ T5732] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.842127][ T5732] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.844741][ T5732] bridge_slave_1: entered allmulticast mode [ 47.848247][ T5732] bridge_slave_1: entered promiscuous mode [ 47.862297][ T5739] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.873931][ T5733] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.876878][ T5733] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.879720][ T5733] bridge_slave_0: entered allmulticast mode [ 47.883268][ T5733] bridge_slave_0: entered promiscuous mode [ 47.896261][ T5739] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.908150][ T5733] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.910866][ T5733] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.913638][ T5733] bridge_slave_1: entered allmulticast mode [ 47.916971][ T5733] bridge_slave_1: entered promiscuous mode [ 47.927920][ T5732] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.943314][ T5735] team0: Port device team_slave_0 added [ 47.955144][ T5732] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.974602][ T5735] team0: Port device team_slave_1 added [ 47.987231][ T5733] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.991091][ T5739] team0: Port device team_slave_0 added [ 47.999221][ T5739] team0: Port device team_slave_1 added [ 48.008218][ T5733] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.019178][ T5732] team0: Port device team_slave_0 added [ 48.028787][ T5735] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.031421][ T5735] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.039966][ T5735] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.051264][ T5735] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.053606][ T5735] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.062083][ T5735] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.066631][ T5732] team0: Port device team_slave_1 added [ 48.080156][ T5733] team0: Port device team_slave_0 added [ 48.088322][ T5733] team0: Port device team_slave_1 added [ 48.099419][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.101693][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.111278][ T5739] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.117264][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.120151][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.130553][ T5739] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.176206][ T5732] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.178326][ T5732] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.185912][ T5732] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.191778][ T5732] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.193863][ T5732] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.201397][ T5732] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.215519][ T5733] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.217600][ T5733] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.225115][ T5733] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.231192][ T5733] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.233333][ T5733] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.241517][ T5733] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.253958][ T5735] hsr_slave_0: entered promiscuous mode [ 48.256948][ T5735] hsr_slave_1: entered promiscuous mode [ 48.281960][ T5739] hsr_slave_0: entered promiscuous mode [ 48.284092][ T5739] hsr_slave_1: entered promiscuous mode [ 48.286032][ T5739] debugfs: 'hsr0' already exists in 'hsr' [ 48.287785][ T5739] Cannot create hsr debugfs directory [ 48.325710][ T5732] hsr_slave_0: entered promiscuous mode [ 48.328613][ T5732] hsr_slave_1: entered promiscuous mode [ 48.331320][ T5732] debugfs: 'hsr0' already exists in 'hsr' [ 48.333650][ T5732] Cannot create hsr debugfs directory [ 48.349871][ T5733] hsr_slave_0: entered promiscuous mode [ 48.352007][ T5733] hsr_slave_1: entered promiscuous mode [ 48.354297][ T5733] debugfs: 'hsr0' already exists in 'hsr' [ 48.356191][ T5733] Cannot create hsr debugfs directory [ 48.669343][ T5733] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 48.675117][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.678478][ T5733] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 48.682867][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.697703][ T5733] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 48.703501][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.707024][ T5733] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 48.713612][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.766464][ T5735] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 48.772402][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.776875][ T5735] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 48.782340][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.794206][ T5735] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 48.799543][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.807833][ T5735] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 48.811919][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.837345][ T5739] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 48.842945][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.845740][ T5739] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 48.850404][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.856327][ T5739] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 48.863081][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.867524][ T5739] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 48.873298][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.927913][ T5733] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.942469][ T5732] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 48.946802][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.949579][ T5732] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 48.954592][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.958361][ T5732] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 48.964617][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.967424][ T5732] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 48.973087][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.994395][ T5733] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.013916][ T1165] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.017128][ T1165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.033402][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.035528][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.091184][ T5737] Bluetooth: hci1: command tx timeout [ 49.091191][ T5741] Bluetooth: hci3: command tx timeout [ 49.091669][ T5735] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.094679][ T5092] Bluetooth: hci0: command tx timeout [ 49.100757][ T5092] Bluetooth: hci2: command tx timeout [ 49.100801][ T5739] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.122108][ T5735] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.130186][ T5739] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.142670][ T1165] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.145614][ T1165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.159598][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.162504][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.169095][ T1165] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.172038][ T1165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.196581][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.199428][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.208130][ T5732] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.242456][ T5732] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.254919][ T1165] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.257415][ T1165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.262639][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.265342][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.408790][ T5733] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.452683][ T5733] veth0_vlan: entered promiscuous mode [ 49.465268][ T5733] veth1_vlan: entered promiscuous mode [ 49.499511][ T5735] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.505485][ T5733] veth0_macvtap: entered promiscuous mode [ 49.512540][ T5733] veth1_macvtap: entered promiscuous mode [ 49.523293][ T5739] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.537104][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.544104][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.565874][ T5813] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.575396][ T5813] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.581739][ T5735] veth0_vlan: entered promiscuous mode [ 49.584561][ T5813] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.587454][ T5813] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.602564][ T5732] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.608956][ T5735] veth1_vlan: entered promiscuous mode [ 49.637562][ T5739] veth0_vlan: entered promiscuous mode [ 49.660171][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.662839][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.664261][ T5739] veth1_vlan: entered promiscuous mode [ 49.678946][ T5735] veth0_macvtap: entered promiscuous mode [ 49.691958][ T5732] veth0_vlan: entered promiscuous mode [ 49.695614][ T110] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.695969][ T5735] veth1_macvtap: entered promiscuous mode [ 49.697975][ T110] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.706776][ T5732] veth1_vlan: entered promiscuous mode [ 49.723590][ T5735] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.727716][ T5739] veth0_macvtap: entered promiscuous mode [ 49.734021][ T5735] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.741983][ T5733] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 49.742068][ T5739] veth1_macvtap: entered promiscuous mode [ 49.752632][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.755199][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.764006][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.766802][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.785180][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.797896][ T5732] veth0_macvtap: entered promiscuous mode [ 49.816649][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.823655][ T5732] veth1_macvtap: entered promiscuous mode [ 49.829567][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.834903][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.843491][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.848351][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.866321][ T110] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.868875][ T110] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.880476][ T5732] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.899369][ T1165] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.903108][ T1165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.905875][ T5732] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.928335][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.934569][ T1169] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.937051][ T1169] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.944184][ T5583] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.947159][ T5583] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.955299][ T5583] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.985627][ T110] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.993562][ T110] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.043355][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.047564][ T5892] netlink: 'syz.2.5': attribute type 21 has an invalid length. [ 50.049087][ T5891] netlink: 'syz.1.2': attribute type 21 has an invalid length. [ 50.050196][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.079318][ T5742] FAULT_INJECTION: forcing a failure. [ 50.079318][ T5742] name failslab, interval 1, probability 10, space 0, times 1 [ 50.079347][ T5892] FAULT_INJECTION: forcing a failure. [ 50.079347][ T5892] name failslab, interval 1, probability 10, space 0, times 1 [ 50.079401][ T1169] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.079414][ T1169] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.079494][ T1169] FAULT_INJECTION: forcing a failure. [ 50.079494][ T1169] name failslab, interval 1, probability 10, space 0, times 1 [ 50.079512][ T1169] CPU: 3 UID: 0 PID: 1169 Comm: kworker/u33:12 Not tainted syzkaller #0 PREEMPT(full) [ 50.079524][ T1169] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 50.079532][ T1169] Workqueue: events_unbound cfg80211_wiphy_work [ 50.079554][ T1169] Call Trace: [ 50.079570][ T1169] [ 50.079575][ T1169] dump_stack_lvl+0x100/0x190 [ 50.079592][ T1169] should_fail_ex.cold+0x5/0xa [ 50.079608][ T1169] should_failslab+0xc2/0x120 [ 50.079625][ T1169] __kmalloc_noprof+0xfc/0x820 [ 50.079637][ T1169] ? find_held_lock+0x2b/0x80 [ 50.079674][ T1169] ? unwind_next_frame+0x3be/0x2090 [ 50.079686][ T1169] ? cfg80211_inform_single_bss_data+0x557/0x1dc0 [ 50.079704][ T1169] cfg80211_inform_single_bss_data+0x557/0x1dc0 [ 50.079720][ T1169] ? ret_from_fork_asm+0x1a/0x30 [ 50.079740][ T1169] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10 [ 50.079765][ T1169] ? __lock_acquire+0x49f/0x1a40 [ 50.079778][ T1169] ? kasan_save_stack+0x3f/0x50 [ 50.079791][ T1169] ? kasan_save_stack+0x30/0x50 [ 50.079803][ T1169] ? kasan_save_track+0x14/0x30 [ 50.079815][ T1169] ? __kasan_kmalloc+0xaa/0xb0 [ 50.079830][ T1169] ? cfg80211_inform_bss_data+0x230/0x3b60 [ 50.079844][ T1169] cfg80211_inform_bss_data+0x230/0x3b60 [ 50.079862][ T1169] ? __lock_acquire+0x49f/0x1a40 [ 50.079876][ T1169] ? do_raw_spin_unlock+0x145/0x1e0 [ 50.079894][ T1169] ? __pfx_cfg80211_inform_bss_data+0x10/0x10 [ 50.079910][ T1169] ? do_raw_spin_lock+0x128/0x260 [ 50.079926][ T1169] ? find_held_lock+0x2b/0x80 [ 50.079943][ T1169] ? debug_object_activate+0x343/0x4b0 [ 50.079960][ T1169] ? debug_object_activate+0x343/0x4b0 [ 50.079976][ T1169] ? do_raw_spin_unlock+0x145/0x1e0 [ 50.079992][ T1169] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 50.080005][ T1169] ? debug_object_activate+0x343/0x4b0 [ 50.080019][ T1169] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 50.080036][ T1169] ? __pfx_debug_object_activate+0x10/0x10 [ 50.080055][ T1169] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 50.080073][ T1169] ? lockdep_hardirqs_on+0x78/0x100 [ 50.080086][ T1169] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 50.080097][ T1169] ? __mod_timer+0x40e/0xca0 [ 50.080114][ T1169] ? __pfx___mod_timer+0x10/0x10 [ 50.080130][ T1169] cfg80211_inform_bss_frame_data+0x245/0x7c0 [ 50.080149][ T1169] __ieee80211_sta_join_ibss+0xc85/0x1940 [ 50.080170][ T1169] ? __pfx___ieee80211_sta_join_ibss+0x10/0x10 [ 50.080185][ T1169] ? vprintk_emit+0x131/0x6b0 [ 50.080208][ T1169] ? __pfx_vprintk_emit+0x10/0x10 [ 50.080237][ T1169] ? _printk+0xcf/0x110 [ 50.080263][ T1169] ieee80211_sta_create_ibss.cold+0xaf/0x104 [ 50.080285][ T1169] ? __cfg80211_get_bss+0x612/0x960 [ 50.080310][ T1169] ? __pfx_ieee80211_sta_create_ibss+0x10/0x10 [ 50.080341][ T1169] ieee80211_ibss_work.cold+0x253/0x431 [ 50.080363][ T1169] ? __pfx_ieee80211_ibss_work+0x10/0x10 [ 50.080386][ T1169] ? __lock_acquire+0x49f/0x1a40 [ 50.080405][ T1169] ? rcu_is_watching+0x12/0xc0 [ 50.080422][ T1169] ? trace_contention_end+0x126/0x160 [ 50.080440][ T1169] ? do_raw_spin_lock+0x128/0x260 [ 50.080456][ T1169] ? find_held_lock+0x2b/0x80 [ 50.080475][ T1169] ? mark_held_locks+0x40/0x70 [ 50.080488][ T1169] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 50.080499][ T1169] ? lockdep_hardirqs_on+0x78/0x100 [ 50.080511][ T1169] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 50.080524][ T1169] ieee80211_iface_work+0xac4/0x1070 [ 50.080544][ T1169] cfg80211_wiphy_work+0x2b7/0x550 [ 50.080562][ T1169] process_one_work+0xa23/0x1940 [ 50.080580][ T1169] ? __pfx_process_one_work+0x10/0x10 [ 50.080596][ T1169] ? __pfx_cfg80211_wiphy_work+0x10/0x10 [ 50.080620][ T1169] worker_thread+0x5ef/0xe50 [ 50.080645][ T1169] ? kthread+0x13a/0x450 [ 50.080662][ T1169] ? __pfx_worker_thread+0x10/0x10 [ 50.080678][ T1169] kthread+0x370/0x450 [ 50.080693][ T1169] ? __pfx_kthread+0x10/0x10 [ 50.080710][ T1169] ret_from_fork+0x72b/0xd50 [ 50.080734][ T1169] ? __pfx_ret_from_fork+0x10/0x10 [ 50.080758][ T1169] ? __switch_to+0x800/0x10f0 [ 50.080775][ T1169] ? __pfx_kthread+0x10/0x10 [ 50.080790][ T1169] ret_from_fork_asm+0x1a/0x30 [ 50.080826][ T1169] [ 50.082364][ T5813] ------------[ cut here ]------------ [ 50.082404][ T5813] !bss [ 50.082410][ T5813] WARNING: net/wireless/ibss.c:37 at __cfg80211_ibss_joined+0x4d5/0x580, CPU#3: kworker/u32:3/5813 [ 50.082445][ T5813] Modules linked in: [ 50.082467][ T5813] CPU: 3 UID: 0 PID: 5813 Comm: kworker/u32:3 Not tainted syzkaller #0 PREEMPT(full) [ 50.082487][ T5813] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 50.082499][ T5813] Workqueue: cfg80211 cfg80211_event_work [ 50.082522][ T5813] RIP: 0010:__cfg80211_ibss_joined+0x4d5/0x580 [ 50.082540][ T5813] Code: ff ff e8 de be f3 f6 90 0f 0b 90 e9 58 fe ff ff e8 60 47 64 f7 e9 22 fc ff ff e8 f6 46 64 f7 e9 66 fc ff ff e8 bc be f3 f6 90 <0f> 0b 90 e9 6f fc ff ff e8 ae be f3 f6 90 0f 0b e8 66 47 64 f7 e9 [ 50.082554][ T5813] RSP: 0018:ffffc900038e7ad0 EFLAGS: 00010293 [ 50.082567][ T5813] RAX: 0000000000000000 RBX: ffff888051610ed0 RCX: 0000000000000040 [ 50.082577][ T5813] RDX: ffff88802ded0000 RSI: ffffffff8b16a184 RDI: ffffffff8c401680 [ 50.082589][ T5813] RBP: ffffc900038e7b80 R08: 0000000000000001 R09: 0000000000000000 [ 50.082601][ T5813] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888051610000 [ 50.082612][ T5813] R13: 1ffff9200071cf5e R14: 0000000000000000 R15: ffffc900038e7b10 [ 50.082624][ T5813] FS: 0000000000000000(0000) GS:ffff8880d60dc000(0000) knlGS:0000000000000000 [ 50.082661][ T5813] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 50.082674][ T5813] CR2: 000055b1b52bd098 CR3: 0000000057ef9000 CR4: 0000000000352ef0 [ 50.082687][ T5813] Call Trace: [ 50.082694][ T5813] [ 50.082703][ T5813] ? __pfx___cfg80211_ibss_joined+0x10/0x10 [ 50.082728][ T5813] ? mark_held_locks+0x40/0x70 [ 50.082754][ T5813] ? cfg80211_process_wdev_events+0x442/0x650 [ 50.082778][ T5813] cfg80211_process_wdev_events+0x442/0x650 [ 50.082808][ T5813] cfg80211_process_rdev_events+0x9f/0x130 [ 50.082833][ T5813] cfg80211_event_work+0x2b/0x40 [ 50.082857][ T5813] process_one_work+0xa23/0x1940 [ 50.082888][ T5813] ? __pfx_process_one_work+0x10/0x10 [ 50.082915][ T5813] ? __pfx_cfg80211_event_work+0x10/0x10 [ 50.082942][ T5813] worker_thread+0x5ef/0xe50 [ 50.082969][ T5813] ? __pfx_worker_thread+0x10/0x10 [ 50.082990][ T5813] ? kthread+0x13a/0x450 [ 50.083007][ T5813] ? __pfx_worker_thread+0x10/0x10 [ 50.083026][ T5813] kthread+0x370/0x450 [ 50.083043][ T5813] ? __pfx_kthread+0x10/0x10 [ 50.083063][ T5813] ret_from_fork+0x72b/0xd50 [ 50.083090][ T5813] ? __pfx_ret_from_fork+0x10/0x10 [ 50.083114][ T5813] ? __switch_to+0x800/0x10f0 [ 50.083130][ T5742] CPU: 2 UID: 0 PID: 5742 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 50.083162][ T5742] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 50.083134][ T5813] ? __pfx_kthread+0x10/0x10 [ 50.083169][ T5742] Call Trace: [ 50.083173][ T5742] [ 50.083178][ T5742] dump_stack_lvl+0x100/0x190 [ 50.083184][ T5813] ret_from_fork_asm+0x1a/0x30 [ 50.083195][ T5742] should_fail_ex.cold+0x5/0xa [ 50.083209][ T5742] should_failslab+0xc2/0x120 [ 50.083224][ T5813] [ 50.083234][ T5813] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 50.083246][ T5813] CPU: 3 UID: 0 PID: 5813 Comm: kworker/u32:3 Not tainted syzkaller #0 PREEMPT(full) [ 50.083265][ T5813] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 50.083276][ T5813] Workqueue: cfg80211 cfg80211_event_work [ 50.083306][ T5813] Call Trace: [ 50.083312][ T5813] [ 50.083319][ T5813] dump_stack_lvl+0x100/0x190 [ 50.083342][ T5813] vpanic+0x552/0x970 [ 50.083360][ T5813] ? __pfx_vpanic+0x10/0x10 [ 50.083385][ T5813] panic+0xd1/0xe0 [ 50.083401][ T5813] ? __pfx_panic+0x10/0x10 [ 50.083425][ T5813] ? check_panic_on_warn+0x1f/0x90 [ 50.083446][ T5813] check_panic_on_warn.cold+0x19/0x34 [ 50.083465][ T5813] ? __cfg80211_ibss_joined+0x4d5/0x580 [ 50.083485][ T5813] __warn.cold+0x191/0x318 [ 50.083505][ T5813] __report_bug+0x30f/0x440 [ 50.083525][ T5813] ? __cfg80211_ibss_joined+0x4d5/0x580 [ 50.083548][ T5813] ? __pfx___report_bug+0x10/0x10 [ 50.083566][ T5813] ? __lock_acquire+0x49f/0x1a40 [ 50.083588][ T5813] ? stack_trace_save+0x8e/0xc0 [ 50.083607][ T5813] ? __pfx_stack_trace_save+0x10/0x10 [ 50.083633][ T5813] ? __cfg80211_ibss_joined+0x4d5/0x580 [ 50.083655][ T5813] report_bug+0xb2/0x220 [ 50.083674][ T5813] ? __cfg80211_ibss_joined+0x4d5/0x580 [ 50.083695][ T5813] handle_bug+0x16a/0x2a0 [ 50.083719][ T5813] exc_invalid_op+0x17/0x50 [ 50.083742][ T5813] asm_exc_invalid_op+0x1a/0x20 [ 50.083760][ T5813] RIP: 0010:__cfg80211_ibss_joined+0x4d5/0x580 [ 50.083781][ T5813] Code: ff ff e8 de be f3 f6 90 0f 0b 90 e9 58 fe ff ff e8 60 47 64 f7 e9 22 fc ff ff e8 f6 46 64 f7 e9 66 fc ff ff e8 bc be f3 f6 90 <0f> 0b 90 e9 6f fc ff ff e8 ae be f3 f6 90 0f 0b e8 66 47 64 f7 e9 [ 50.083796][ T5813] RSP: 0018:ffffc900038e7ad0 EFLAGS: 00010293 [ 50.083826][ T5813] RAX: 0000000000000000 RBX: ffff888051610ed0 RCX: 0000000000000040 [ 50.083837][ T5813] RDX: ffff88802ded0000 RSI: ffffffff8b16a184 RDI: ffffffff8c401680 [ 50.083849][ T5813] RBP: ffffc900038e7b80 R08: 0000000000000001 R09: 0000000000000000 [ 50.083860][ T5813] R10: 0000000000000001 R11: 0000000000000000 R12: ffff888051610000 [ 50.083871][ T5813] R13: 1ffff9200071cf5e R14: 0000000000000000 R15: ffffc900038e7b10 [ 50.083890][ T5813] ? __cfg80211_ibss_joined+0x4d4/0x580 [ 50.083919][ T5813] ? __pfx___cfg80211_ibss_joined+0x10/0x10 [ 50.083943][ T5813] ? mark_held_locks+0x40/0x70 [ 50.083968][ T5813] ? cfg80211_process_wdev_events+0x442/0x650 [ 50.083990][ T5813] cfg80211_process_wdev_events+0x442/0x650 [ 50.084019][ T5813] cfg80211_process_rdev_events+0x9f/0x130 [ 50.084044][ T5813] cfg80211_event_work+0x2b/0x40 [ 50.084067][ T5813] process_one_work+0xa23/0x1940 [ 50.084097][ T5813] ? __pfx_process_one_work+0x10/0x10 [ 50.084123][ T5813] ? __pfx_cfg80211_event_work+0x10/0x10 [ 50.084148][ T5813] worker_thread+0x5ef/0xe50 [ 50.084172][ T5813] ? __pfx_worker_thread+0x10/0x10 [ 50.084186][ T5813] ? kthread+0x13a/0x450 [ 50.084196][ T5813] ? __pfx_worker_thread+0x10/0x10 [ 50.084208][ T5813] kthread+0x370/0x450 [ 50.084218][ T5813] ? __pfx_kthread+0x10/0x10 [ 50.084230][ T5813] ret_from_fork+0x72b/0xd50 [ 50.084247][ T5813] ? __pfx_ret_from_fork+0x10/0x10 [ 50.084264][ T5813] ? __switch_to+0x800/0x10f0 [ 50.084276][ T5813] ? __pfx_kthread+0x10/0x10 [ 50.084292][ T5813] ret_from_fork_asm+0x1a/0x30 [ 50.084316][ T5813] [ 50.087436][ T5813] Kernel Offset: disabled