last executing test programs: 1.005601137s ago: executing program 3 (id=4): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(michael_mic-generic,pcbc(fcrypt-generic))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) 854.976506ms ago: executing program 3 (id=5): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000d00)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xfffffffe, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x10, 0x2, [@TCA_RED_FLAGS={0xc, 0x4, {0x18, 0x4}}]}}]}, 0x3c}}, 0x0) 736.558532ms ago: executing program 3 (id=6): socket$kcm(0x29, 0x5, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000240)='net/kcm\x00') preadv(r0, &(0x7f0000000100)=[{&(0x7f00000002c0)=""/250, 0xfa}], 0x1, 0x185, 0x0) 683.450331ms ago: executing program 2 (id=3): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a09040000000000000000020000000900010073797a30000000000900020073797a320000000048000480440001800c0001007061796c6f61640034000280080004400000000008000840d600000108000240000000020800054000000000080003"], 0x9c}}, 0x4000020) 532.9901ms ago: executing program 1 (id=2): syz_mount_image$hfs(&(0x7f0000000040), &(0x7f00000000c0)='./file1\x00', 0x0, &(0x7f0000002cc0)=ANY=[], 0xff, 0x29c, &(0x7f0000000500)="$eJzs3U9rE08cx/HPbLZtfr+WurYVQTxVC56kfy7ipSJ9Bl48idpEKIYKWkE9tZ7Fg0fvfQo+AI+exLPgrScP4ingITKzE7P5s9kkZF2TvF+QbdLMd/5kZjMzW8oKwMy6vfftdOfMPoxUUknSTSmQVJZCSRd0sfz88OjgqFat9Muo5CLswyiONF1p9g+rvUJtnIvwIvsq1FLyd8hH+auOi64DiufO/jbL7hhIC/bsbJ7M5b9ftVzM9KD/dRL/fOE7GQAws/z8H8QreS359XsQSBt+2nfrAz//h5M+gdaLrkDOPma8b+qq+/k/fPdDahjbv+fcW639XscW7nTnbJS6zCseWW0LTJO1q3R1Cf57dFCrXt9/UqsEeq1db66VbM0dK/HQbWruae3zk+6s133DBtxfJnMbzqJrw5xtw3ay/okkq+MtMZv5ZD6beybSe1X+rP/ChrHd5Hoq6uipuP6b6Tm6Vs7LpUpp5XlXyCVfgte3lSV17Uha5n2ebR0YZdXTRa10RMWt28qIWu0ZtZ0RtdYZ1RrN6ZF5M2/NXbOu7/qgvcT6P7Cf9oYGOTNtGpfSj4y+7QldysjNJ/7r5Phyz5TBqC3CCN7ooW5o+dnLV48f1GrVp1P7xJ6JuRXxM4+cb+X+sTQHQfG9M+VP7IdcSOnNeWf0fNK/OrgsPz1anT5kIINgWth1l4n3f4n9yqZbrNlD1L5OX0jGNrIyT+S4lbI3WHHH/9N3cG2Mu3a/2OOvi90l9t1zXbkmXR2kxFjk6/nv2R0lyOzpi+5z/R8AAAAAAAAAAAAAAAAAAGDSjO9fDspKe6voNgIAAAAAAAAAAAAAAAAAAAAAMOl63P93Ybj7//p7MY3r/r93FL/i/r9A7n4HAAD//wPkdI4=") openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x143041, 0x114) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_user\x00', 0x275a, 0x0) 435.29307ms ago: executing program 3 (id=7): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000083c0)={{0x3}}) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r0, 0x80585414, &(0x7f0000000100)) 411.127515ms ago: executing program 2 (id=8): syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000000)='./file2\x00', 0x20404a, &(0x7f00000003c0)=ANY=[], 0xfd, 0x1e1, &(0x7f0000000640)="$eJzslr1u01AUx//XtpwEBSExsjAQCRhwbAcQC4gsTAxIQCIGhoiYKGCIlGQgkVDgCViYkBgY2HkBJFj7EFXaqUu6deni6vpe27eRnaT56tDzk3r6t318fD6s44AgiAvL/t7ROEA+1EWUkJPnD/TER1P8d/OHn/8/fVL/9vr3Tm5sFdJiBsHizzcA/Kvq6Mf3nr67JP+/gBbrl9BwW+o6GCypeTI1qT0wvJL6naI73N+y3rZ9z3rT8Ztc2Nw43LjcVKbzm3xlaCr5MeV6bzB83/B9r7tBMa9/k6qGh0p+6rwsiGxtpX8ONDhSV8DwXOoHyEW9ES1R6r9mJPH1mfWbWGP9tWLKJZ7KGeJcvZw5KhPAcokBLA74EytVii/yld3kO5QhdIQimuh6In/Xt1QFf9Hn+MDYelfZas1cZhZ/H4t7ojPBSByHPlcyAgajBR9hYpluJPsp+MVwU9lPYpX8CD81fITl3mB4p/2h0fJa3kfXrdy379r2PbccLiJhZ+y/QrifLiXxU79JHJOZ+NTo97uOsPGxK2zaxtXC/afh1g1xzIdrTsXNK5rJPwNGPMg/qvOjzFIIgiC2ynWw40BiREJ+TaD81n12jjkSBEEQBEEQBEEQBLEaJwEAAP//63FC3Q==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file2\x00', 0x80000, 0x0) readahead(r0, 0x5, 0x1000005) 356.714014ms ago: executing program 0 (id=1): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x7, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000500000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bc8900000000000035090100000500009500000000000000b7080000000100007b9a00fe00000000b509ffffff1f0000c3aaf0fff1000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608ebff76000000bf9800000000000056080000000000008500000000000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) 166.971795ms ago: executing program 3 (id=9): r0 = openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fchdir(r0) open(&(0x7f0000000080)='./bus\x00', 0x169242, 0x10) 117.816255ms ago: executing program 0 (id=10): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100008e88052086800095d89301020301090212000100000000090401"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f00000000c0)=[{0x6, 0x4001, 0x0, 0x0}], 0x1}) 366.891µs ago: executing program 1 (id=11): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f00000012c0), 0x0, 0x0) read$alg(r0, &(0x7f0000000240)=""/4096, 0xfffffdef) 0s ago: executing program 3 (id=12): r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r1 = socket(0x28, 0x801, 0x0) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000780), 0x800080, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.246' (ED25519) to the list of known hosts. syzkaller login: [ 58.182582][ T5752] cgroup: Unknown subsys name 'net' [ 58.343409][ T5752] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 59.751898][ T5752] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 61.630502][ T5765] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 61.646528][ T5765] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 61.656532][ T5765] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 61.677882][ T5768] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 61.685220][ T5768] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 61.694095][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 61.702092][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 61.717476][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 61.747616][ T5770] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 61.756691][ T5772] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 61.766843][ T5768] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 61.774844][ T5768] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 61.793298][ T5765] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 61.820751][ T5774] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 61.829636][ T5774] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 61.842248][ T5774] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 61.846213][ T5772] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 61.857673][ T5774] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 61.871941][ T5772] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 61.876553][ T5774] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 61.879976][ T5772] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 61.894353][ T5772] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 61.894824][ T5774] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 61.917565][ T5772] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 62.300597][ T5767] chnl_net:caif_netlink_parms(): no params data found [ 62.317516][ T5764] chnl_net:caif_netlink_parms(): no params data found [ 62.351061][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 62.471379][ T5771] chnl_net:caif_netlink_parms(): no params data found [ 62.512645][ T5767] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.520923][ T5767] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.530061][ T5767] bridge_slave_0: entered allmulticast mode [ 62.537633][ T5767] bridge_slave_0: entered promiscuous mode [ 62.554647][ T5767] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.562303][ T5767] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.570066][ T5767] bridge_slave_1: entered allmulticast mode [ 62.579353][ T5767] bridge_slave_1: entered promiscuous mode [ 62.612639][ T5764] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.620158][ T5764] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.627393][ T5764] bridge_slave_0: entered allmulticast mode [ 62.634429][ T5764] bridge_slave_0: entered promiscuous mode [ 62.668733][ T5764] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.675902][ T5764] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.683762][ T5764] bridge_slave_1: entered allmulticast mode [ 62.690742][ T5764] bridge_slave_1: entered promiscuous mode [ 62.707492][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.714608][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.722196][ T5775] bridge_slave_0: entered allmulticast mode [ 62.729279][ T5775] bridge_slave_0: entered promiscuous mode [ 62.745342][ T5767] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 62.764032][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.772004][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 62.781548][ T5775] bridge_slave_1: entered allmulticast mode [ 62.788609][ T5775] bridge_slave_1: entered promiscuous mode [ 62.801785][ T5767] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 62.813643][ T5764] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 62.856515][ T5764] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 62.900812][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 62.913073][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 62.922659][ T5771] bridge0: port 1(bridge_slave_0) entered blocking state [ 62.930122][ T5771] bridge0: port 1(bridge_slave_0) entered disabled state [ 62.937521][ T5771] bridge_slave_0: entered allmulticast mode [ 62.944300][ T5771] bridge_slave_0: entered promiscuous mode [ 62.954338][ T5767] team0: Port device team_slave_0 added [ 62.974129][ T5764] team0: Port device team_slave_0 added [ 62.990404][ T5771] bridge0: port 2(bridge_slave_1) entered blocking state [ 62.997671][ T5771] bridge0: port 2(bridge_slave_1) entered disabled state [ 63.004908][ T5771] bridge_slave_1: entered allmulticast mode [ 63.012299][ T5771] bridge_slave_1: entered promiscuous mode [ 63.020565][ T5767] team0: Port device team_slave_1 added [ 63.030529][ T5764] team0: Port device team_slave_1 added [ 63.087643][ T5775] team0: Port device team_slave_0 added [ 63.103633][ T5767] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.110791][ T5767] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 63.137245][ T5767] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 63.149786][ T5764] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.157091][ T5764] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 63.183443][ T5764] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 63.196801][ T5775] team0: Port device team_slave_1 added [ 63.204593][ T5771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 63.215125][ T5767] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 63.222247][ T5767] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 63.250741][ T5767] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.262973][ T5764] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 63.270153][ T5764] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 63.296247][ T5764] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.319591][ T5771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 63.389135][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.396104][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 63.426675][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 63.441662][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 63.448740][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 63.474775][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.490241][ T5771] team0: Port device team_slave_0 added [ 63.507914][ T5771] team0: Port device team_slave_1 added [ 63.542171][ T5767] hsr_slave_0: entered promiscuous mode [ 63.548455][ T5767] hsr_slave_1: entered promiscuous mode [ 63.558985][ T5764] hsr_slave_0: entered promiscuous mode [ 63.567136][ T5764] hsr_slave_1: entered promiscuous mode [ 63.573226][ T5764] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 63.582085][ T5764] Cannot create hsr debugfs directory [ 63.605058][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 63.612070][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 63.638024][ T5771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 63.650481][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 63.657703][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 63.683969][ T5771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 63.764383][ T5775] hsr_slave_0: entered promiscuous mode [ 63.770701][ T5775] hsr_slave_1: entered promiscuous mode [ 63.777475][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 63.785050][ T5775] Cannot create hsr debugfs directory [ 63.817204][ T5772] Bluetooth: hci0: command tx timeout [ 63.863228][ T5771] hsr_slave_0: entered promiscuous mode [ 63.869459][ T5771] hsr_slave_1: entered promiscuous mode [ 63.875436][ T5771] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 63.883318][ T5771] Cannot create hsr debugfs directory [ 63.896448][ T5772] Bluetooth: hci1: command tx timeout [ 63.976451][ T5772] Bluetooth: hci2: command tx timeout [ 63.977611][ T51] Bluetooth: hci3: command tx timeout [ 64.202460][ T5764] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 64.213791][ T5764] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 64.225855][ T5764] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 64.245702][ T5764] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 64.304811][ T5767] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 64.317725][ T5767] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 64.340450][ T5767] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 64.351458][ T5767] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 64.408578][ T5775] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 64.442773][ T5775] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 64.452365][ T5775] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 64.463384][ T5775] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 64.508971][ T5771] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 64.522806][ T5771] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 64.545258][ T5771] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 64.562416][ T5771] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 64.637474][ T5764] 8021q: adding VLAN 0 to HW filter on device bond0 [ 64.703161][ T5764] 8021q: adding VLAN 0 to HW filter on device team0 [ 64.714764][ T5767] 8021q: adding VLAN 0 to HW filter on device bond0 [ 64.772394][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 64.784986][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.792318][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.802707][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.809876][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.838766][ T5767] 8021q: adding VLAN 0 to HW filter on device team0 [ 64.859251][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 64.878810][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 64.895983][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.903168][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.941302][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.948422][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.957800][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.964912][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.981165][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 65.009715][ T1075] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.016895][ T1075] bridge0: port 1(bridge_slave_0) entered forwarding state [ 65.031220][ T1075] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.038330][ T1075] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.078257][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.085400][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 65.509880][ T5764] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.610849][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.642311][ T5767] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.718175][ T5764] veth0_vlan: entered promiscuous mode [ 65.734018][ T5764] veth1_vlan: entered promiscuous mode [ 65.744915][ T5775] veth0_vlan: entered promiscuous mode [ 65.755941][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.785360][ T5767] veth0_vlan: entered promiscuous mode [ 65.792294][ T5775] veth1_vlan: entered promiscuous mode [ 65.814995][ T5767] veth1_vlan: entered promiscuous mode [ 65.838813][ T5775] veth0_macvtap: entered promiscuous mode [ 65.865841][ T5775] veth1_macvtap: entered promiscuous mode [ 65.896842][ T51] Bluetooth: hci0: command tx timeout [ 65.898755][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.920486][ T5764] veth0_macvtap: entered promiscuous mode [ 65.932959][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.945168][ T5775] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.954347][ T5775] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.963518][ T5775] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.974088][ T5775] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.984038][ T51] Bluetooth: hci1: command tx timeout [ 66.021995][ T5764] veth1_macvtap: entered promiscuous mode [ 66.037865][ T5767] veth0_macvtap: entered promiscuous mode [ 66.058126][ T51] Bluetooth: hci3: command tx timeout [ 66.058135][ T5772] Bluetooth: hci2: command tx timeout [ 66.059673][ T5767] veth1_macvtap: entered promiscuous mode [ 66.085850][ T5771] veth0_vlan: entered promiscuous mode [ 66.128692][ T5771] veth1_vlan: entered promiscuous mode [ 66.144333][ T5767] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.161635][ T5767] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.174324][ T5767] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.191307][ T5764] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.202251][ T5764] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.212236][ T5764] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.222953][ T5764] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.234288][ T5764] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.255422][ T5764] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.267386][ T5764] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.279232][ T5764] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.298564][ T5767] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.309073][ T5767] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.319313][ T5767] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.329853][ T5767] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.342150][ T5767] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.368230][ T5764] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.378349][ T5764] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.387908][ T5764] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.396809][ T5764] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.423725][ T78] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.434128][ T78] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.449234][ T5767] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.460428][ T5767] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.469848][ T5767] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.479351][ T5767] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.552154][ T78] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.561622][ T78] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.563135][ T5771] veth0_macvtap: entered promiscuous mode [ 66.585032][ T5771] veth1_macvtap: entered promiscuous mode [ 66.613178][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.630372][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.643965][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.655046][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.664962][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.675604][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.688136][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.720300][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.731745][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.741722][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.758020][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.768241][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.780163][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.792028][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.813258][ T5771] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.822906][ T5771] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.832438][ T5771] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.843014][ T5771] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.878699][ T1144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.893262][ T1144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.974757][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.002872][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.023664][ T3543] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.044960][ T3543] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.137799][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.145686][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.265510][ T3543] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.289643][ T3543] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.317373][ T5830] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3'. [ 67.334937][ T78] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.358435][ T78] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.459158][ T5833] syz.1.2[5833]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 67.496115][ T5833] loop1: detected capacity change from 0 to 64 [ 67.608610][ T5837] loop2: detected capacity change from 0 to 16 [ 67.647691][ T5837] ======================================================= [ 67.647691][ T5837] WARNING: The mand mount option has been deprecated and [ 67.647691][ T5837] and is ignored by this kernel. Remove the mand [ 67.647691][ T5837] option from the mount to silence this warning. [ 67.647691][ T5837] ======================================================= [ 67.703300][ T5833] hfs: request for non-existent node 1280 in B*Tree [ 67.731719][ T5833] hfs: request for non-existent node 1280 in B*Tree [ 67.743057][ T5837] erofs: (device loop2): mounted with root inode @ nid 36. [ 67.830318][ T5837] erofs: (device loop2): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 0 [ 67.841924][ T5837] erofs: (device loop2): z_erofs_readahead: readahead error at folio 2 @ nid 89 [ 67.852389][ T5837] erofs: (device loop2): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 0 [ 67.874635][ T5837] erofs: (device loop2): z_erofs_readahead: readahead error at folio 1 @ nid 89 [ 67.898244][ T12] ------------[ cut here ]------------ [ 67.903906][ T12] kernel BUG at fs/hfs/inode.c:449! [ 67.908118][ T5837] erofs: (device loop2): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 0 [ 67.924423][ T5837] erofs: (device loop2): z_erofs_readahead: readahead error at folio 0 @ nid 89 [ 67.938975][ T12] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 67.945084][ T12] CPU: 1 PID: 12 Comm: kworker/u4:1 Not tainted syzkaller #0 [ 67.950015][ T5837] erofs: (device loop2): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 0 [ 67.952441][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 67.952460][ T12] Workqueue: writeback wb_workfn [ 67.963340][ T5837] erofs: (device loop2): z_erofs_fill_inode_lazy: invalid tail-packing pclustersize 0 [ 67.972026][ T12] (flush-7:1) [ 67.972043][ T12] RIP: 0010:hfs_write_inode+0x87a/0x880 [ 67.972066][ T12] Code: c7 c1 00 93 30 97 80 e1 07 80 c1 03 38 c1 0f 8c 73 fe ff ff 48 c7 c7 00 93 30 97 e8 b0 0f 84 ff e9 62 fe ff ff e8 36 e0 2b ff <0f> 0b 0f 1f 40 00 f3 0f 1e fa 55 41 57 41 56 41 54 53 48 89 fb 49 [ 67.972077][ T12] RSP: 0018:ffffc90000117340 EFLAGS: 00010293 [ 67.972088][ T12] RAX: ffffffff825b34da RBX: ffff888026a80ea8 RCX: ffff88801b645a00 [ 67.972099][ T12] RDX: 0000000000000000 RSI: ffffffff8d339760 RDI: 0000000000000000 [ 67.972108][ T12] RBP: ffffc900001174d0 R08: ffff88801b645a00 R09: 0000000000000003 [ 67.972117][ T12] R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000 [ 67.972126][ T12] R13: 1ffff92000022e6c R14: ffff888026a80e58 R15: 0000000000000000 [ 67.972135][ T12] FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 67.972146][ T12] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 67.972156][ T12] CR2: 00007f1c183456b8 CR3: 000000006200f000 CR4: 00000000003506e0 [ 67.972171][ T12] Call Trace: [ 67.972189][ T12] [ 67.972197][ T12] ? hfs_inode_write_fork+0x1a0/0x1a0 [ 67.972219][ T12] ? __rwlock_init+0x150/0x150 [ 67.983707][ T5837] erofs: (device loop2): z_erofs_read_folio: read error -117 @ 0 of nid 89 [ 67.986661][ T12] __writeback_single_inode+0x705/0xec0 [ 67.986691][ T12] writeback_sb_inodes+0x7cd/0xf50 [ 67.986719][ T12] ? queue_io+0x550/0x550 [ 68.018920][ T27] audit: type=1800 audit(1772628801.909:2): pid=5837 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.8" name="file2" dev="loop2" ino=89 res=0 errno=0 [ 68.021354][ T12] ? rcu_is_watching+0x15/0xb0 [ 68.021382][ T12] wb_writeback+0x46a/0xbf0 [ 68.021406][ T12] ? queue_io+0x361/0x550 [ 68.021427][ T12] ? percpu_ref_tryget+0x250/0x250 [ 68.021448][ T12] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 68.021470][ T12] ? _raw_spin_unlock_irq+0x23/0x50 [ 68.021494][ T12] wb_workfn+0x400/0xe60 [ 68.021520][ T12] ? inode_wait_for_writeback+0x230/0x230 [ 68.021545][ T12] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 68.021564][ T12] ? read_lock_is_recursive+0x20/0x20 [ 68.021583][ T12] ? _raw_spin_unlock_irq+0x23/0x50 [ 68.021599][ T12] ? process_scheduled_works+0x96f/0x15d0 [ 68.021617][ T12] ? process_scheduled_works+0x96f/0x15d0 [ 68.021635][ T12] process_scheduled_works+0xa5d/0x15d0 [ 68.021664][ T12] ? assign_work+0x430/0x430 [ 68.021684][ T12] ? assign_work+0x3d0/0x430 [ 68.021704][ T12] worker_thread+0xa55/0xfc0 [ 68.021731][ T12] kthread+0x2fa/0x390 [ 68.021746][ T12] ? pr_cont_work+0x560/0x560 [ 68.021763][ T12] ? kthread_blkcg+0xd0/0xd0 [ 68.021778][ T12] ret_from_fork+0x48/0x80 [ 68.021797][ T12] ? kthread_blkcg+0xd0/0xd0 [ 68.021812][ T12] ret_from_fork_asm+0x11/0x20 [ 68.021837][ T12] [ 68.021849][ T12] Modules linked in: [ 68.046396][ T51] Bluetooth: hci0: command tx timeout [ 68.079269][ T5772] Bluetooth: hci1: command tx timeout [ 68.115505][ T12] ---[ end trace 0000000000000000 ]--- [ 68.137093][ T5803] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 68.189075][ T12] RIP: 0010:hfs_write_inode+0x87a/0x880 [ 68.193552][ T5772] Bluetooth: hci2: command tx timeout [ 68.217276][ T51] Bluetooth: hci3: command tx timeout [ 68.226142][ T12] Code: c7 c1 00 93 30 97 80 e1 07 80 c1 03 38 c1 0f 8c 73 fe ff ff 48 c7 c7 00 93 30 97 e8 b0 0f 84 ff e9 62 fe ff ff e8 36 e0 2b ff <0f> 0b 0f 1f 40 00 f3 0f 1e fa 55 41 57 41 56 41 54 53 48 89 fb 49 [ 68.331681][ T12] RSP: 0018:ffffc90000117340 EFLAGS: 00010293 [ 68.338975][ T12] RAX: ffffffff825b34da RBX: ffff888026a80ea8 RCX: ffff88801b645a00 [ 68.347095][ T12] RDX: 0000000000000000 RSI: ffffffff8d339760 RDI: 0000000000000000 [ 68.355070][ T12] RBP: ffffc900001174d0 R08: ffff88801b645a00 R09: 0000000000000003 [ 68.363450][ T12] R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000 [ 68.371569][ T12] R13: 1ffff92000022e6c R14: ffff888026a80e58 R15: 0000000000000000 [ 68.381568][ T12] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 68.390680][ T12] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 68.397304][ T12] CR2: 00007ffdf49e5ff0 CR3: 000000001ffb0000 CR4: 00000000003506f0 [ 68.405470][ T12] Kernel panic - not syncing: Fatal exception [ 68.411932][ T12] Kernel Offset: disabled [ 68.416245][ T12] Rebooting in 86400 seconds..