last executing test programs: 270.86609ms ago: executing program 3 (id=4): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x29c780}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="4c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="46060900000000001c00128009000100766c616e000000000c000280060001000400000008000500", @ANYRES32=r5, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r3], 0x4c}, 0x1, 0x0, 0x0, 0x600}, 0x0) 236.904749ms ago: executing program 2 (id=3): r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newtfilter={0x84, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xf}, {}, {0x2, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x58, 0x2, [@TCA_U32_SEL={0x44, 0x5, {0x1, 0x1, 0x3, 0x1, 0x4, 0x2, 0x6, 0x7ffffffa, [{0x200, 0x500, 0x3, 0x6}, {0x6783, 0x2, 0x8001, 0x10}, {0x0, 0x53, 0xa9, 0x1}]}}, @TCA_U32_MARK={0x2d, 0xa, {0xf2ff, 0x6}}]}}]}, 0x84}}, 0x24040084) 202.966024ms ago: executing program 0 (id=1): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x9b, &(0x7f0000006680)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{0x0, 0x0, 0x0, 0x3}, 'syz1\x00', 0x52}) ioctl$UI_DEV_CREATE(r0, 0x5501) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) sendto$inet(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = syz_io_uring_setup(0x239, &(0x7f00000002c0)={0x0, 0xf2cf, 0x10100, 0x0, 0x0, 0x0, r2}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r2, 0x0, 0x0, 0x0, {0x90c0}, 0x1}) io_uring_enter(r3, 0x2ded, 0x4000, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200)=0x1, 0x12) r6 = syz_open_dev$evdev(&(0x7f0000000080), 0x72, 0x0) readv(r6, &(0x7f0000000040)=[{&(0x7f00000001c0)=""/105, 0x69}], 0x1) 68.757992ms ago: executing program 3 (id=6): r0 = socket$inet_sctp(0x2, 0x1, 0x84) prctl$PR_MCE_KILL(0x35, 0x1, 0x2) r1 = syz_open_dev$loop(&(0x7f0000000100), 0x8, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.empty_time\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000000)={0x0, {}, 0x0, {}, 0x9, 0x5, 0x17, 0x8, "038b0ced01d119456adc3b7aa5fda49436ef7fc25f433b0666324210780fd75009efb2033b1d6397f69e31a3b8a6f59f3ad6a6cfc3e99f3ca0cc8e0cda21bfcc", "1adad85867f7c226807b0f528c3e616ddbcdbbb3dc002b7ee11f8d8752ac335b", [0x5]}) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, 0x0, 0x0) 14.710143ms ago: executing program 2 (id=7): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) 0s ago: executing program 1 (id=2): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r0) r1 = syz_clone(0x20022180, 0x0, 0xfe02, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) syz_open_procfs(r1, &(0x7f0000000180)='attr/current\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.226' (ED25519) to the list of known hosts. [ 35.693286][ T6505] cgroup: Unknown subsys name 'net' [ 35.837278][ T6505] cgroup: Unknown subsys name 'cpuset' [ 35.840815][ T6505] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 36.052246][ T6505] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 37.536467][ T6516] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 37.554750][ T6516] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 37.557613][ T6516] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 37.565843][ T6516] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 37.569537][ T6520] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 37.572276][ T6520] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 37.577194][ T6520] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 37.577658][ T6522] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 37.578348][ T6522] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 37.578789][ T6522] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 37.634013][ T6520] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 37.636913][ T6520] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 37.639266][ T6520] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 37.641991][ T6520] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 37.644791][ T6520] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 37.655711][ T53] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 37.656488][ T53] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 37.656879][ T53] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 37.657498][ T53] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 37.657948][ T53] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 37.678092][ T6520] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 37.680615][ T6520] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 37.683022][ T6520] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 37.685999][ T6520] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 37.691995][ T6520] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 37.945216][ T6515] chnl_net:caif_netlink_parms(): no params data found [ 37.987485][ T6523] chnl_net:caif_netlink_parms(): no params data found [ 38.019366][ T6518] chnl_net:caif_netlink_parms(): no params data found [ 38.100648][ T6515] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.102964][ T6515] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.105407][ T6515] bridge_slave_0: entered allmulticast mode [ 38.108140][ T6515] bridge_slave_0: entered promiscuous mode [ 38.112005][ T6515] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.114043][ T6515] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.114874][ T6515] bridge_slave_1: entered allmulticast mode [ 38.115719][ T6515] bridge_slave_1: entered promiscuous mode [ 38.155149][ T6523] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.155253][ T6523] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.155390][ T6523] bridge_slave_0: entered allmulticast mode [ 38.156232][ T6523] bridge_slave_0: entered promiscuous mode [ 38.157505][ T6523] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.157560][ T6523] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.157658][ T6523] bridge_slave_1: entered allmulticast mode [ 38.158458][ T6523] bridge_slave_1: entered promiscuous mode [ 38.175666][ T6524] chnl_net:caif_netlink_parms(): no params data found [ 38.196102][ T6523] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.217777][ T6515] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.221145][ T6515] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.222643][ T6523] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.238613][ T6518] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.238721][ T6518] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.238881][ T6518] bridge_slave_0: entered allmulticast mode [ 38.239754][ T6518] bridge_slave_0: entered promiscuous mode [ 38.241090][ T6518] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.241146][ T6518] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.241245][ T6518] bridge_slave_1: entered allmulticast mode [ 38.242119][ T6518] bridge_slave_1: entered promiscuous mode [ 38.267467][ T6523] team0: Port device team_slave_0 added [ 38.272861][ T6523] team0: Port device team_slave_1 added [ 38.333546][ T6515] team0: Port device team_slave_0 added [ 38.335395][ T6515] team0: Port device team_slave_1 added [ 38.353024][ T6523] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.356119][ T6523] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.362434][ T6523] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.365226][ T6518] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.375456][ T6523] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.375507][ T6523] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.375567][ T6523] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.390477][ T6518] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.401157][ T6515] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.401209][ T6515] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.401245][ T6515] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.402359][ T6515] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.402384][ T6515] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.402415][ T6515] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.420486][ T6523] hsr_slave_0: entered promiscuous mode [ 38.421202][ T6523] hsr_slave_1: entered promiscuous mode [ 38.448516][ T6524] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.450532][ T6524] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.452573][ T6524] bridge_slave_0: entered allmulticast mode [ 38.455322][ T6524] bridge_slave_0: entered promiscuous mode [ 38.458057][ T6527] chnl_net:caif_netlink_parms(): no params data found [ 38.460504][ T6524] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.461826][ T6524] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.461946][ T6524] bridge_slave_1: entered allmulticast mode [ 38.462845][ T6524] bridge_slave_1: entered promiscuous mode [ 38.465501][ T6518] team0: Port device team_slave_0 added [ 38.503155][ T6518] team0: Port device team_slave_1 added [ 38.537478][ T6524] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.554922][ T6515] hsr_slave_0: entered promiscuous mode [ 38.557012][ T6515] hsr_slave_1: entered promiscuous mode [ 38.559132][ T6515] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 38.559393][ T6515] Cannot create hsr debugfs directory [ 38.579536][ T6524] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.580277][ T6518] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.580303][ T6518] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.580340][ T6518] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.582493][ T6518] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.582520][ T6518] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.582555][ T6518] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.648097][ T6524] team0: Port device team_slave_0 added [ 38.649626][ T6524] team0: Port device team_slave_1 added [ 38.691088][ T6524] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.691152][ T6524] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.691209][ T6524] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.698928][ T6524] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.698958][ T6524] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.698998][ T6524] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.733321][ T6518] hsr_slave_0: entered promiscuous mode [ 38.733890][ T6518] hsr_slave_1: entered promiscuous mode [ 38.734220][ T6518] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 38.734249][ T6518] Cannot create hsr debugfs directory [ 38.761259][ T6527] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.763299][ T6527] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.765191][ T6527] bridge_slave_0: entered allmulticast mode [ 38.766055][ T6527] bridge_slave_0: entered promiscuous mode [ 38.782088][ T6524] hsr_slave_0: entered promiscuous mode [ 38.784256][ T6524] hsr_slave_1: entered promiscuous mode [ 38.785539][ T6524] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 38.785571][ T6524] Cannot create hsr debugfs directory [ 38.799069][ T6527] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.801101][ T6527] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.803222][ T6527] bridge_slave_1: entered allmulticast mode [ 38.805826][ T6527] bridge_slave_1: entered promiscuous mode [ 38.864284][ T6527] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.884781][ T6527] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.952893][ T6515] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 38.970963][ T6527] team0: Port device team_slave_0 added [ 38.972692][ T6527] team0: Port device team_slave_1 added [ 38.973232][ T6515] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 39.005597][ T6515] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 39.009591][ T6515] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 39.027145][ T6527] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.027199][ T6527] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.027526][ T6527] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.028871][ T6527] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.028896][ T6527] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.028932][ T6527] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.080677][ T6527] hsr_slave_0: entered promiscuous mode [ 39.081238][ T6527] hsr_slave_1: entered promiscuous mode [ 39.081541][ T6527] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 39.081570][ T6527] Cannot create hsr debugfs directory [ 39.098495][ T6523] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 39.120694][ T6523] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 39.148333][ T6523] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 39.150239][ T6523] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 39.209575][ T6518] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 39.213317][ T6518] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 39.233596][ T6518] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 39.250106][ T6518] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 39.302042][ T6524] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.306963][ T6524] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.311016][ T6524] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.327880][ T6524] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.385230][ T6523] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.421318][ T6523] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.428443][ T6527] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 39.438006][ T6515] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.439338][ T6527] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 39.444277][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.444392][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.452810][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.452884][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.457218][ T6527] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 39.468515][ T6527] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 39.489309][ T6524] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.492820][ T6515] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.496572][ T6518] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.515680][ T6518] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.519210][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.519292][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.535888][ T6524] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.546085][ T2186] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.546183][ T2186] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.551059][ T2186] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.551133][ T2186] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.563411][ T2186] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.563503][ T2186] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.589030][ T6515] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 39.591010][ T6515] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 39.608300][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.608377][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.624388][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.624487][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.625273][ T6520] Bluetooth: hci1: command tx timeout [ 39.625483][ T6520] Bluetooth: hci0: command tx timeout [ 39.705480][ T6084] Bluetooth: hci2: command tx timeout [ 39.705638][ T6084] Bluetooth: hci3: command tx timeout [ 39.714271][ T6527] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.723066][ T6527] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.731596][ T6524] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 39.746062][ T6524] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 39.763078][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.763159][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.769347][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.769419][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.784825][ T6520] Bluetooth: hci4: command tx timeout [ 39.809073][ T6527] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 39.819065][ T6527] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 39.867819][ T6523] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.885073][ T6523] veth0_vlan: entered promiscuous mode [ 39.903178][ T6515] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.907105][ T6523] veth1_vlan: entered promiscuous mode [ 39.939677][ T6518] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.983569][ T6523] veth0_macvtap: entered promiscuous mode [ 39.988320][ T6518] veth0_vlan: entered promiscuous mode [ 39.993713][ T6523] veth1_macvtap: entered promiscuous mode [ 40.003561][ T6518] veth1_vlan: entered promiscuous mode [ 40.020193][ T6518] veth0_macvtap: entered promiscuous mode [ 40.039745][ T6518] veth1_macvtap: entered promiscuous mode [ 40.043785][ T6524] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.053037][ T6527] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.082920][ T6524] veth0_vlan: entered promiscuous mode [ 40.088205][ T6524] veth1_vlan: entered promiscuous mode [ 40.111199][ T6523] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.113235][ T6523] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.120147][ T6523] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.121009][ T6523] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.121043][ T6523] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.121073][ T6523] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.126782][ T6518] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.138815][ T6515] veth0_vlan: entered promiscuous mode [ 40.141607][ T6518] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.159901][ T6515] veth1_vlan: entered promiscuous mode [ 40.169935][ T6518] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.170002][ T6518] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.170033][ T6518] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.170063][ T6518] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.242971][ T6515] veth0_macvtap: entered promiscuous mode [ 40.252908][ T6524] veth0_macvtap: entered promiscuous mode [ 40.281002][ T6524] veth1_macvtap: entered promiscuous mode [ 40.283435][ T6515] veth1_macvtap: entered promiscuous mode [ 40.302372][ T6527] veth0_vlan: entered promiscuous mode [ 40.318057][ T6527] veth1_vlan: entered promiscuous mode [ 40.331590][ T6524] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.334183][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.334276][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.341916][ T6515] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.353591][ T599] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.358022][ T599] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.362747][ T6524] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.367605][ T6515] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.373604][ T6515] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.376281][ T6515] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.378645][ T6515] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.379285][ T6515] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.385110][ T6524] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.387484][ T6524] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.389791][ T6524] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.390487][ T6524] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.429773][ T6527] veth0_macvtap: entered promiscuous mode [ 40.432438][ T6527] veth1_macvtap: entered promiscuous mode [ 40.439058][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.439105][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.450492][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.450545][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.455568][ T6527] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.480600][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.480665][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.482385][ T6527] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.483848][ T6527] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.483887][ T6527] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.483917][ T6527] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.483947][ T6527] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.552015][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.554578][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.590969][ T6523] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 40.596980][ T2186] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.597035][ T2186] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.650990][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.651052][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.667506][ T6627] netlink: 'syz.3.4': attribute type 1 has an invalid length. [ 40.717877][ T6627] vlan2: entered allmulticast mode [ 40.718023][ T6627] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 40.737181][ T6631] input: syz1 as /devices/virtual/input/input2 [ 40.844131][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.844191][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.156327][ T6637] [ 41.157051][ T6637] ====================================================== [ 41.158958][ T6637] WARNING: possible circular locking dependency detected [ 41.160879][ T6637] 6.16.0-rc1-syzkaller-g39dfc971e42d #0 Not tainted [ 41.162627][ T6637] ------------------------------------------------------ [ 41.164523][ T6637] syz.3.6/6637 is trying to acquire lock: [ 41.166029][ T6637] ffff800092bd96e8 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x24c/0x548 [ 41.169037][ T6637] [ 41.169037][ T6637] but task is already holding lock: [ 41.171024][ T6637] ffff0000ca198a68 (&q->q_usage_counter(io)#25){++++}-{0:0}, at: loop_set_status+0x1d4/0x9e0 [ 41.173826][ T6637] [ 41.173826][ T6637] which lock already depends on the new lock. [ 41.173826][ T6637] [ 41.176731][ T6637] [ 41.176731][ T6637] the existing dependency chain (in reverse order) is: [ 41.179155][ T6637] [ 41.179155][ T6637] -> #2 (&q->q_usage_counter(io)#25){++++}-{0:0}: [ 41.181506][ T6637] blk_alloc_queue+0x48c/0x54c ** replaying previous printk message ** [ 41.182416][ T2186] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.185926][ T6637] __blk_mq_alloc_disk+0x12c/0x310 ** replaying previous printk message ** [ 41.186389][ T2186] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.190340][ T6637] loop_add+0x32c/0x88c [ 41.191586][ T6637] loop_init+0x168/0x1a0 [ 41.192859][ T6637] do_one_initcall+0x250/0x990 [ 41.194341][ T6637] do_initcall_level+0x154/0x214 [ 41.195796][ T6637] do_initcalls+0x84/0xf4 [ 41.197071][ T6637] do_basic_setup+0x8c/0xa0 [ 41.198436][ T6637] kernel_init_freeable+0x2dc/0x444 [ 41.199986][ T6637] kernel_init+0x24/0x1dc [ 41.201313][ T6637] ret_from_fork+0x10/0x20 [ 41.202607][ T6637] [ 41.202607][ T6637] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 41.204541][ T6637] fs_reclaim_acquire+0x8c/0x118 [ 41.206028][ T6637] kmem_cache_alloc_node_noprof+0x60/0x3f4 [ 41.207778][ T6637] __alloc_skb+0x144/0x2ec [ 41.209094][ T6637] alloc_uevent_skb+0x78/0x1e0 [ 41.210486][ T6637] kobject_uevent_net_broadcast+0x2d4/0x548 [ 41.212200][ T6637] kobject_uevent_env+0x528/0x884 [ 41.213659][ T6637] kobject_synth_uevent+0x82c/0xa74 [ 41.215184][ T6637] bus_uevent_store+0x114/0x16c [ 41.216597][ T6637] bus_attr_store+0x80/0xa4 [ 41.217985][ T6637] sysfs_kf_write+0x1a8/0x23c [ 41.219394][ T6637] kernfs_fop_write_iter+0x314/0x488 [ 41.220943][ T6637] vfs_write+0x62c/0x97c [ 41.222226][ T6637] ksys_write+0x120/0x210 [ 41.223530][ T6637] __arm64_sys_write+0x7c/0x90 [ 41.224908][ T6637] invoke_syscall+0x98/0x2b8 [ 41.226249][ T6637] el0_svc_common+0x130/0x23c [ 41.227611][ T6637] do_el0_svc+0x48/0x58 [ 41.228924][ T6637] el0_svc+0x58/0x17c [ 41.230177][ T6637] el0t_64_sync_handler+0x78/0x108 [ 41.231737][ T6637] el0t_64_sync+0x198/0x19c [ 41.233074][ T6637] [ 41.233074][ T6637] -> #0 (uevent_sock_mutex){+.+.}-{4:4}: [ 41.235221][ T6637] __lock_acquire+0x1774/0x30a4 [ 41.236642][ T6637] lock_acquire+0x14c/0x2e0 [ 41.237990][ T6637] __mutex_lock_common+0x1d0/0x2190 [ 41.239538][ T6637] mutex_lock_nested+0x2c/0x38 [ 41.240914][ T6637] kobject_uevent_net_broadcast+0x24c/0x548 [ 41.242708][ T6637] kobject_uevent_env+0x528/0x884 [ 41.244392][ T6637] kobject_uevent+0x2c/0x3c [ 41.245741][ T6637] loop_set_status+0x43c/0x9e0 [ 41.247238][ T6637] lo_ioctl+0x7f0/0x1b8c [ 41.248500][ T6637] blkdev_ioctl+0x610/0xac0 [ 41.249891][ T6637] __arm64_sys_ioctl+0x14c/0x1c4 [ 41.251359][ T6637] invoke_syscall+0x98/0x2b8 [ 41.252667][ T6637] el0_svc_common+0x130/0x23c [ 41.254047][ T6637] do_el0_svc+0x48/0x58 [ 41.255285][ T6637] el0_svc+0x58/0x17c [ 41.256525][ T6637] el0t_64_sync_handler+0x78/0x108 [ 41.258009][ T6637] el0t_64_sync+0x198/0x19c [ 41.259374][ T6637] [ 41.259374][ T6637] other info that might help us debug this: [ 41.259374][ T6637] [ 41.262113][ T6637] Chain exists of: [ 41.262113][ T6637] uevent_sock_mutex --> fs_reclaim --> &q->q_usage_counter(io)#25 [ 41.262113][ T6637] [ 41.265783][ T6637] Possible unsafe locking scenario: [ 41.265783][ T6637] [ 41.267782][ T6637] CPU0 CPU1 [ 41.269173][ T6637] ---- ---- [ 41.270576][ T6637] lock(&q->q_usage_counter(io)#25); [ 41.272019][ T6637] lock(fs_reclaim); [ 41.273815][ T6637] lock(&q->q_usage_counter(io)#25); [ 41.275903][ T6637] lock(uevent_sock_mutex); [ 41.277245][ T6637] [ 41.277245][ T6637] *** DEADLOCK *** [ 41.277245][ T6637] [ 41.279391][ T6637] 3 locks held by syz.3.6/6637: [ 41.280716][ T6637] #0: ffff0000ca193400 (&lo->lo_mutex){+.+.}-{4:4}, at: loop_set_status+0x40/0x9e0 [ 41.283218][ T6637] #1: ffff0000ca198a68 (&q->q_usage_counter(io)#25){++++}-{0:0}, at: loop_set_status+0x1d4/0x9e0 [ 41.286097][ T6637] #2: ffff0000ca198aa0 (&q->q_usage_counter(queue)#20){+.+.}-{0:0}, at: loop_set_status+0x1d4/0x9e0 [ 41.288983][ T6637] [ 41.288983][ T6637] stack backtrace: [ 41.290543][ T6637] CPU: 1 UID: 0 PID: 6637 Comm: syz.3.6 Not tainted 6.16.0-rc1-syzkaller-g39dfc971e42d #0 PREEMPT [ 41.293464][ T6637] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 41.296207][ T6637] Call trace: [ 41.297060][ T6637] show_stack+0x2c/0x3c (C) [ 41.298292][ T6637] __dump_stack+0x30/0x40 [ 41.299457][ T6637] dump_stack_lvl+0xd8/0x12c [ 41.300719][ T6637] dump_stack+0x1c/0x28 [ 41.301817][ T6637] print_circular_bug+0x324/0x32c [ 41.303189][ T6637] check_noncircular+0x154/0x174 [ 41.304518][ T6637] __lock_acquire+0x1774/0x30a4 [ 41.305792][ T6637] lock_acquire+0x14c/0x2e0 [ 41.306993][ T6637] __mutex_lock_common+0x1d0/0x2190 [ 41.308489][ T6637] mutex_lock_nested+0x2c/0x38 [ 41.309758][ T6637] kobject_uevent_net_broadcast+0x24c/0x548 [ 41.311380][ T6637] kobject_uevent_env+0x528/0x884 [ 41.312776][ T6637] kobject_uevent+0x2c/0x3c [ 41.313987][ T6637] loop_set_status+0x43c/0x9e0 [ 41.315220][ T6637] lo_ioctl+0x7f0/0x1b8c [ 41.316387][ T6637] blkdev_ioctl+0x610/0xac0 [ 41.317617][ T6637] __arm64_sys_ioctl+0x14c/0x1c4 [ 41.318981][ T6637] invoke_syscall+0x98/0x2b8 [ 41.320216][ T6637] el0_svc_common+0x130/0x23c [ 41.321492][ T6637] do_el0_svc+0x48/0x58 [ 41.322596][ T6637] el0_svc+0x58/0x17c [ 41.323658][ T6637] el0t_64_sync_handler+0x78/0x108 [ 41.324991][ T6637] el0t_64_sync+0x198/0x19c [ 41.704839][ T6520] Bluetooth: hci0: command tx timeout [ 41.704899][ T6520] Bluetooth: hci1: command tx timeout [ 41.784722][ T6084] Bluetooth: hci3: command tx timeout [ 41.784739][ T6520] Bluetooth: hci2: command tx timeout [ 41.864690][ T6084] Bluetooth: hci4: command tx timeout [ 43.784571][ T6084] Bluetooth: hci1: command tx timeout [ 43.784738][ T6520] Bluetooth: hci0: command tx timeout [ 43.864935][ T6084] Bluetooth: hci3: command tx timeout [ 43.864947][ T6520] Bluetooth: hci2: command tx timeout [ 43.944559][ T6084] Bluetooth: hci4: command tx timeout [ 45.865396][ T6520] Bluetooth: hci0: command tx timeout [ 45.865477][ T6084] Bluetooth: hci1: command tx timeout [ 45.944897][ T6520] Bluetooth: hci2: command tx timeout [ 45.944955][ T6520] Bluetooth: hci3: command tx timeout [ 46.024712][ T6084] Bluetooth: hci4: command tx timeout