last executing test programs: 50.602713495s ago: executing program 1 (id=232): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = eventfd2(0xd, 0x1) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000080)={0x0, r1}) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000200)) 50.459974213s ago: executing program 1 (id=233): bpf$MAP_CREATE(0x0, 0x0, 0x48) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="18050000000000fe000000004b64ffec850000007d000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r2}, 0xc) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x2200c851, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r3, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000e00)='net/icmp6\x00') lseek(r4, 0x7ffffffffffffbff, 0x0) 46.197512158s ago: executing program 1 (id=234): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000400007b8af8ff00000000bfa200000000000007020000fcffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000002c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x62040200) 39.313589032s ago: executing program 1 (id=237): write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0xfdef) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) r1 = getpid() bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000040000000800000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000000)=@usbdevfs_connect) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc}, 0x94) socket$inet6(0xa, 0x3, 0x8000000003c) 36.606342445s ago: executing program 1 (id=242): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) getgroups(0x0, 0x0) keyctl$chown(0x4, r0, 0xee01, 0x0) keyctl$setperm(0x5, r0, 0x3220120) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x5) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000001700)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x6}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x3fffffffffffcb5, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x15, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000000000400000000dfffff1918120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='sched_switch\x00', r5}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f00000005c0), r6) sendmsg$WG_CMD_SET_DEVICE(r6, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r7, @ANYBLOB="01000000000000000000010000000800050001000000140002007767310000000000000000000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb5420800050000000000900008808c00008024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c640009801c000080060001000200000008000200ffffffff0500030003"], 0xec}, 0x1, 0x0, 0x0, 0x4084}, 0x20000010) 19.521357768s ago: executing program 0 (id=255): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x1fffffffffffffcd, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x2010000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c25000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000000)='tlb_flush\x00', r0}, 0x10) 19.366479746s ago: executing program 0 (id=256): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x4e22, @broadcast}}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20000040) getresuid(&(0x7f0000000380), 0x0, &(0x7f0000000400)) 17.110632476s ago: executing program 0 (id=257): openat$tcp_mem(0xffffffffffffff9c, 0x0, 0x1, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00', r0}, 0x18) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a00, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) 8.946611717s ago: executing program 0 (id=258): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r1 = dup(r0) ppoll(&(0x7f0000000640)=[{r1, 0x2001}], 0x1, 0x0, 0x0, 0x0) 8.678205321s ago: executing program 0 (id=259): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = timerfd_create(0x8, 0x80000) timerfd_settime(r3, 0x0, &(0x7f0000007000)={{0x0, 0x4}, {0x0, 0x989680}}, 0x0) readv(r3, &(0x7f0000000a40)=[{&(0x7f0000000cc0)=""/53, 0x35}], 0x1) 292.766505ms ago: executing program 0 (id=260): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000040)=0x81) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) syz_io_uring_setup(0x50cf, &(0x7f0000000000)={0x0, 0xfffffffc, 0x40000, 0x2, 0x333}, &(0x7f0000000080), &(0x7f0000ff4000)) 0s ago: executing program 1 (id=261): bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000001000000e27f000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x5c, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r5}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x12, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x3c}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x80) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:14285' (ED25519) to the list of known hosts. syzkaller login: [ 150.799665][ T3302] cgroup: Unknown subsys name 'net' [ 151.049820][ T3302] cgroup: Unknown subsys name 'cpuset' [ 151.095823][ T3302] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 151.878487][ T3302] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 167.950680][ T3309] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 168.088558][ T3309] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 168.172358][ T3308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 168.269462][ T3308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 170.325881][ T3309] hsr_slave_0: entered promiscuous mode [ 170.336286][ T3309] hsr_slave_1: entered promiscuous mode [ 170.669240][ T3308] hsr_slave_0: entered promiscuous mode [ 170.677792][ T3308] hsr_slave_1: entered promiscuous mode [ 170.685279][ T3308] debugfs: 'hsr0' already exists in 'hsr' [ 170.686444][ T3308] Cannot create hsr debugfs directory [ 172.196102][ T3309] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 172.290368][ T3309] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 172.316269][ T3309] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 172.337356][ T3309] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 172.657760][ T3308] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 172.690313][ T3308] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 172.720230][ T3308] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 172.756073][ T3308] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 173.979396][ T3308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 174.526268][ T3309] 8021q: adding VLAN 0 to HW filter on device bond0 [ 180.659808][ T3308] veth0_vlan: entered promiscuous mode [ 180.749926][ T3308] veth1_vlan: entered promiscuous mode [ 180.991786][ T3308] veth0_macvtap: entered promiscuous mode [ 181.036393][ T3308] veth1_macvtap: entered promiscuous mode [ 181.240438][ T3309] veth0_vlan: entered promiscuous mode [ 181.346687][ T3309] veth1_vlan: entered promiscuous mode [ 181.449776][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 181.458553][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 181.460961][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 181.483105][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 181.842265][ T3309] veth0_macvtap: entered promiscuous mode [ 181.903047][ T3309] veth1_macvtap: entered promiscuous mode [ 182.312538][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 182.323112][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 182.329219][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 182.329697][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 182.348076][ T3308] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 186.512156][ T3465] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 186.556203][ T3465] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 213.276286][ T3473] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 235.737244][ T3495] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 235.739619][ T3495] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 246.657804][ T3511] netem: change failed [ 282.185923][ T3557] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 288.041711][ T3567] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 288.070848][ T3567] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 289.246341][ T3572] binder: 3571:3572 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 289.266800][ T3572] binder: 3572 RLIMIT_NICE not set [ 289.870717][ T30] audit: type=1326 audit(289.570:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3571 comm="syz.1.35" exe="/syz-executor" sig=9 arch=c00000b7 syscall=98 compat=0 ip=0xffffa8f5af28 code=0x0 [ 302.744761][ T3592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 302.746969][ T3592] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 360.551149][ T3641] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 360.567015][ T3641] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 362.149301][ T3644] netlink: 76 bytes leftover after parsing attributes in process `syz.1.53'. [ 370.856305][ T3663] futex_wake_op: syz.0.59 tries to shift op by -1; fix this program [ 418.637107][ T3409] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 418.989703][ T3409] usb 1-1: New USB device found, idVendor=6189, idProduct=182d, bcdDevice= 1.73 [ 418.997185][ T3409] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.006037][ T3409] usb 1-1: Product: syz [ 419.015603][ T3409] usb 1-1: Manufacturer: syz [ 419.020129][ T3409] usb 1-1: SerialNumber: syz [ 419.076058][ T3409] usb 1-1: config 0 descriptor?? [ 420.220391][ T3409] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 420.230399][ T3409] asix 1-1:0.0: probe with driver asix failed with error -71 [ 420.266792][ T3409] usb 1-1: USB disconnect, device number 2 [ 439.006237][ T3761] binder: 3760:3761 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 439.006976][ T3761] binder: 3761 RLIMIT_NICE not set [ 440.499074][ T3769] netlink: 'syz.1.86': attribute type 4 has an invalid length. [ 441.785424][ T3773] syz.1.87 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 441.916442][ C0] hrtimer: interrupt took 1217650 ns [ 460.581862][ T3815] can0: slcan on ptm0. [ 460.607632][ T3815] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 460.616580][ T3815] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 460.750728][ T3815] can0 (unregistered): slcan off ptm0. [ 467.014000][ T3831] netlink: 96 bytes leftover after parsing attributes in process `syz.0.107'. [ 481.765884][ T3855] netlink: 12 bytes leftover after parsing attributes in process `syz.1.114'. [ 502.055959][ T3877] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 502.056572][ T3877] IPv6: NLM_F_CREATE should be set when creating new route [ 505.784734][ T3883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.787814][ T3883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.576951][ T108] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 512.275181][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 519.795395][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 527.935383][ T9] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 528.115335][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 528.237652][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 528.242669][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 528.248729][ T9] usb 1-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 528.252509][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 528.275608][ T9] usb 1-1: config 0 descriptor?? [ 528.854564][ T9] hid-generic 0003:13EC:0006.0001: item fetching failed at offset 2/5 [ 528.857822][ T9] hid-generic 0003:13EC:0006.0001: probe with driver hid-generic failed with error -22 [ 529.027992][ T24] usb 1-1: USB disconnect, device number 3 [ 533.875325][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 546.176880][ T3952] netlink: 16 bytes leftover after parsing attributes in process `syz.1.141'. [ 546.185510][ T3952] tc_dump_action: action bad kind [ 562.674809][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 568.285230][ T3983] netlink: 4 bytes leftover after parsing attributes in process `syz.0.151'. [ 568.400531][ T3983] netlink: 12 bytes leftover after parsing attributes in process `syz.0.151'. [ 583.646313][ T4007] netlink: 388 bytes leftover after parsing attributes in process `syz.1.157'. [ 584.817568][ T31] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 585.124271][ T31] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 585.125132][ T31] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 585.125703][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 585.199561][ T31] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 585.438309][ T31] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 585.518035][ T31] usb 1-1: USB disconnect, device number 4 [ 587.179924][ T4020] udevd[4020]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 598.607549][ T4045] Zero length message leads to an empty skb [ 611.056927][ T4079] netlink: 8 bytes leftover after parsing attributes in process `syz.0.183'. [ 622.841744][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 629.940704][ T4110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 629.959638][ T4110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.658317][ T4120] vlan2: entered allmulticast mode [ 630.659044][ T4120] bridge_slave_0: entered allmulticast mode [ 634.027766][ T4136] binder: 4135:4136 tried to acquire reference to desc 0, got 1 instead [ 634.050674][ T11] binder: undelivered TRANSACTION_COMPLETE [ 634.098351][ T3409] binder: undelivered transaction 8, process died. [ 663.740022][ T4183] Driver unsupported XDP return value 0 on prog (id 36) dev N/A, expect packet loss! [ 664.786020][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 665.430659][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 665.444294][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 665.448731][ T9] usb 1-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 665.457443][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 665.519426][ T9] usb 1-1: config 0 descriptor?? [ 666.760384][ T9] hid-generic 0003:0FC5:B080.0002: unknown main item tag 0x0 [ 666.806756][ T9] hid-generic 0003:0FC5:B080.0002: hidraw0: USB HID v0.00 Device [HID 0fc5:b080] on usb-dummy_hcd.0-1/input0 [ 666.954142][ T9] usb 1-1: USB disconnect, device number 5 [ 669.722554][ T4193] fido_id[4193]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 672.383704][ C1] sched: DL replenish lagged too much [ 672.934905][ T4203] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 672.937967][ T4203] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 677.254026][ T9] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 677.434043][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 677.472993][ T9] usb 1-1: config 0 has an invalid interface number: 251 but max is 0 [ 677.475138][ T9] usb 1-1: config 0 has no interface number 0 [ 677.478168][ T9] usb 1-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 677.480858][ T9] usb 1-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 677.558705][ T9] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 677.564272][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.568030][ T9] usb 1-1: Product: syz [ 677.571107][ T9] usb 1-1: Manufacturer: syz [ 677.574402][ T9] usb 1-1: SerialNumber: syz [ 677.611358][ T9] usb 1-1: config 0 descriptor?? [ 677.648289][ T4218] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 677.658901][ T4218] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 677.939741][ T4218] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 677.957587][ T4218] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 680.131193][ T9] asix 1-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 681.262102][ T9] asix 1-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0002: -71 [ 681.285022][ T9] asix 1-1:0.251 (unnamed net_device) (uninitialized): Could not register MDIO bus [ 681.291907][ T9] asix 1-1:0.251: probe with driver asix failed with error -5 [ 681.347079][ T9] usb 1-1: USB disconnect, device number 6 [ 698.230017][ T4264] netlink: 24 bytes leftover after parsing attributes in process `syz.0.238'. [ 699.201759][ T4270] netlink: 4 bytes leftover after parsing attributes in process `syz.0.240'. [ 699.249651][ T4270] netlink: 12 bytes leftover after parsing attributes in process `syz.0.240'. [ 699.854568][ T4277] netlink: 12 bytes leftover after parsing attributes in process `syz.0.243'. [ 699.985723][ T4277] netlink: 12 bytes leftover after parsing attributes in process `syz.0.243'. [ 738.595353][ T4331] ------------[ cut here ]------------ [ 738.595916][ T4331] verifier bug: error during ctx access conversion (0)(1) [ 738.597661][ T4331] WARNING: CPU: 1 PID: 4331 at kernel/bpf/verifier.c:21448 convert_ctx_accesses+0x9ac/0xb00 [ 738.609670][ T4331] Modules linked in: [ 738.613427][ T4331] CPU: 1 UID: 0 PID: 4331 Comm: syz.1.261 Not tainted 6.17.0-rc1-syzkaller-00031-g3a4a0367c9f4 #0 PREEMPT [ 738.615487][ T4331] Hardware name: linux,dummy-virt (DT) [ 738.616430][ T4331] pstate: 61402009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 738.617447][ T4331] pc : convert_ctx_accesses+0x9ac/0xb00 [ 738.618158][ T4331] lr : convert_ctx_accesses+0x9ac/0xb00 [ 738.618860][ T4331] sp : ffff80008b1ab9e0 [ 738.619373][ T4331] x29: ffff80008b1ab9e0 x28: fbf000000cde0000 x27: 0000000000000002 [ 738.620928][ T4331] x26: f8ff8000883c5058 x25: 0000000000000000 x24: 0000000000000000 [ 738.622165][ T4331] x23: ffff8000816c7e84 x22: 0000000000000004 x21: 0000000000000002 [ 738.623732][ T4331] x20: 0000000000000004 x19: ffff80008242a5a8 x18: 00000000ffffffff [ 738.624800][ T4331] x17: 0000000000000000 x16: 0000000000000000 x15: ffff80008b1ab5e0 [ 738.625795][ T4331] x14: 00000000ffffffea x13: ffff80008b1ab6a8 x12: ffff8000829ef250 [ 738.628229][ T4331] x11: 0000000000000001 x10: 0000000000000001 x9 : 000000000002ffe8 [ 738.629409][ T4331] x8 : ffffffffffffffff x7 : ffff800082913bb8 x6 : 0000000000000002 [ 738.630627][ T4331] x5 : ffff800082913000 x4 : 0000000000000002 x3 : 0000000000000001 [ 738.631824][ T4331] x2 : 0000000000000000 x1 : 0000000000000000 x0 : f1f000000acdb780 [ 738.633143][ T4331] Call trace: [ 738.634210][ T4331] convert_ctx_accesses+0x9ac/0xb00 (P) [ 738.635293][ T4331] bpf_check+0x12f8/0x2aac [ 738.636045][ T4331] bpf_prog_load+0x634/0xb74 [ 738.636716][ T4331] __sys_bpf+0x2e0/0x1a3c [ 738.637350][ T4331] __arm64_sys_bpf+0x24/0x34 [ 738.638032][ T4331] invoke_syscall+0x48/0x110 [ 738.638733][ T4331] el0_svc_common.constprop.0+0x40/0xe0 [ 738.640496][ T4331] do_el0_svc+0x1c/0x28 [ 738.641862][ T4331] el0_svc+0x34/0x10c [ 738.643276][ T4331] el0t_64_sync_handler+0xa0/0xe4 [ 738.645001][ T4331] el0t_64_sync+0x1a4/0x1a8 [ 738.646880][ T4331] ---[ end trace 0000000000000000 ]--- SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 745.716804][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 746.008753][ T3605] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 746.183062][ T3605] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 746.438471][ T3605] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 746.565678][ T3605] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.802511][ T3605] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 748.949901][ T3605] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 749.011753][ T3605] bond0 (unregistering): Released all slaves [ 749.379803][ T3605] hsr_slave_0: left promiscuous mode [ 749.420285][ T3605] hsr_slave_1: left promiscuous mode [ 749.495886][ T3605] veth1_macvtap: left promiscuous mode [ 749.499278][ T3605] veth0_macvtap: left promiscuous mode [ 749.506352][ T3605] veth1_vlan: left promiscuous mode [ 749.507422][ T3605] veth0_vlan: left promiscuous mode [ 754.067754][ T3605] ------------[ cut here ]------------ [ 754.068762][ T3605] WARNING: CPU: 0 PID: 3605 at net/ipv6/xfrm6_tunnel.c:341 xfrm6_tunnel_net_exit+0x60/0xb4 [ 754.073282][ T3605] Modules linked in: [ 754.075353][ T3605] CPU: 0 UID: 0 PID: 3605 Comm: kworker/u8:8 Tainted: G W 6.17.0-rc1-syzkaller-00031-g3a4a0367c9f4 #0 PREEMPT [ 754.078146][ T3605] Tainted: [W]=WARN [ 754.079311][ T3605] Hardware name: linux,dummy-virt (DT) [ 754.081244][ T3605] Workqueue: netns cleanup_net [ 754.083018][ T3605] pstate: 60402009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 754.085150][ T3605] pc : xfrm6_tunnel_net_exit+0x60/0xb4 [ 754.085808][ T3605] lr : xfrm6_tunnel_net_exit+0x40/0xb4 [ 754.086471][ T3605] sp : ffff80008935bc70 [ 754.086940][ T3605] x29: ffff80008935bc70 x28: 0000000000000000 x27: 0000000000000000 [ 754.087888][ T3605] x26: ffff800082b74840 x25: 0000000000000001 x24: 0000000000000001 [ 754.088850][ T3605] x23: ffff800082b85118 x22: ffff800082b748b8 x21: ffff800082b748b8 [ 754.089802][ T3605] x20: fdf000000af28000 x19: fcf000000882c000 x18: ffff8000894db9a0 [ 754.090802][ T3605] x17: fff07ffffcfe1000 x16: ffff800080000000 x15: ffff800081b63bd0 [ 754.091912][ T3605] x14: 0000000000000008 x13: 0000000000000001 x12: 0000000000000003 [ 754.093145][ T3605] x11: 00000000000000c0 x10: 3ac941732c3e689a x9 : e32133307cf5227a [ 754.104033][ T3605] x8 : f3f0000004485bf8 x7 : 0000000000000190 x6 : ffff80008293d808 [ 754.105005][ T3605] x5 : 0000000000000001 x4 : fbffff3fffffffff x3 : 0000000000000000 [ 754.106044][ T3605] x2 : 0000000000000000 x1 : f5f00000061ce700 x0 : 0000000000000000 [ 754.107162][ T3605] Call trace: [ 754.107536][ T3605] xfrm6_tunnel_net_exit+0x60/0xb4 (P) [ 754.108231][ T3605] ops_undo_list+0xec/0x23c [ 754.108823][ T3605] cleanup_net+0x1f4/0x3cc [ 754.109396][ T3605] process_one_work+0x178/0x2cc [ 754.110024][ T3605] worker_thread+0x250/0x358 [ 754.110676][ T3605] kthread+0x130/0x1fc [ 754.111260][ T3605] ret_from_fork+0x10/0x20 [ 754.111906][ T3605] ---[ end trace 0000000000000000 ]--- [ 754.126368][ T3605] ------------[ cut here ]------------ [ 754.126543][ T3605] WARNING: CPU: 0 PID: 3605 at net/ipv6/xfrm6_tunnel.c:344 xfrm6_tunnel_net_exit+0x94/0xb4 [ 754.127924][ T3605] Modules linked in: [ 754.128479][ T3605] CPU: 0 UID: 0 PID: 3605 Comm: kworker/u8:8 Tainted: G W 6.17.0-rc1-syzkaller-00031-g3a4a0367c9f4 #0 PREEMPT [ 754.129802][ T3605] Tainted: [W]=WARN [ 754.130299][ T3605] Hardware name: linux,dummy-virt (DT) [ 754.130936][ T3605] Workqueue: netns cleanup_net [ 754.131628][ T3605] pstate: 80402009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 754.132471][ T3605] pc : xfrm6_tunnel_net_exit+0x94/0xb4 [ 754.133086][ T3605] lr : xfrm6_tunnel_net_exit+0x40/0xb4 [ 754.144132][ T3605] sp : ffff80008935bc70 [ 754.144761][ T3605] x29: ffff80008935bc70 x28: 0000000000000000 x27: 0000000000000000 [ 754.146007][ T3605] x26: ffff800082b74840 x25: 0000000000000001 x24: 0000000000000001 [ 754.147141][ T3605] x23: ffff800082b85118 x22: ffff800082b748b8 x21: ffff800082b748b8 [ 754.148101][ T3605] x20: fdf000000af28000 x19: fcf000000882c000 x18: ffff8000894db9a0 [ 754.149105][ T3605] x17: fff07ffffcfe1000 x16: ffff800080000000 x15: ffff800081b63bd0 [ 754.150205][ T3605] x14: 0000000000000008 x13: 0000000000000001 x12: 0000000000000003 [ 754.151262][ T3605] x11: 00000000000000c0 x10: 3ac941732c3e689a x9 : e32133307cf5227a [ 754.152441][ T3605] x8 : f3f0000004485bf8 x7 : 0000000000000190 x6 : ffff80008293d808 [ 754.153649][ T3605] x5 : 0000000000000001 x4 : fbffff3fffffffff x3 : 0000000000000000 [ 754.164097][ T3605] x2 : 0000000000000000 x1 : f5f00000061ce710 x0 : 0000000000000001 [ 754.165296][ T3605] Call trace: [ 754.165735][ T3605] xfrm6_tunnel_net_exit+0x94/0xb4 (P) [ 754.166550][ T3605] ops_undo_list+0xec/0x23c [ 754.168227][ T3605] cleanup_net+0x1f4/0x3cc [ 754.170061][ T3605] process_one_work+0x178/0x2cc [ 754.171750][ T3605] worker_thread+0x250/0x358 [ 754.173486][ T3605] kthread+0x130/0x1fc [ 754.174993][ T3605] ret_from_fork+0x10/0x20 [ 754.176761][ T3605] ---[ end trace 0000000000000000 ]--- [ 754.282448][ T3605] ------------[ cut here ]------------ [ 754.282666][ T3605] WARNING: CPU: 0 PID: 3605 at net/xfrm/xfrm_state.c:3303 xfrm_state_fini+0xc0/0x164 [ 754.294829][ T3605] Modules linked in: [ 754.296372][ T3605] CPU: 0 UID: 0 PID: 3605 Comm: kworker/u8:8 Tainted: G W 6.17.0-rc1-syzkaller-00031-g3a4a0367c9f4 #0 PREEMPT [ 754.300444][ T3605] Tainted: [W]=WARN [ 754.301825][ T3605] Hardware name: linux,dummy-virt (DT) [ 754.303768][ T3605] Workqueue: netns cleanup_net [ 754.305534][ T3605] pstate: 80402009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 754.308047][ T3605] pc : xfrm_state_fini+0xc0/0x164 [ 754.309695][ T3605] lr : xfrm_state_fini+0x3c/0x164 [ 754.311397][ T3605] sp : ffff80008935bc50 [ 754.312778][ T3605] x29: ffff80008935bc50 x28: 0000000000000000 x27: 0000000000000000 [ 754.315758][ T3605] x26: ffff800082b74840 x25: 0000000000000001 x24: 0000000000000001 [ 754.318539][ T3605] x23: ffff800082b81d00 x22: ffff800082b748b8 x21: ffff800082b748b8 [ 754.321059][ T3605] x20: fdf000000af28000 x19: fdf000000af28000 x18: 0000000000000000 [ 754.323816][ T3605] x17: fff07ffffcfe1000 x16: ffff800080000000 x15: ffff800081b63bd0 [ 754.326452][ T3605] x14: 00000000000000e9 x13: 0000000000000000 x12: ffff800082911258 [ 754.327815][ T3605] x11: 0000000000000040 x10: ffff800082939d68 x9 : ffff800082939d60 [ 754.329197][ T3605] x8 : f9f0000003400028 x7 : 0000000000000000 x6 : 0000000000000000 [ 754.330586][ T3605] x5 : f9f0000003400000 x4 : f9f0000003400038 x3 : 0000000000000000 [ 754.331929][ T3605] x2 : 0000000000000000 x1 : f9f0000008aa0418 x0 : fdf000000af28c80 [ 754.333400][ T3605] Call trace: [ 754.333977][ T3605] xfrm_state_fini+0xc0/0x164 (P) [ 754.335010][ T3605] xfrm_net_exit+0x30/0x50 [ 754.335908][ T3605] ops_undo_list+0xec/0x23c [ 754.337408][ T3605] cleanup_net+0x1f4/0x3cc [ 754.339598][ T3605] process_one_work+0x178/0x2cc [ 754.341336][ T3605] worker_thread+0x250/0x358 [ 754.343016][ T3605] kthread+0x130/0x1fc [ 754.344907][ T3605] ret_from_fork+0x10/0x20 [ 754.346984][ T3605] ---[ end trace 0000000000000000 ]--- VM DIAGNOSIS: 08:03:41 Registers: info registers vcpu 0 CPU#0 PC=ffff80008013bd98 X00=fbf0000005a4d2ac X01=0000000000000000 X02=0000000000000001 X03=e59678c88ddd42ee X04=663007d3ab15c105 X05=ce16cdcd7c63ef6d X06=ca988abd37ebafaa X07=908cf1fe27f44f61 X08=fff000007f8d2108 X09=0000000000000008 X10=0000000000000001 X11=fdf000000403f828 X12=0000000000000000 X13=0000000000000000 X14=00000000000001ae X15=ffff800081b63bd0 X16=ffff800080000000 X17=fff07ffffcfe1000 X18=0000000000000000 X19=fbf0000005a4d200 X20=0000000000000001 X21=fbf0000005a4d230 X22=fbf0000005a4d2ac X23=ffff8000828f0f00 X24=fdf000000664d6d4 X25=0000000000000040 X26=0000000000000000 X27=f4f000000679576c X28=f0f000000a9d9280 X29=ffff800080003180 X30=ffff80008013bd98 SP=ffff800080003180 PSTATE=804020c9 N--- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000000000000000 P01=0000000000000000 P02=0000000000000000 P03=0000000000000000 P04=0000000000000000 P05=0000000000000000 P06=0000000000000000 P07=0000000000000000 P08=0000000000000000 P09=0000000000000000 P10=0000000000000000 P11=0000000000000000 P12=0000000000000000 P13=0000000000000000 P14=0000000000000000 P15=0000000000000000 FFR=0000000000000000 Z00=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z01=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffb9356428:0000ffffb9356440 Z02=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffb9356438:0000ffffb9356480 Z03=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffb9ebca20:0000ffffb9356420 Z04=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffb9356458:0000ffffb9356430 Z05=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffb9356468:0000ffffb9356460 Z06=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffb9356468:0000ffffb9356460 Z07=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffb9356478:0000ffffb9356470 Z08=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z16=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffd58b42f0:0000ffffd58b42f0 Z17=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:ffffff80ffffffd0:0000ffffd58b42c0 Z18=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z24=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z26=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z28=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z30=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 info registers vcpu 1 CPU#1 PC=ffff800081b06bf0 X00=ffff800082090da0 X01=ffff80008209105c X02=ffff80008b1ab340 X03=0000000000000073 X04=0000000000000043 X05=ffff800082090e78 X06=ffff80008b1ab468 X07=0000000000000004 X08=ffff80008b1ab600 X09=00000000000010eb X10=0000000000000001 X11=0000000000000001 X12=ffff8000829ef250 X13=ffff80008b1ab473 X14=ffff80008b1ab468 X15=ffff80008b1ab2a0 X16=0000000000000000 X17=0000000000000000 X18=00000000ffffffff X19=ffff8000826710dc X20=0000000000000400 X21=0000000000000000 X22=ffff80008b1ab468 X23=0000000000000004 X24=ffff80008b1ab600 X25=00000000ffffffe8 X26=0000000000000008 X27=ffff80008b1ab47e X28=ffff8000826710d8 X29=ffff80008b1ab290 X30=94af800081b0ae58 SP=ffff80008b1ab290 PSTATE=424023c9 -Z-- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000000000000000 P01=0000000000000000 P02=0000000000000000 P03=0000000000000000 P04=0000000000000000 P05=0000000000000000 P06=0000000000000000 P07=0000000000000000 P08=0000000000000000 P09=0000000000000000 P10=0000000000000000 P11=0000000000000000 P12=0000000000000000 P13=0000000000000000 P14=0000000000000000 P15=0000000000000000 FFR=0000000000000000 Z00=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z01=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffa9156428:0000ffffa9156440 Z02=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffa9156438:0000ffffa9156480 Z03=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffa9cbca20:0000ffffa9156420 Z04=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffa9156458:0000ffffa9156430 Z05=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffa9156468:0000ffffa9156460 Z06=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffa9156468:0000ffffa9156460 Z07=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffa9156478:0000ffffa9156470 Z08=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z16=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffefd1e3a0:0000ffffefd1e3a0 Z17=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:ffffff80ffffffd0:0000ffffefd1e370 Z18=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z24=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z26=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z28=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z30=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000