[ 8.460084][ T4398] 8021q: adding VLAN 0 to HW filter on device bond0 [ 8.465597][ T4398] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: [ 8.495646][ T1218] gve 0000:00:00.0 enp0s0: Device link is up. OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.69' (ED25519) to the list of known hosts. 1970/01/01 00:00:23 parsed 1 programs 1970/01/01 00:00:23 serving rpc on tcp://40239 syzkaller login: [ 24.472701][ T4718] cgroup: Unknown subsys name 'net' [ 24.632385][ T4718] cgroup: Unknown subsys name 'cpuset' [ 24.634683][ T4718] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 24.829565][ T4718] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 27.604018][ T4730] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 28.014293][ T4755] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 28.014685][ T4755] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 28.014838][ T4755] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 28.015174][ T4755] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 28.015374][ T4755] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 28.116830][ T3241] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 28.118508][ T3241] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 28.127413][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 28.129099][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 28.983701][ T4787] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.983986][ T4787] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.984065][ T4787] bridge_slave_0: entered allmulticast mode [ 28.984519][ T4787] bridge_slave_0: entered promiscuous mode [ 28.985955][ T4787] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.986010][ T4787] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.986069][ T4787] bridge_slave_1: entered allmulticast mode [ 28.986458][ T4787] bridge_slave_1: entered promiscuous mode [ 28.993455][ T4787] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 28.994644][ T4787] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.000371][ T4787] team0: Port device team_slave_0 added [ 29.001417][ T4787] team0: Port device team_slave_1 added [ 29.006813][ T4787] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.007101][ T4787] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.007119][ T4787] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.007900][ T4787] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.007908][ T4787] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.007923][ T4787] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.022502][ T4787] hsr_slave_0: entered promiscuous mode [ 29.022829][ T4787] hsr_slave_1: entered promiscuous mode [ 29.064544][ T4787] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 29.067310][ T4787] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.067676][ T4787] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 29.069753][ T4787] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.070094][ T4787] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 29.072158][ T4787] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.072654][ T4787] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 29.074276][ T4787] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.082851][ T4787] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.082917][ T4787] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.083082][ T4787] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.083110][ T4787] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.098849][ T4787] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.104732][ T1218] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.106494][ T1218] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.111782][ T4787] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.114787][ T1218] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.114841][ T1218] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.117823][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.117861][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.212555][ T4787] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 29.226068][ T4787] veth0_vlan: entered promiscuous mode [ 29.228411][ T4787] veth1_vlan: entered promiscuous mode [ 29.236572][ T4787] veth0_macvtap: entered promiscuous mode [ 29.237757][ T4787] veth1_macvtap: entered promiscuous mode [ 29.243436][ T4787] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 29.244594][ T4787] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 29.247815][ T1218] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.249584][ T1218] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.256195][ T1218] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.257872][ T1218] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 29.346238][ T39] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 29.393896][ T39] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 1970/01/01 00:00:29 executed programs: 0 [ 29.468601][ T4755] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 29.469080][ T4755] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 29.469256][ T4755] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 29.469551][ T4755] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 29.469765][ T4755] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 29.494314][ T39] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 29.555122][ T39] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 29.604719][ T4825] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.604799][ T4825] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.604858][ T4825] bridge_slave_0: entered allmulticast mode [ 29.605269][ T4825] bridge_slave_0: entered promiscuous mode [ 29.606114][ T4825] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.606160][ T4825] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.606202][ T4825] bridge_slave_1: entered allmulticast mode [ 29.606782][ T4825] bridge_slave_1: entered promiscuous mode [ 29.613444][ T4825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.614467][ T4825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.623301][ T4825] team0: Port device team_slave_0 added [ 29.624074][ T4825] team0: Port device team_slave_1 added [ 29.629630][ T4825] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.629659][ T4825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.629674][ T4825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.630209][ T4825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.630216][ T4825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.630231][ T4825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.640478][ T4825] hsr_slave_0: entered promiscuous mode [ 29.640765][ T4825] hsr_slave_1: entered promiscuous mode [ 29.641052][ T4825] debugfs: 'hsr0' already exists in 'hsr' [ 29.641102][ T4825] Cannot create hsr debugfs directory [ 31.521233][ T4755] Bluetooth: hci0: command tx timeout [ 33.047205][ T39] bridge_slave_1: left allmulticast mode [ 33.047249][ T39] bridge_slave_1: left promiscuous mode [ 33.047535][ T39] bridge0: port 2(bridge_slave_1) entered disabled state [ 33.052739][ T39] bridge_slave_0: left allmulticast mode [ 33.052768][ T39] bridge_slave_0: left promiscuous mode [ 33.052839][ T39] bridge0: port 1(bridge_slave_0) entered disabled state [ 33.110592][ T39] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 33.113838][ T39] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 33.141776][ T39] bond0 (unregistering): Released all slaves [ 33.194222][ T39] hsr_slave_0: left promiscuous mode [ 33.195458][ T39] hsr_slave_1: left promiscuous mode [ 33.195714][ T39] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 33.195730][ T39] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 33.196145][ T39] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 33.196156][ T39] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 33.202350][ T39] veth1_macvtap: left promiscuous mode [ 33.202383][ T39] veth0_macvtap: left promiscuous mode [ 33.202460][ T39] veth1_vlan: left promiscuous mode [ 33.202500][ T39] veth0_vlan: left promiscuous mode [ 33.302089][ T39] team0 (unregistering): Port device team_slave_1 removed [ 33.305746][ T39] team0 (unregistering): Port device team_slave_0 removed [ 33.347759][ T4398] 8021q: adding VLAN 0 to HW filter on device eth0 [ 33.543382][ T4825] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 33.547506][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 33.547860][ T4825] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 33.551152][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 33.552370][ T4825] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 33.553584][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 33.553868][ T4825] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 33.555807][ T4825] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 33.591459][ T4825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 33.595933][ T4825] 8021q: adding VLAN 0 to HW filter on device team0 [ 33.598058][ T3241] bridge0: port 1(bridge_slave_0) entered blocking state [ 33.598104][ T3241] bridge0: port 1(bridge_slave_0) entered forwarding state [ 33.600713][ T3241] bridge0: port 2(bridge_slave_1) entered blocking state [ 33.600755][ T3241] bridge0: port 2(bridge_slave_1) entered forwarding state [ 33.600895][ T4755] Bluetooth: hci0: command tx timeout [ 33.609585][ T4825] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 33.609622][ T4825] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 33.736478][ T4825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 33.749062][ T4825] veth0_vlan: entered promiscuous mode [ 33.751833][ T4825] veth1_vlan: entered promiscuous mode [ 33.758853][ T4825] veth0_macvtap: entered promiscuous mode [ 33.759947][ T4825] veth1_macvtap: entered promiscuous mode [ 33.765990][ T4825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.766934][ T4825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.770239][ T3241] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.774930][ T3241] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.776969][ T3241] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.778756][ T3241] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.800297][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.800331][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.813232][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.813262][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.871078][ T4930] [ 33.871534][ T4930] ============================= [ 33.872339][ T4930] WARNING: suspicious RCU usage [ 33.873119][ T4930] syzkaller #0 Not tainted [ 33.873881][ T4930] ----------------------------- [ 33.874624][ T4930] net/xfrm/xfrm_user.c:1630 suspicious rcu_dereference_check() usage! [ 33.876070][ T4930] [ 33.876070][ T4930] other info that might help us debug this: [ 33.876070][ T4930] [ 33.877697][ T4930] [ 33.877697][ T4930] rcu_scheduler_active = 2, debug_locks = 1 [ 33.878971][ T4930] 1 lock held by syz.0.17/4930: [ 33.879705][ T4930] #0: ffff0000c6431c50 (&net->xfrm.xfrm_cfg_mutex){+.+.}-{4:4}, at: xfrm_netlink_rcv+0x70/0x9c [ 33.881590][ T4930] [ 33.881590][ T4930] stack backtrace: [ 33.882604][ T4930] CPU: 1 UID: 0 PID: 4930 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT [ 33.884020][ T4930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 33.885679][ T4930] Call trace: [ 33.886198][ T4930] show_stack+0x2c/0x3c (C) [ 33.886909][ T4930] __dump_stack+0x30/0x40 [ 33.887633][ T4930] dump_stack_lvl+0xd8/0x12c [ 33.888434][ T4930] dump_stack+0x1c/0x28 [ 33.889131][ T4930] lockdep_rcu_suspicious+0x168/0x26c [ 33.890026][ T4930] xfrm_send_migrate_state+0x6b0/0x958 [ 33.890973][ T4930] xfrm_do_migrate_state+0x1114/0x1728 [ 33.891959][ T4930] xfrm_user_rcv_msg+0x4e0/0x950 [ 33.892861][ T4930] netlink_rcv_skb+0x238/0x414 [ 33.893659][ T4930] xfrm_netlink_rcv+0x80/0x9c [ 33.894483][ T4930] netlink_unicast+0x600/0x7f8 [ 33.895310][ T4930] netlink_sendmsg+0x648/0x948 [ 33.896118][ T4930] __sock_sendmsg+0xc8/0x17c [ 33.896859][ T4930] ____sys_sendmsg+0x3d0/0x6c8 [ 33.897692][ T4930] ___sys_sendmsg+0x198/0x224 [ 33.898483][ T4930] __sys_sendmsg+0x158/0x204 [ 33.899248][ T4930] __arm64_sys_sendmsg+0x80/0x94 [ 33.900102][ T4930] invoke_syscall+0x98/0x244 [ 33.900830][ T4930] el0_svc_common+0xec/0x23c [ 33.901606][ T4930] do_el0_svc+0x4c/0x5c [ 33.902313][ T4930] el0_svc+0x64/0x260 [ 33.903009][ T4930] el0t_64_sync_handler+0x48/0x148 [ 33.903858][ T4930] el0t_64_sync+0x198/0x19c