last executing test programs: 2.230777697s ago: executing program 1 (id=20): r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/net\x00') setns(r0, 0x40000000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@setneightbl={0x34, 0x43, 0x1, 0x0, 0x0, {0x2}, [@NDTA_NAME={0xe, 0x1, 'arp_cache\x00'}, @NDTA_THRESH1={0x8}, @NDTA_THRESH2={0x8}, @NDTA_THRESH3={0x8, 0x4, 0x1}]}, 0x34}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000300)=@newneigh={0x30, 0x1c, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x1, 0x2}, [@NDA_DST_IPV4={0x8, 0x1, @rand_addr=0x64010100}, @NDA_LLADDR={0xa, 0x2, @random="aabbccddeeff"}]}, 0x30}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000600)=@newneigh={0x30, 0x1c, 0x401, 0x0, 0x0, {0x2, 0x0, 0x0, 0x1, 0x2}, [@NDA_DST_IPV4={0x8, 0x1, @rand_addr=0x64010101}, @NDA_LLADDR={0xa, 0x2, @random="aabbccddeefe"}]}, 0x30}}, 0x0) 2.230444667s ago: executing program 1 (id=22): setns(0xc9, 0x0) r0 = socket(0x1f, 0x3, 0x1) bind(r0, &(0x7f0000000300)=@generic={0x1f, "ffff0300"}, 0x6) write(r0, &(0x7f0000000400)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) syz_emit_vhci(&(0x7f0000000500)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0xc}, @hci_rp_read_local_features={{0x1}, {0x0, "ffffffffffffffff"}}}}, 0xf) syz_emit_vhci(&(0x7f0000000510)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0xc}, @hci_rp_le_read_local_features={{0x1}, {0x0, "ffffffffffffffff"}}}}, 0xf) syz_emit_vhci(&(0x7f0000000520)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0xa}, @hci_rp_le_read_buffer_size_v2={{0x1}, {0x0, 0x100, 0xa, 0x100, 0xa}}}}, 0xd) nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0) 1.560724527s ago: executing program 1 (id=35): mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/block/md0/md/dev-loop0/size\x00', 0x0, 0x0) read(r0, &(0x7f0000000920)=""/32, 0x20) 1.490521081s ago: executing program 1 (id=36): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0\x00', 0x4) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./img\x00', 0x42, 0x1b6) ftruncate(r1, 0x2000000) syz_open_dev$loop(&(0x7f00000002c0), 0x0, 0x2) ioctl(0xffffffffffffffff, 0x40480923, &(0x7f0000000400)="000000000000000000000000000000000100000000040000010000000100000000000000010000000000000000000000010000000100"/72) r2 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/block/md0/md/dev-loop0/slot\x00', 0x0, 0x0) read(r2, &(0x7f0000000940)=""/32, 0x20) 1.440170987s ago: executing program 1 (id=38): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000090)={&(0x7f0000000300)=@newtclass={0x40, 0x28, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1, 0x1}, {0x0, 0x1}}, [@tclass_kind_options=@c_qfq={{0x8}, {0x14, 0x2, [@TCA_QFQ_WEIGHT={0x8, 0x1, 0x1}, @TCA_QFQ_LMAX={0x8, 0x2, 0x5dc}]}}]}, 0x40}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000001400)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r1, &(0x7f0000001500)={0x0, 0x0, &(0x7f00000000b0)={&(0x7f0000000500)=@setlink={0x20, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x41, 0x1}}, 0x20}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) bind$packet(r3, &(0x7f0000000700)={0x11, 0x300, r2}, 0x14) setsockopt$sock_int(r3, 0x1, 0xc, &(0x7f00000005c0)=0x10001, 0x4) write(r3, &(0x7f0000000600)='\x00'/1000, 0x3e8) write(r3, &(0x7f0000000600)='\x00'/1000, 0x3e8) 780.845743ms ago: executing program 0 (id=48): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/dev-loop0/offset\x00', 0x0, 0x0) read(r0, &(0x7f0000000900)=""/32, 0x20) 720.561262ms ago: executing program 0 (id=49): ioctl(0x0, 0xc138fd09, &(0x7f0000002000)='\x00\x00\x00\x00\x00\x00\x00\x00') 720.399313ms ago: executing program 0 (id=50): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'dummy0\x00'}) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/net/bonding_masters\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='+bond1\n\x00', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/net/bond1/bonding/mode\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='balance-alb\n\x00', 0xc) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/net/bond1/bonding/slaves\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='+dummy0\n\x00', 0x8) close(r3) ioctl(r0, 0x8914, &(0x7f0000000280)="626f6e643100000000000000000000000100") ioctl(r0, 0x8983, &(0x7f0000000300)="00000000626f6e6431000000000000000000000000000000000000000100"/54) ioctl(r0, 0x8914, &(0x7f0000000340)="626f6e64312e310000000000000000000100") ioctl(r0, 0x8924, &(0x7f0000000380)="626f6e643100000000000000000000000100001122334455") 459.315801ms ago: executing program 0 (id=51): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000100)='debugfs\x00', 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) r3 = socket(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000001c0)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/ieee80211/phy0/netdev:wlan0/mesh_config/dot11MeshHWMPnetDiameterTraversalTime\x00', 0x0, 0x0) 459.093441ms ago: executing program 0 (id=53): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/drivers/fsa4480\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/i2c/devices/i2c-1/new_device\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/typec\x00', 0x0, 0x0) 399.553679ms ago: executing program 0 (id=56): setns(0xc9, 0x0) r0 = socket(0x1f, 0x3, 0x1) bind(r0, &(0x7f0000000300)=@generic={0x1f, "ffff0300"}, 0x6) write(r0, &(0x7f0000000400)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17) syz_emit_vhci(&(0x7f0000000500)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0xc}, @hci_rp_read_local_features={{0x1}, {0x0, "ffffffffffffffff"}}}}, 0xf) syz_emit_vhci(&(0x7f0000000510)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0xc}, @hci_rp_le_read_local_features={{0x1}, {0x0, "ffffffffffffffff"}}}}, 0xf) 330.798526ms ago: executing program 3 (id=59): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'dummy0\x00'}) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/net/bonding_masters\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='+bond1\n\x00', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/net/bond1/bonding/mode\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='balance-alb\n\x00', 0xc) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/net/bond1/bonding/slaves\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='+dummy0\n\x00', 0x8) ioctl(r0, 0x8914, &(0x7f0000000280)="626f6e643100000000000000000000000100") ioctl(r0, 0x8983, &(0x7f0000000300)="00000000626f6e6431000000000000000000000000000000000000000100"/54) ioctl(r0, 0x8914, &(0x7f0000000340)="626f6e64312e310000000000000000000100") ioctl(r0, 0x8924, &(0x7f0000000380)="626f6e643100000000000000000000000100001122334455") 270.800141ms ago: executing program 3 (id=60): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) read(r0, &(0x7f0000000900)=""/32, 0x20) 270.592394ms ago: executing program 3 (id=62): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt(r0, 0x29, 0x40, &(0x7f0000000000), 0x1) 270.517268ms ago: executing program 2 (id=63): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/block/md0/md/dev-loop0/size\x00', 0x0, 0x0) read(r0, &(0x7f0000000920)=""/32, 0x20) 210.20282ms ago: executing program 3 (id=64): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/rds/tcp/rds_tcp_rcvbuf\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='1048576\n\x00', 0x8) close(r0) write(0xffffffffffffffff, &(0x7f0000000180)='1048576\n\x00', 0x8) 209.954338ms ago: executing program 2 (id=65): mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/rds/tcp/rds_tcp_rcvbuf\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='1048576\n\x00', 0x8) 209.837048ms ago: executing program 3 (id=66): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) ftruncate(r0, 0x1000000) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_CLR_FD(r1, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001000)='./dev\x00', &(0x7f0000001040)='devtmpfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000002000)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r2, 0xc138fd03, &(0x7f0000003000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000007465737400") r3 = openat(0xffffffffffffff9c, &(0x7f0000002100)='./dummy\x00', 0x42, 0x1ff) write(r3, &(0x7f0000003138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00integrity\x00\x00\x00\x00\x00\x00\x007:0 0 4 J 0\x00', 0x34) close(r3) ioctl(r2, 0xc138fd09, &(0x7f0000003000)="0400000000000000000000006c01000038010000010000000000000000000000000000000000000000000000000000007465737400") ioctl(r2, 0xc138fd06, &(0x7f0000003000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000007465737400") nanosleep(&(0x7f0000004000)={0x0, 0x5f5e100}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000004100)='./dev/dm-0\x00', 0x2, 0x0) pwrite64(r4, &(0x7f0000005000)="11111111111111111111111111111111", 0x10, 0x0) pwrite64(r4, &(0x7f0000005000)='\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"', 0x10, 0x1000) fsync(r4) close(r4) ioctl(r2, 0xc138fd06, &(0x7f0000003000)="0400000000000000000000003801000000000000000000000000000002000000000000000000000000000000000000007465737400") 209.773068ms ago: executing program 2 (id=67): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$nci(r0, &(0x7f0000000040)=@NCI_OP_RF_INTF_ACTIVATED_NTF={0x1, 0x0, 0x3, 0x5, 0x0, @b={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1, "aa"}}}, 0x11) 100.876098ms ago: executing program 2 (id=68): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0\x00', 0x4) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./img\x00', 0x42, 0x1b6) ftruncate(r1, 0x2000000) pwrite64(r1, &(0x7f0000000280)="6269746d04000000001000000500000000000000", 0x14, 0x1000) syz_open_dev$loop(&(0x7f00000002c0), 0x0, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r2, 0x40480923, &(0x7f0000000400)="000000000000000000000000000000000100000000040000010000000100000000000000010000000000000000000000010000000100"/72) read(0xffffffffffffffff, &(0x7f0000000900)=""/32, 0x20) openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/block/md0/md/dev-loop0/size\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./sys/block/md0/md/dev-loop0/state\x00', 0x0, 0x0) read(r3, &(0x7f0000000960)=""/32, 0x20) 56.459369ms ago: executing program 2 (id=69): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'dummy0\x00'}) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/net/bonding_masters\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='+bond1\n\x00', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/net/bond1/bonding/mode\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='balance-alb\n\x00', 0xc) close(r2) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/net/bond1/bonding/slaves\x00', 0x2, 0x0) ioctl(r0, 0x8914, &(0x7f0000000280)="626f6e643100000000000000000000000100") ioctl(r0, 0x8983, &(0x7f0000000300)="00000000626f6e6431000000000000000000000000000000000000000100"/54) ioctl(r0, 0x8914, &(0x7f0000000340)="626f6e64312e310000000000000000000100") ioctl(r0, 0x8924, &(0x7f0000000380)="626f6e643100000000000000000000000100001122334455") 725.52µs ago: executing program 3 (id=70): mkdir(&(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='nfsd\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000200)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)='-2 -3 +4\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='udp 20000\n', 0xa) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000800)='1\n', 0x2) close(r2) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000900)='ping', 0x4, 0x0, &(0x7f0000000a00)={0x2, 0x4e20, @loopback}, 0x10) nanosleep(&(0x7f0000000b00)={0x0, 0x5f5e100}, 0x0) 309.838µs ago: executing program 2 (id=71): ioctl(0x0, 0xc138fd09, &(0x7f0000002000)='\x00'/248) 0s ago: executing program 1 (id=72): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/cfg80211/parameters/bss_entries_limit\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='1\n', 0x2) close(r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_IBSS(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}}, 0x0) syz_80211_join_ibss(&(0x7f0000000300)='wlan0\x00', &(0x7f0000000340)=@default_ibss_ssid, 0x6, 0x0) syz_80211_inject_frame(&(0x7f0000000400), &(0x7f0000000440)=@mgmt_frame=@beacon={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000800)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f0000000500), &(0x7f0000000540)=@mgmt_frame=@beacon={{{}, {}, @device_b, @device_b, @from_mac=@device_b}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ibss_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000900)={0x0, 0x2faf080}, 0x0) kernel console output (not intermixed with test programs): [ 28.702789][ T43] audit: type=1400 audit(1790053457.230:115): avc: denied { siginh } for pid=5627 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '[localhost]:26808' (ED25519) to the list of known hosts. [ 30.765628][ T43] audit: type=1400 audit(1790053459.300:116): avc: denied { name_bind } for pid=5639 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 32.700545][ T43] kauditd_printk_skb: 2 callbacks suppressed [ 32.700557][ T43] audit: type=1400 audit(1790053461.230:119): avc: denied { write } for pid=5641 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.774033][ T43] audit: type=1400 audit(1790053461.310:120): avc: denied { write } for pid=5644 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.890452][ T43] audit: type=1400 audit(1790053461.420:121): avc: denied { write } for pid=5647 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.965575][ T43] audit: type=1400 audit(1790053461.500:122): avc: denied { write } for pid=5650 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 33.062288][ T43] audit: type=1400 audit(1790053461.590:123): avc: denied { write } for pid=5653 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 33.118378][ T43] audit: type=1400 audit(1790053461.650:124): avc: denied { write } for pid=5656 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 33.232207][ T43] audit: type=1400 audit(1790053461.760:125): avc: denied { write } for pid=5659 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 33.272915][ T43] audit: type=1400 audit(1790053461.800:126): avc: denied { mounton } for pid=5640 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 33.275686][ T43] audit: type=1400 audit(1790053461.810:127): avc: denied { read } for pid=5661 comm="cmp" name="resolv.conf" dev="tmpfs" ino=4 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 33.276219][ T43] audit: type=1400 audit(1790053461.810:128): avc: denied { open } for pid=5661 comm="cmp" path="/tmp/resolv.conf" dev="tmpfs" ino=4 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 33.287609][ T5640] cgroup: Unknown subsys name 'net' [ 33.477048][ T5640] cgroup: Unknown subsys name 'cpuset' [ 33.482691][ T5640] cgroup: Unknown subsys name 'rlimit' [ 33.717470][ T5680] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 34.460849][ T5640] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 38.351285][ T43] kauditd_printk_skb: 33 callbacks suppressed [ 38.351297][ T43] audit: type=1400 audit(1790053466.880:162): avc: denied { execmem } for pid=5720 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 38.555881][ T43] audit: type=1400 audit(1790053467.090:163): avc: denied { create } for pid=5724 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 38.556556][ T43] audit: type=1400 audit(1790053467.090:164): avc: denied { read write } for pid=5724 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 38.556924][ T43] audit: type=1400 audit(1790053467.090:165): avc: denied { open } for pid=5724 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 38.585935][ T43] audit: type=1400 audit(1790053467.110:166): avc: denied { ioctl } for pid=5724 comm="syz-executor" path="socket:[6124]" dev="sockfs" ino=6124 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 38.588453][ T5725] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 38.590080][ T5725] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 38.590275][ T5725] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 38.590674][ T5725] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 38.592236][ T5725] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 38.595485][ T5730] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 38.596429][ T5730] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 38.598299][ T5730] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 38.605813][ T5725] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 38.606409][ T5725] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 38.608021][ T5725] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 38.609045][ T5725] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 38.609729][ T5725] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 38.610435][ T5725] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 38.611836][ T5725] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 38.612629][ T5725] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 38.612646][ T43] audit: type=1400 audit(1790053467.140:167): avc: denied { read } for pid=5724 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 38.612671][ T43] audit: type=1400 audit(1790053467.140:168): avc: denied { open } for pid=5724 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 38.612690][ T43] audit: type=1400 audit(1790053467.140:169): avc: denied { mounton } for pid=5724 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 38.612710][ T5725] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 38.614069][ T5725] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 38.614512][ T5725] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 38.617757][ T43] audit: type=1400 audit(1790053467.150:170): avc: denied { module_request } for pid=5724 comm="syz-executor" kmod="netdev-nr3" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 38.618764][ T5729] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 38.644504][ T43] audit: type=1400 audit(1790053467.180:171): avc: denied { sys_module } for pid=5724 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 39.211420][ T5731] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.211505][ T5731] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.211596][ T5731] bridge_slave_0: entered allmulticast mode [ 39.212947][ T5731] bridge_slave_0: entered promiscuous mode [ 39.235736][ T5731] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.235779][ T5731] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.235833][ T5731] bridge_slave_1: entered allmulticast mode [ 39.236594][ T5731] bridge_slave_1: entered promiscuous mode [ 39.274234][ T5731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.300985][ T5731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.315486][ T5732] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.315571][ T5732] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.315729][ T5732] bridge_slave_0: entered allmulticast mode [ 39.316461][ T5732] bridge_slave_0: entered promiscuous mode [ 39.317664][ T5724] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.317704][ T5724] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.317851][ T5724] bridge_slave_0: entered allmulticast mode [ 39.318521][ T5724] bridge_slave_0: entered promiscuous mode [ 39.319584][ T5724] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.319643][ T5724] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.320950][ T5724] bridge_slave_1: entered allmulticast mode [ 39.321727][ T5724] bridge_slave_1: entered promiscuous mode [ 39.337161][ T5726] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.337230][ T5726] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.337381][ T5726] bridge_slave_0: entered allmulticast mode [ 39.338122][ T5726] bridge_slave_0: entered promiscuous mode [ 39.340991][ T5731] team0: Port device team_slave_0 added [ 39.341066][ T5732] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.341115][ T5732] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.341167][ T5732] bridge_slave_1: entered allmulticast mode [ 39.341926][ T5732] bridge_slave_1: entered promiscuous mode [ 39.350357][ T5731] team0: Port device team_slave_1 added [ 39.356783][ T5726] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.356825][ T5726] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.356971][ T5726] bridge_slave_1: entered allmulticast mode [ 39.358181][ T5726] bridge_slave_1: entered promiscuous mode [ 39.372813][ T5724] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.390692][ T5724] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.391807][ T5732] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.392263][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.392271][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.392283][ T5731] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.394608][ T5732] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.404158][ T5726] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.404441][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.404448][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.404460][ T5731] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.429624][ T5726] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.430988][ T5732] team0: Port device team_slave_0 added [ 39.432287][ T5732] team0: Port device team_slave_1 added [ 39.459341][ T5724] team0: Port device team_slave_0 added [ 39.459752][ T5732] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.459762][ T5732] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.459774][ T5732] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.468196][ T5726] team0: Port device team_slave_0 added [ 39.482027][ T5724] team0: Port device team_slave_1 added [ 39.489683][ T5732] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.489698][ T5732] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.489719][ T5732] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.497433][ T5726] team0: Port device team_slave_1 added [ 39.500797][ T5731] hsr_slave_0: entered promiscuous mode [ 39.501424][ T5731] hsr_slave_1: entered promiscuous mode [ 39.506931][ T5724] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.506940][ T5724] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.506952][ T5724] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.524863][ T5726] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.524877][ T5726] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.524895][ T5726] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.526289][ T5726] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.526299][ T5726] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.526316][ T5726] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.527176][ T5724] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.527189][ T5724] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 39.527209][ T5724] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.616246][ T5732] hsr_slave_0: entered promiscuous mode [ 39.616690][ T5732] hsr_slave_1: entered promiscuous mode [ 39.616985][ T5732] debugfs: 'hsr0' already exists in 'hsr' [ 39.617038][ T5732] Cannot create hsr debugfs directory [ 39.619839][ T5724] hsr_slave_0: entered promiscuous mode [ 39.620257][ T5724] hsr_slave_1: entered promiscuous mode [ 39.620561][ T5724] debugfs: 'hsr0' already exists in 'hsr' [ 39.620571][ T5724] Cannot create hsr debugfs directory [ 39.646823][ T5726] hsr_slave_0: entered promiscuous mode [ 39.647395][ T5726] hsr_slave_1: entered promiscuous mode [ 39.647737][ T5726] debugfs: 'hsr0' already exists in 'hsr' [ 39.647748][ T5726] Cannot create hsr debugfs directory [ 39.897848][ T5731] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.904474][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.905164][ T5731] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.908493][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.909167][ T5731] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.912268][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.914027][ T5731] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.916758][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.956745][ T5731] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.956795][ T5731] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.957000][ T5731] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.957043][ T5731] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.970454][ T5732] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 39.975140][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.975741][ T5732] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 39.979608][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.982668][ T5732] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 39.986651][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.990624][ T5732] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 39.992517][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 40.066520][ T5732] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.066594][ T5732] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.066790][ T5732] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.066834][ T5732] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.070138][ T5726] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 40.074359][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 40.075008][ T5726] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 40.078326][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 40.087733][ T5726] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 40.090734][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 40.094003][ T5726] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 40.098386][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 40.109499][ T56] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.110445][ T56] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.112831][ T56] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.113704][ T56] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.136522][ T5731] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.187397][ T5731] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.190033][ T5724] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 40.193750][ T5724] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 40.194286][ T5724] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 40.198231][ T5724] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 40.198950][ T5724] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 40.202707][ T5724] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 40.209954][ T5724] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 40.214894][ T5724] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 40.231975][ T231] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.232061][ T231] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.244149][ T231] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.244232][ T231] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.278009][ T5732] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.318784][ T5732] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.331537][ T231] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.331583][ T231] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.343665][ T5726] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.347827][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.347872][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.370851][ T5726] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.379773][ T5724] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.382206][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.382318][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.389354][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.389447][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.410757][ T5724] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.426837][ T231] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.426884][ T231] bridge0: port 1(bridge_slave_0) entered forwarding state [ 40.427824][ T231] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.427865][ T231] bridge0: port 2(bridge_slave_1) entered forwarding state [ 40.439311][ T5732] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 40.654394][ T5730] Bluetooth: hci0: command tx timeout [ 40.660186][ T5731] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.664520][ T5730] Bluetooth: hci1: command tx timeout [ 40.664700][ T5730] Bluetooth: hci2: command tx timeout [ 40.664786][ T65] Bluetooth: hci3: command tx timeout [ 40.702842][ T5731] veth0_vlan: entered promiscuous mode [ 40.710177][ T5732] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.713157][ T5731] veth1_vlan: entered promiscuous mode [ 40.733132][ T5726] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.781212][ T5731] veth0_macvtap: entered promiscuous mode [ 40.789874][ T5732] veth0_vlan: entered promiscuous mode [ 40.790776][ T5731] veth1_macvtap: entered promiscuous mode [ 40.796375][ T5724] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.804489][ T5732] veth1_vlan: entered promiscuous mode [ 40.817787][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.818363][ T5726] veth0_vlan: entered promiscuous mode [ 40.825363][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.847158][ T5726] veth1_vlan: entered promiscuous mode [ 40.876077][ T5724] veth0_vlan: entered promiscuous mode [ 40.884105][ T5724] veth1_vlan: entered promiscuous mode [ 40.888570][ T5732] veth0_macvtap: entered promiscuous mode [ 40.892892][ T5732] veth1_macvtap: entered promiscuous mode [ 40.905023][ T5726] veth0_macvtap: entered promiscuous mode [ 40.928071][ T5726] veth1_macvtap: entered promiscuous mode [ 40.928876][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.928891][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.930193][ T5732] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.932170][ T5732] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.944119][ T5777] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.944268][ T5777] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.944293][ T5777] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.944311][ T5777] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.953613][ T5804] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.955642][ T5724] veth0_macvtap: entered promiscuous mode [ 40.964283][ T5724] veth1_macvtap: entered promiscuous mode [ 40.971786][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.971799][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.974553][ T5804] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.974730][ T5804] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.977536][ T5726] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.998286][ T5726] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 41.023043][ T755] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.023071][ T755] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.025050][ T5731] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 41.030400][ T5724] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 41.052263][ T5724] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 41.075012][ T171] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.075027][ T171] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.124855][ T5777] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.126456][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.126473][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.169781][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.169795][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.183525][ T5804] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.183851][ T5804] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.183880][ T5804] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.183907][ T5804] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.183933][ T5804] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.183964][ T5804] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.183990][ T5804] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.184017][ T5804] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.232698][ T231] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.232718][ T231] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.257215][ T5882] Bluetooth: ISO socket layer initialized [ 41.277526][ T231] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.277539][ T231] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.319747][ T5883] svc: failed to register nfsdv3 RPC service (errno 111). [ 41.321514][ T5883] svc: failed to register nfsaclv3 RPC service (errno 111). [ 41.358768][ T5886] NFSD: Failed to start, no listeners configured. [ 41.608888][ T5892] infiniband syz0: set active [ 41.609600][ T5892] infiniband syz0: added veth0 [ 41.621826][ T5892] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 41.621858][ T5892] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 41.621891][ T5892] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 41.641728][ T5892] RDS/IB: syz0: added [ 41.641943][ T5892] smc: adding ib device syz0 with port count 1 [ 41.642005][ T5892] smc: ib device syz0 port 1 has no pnetid [ 41.896650][ T5902] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 41.897269][ T5904] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 41.899886][ T5904] loop0: detected capacity change from 0 to 65536 [ 42.017700][ T5915] Bluetooth: MGMT ver 1.23 [ 42.024438][ C1] TCP: tcp_send_synack: wrong queue state [ 42.170952][ T5923] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 42.184842][ T5923] loop0: detected capacity change from 0 to 65536 [ 42.272256][ T5930] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 42.317541][ T5936] bonding: bond1 is being created... [ 42.374519][ T5936] bond1: (slave dummy0): making interface the new active one [ 42.375482][ T5936] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 42.375859][ T5941] bridge0: port 3(syz_tun) entered blocking state [ 42.375978][ T5941] bridge0: port 3(syz_tun) entered disabled state [ 42.376138][ T5941] syz_tun: entered allmulticast mode [ 42.377994][ T5941] syz_tun: entered promiscuous mode [ 42.378540][ T5941] bridge0: port 3(syz_tun) entered blocking state [ 42.378627][ T5941] bridge0: port 3(syz_tun) entered forwarding state [ 42.653852][ T5949] md: could not open device unknown-block(1,0). [ 42.674319][ T50] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 42.713610][ T5949] md: could not open device unknown-block(1,1). [ 42.743802][ T5730] Bluetooth: hci0: command tx timeout [ 42.744390][ T5952] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 42.855715][ T50] usb 7-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 42.857981][ T50] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.893503][ T5952] md: could not open device unknown-block(1,1). [ 42.894389][ T5957] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 42.987517][ T5968] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 43.015534][ T5968] md: array md0 already has disks! [ 43.115598][ T5970] md: could not open device unknown-block(1,0). [ 43.136340][ T5970] md: could not open device unknown-block(1,1). [ 43.357131][ T5979] tpm_tis pcspkr: no memory resource defined [ 43.373921][ T5730] Bluetooth: hci1: command tx timeout [ 43.397596][ T5981] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 43.582138][ T50] rtsx_usb 7-1:1.0: probe with driver rtsx_usb failed with error -71 [ 43.598771][ T50] usb 7-1: USB disconnect, device number 2 [ 43.736833][ T5988] bonding: bond1 is being created... [ 43.807278][ T43] kauditd_printk_skb: 49 callbacks suppressed [ 43.807318][ T43] audit: type=1400 audit(1790053472.340:221): avc: denied { sys_module } for pid=5986 comm="syz.0.50" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 43.867317][ T5989] 8021q: adding VLAN 0 to HW filter on device bond1 [ 43.906219][ T43] audit: type=1400 audit(1790053472.440:222): avc: denied { mount } for pid=5994 comm="syz.0.51" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 43.908090][ T43] audit: type=1400 audit(1790053472.440:223): avc: denied { ioctl } for pid=5994 comm="syz.0.51" path="socket:[10488]" dev="sockfs" ino=10488 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 43.923950][ T43] audit: type=1400 audit(1790053472.460:224): avc: denied { unmount } for pid=5731 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 44.048449][ T6011] bonding: bond1 is being created... [ 44.066392][ T6011] bond1: (slave dummy0): making interface the new active one [ 44.066888][ T6011] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 44.069341][ T6011] 8021q: adding VLAN 0 to HW filter on device bond1 [ 44.189971][ T6026] loop0: detected capacity change from 0 to 32768 [ 44.190914][ T43] audit: type=1400 audit(1790053472.720:225): avc: denied { read write } for pid=6025 comm="syz.3.66" name="control" dev="devtmpfs" ino=1289 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 44.191091][ T43] audit: type=1400 audit(1790053472.720:226): avc: denied { open } for pid=6025 comm="syz.3.66" path="/26/dev/mapper/control" dev="devtmpfs" ino=1289 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 44.191392][ T43] audit: type=1400 audit(1790053472.720:227): avc: denied { ioctl } for pid=6025 comm="syz.3.66" path="/26/dev/mapper/control" dev="devtmpfs" ino=1289 ioctlcmd=0xfd03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 44.275776][ T6040] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 44.302601][ T6026] device-mapper: core: 248:0: mapping table unavailable, erroring io [ 44.323672][ T6040] md: array md0 already has disks! [ 44.368914][ T6042] bonding: bond1 is being created... [ 44.369822][ T6042] bonding: bond1 already exists [ 44.370676][ T6042] bond1: option mode: unable to set because the bond device has slaves [ 44.372204][ T6042] 8021q: adding VLAN 0 to HW filter on device bond1 [ 44.386935][ T5777] bond1: (slave dummy0): link status definitely down, disabling slave [ 44.388019][ T5777] bond1: now running without any active interface! [ 44.426003][ T171] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 44.426016][ T171] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 44.430021][ T6046] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 44.463102][ C3] ------------[ cut here ]------------ [ 44.463112][ C3] !oldest [ 44.463115][ C3] WARNING: net/wireless/scan.c:513 at __cfg8 ** replaying previous printk message ** [ 44.463115][ C3] WARNING: net/wireless/scan.c:513 at __cfg80211_bss_update+0x19d8/0x2450, CPU#3: swapper/3/0 [ 44.463229][ C1] ------------[ cut here ]------------ [ 44.463237][ C1] !oldest [ 44.463241][ C1] WARNING: net/wireless/scan.c:513 at __cfg80211_bss_update+0x19d8/0x2450, CPU#1: syz-executor/5726 [ 44.463272][ C1] Modules linked in: [ 44.463286][ C1] CPU: 1 UID: 0 PID: 5726 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 44.464084][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 44.464098][ C1] RIP: 0010:__cfg80211_bss_update+0x19d8/0x2450 [ 44.464130][ C1] Code: 00 31 ff 41 89 c5 89 c6 e8 45 de ec f6 45 85 ed 0f 85 65 f9 ff ff e8 c7 e3 ec f6 90 0f 0b 90 e9 57 f9 ff ff e8 b9 e3 ec f6 90 <0f> 0b 90 e9 fc fa ff ff e8 ab e3 ec f6 48 8b 44 24 08 48 8d 88 ac [ 44.464147][ C1] RSP: 0018:ffffc900006b0348 EFLAGS: 00010246 [ 44.464164][ C1] RAX: 0000000000000000 RBX: ffffffff91457604 RCX: 0000000000000303 [ 44.464178][ C1] RDX: ffff88802d748000 RSI: ffffffff8b1f3ed7 RDI: ffff88802d748000 [ 44.464190][ C1] RBP: ffff8880383cc088 R08: 0000000000000005 R09: 0000000000000000 [ 44.464202][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880383cc000 [ 44.464214][ C1] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888058b70190 [ 44.464226][ C1] FS: 0000555594b55500(0000) GS:ffff8880d5c53000(0000) knlGS:0000000000000000 [ 44.464261][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.464276][ C1] CR2: 00007f75f21556c8 CR3: 00000000506da000 CR4: 0000000000352ef0 [ 44.464289][ C1] Call Trace: [ 44.464296][ C1] [ 44.464310][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 44.464336][ C1] ? cfg80211_inform_single_bss_data+0x557/0x1dc0 [ 44.464361][ C1] cfg80211_inform_single_bss_data+0x770/0x1dc0 [ 44.464388][ C1] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10 [ 44.464423][ C1] ? mark_held_locks+0x40/0x70 [ 44.464447][ C1] ? mark_held_locks+0x40/0x70 [ 44.464470][ C1] ? cfg80211_inform_bss_data+0x230/0x3c20 [ 44.464488][ C1] cfg80211_inform_bss_data+0x230/0x3c20 [ 44.464518][ C1] ? __pfx_ieee80211_rx_handlers+0x10/0x10 [ 44.464543][ C1] ? __pfx_cfg80211_inform_bss_data+0x10/0x10 [ 44.464562][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 44.464585][ C1] ? lock_acquire+0x1d1/0x380 [ 44.464605][ C1] ? unwind_next_frame+0xbd/0x2090 [ 44.464636][ C1] ? lock_acquire+0x1d1/0x380 [ 44.464655][ C1] ? is_bpf_text_address+0x25/0x1a0 [ 44.464681][ C1] ? find_held_lock+0x2b/0x80 [ 44.464707][ C1] ? is_bpf_text_address+0x8a/0x1a0 [ 44.464731][ C1] ? is_bpf_text_address+0x8a/0x1a0 [ 44.464764][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 44.464797][ C1] cfg80211_inform_bss_frame_data+0x245/0x7c0 [ 44.464824][ C1] ieee80211_bss_info_update+0x310/0xab0 [ 44.464848][ C1] ? __pfx_ieee80211_bss_info_update+0x10/0x10 [ 44.464881][ C1] ? ieee80211_get_channel_khz+0x14a/0x1e0 [ 44.464910][ C1] ieee80211_scan_rx+0x4e6/0xb60 [ 44.465429][ C3] Modules linked in: [ 44.465443][ C3] CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted syzkaller #0 PREEMPT(full) [ 44.465456][ C3] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 44.465462][ C3] RIP: 0010:__cfg80211_bss_update+0x19d8/0x2450 [ 44.465481][ C3] Code: 00 31 ff 41 89 c5 89 c6 e8 45 de ec f6 45 85 ed 0f 85 65 f9 ff ff e8 c7 e3 ec f6 90 0f 0b 90 e9 57 f9 ff ff e8 b9 e3 ec f6 90 <0f> 0b 90 e9 fc fa ff ff e8 ab e3 ec f6 48 8b 44 24 08 48 8d 88 ac [ 44.465492][ C3] RSP: 0018:ffffc90000708348 EFLAGS: 00010246 [ 44.465501][ C3] RAX: 0000000000000000 RBX: ffffffff91457604 RCX: 0000000000000302 [ 44.465509][ C3] RDX: ffff88801f698000 RSI: ffffffff8b1f3ed7 RDI: ffff88801f698000 [ 44.465516][ C3] RBP: ffff88804af96488 R08: 0000000000000005 R09: 0000000000000000 [ 44.465523][ C3] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88804af96400 [ 44.465529][ C3] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888058b00190 [ 44.465537][ C3] FS: 0000000000000000(0000) GS:ffff8880d5e53000(0000) knlGS:0000000000000000 [ 44.465559][ C3] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.465569][ C3] CR2: 00007f75f1627dac CR3: 000000004d16e000 CR4: 0000000000352ef0 [ 44.465576][ C3] Call Trace: [ 44.465580][ C3] [ 44.465588][ C3] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 44.465604][ C3] ? cfg80211_inform_single_bss_data+0x557/0x1dc0 [ 44.465618][ C3] cfg80211_inform_single_bss_data+0x770/0x1dc0 [ 44.465633][ C3] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10 [ 44.465655][ C3] ? unwind_next_frame+0x3c8/0x2090 [ 44.465670][ C3] ? common_startup_64+0x13e/0x158 [ 44.465687][ C3] ? cfg80211_inform_bss_data+0x230/0x3c20 [ 44.465698][ C3] cfg80211_inform_bss_data+0x230/0x3c20 [ 44.465712][ C3] ? __lock_acquire+0x5c0/0x1f40 [ 44.465727][ C3] ? __pfx_cfg80211_inform_bss_data+0x10/0x10 [ 44.465740][ C3] ? lock_acquire+0x1d1/0x380 [ 44.465752][ C3] ? unwind_next_frame+0xbd/0x2090 [ 44.465768][ C3] ? lock_acquire+0x1d1/0x380 [ 44.465780][ C3] ? unwind_next_frame+0xbd/0x2090 [ 44.465795][ C3] ? find_held_lock+0x2b/0x80 [ 44.465810][ C3] ? unwind_next_frame+0x3be/0x2090 [ 44.465825][ C3] ? unwind_next_frame+0x3be/0x2090 [ 44.465846][ C3] ? __lock_acquire+0x5c0/0x1f40 [ 44.465860][ C3] ? common_startup_64+0x13e/0x158 [ 44.465878][ C3] cfg80211_inform_bss_frame_data+0x245/0x7c0 [ 44.465896][ C3] ieee80211_bss_info_update+0x310/0xab0 [ 44.465911][ C3] ? __pfx_ieee80211_bss_info_update+0x10/0x10 [ 44.465926][ C3] ? do_idle+0x3ae/0x5b0 [ 44.465939][ C3] ? cpu_startup_entry+0x4f/0x60 [ 44.465953][ C3] ? start_secondary+0x21d/0x2d0 [ 44.465964][ C3] ? common_startup_64+0x13e/0x158 [ 44.465978][ C3] ? ieee80211_get_channel_khz+0x14a/0x1e0 [ 44.465995][ C3] ieee80211_scan_rx+0x4e6/0xb60 [ 44.466008][ C3] ? __lock_acquire+0x5c0/0x1f40 [ 44.466022][ C3] __ieee80211_rx_handle_packet+0xbab/0xfc0 [ 44.466039][ C3] ? __pfx___ieee80211_rx_handle_packet+0x10/0x10 [ 44.466058][ C3] ? kcov_remote_start+0x3bf/0x6d0 [ 44.466071][ C3] ? lockdep_hardirqs_on+0x7d/0x110 [ 44.466088][ C3] ? ieee80211_clean_skb+0x1a7/0x740 [ 44.466102][ C3] ieee80211_rx_list+0xf19/0x2160 [ 44.466119][ C3] ? lock_acquire+0x1d1/0x380 [ 44.466131][ C3] ? ieee80211_rx_napi+0x9a/0x400 [ 44.466144][ C3] ? __pfx_ieee80211_rx_list+0x10/0x10 [ 44.466220][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 44.466237][ C1] __ieee80211_rx_handle_packet+0xbab/0xfc0 [ 44.466257][ C1] ? __pfx___ieee80211_rx_handle_packet+0x10/0x10 [ 44.466289][ C1] ? kcov_remote_start+0x3bf/0x6d0 [ 44.466311][ C1] ? lockdep_hardirqs_on+0x7d/0x110 [ 44.466337][ C1] ? ieee80211_clean_skb+0x1a7/0x740 [ 44.466361][ C1] ieee80211_rx_list+0xf19/0x2160 [ 44.466391][ C1] ? lock_acquire+0x1d1/0x380 [ 44.466411][ C1] ? ieee80211_rx_napi+0x9a/0x400 [ 44.466433][ C1] ? __pfx_ieee80211_rx_list+0x10/0x10 [ 44.466463][ C1] ieee80211_rx_napi+0xdc/0x400 [ 44.466487][ C1] ? __pfx_ieee80211_rx_napi+0x10/0x10 [ 44.466510][ C1] ? lockdep_hardirqs_on+0x7d/0x110 [ 44.466535][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 44.466564][ C1] ieee80211_handle_queued_frames+0xc8/0x120 [ 44.466586][ C1] tasklet_action_common+0x2de/0x3d0 [ 44.466612][ C1] handle_softirqs+0x1e6/0x9d0 [ 44.466636][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 44.466657][ C1] ? _raw_spin_unlock+0x28/0x50 [ 44.466679][ C1] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 44.466711][ C1] __irq_exit_rcu+0x16a/0x210 [ 44.466731][ C1] irq_exit_rcu+0x9/0x30 [ 44.466750][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 44.466775][ C1] [ 44.466783][ C1] [ 44.466790][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 44.466812][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x46/0x70 [ 44.466835][ C1] Code: 00 01 00 ff 74 1e f6 c4 01 74 44 a9 00 00 00 0f 75 3d f7 c1 00 00 00 f0 75 35 8b 82 3c 17 00 00 85 c0 74 2b 8b 82 10 17 00 00 <83> f8 02 75 20 48 8b 8a 18 17 00 00 8b 92 14 17 00 00 48 8b 01 48 [ 44.466853][ C1] RSP: 0018:ffffc900030af4f0 EFLAGS: 00000246 [ 44.466869][ C1] RAX: 0000000000000000 RBX: 800000004b092007 RCX: 0000000000000002 [ 44.466883][ C1] RDX: ffff88802d748000 RSI: ffffffff826410f8 RDI: ffff88802d748000 [ 44.466895][ C1] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 44.466908][ C1] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 [ 44.466919][ C1] R13: 0000000000000000 R14: ffff8880506e8478 R15: 00007f75f0c00000 [ 44.466939][ C1] ? copy_page_range+0x1198/0x57c0 [ 44.466973][ C1] copy_page_range+0x1198/0x57c0 [ 44.467027][ C1] ? __pfx_copy_page_range+0x10/0x10 [ 44.467051][ C1] ? mas_wr_store_entry+0xa4/0x1d50 [ 44.467080][ C1] ? lock_acquire+0x1d1/0x380 [ 44.467100][ C1] ? dup_mmap+0xd0a/0x2370 [ 44.467128][ C1] ? find_held_lock+0x2b/0x80 [ 44.467153][ C1] ? dup_mmap+0xe66/0x2370 [ 44.467178][ C1] ? dup_mmap+0xe66/0x2370 [ 44.467202][ C1] ? down_write+0x146/0x1f0 [ 44.467222][ C1] ? up_write+0x2dc/0x5b0 [ 44.467247][ C1] dup_mmap+0x1230/0x2370 [ 44.467280][ C1] ? __pfx_dup_mmap+0x10/0x10 [ 44.467303][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 44.467329][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 44.467357][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 44.467388][ C1] ? lock_acquire+0x1d1/0x380 [ 44.467407][ C1] ? copy_process+0x4806/0x8370 [ 44.467438][ C1] copy_process+0x4811/0x8370 [ 44.467473][ C1] ? __pfx_copy_process+0x10/0x10 [ 44.467499][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 44.467528][ C1] kernel_clone+0x176/0x9d0 [ 44.467552][ C1] ? __pfx_kernel_clone+0x10/0x10 [ 44.467578][ C1] ? __might_fault+0xc5/0x140 [ 44.467605][ C1] ? find_held_lock+0x2b/0x80 [ 44.467629][ C1] ? __might_fault+0xc5/0x140 [ 44.467658][ C1] __do_sys_clone+0xd9/0x120 [ 44.467679][ C1] ? __pfx___do_sys_clone+0x10/0x10 [ 44.467721][ C1] do_syscall_64+0x123/0x790 [ 44.467750][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.467770][ C1] RIP: 0033:0x7f75f13c6bd2 [ 44.467785][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 44.467801][ C1] RSP: 002b:00007ffe357aade0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 44.467820][ C1] RAX: ffffffffffffffda RBX: 00007ffe357aade0 RCX: 00007f75f13c6bd2 [ 44.467833][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 44.467845][ C1] RBP: 00007ffe357aaf6c R08: 0000000000000000 R09: 0000000000000001 [ 44.467856][ C1] R10: 0000555594b557d0 R11: 0000000000000246 R12: 0000000000000001 [ 44.467869][ C1] R13: 00000000000927c0 R14: 000000000000ad26 R15: 00007ffe357aafc0 [ 44.467894][ C1] [ 44.467904][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 44.804845][ C1] CPU: 1 UID: 0 PID: 5726 Comm: syz-executor Tainted: G W syzkaller #0 PREEMPT(full) [ 44.808664][ C1] Tainted: [W]=WARN [ 44.809884][ C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 44.813448][ C1] Call Trace: [ 44.814752][ C1] [ 44.815843][ C1] dump_stack_lvl+0x100/0x190 [ 44.817518][ C1] vpanic+0x553/0x970 [ 44.818997][ C1] ? __pfx_vpanic+0x10/0x10 [ 44.820757][ C1] panic+0xd1/0xe0 [ 44.822245][ C1] ? __pfx_panic+0x10/0x10 [ 44.823882][ C1] check_panic_on_warn.cold+0x19/0x34 [ 44.825744][ C1] ? __cfg80211_bss_update+0x19d8/0x2450 [ 44.827520][ C1] __warn.cold+0x191/0x318 [ 44.829113][ C1] __report_bug+0x30f/0x440 [ 44.830787][ C1] ? __cfg80211_bss_update+0x19d8/0x2450 [ 44.832830][ C1] ? __pfx___report_bug+0x10/0x10 [ 44.834694][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 44.836807][ C1] ? __cfg80211_bss_update+0x19d8/0x2450 [ 44.838584][ C1] report_bug+0xb3/0x220 [ 44.840044][ C1] ? __cfg80211_bss_update+0x19d8/0x2450 [ 44.841874][ C1] handle_bug+0x16a/0x2a0 [ 44.843250][ C1] exc_invalid_op+0x17/0x50 [ 44.844706][ C1] asm_exc_invalid_op+0x1a/0x20 [ 44.846256][ C1] RIP: 0010:__cfg80211_bss_update+0x19d8/0x2450 [ 44.848239][ C1] Code: 00 31 ff 41 89 c5 89 c6 e8 45 de ec f6 45 85 ed 0f 85 65 f9 ff ff e8 c7 e3 ec f6 90 0f 0b 90 e9 57 f9 ff ff e8 b9 e3 ec f6 90 <0f> 0b 90 e9 fc fa ff ff e8 ab e3 ec f6 48 8b 44 24 08 48 8d 88 ac [ 44.854258][ C1] RSP: 0018:ffffc900006b0348 EFLAGS: 00010246 [ 44.856173][ C1] RAX: 0000000000000000 RBX: ffffffff91457604 RCX: 0000000000000303 [ 44.858638][ C1] RDX: ffff88802d748000 RSI: ffffffff8b1f3ed7 RDI: ffff88802d748000 [ 44.861087][ C1] RBP: ffff8880383cc088 R08: 0000000000000005 R09: 0000000000000000 [ 44.863581][ C1] R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880383cc000 [ 44.866037][ C1] R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888058b70190 [ 44.868507][ C1] ? __cfg80211_bss_update+0x19d7/0x2450 [ 44.870283][ C1] ? __cfg80211_bss_update+0x19d7/0x2450 [ 44.872072][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 44.873782][ C1] ? cfg80211_inform_single_bss_data+0x557/0x1dc0 [ 44.875785][ C1] cfg80211_inform_single_bss_data+0x770/0x1dc0 [ 44.877748][ C1] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10 [ 44.879828][ C1] ? mark_held_locks+0x40/0x70 [ 44.881336][ C1] ? mark_held_locks+0x40/0x70 [ 44.882904][ C1] ? cfg80211_inform_bss_data+0x230/0x3c20 [ 44.884735][ C1] cfg80211_inform_bss_data+0x230/0x3c20 [ 44.886516][ C1] ? __pfx_ieee80211_rx_handlers+0x10/0x10 [ 44.888342][ C1] ? __pfx_cfg80211_inform_bss_data+0x10/0x10 [ 44.890248][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 44.891841][ C1] ? lock_acquire+0x1d1/0x380 [ 44.893356][ C1] ? unwind_next_frame+0xbd/0x2090 [ 44.894995][ C1] ? lock_acquire+0x1d1/0x380 [ 44.896486][ C1] ? is_bpf_text_address+0x25/0x1a0 [ 44.898142][ C1] ? find_held_lock+0x2b/0x80 [ 44.899646][ C1] ? is_bpf_text_address+0x8a/0x1a0 [ 44.901299][ C1] ? is_bpf_text_address+0x8a/0x1a0 [ 44.902978][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 44.904544][ C1] cfg80211_inform_bss_frame_data+0x245/0x7c0 [ 44.906538][ C1] ieee80211_bss_info_update+0x310/0xab0 [ 44.908331][ C1] ? __pfx_ieee80211_bss_info_update+0x10/0x10 [ 44.910300][ C1] ? ieee80211_get_channel_khz+0x14a/0x1e0 [ 44.912203][ C1] ieee80211_scan_rx+0x4e6/0xb60 [ 44.913839][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 44.915445][ C1] __ieee80211_rx_handle_packet+0xbab/0xfc0 [ 44.917335][ C1] ? __pfx___ieee80211_rx_handle_packet+0x10/0x10 [ 44.919378][ C1] ? kcov_remote_start+0x3bf/0x6d0 [ 44.921040][ C1] ? lockdep_hardirqs_on+0x7d/0x110 [ 44.922736][ C1] ? ieee80211_clean_skb+0x1a7/0x740 [ 44.924453][ C1] ieee80211_rx_list+0xf19/0x2160 [ 44.926200][ C1] ? lock_acquire+0x1d1/0x380 [ 44.927694][ C1] ? ieee80211_rx_napi+0x9a/0x400 [ 44.929331][ C1] ? __pfx_ieee80211_rx_list+0x10/0x10 [ 44.931092][ C1] ieee80211_rx_napi+0xdc/0x400 [ 44.932755][ C1] ? __pfx_ieee80211_rx_napi+0x10/0x10 [ 44.934603][ C1] ? lockdep_hardirqs_on+0x7d/0x110 [ 44.936300][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 44.938182][ C1] ieee80211_handle_queued_frames+0xc8/0x120 [ 44.940168][ C1] tasklet_action_common+0x2de/0x3d0 [ 44.941936][ C1] handle_softirqs+0x1e6/0x9d0 [ 44.943515][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 44.945200][ C1] ? _raw_spin_unlock+0x28/0x50 [ 44.946744][ C1] ? __hrtimer_rearm_deferred+0x9b/0x7b0 [ 44.948496][ C1] __irq_exit_rcu+0x16a/0x210 [ 44.950028][ C1] irq_exit_rcu+0x9/0x30 [ 44.951377][ C1] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 44.953165][ C1] [ 44.954119][ C1] [ 44.955071][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 44.956959][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x46/0x70 [ 44.958904][ C1] Code: 00 01 00 ff 74 1e f6 c4 01 74 44 a9 00 00 00 0f 75 3d f7 c1 00 00 00 f0 75 35 8b 82 3c 17 00 00 85 c0 74 2b 8b 82 10 17 00 00 <83> f8 02 75 20 48 8b 8a 18 17 00 00 8b 92 14 17 00 00 48 8b 01 48 [ 44.964888][ C1] RSP: 0018:ffffc900030af4f0 EFLAGS: 00000246 [ 44.966807][ C1] RAX: 0000000000000000 RBX: 800000004b092007 RCX: 0000000000000002 [ 44.969424][ C1] RDX: ffff88802d748000 RSI: ffffffff826410f8 RDI: ffff88802d748000 [ 44.971993][ C1] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 [ 44.974564][ C1] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000001 [ 44.977036][ C1] R13: 0000000000000000 R14: ffff8880506e8478 R15: 00007f75f0c00000 [ 44.979515][ C1] ? copy_page_range+0x1198/0x57c0 [ 44.981182][ C1] copy_page_range+0x1198/0x57c0 [ 44.982786][ C1] ? __pfx_copy_page_range+0x10/0x10 [ 44.984461][ C1] ? mas_wr_store_entry+0xa4/0x1d50 [ 44.986109][ C1] ? lock_acquire+0x1d1/0x380 [ 44.987594][ C1] ? dup_mmap+0xd0a/0x2370 [ 44.989014][ C1] ? find_held_lock+0x2b/0x80 [ 44.990509][ C1] ? dup_mmap+0xe66/0x2370 [ 44.991935][ C1] ? dup_mmap+0xe66/0x2370 [ 44.993377][ C1] ? down_write+0x146/0x1f0 [ 44.994828][ C1] ? up_write+0x2dc/0x5b0 [ 44.996197][ C1] dup_mmap+0x1230/0x2370 [ 44.997574][ C1] ? __pfx_dup_mmap+0x10/0x10 [ 44.999066][ C1] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 45.000892][ C1] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 45.002876][ C1] ? __lock_acquire+0x5c0/0x1f40 [ 45.005075][ C1] ? lock_acquire+0x1d1/0x380 [ 45.007162][ C1] ? copy_process+0x4806/0x8370 [ 45.009306][ C1] copy_process+0x4811/0x8370 [ 45.011323][ C1] ? __pfx_copy_process+0x10/0x10 [ 45.013515][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 45.015788][ C1] kernel_clone+0x176/0x9d0 [ 45.017768][ C1] ? __pfx_kernel_clone+0x10/0x10 [ 45.019912][ C1] ? __might_fault+0xc5/0x140 [ 45.021964][ C1] ? find_held_lock+0x2b/0x80 [ 45.023977][ C1] ? __might_fault+0xc5/0x140 [ 45.026005][ C1] __do_sys_clone+0xd9/0x120 [ 45.027960][ C1] ? __pfx___do_sys_clone+0x10/0x10 [ 45.030047][ C1] do_syscall_64+0x123/0x790 [ 45.031530][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 45.033680][ C1] RIP: 0033:0x7f75f13c6bd2 [ 45.035487][ C1] Code: 89 e7 e8 71 8b f7 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 89 c5 85 c0 75 3b 64 48 8b 04 25 10 00 00 [ 45.042183][ C1] RSP: 002b:00007ffe357aade0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 [ 45.044923][ C1] RAX: ffffffffffffffda RBX: 00007ffe357aade0 RCX: 00007f75f13c6bd2 [ 45.048082][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 [ 45.050703][ C1] RBP: 00007ffe357aaf6c R08: 0000000000000000 R09: 0000000000000001 [ 45.053347][ C1] R10: 0000555594b557d0 R11: 0000000000000246 R12: 0000000000000001 [ 45.056491][ C1] R13: 00000000000927c0 R14: 000000000000ad26 R15: 00007ffe357aafc0 [ 45.059463][ C1] [ 45.060966][ C1] Kernel Offset: disabled [ 45.062671][ C1] Rebooting in 86400 seconds..