Warning: Permanently added '10.128.0.38' (ED25519) to the list of known hosts. 2026/02/16 03:41:47 parsed 1 programs syzkaller login: [ 88.182370][ T5776] cgroup: Unknown subsys name 'net' [ 88.322317][ T5776] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 90.009403][ T5776] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 91.786296][ T5791] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 91.795346][ T5791] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 91.803600][ T5791] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 91.811933][ T5791] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 91.820287][ T5791] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 91.827804][ T5791] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 92.070159][ T27] cfg80211: failed to load regulatory.db [ 92.508328][ T3003] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.516702][ T3003] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.552950][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.560963][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.668211][ T5826] chnl_net:caif_netlink_parms(): no params data found [ 93.777827][ T5826] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.785175][ T5826] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.792436][ T5826] bridge_slave_0: entered allmulticast mode [ 93.799982][ T5826] bridge_slave_0: entered promiscuous mode [ 93.817043][ T5826] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.824947][ T5826] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.832188][ T5826] bridge_slave_1: entered allmulticast mode [ 93.839795][ T5826] bridge_slave_1: entered promiscuous mode [ 93.890275][ T5826] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 93.902208][ T5826] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 93.948885][ T5826] team0: Port device team_slave_0 added [ 93.957529][ T5826] team0: Port device team_slave_1 added [ 93.998601][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 94.005680][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 94.031671][ T5826] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.044694][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 94.051658][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 94.077920][ T5826] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 94.129611][ T5826] hsr_slave_0: entered promiscuous mode [ 94.138117][ T5826] hsr_slave_1: entered promiscuous mode [ 94.329796][ T5826] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 94.357912][ T5826] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 94.375004][ T5826] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 94.389655][ T5826] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 94.420926][ T5826] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.428443][ T5826] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.436589][ T5826] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.443837][ T5826] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.516548][ T5826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.549311][ T62] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.558231][ T62] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.577368][ T5826] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.601932][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.609133][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.630877][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.638139][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.871173][ T5826] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.913305][ T5826] veth0_vlan: entered promiscuous mode [ 94.935398][ T5826] veth1_vlan: entered promiscuous mode [ 94.976112][ T5826] veth0_macvtap: entered promiscuous mode [ 94.985922][ T5826] veth1_macvtap: entered promiscuous mode [ 95.005185][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.032421][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.053530][ T5826] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.062720][ T5826] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.072148][ T5826] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.081575][ T5826] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.291825][ T1127] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/02/16 03:41:59 executed programs: 0 [ 97.604785][ T5791] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 97.613078][ T5791] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 97.621465][ T5791] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 97.630442][ T5791] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 97.638570][ T5791] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 97.646143][ T5791] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.762944][ T1127] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.821324][ T5885] chnl_net:caif_netlink_parms(): no params data found [ 97.889421][ T5885] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.896832][ T5885] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.910581][ T5885] bridge_slave_0: entered allmulticast mode [ 97.917953][ T5885] bridge_slave_0: entered promiscuous mode [ 97.928331][ T5885] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.935819][ T5885] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.943006][ T5885] bridge_slave_1: entered allmulticast mode [ 97.950904][ T5885] bridge_slave_1: entered promiscuous mode [ 97.981868][ T5885] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.993846][ T5885] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.025964][ T5885] team0: Port device team_slave_0 added [ 98.036451][ T5885] team0: Port device team_slave_1 added [ 98.060629][ T5885] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.068151][ T5885] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 98.094368][ T5885] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.108199][ T5885] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.115281][ T5885] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 98.141264][ T5885] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.185915][ T5885] hsr_slave_0: entered promiscuous mode [ 98.192283][ T5885] hsr_slave_1: entered promiscuous mode [ 98.199014][ T5885] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 98.207510][ T5885] Cannot create hsr debugfs directory [ 99.744979][ T5791] Bluetooth: hci0: command tx timeout [ 100.017442][ T1127] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.070378][ T1127] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.966555][ T1127] hsr_slave_0: left promiscuous mode [ 100.976001][ T1127] hsr_slave_1: left promiscuous mode [ 100.982846][ T1127] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 100.990585][ T1127] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 101.002054][ T1127] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 101.010460][ T1127] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 101.021641][ T1127] bridge_slave_1: left allmulticast mode [ 101.040337][ T1127] bridge_slave_1: left promiscuous mode [ 101.047515][ T1127] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.063140][ T1127] bridge_slave_0: left allmulticast mode [ 101.070465][ T1127] bridge_slave_0: left promiscuous mode [ 101.079126][ T1127] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.113507][ T1127] veth1_macvtap: left promiscuous mode [ 101.121751][ T1127] veth0_macvtap: left promiscuous mode [ 101.127860][ T1127] veth1_vlan: left promiscuous mode [ 101.133424][ T1127] veth0_vlan: left promiscuous mode [ 101.614417][ T1127] team0 (unregistering): Port device team_slave_1 removed [ 101.651585][ T1127] team0 (unregistering): Port device team_slave_0 removed [ 101.688704][ T1127] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 101.723169][ T1127] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 101.826308][ T5791] Bluetooth: hci0: command tx timeout [ 101.963628][ T1127] bond0 (unregistering): Released all slaves [ 102.070130][ T5885] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 102.086132][ T5885] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 102.107288][ T5885] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 102.121345][ T5885] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 102.218948][ T5885] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.242570][ T5885] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.256146][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.263298][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.285199][ T3003] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.292448][ T3003] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.347214][ T5885] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 102.535488][ T5885] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 102.611490][ T5885] veth0_vlan: entered promiscuous mode [ 102.628563][ T5885] veth1_vlan: entered promiscuous mode [ 102.676910][ T5885] veth0_macvtap: entered promiscuous mode [ 102.713435][ T5885] veth1_macvtap: entered promiscuous mode [ 102.742259][ T5885] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.759717][ T5885] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.772983][ T5885] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.782559][ T5885] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.791453][ T5885] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.800555][ T5885] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.861957][ T3490] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.874131][ T3490] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.901301][ T3490] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 2026/02/16 03:42:04 executed programs: 2 [ 102.909376][ T3490] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.006743][ T5933] [ 103.009134][ T5933] ============================= [ 103.014746][ T5933] WARNING: suspicious RCU usage [ 103.019633][ T5933] syzkaller #0 Not tainted [ 103.024511][ T5933] ----------------------------- [ 103.029476][ T5933] net/mac80211/iface.c:378 suspicious rcu_dereference_protected() usage! [ 103.038274][ T5933] [ 103.038274][ T5933] other info that might help us debug this: [ 103.038274][ T5933] [ 103.048837][ T5933] [ 103.048837][ T5933] rcu_scheduler_active = 2, debug_locks = 1 [ 103.057256][ T5933] 1 lock held by syz.0.17/5933: [ 103.062144][ T5933] #0: ffffffff8e3c0208 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x7a4/0x1140 [ 103.071325][ T5933] [ 103.071325][ T5933] stack backtrace: [ 103.077629][ T5933] CPU: 0 PID: 5933 Comm: syz.0.17 Not tainted syzkaller #0 [ 103.084867][ T5933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 103.094986][ T5933] Call Trace: [ 103.098317][ T5933] [ 103.101278][ T5933] dump_stack_lvl+0x18c/0x250 [ 103.105986][ T5933] ? show_regs_print_info+0x20/0x20 [ 103.111234][ T5933] ? load_image+0x400/0x400 [ 103.115798][ T5933] lockdep_rcu_suspicious+0x1e1/0x300 [ 103.121215][ T5933] ieee80211_check_concurrent_iface+0x475/0x950 [ 103.127513][ T5933] ieee80211_open+0xc1/0x200 [ 103.132219][ T5933] __dev_open+0x2cb/0x430 [ 103.136567][ T5933] ? dev_open+0x190/0x190 [ 103.140907][ T5933] __dev_change_flags+0x211/0x6a0 [ 103.145962][ T5933] ? dev_get_flags+0x1c0/0x1c0 [ 103.150769][ T5933] ? mutex_lock_nested+0x20/0x20 [ 103.155735][ T5933] dev_change_flags+0x88/0x1a0 [ 103.160516][ T5933] dev_ioctl+0x7b4/0x1140 [ 103.164869][ T5933] sock_do_ioctl+0x239/0x310 [ 103.169503][ T5933] ? sock_show_fdinfo+0xb0/0xb0 [ 103.174371][ T5933] sock_ioctl+0x5ba/0x7e0 [ 103.178707][ T5933] ? sock_poll+0x3e0/0x3e0 [ 103.183141][ T5933] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 103.189148][ T5933] ? bpf_lsm_file_ioctl+0x9/0x10 [ 103.194124][ T5933] ? security_file_ioctl+0x80/0xa0 [ 103.199272][ T5933] ? sock_poll+0x3e0/0x3e0 [ 103.203709][ T5933] __se_sys_ioctl+0xfd/0x170 [ 103.208332][ T5933] do_syscall_64+0x55/0xa0 [ 103.212778][ T5933] ? clear_bhb_loop+0x40/0x90 [ 103.217477][ T5933] ? clear_bhb_loop+0x40/0x90 [ 103.222177][ T5933] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 103.228095][ T5933] RIP: 0033:0x7f7c1819bf79 [ 103.232543][ T5933] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.252198][ T5933] RSP: 002b:00007ffcd2bf45b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.260637][ T5933] RAX: ffffffffffffffda RBX: 00007f7c18415fa0 RCX: 00007f7c1819bf79 [ 103.268632][ T5933] RDX: 00002000000000c0 RSI: 0000000000008914 RDI: 0000000000000005 [ 103.276659][ T5933] RBP: 00007f7c182327e0 R08: 0000000000000000 R09: 0000000000000000 [ 103.284650][ T5933] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.292635][ T5933] R13: 00007f7c18415fac R14: 00007f7c18415fa0 R15: 00007f7c18415fa0 [ 103.300633][ T5933] [ 103.308312][ T5933] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 103.316676][ T5933] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 103.904025][ T5791] Bluetooth: hci0: command tx timeout [ 105.985458][ T5791] Bluetooth: hci0: command tx timeout 2026/02/16 03:42:09 executed programs: 155 2026/02/16 03:42:14 executed programs: 342