last executing test programs: 5.205387078s ago: executing program 0 (id=59): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x9}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x7, 0x1, 0x6, 0x7a9a, 0x7, 0x5}, {0x9, 0x2, 0x6, 0x8, 0x10, 0x4517926f}, 0x5, 0x80000000, 0x1bb8}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x40) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x4890) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004041}, 0x20004440) 4.923146186s ago: executing program 0 (id=61): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d010110000000090400"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000100)={0x34, &(0x7f0000000140)=ANY=[@ANYBLOB="001500001900805fb292ce391a47d9ae48e3f0dc2bd3f6826612117964767a393a80010132865091d41426f4871236ba6bdce855cfffe76f733651ad48d5460d3a4837fba559ab206febaf13d41590a01d8a8fef9504e36c2a39b0e584b0a11a67"], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = msgget$private(0x0, 0x193) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r2, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000000a0a01080000000000000000000000a36b74a5c4fae1088fbabd8d960a"], 0x14}, 0x1, 0x0, 0x0, 0x845}, 0x2004c004) msgsnd(r1, &(0x7f0000000340)={0x3, "21dddb4cc55288773c6684ae2f396b6b79c72401989d0ffdfb7fe1697fa8ed2391c423cec3b77c7afd0ad6a7079ff5ee47a56785bef3113e9e1e21205c7dd682244d40a6cacec6c92d141c62c3439c29c0eb254ece2b770f176f3827e0252afc8a710e0b55f1141e62c0c04961cbf3076030876abacd6f3da8a55fd8732098762bad930e0153f8579b965f0ba22ab0299d4c71f5f6dd24026711a7e0e42ed4c19799834885103b6cb94cbcf88ede133573e9afd07bc256dcf8d6cc39b4acd379cd0b83c7287bbd0e830fa01c412f0e2ffd84b76b9f022d3840fd3c3b"}, 0xe4, 0x800) msgsnd(r1, &(0x7f0000000640)=ANY=[@ANYBLOB="02"], 0x401, 0x0) msgsnd(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="01"], 0x8, 0x0) msgsnd(r1, &(0x7f0000000300)=ANY=[@ANYRES8], 0x3f9, 0x0) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_opts(r3, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='bridge0\x00', 0x10) connect$inet(r3, &(0x7f0000000100)={0x2, 0x4e28, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000140), 0x4) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000a80)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) write$cgroup_int(r4, &(0x7f0000000200)=0x1, 0x12) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f0000000040)={0xf0f016, 0x4}) msgrcv(r1, &(0x7f00000002c0), 0x8, 0x0, 0x800) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x6, &(0x7f0000006680)) r6 = msgget$private(0x0, 0xa4) msgctl$IPC_INFO(r6, 0x3, &(0x7f0000000040)=""/24) ioctl$HIDIOCGUSAGE(0xffffffffffffffff, 0xc0145b0e, &(0x7f0000000000)={0x3, 0x0, 0xfffffffc}) 4.708112931s ago: executing program 2 (id=63): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0_to_bond\x00'}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000e00)) sendmsg$nl_route(r1, 0x0, 0x800) 4.611882603s ago: executing program 2 (id=64): write(0xffffffffffffffff, 0x0, 0x0) 4.472856817s ago: executing program 2 (id=65): bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0600000004000000040000000f"], 0x50) r0 = syz_open_procfs(0x0, &(0x7f0000000400)='net/vlan/config\x00') r1 = socket$inet6(0xa, 0x2, 0x0) close(r1) r2 = socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000005bc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x6, 0x4, 0xfff, 0x7}, 0x50) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) pread64(r0, &(0x7f0000000000)=""/83, 0x53, 0x3) 3.347728295s ago: executing program 1 (id=68): r0 = socket(0x15, 0x5, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e21, 0x1, @ipv4={'\x00', '\xff\xff', @empty}, 0x8}, 0x1c) 3.192778819s ago: executing program 1 (id=70): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x78, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) r1 = fcntl$dupfd(r0, 0x406, r0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfd, 0x0, 0xe4}]}, 0x10) write$binfmt_elf64(r1, &(0x7f0000000f80)=ANY=[], 0x540) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r1) shutdown(r0, 0x1) 3.103086252s ago: executing program 1 (id=71): mkdirat(0xffffffffffffffff, 0x0, 0x1c1) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001000310029bd7000ffdbdf2500000000", @ANYRES32=r2, @ANYBLOB="100804002010000024001280110001006272696467655f736c618c65000000000c000580050019"], 0x44}, 0x1, 0x0, 0x0, 0x404c1}, 0x40040d4) timer_create(0x7, 0x0, &(0x7f0000000080)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x24044040) 3.018588364s ago: executing program 1 (id=72): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0_to_bond\x00'}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000e00)) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24008000}, 0x800) 2.885484197s ago: executing program 1 (id=74): mq_timedreceive(0xffffffffffffffff, 0x0, 0x0, 0x5, 0x0) 2.813192049s ago: executing program 3 (id=75): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r0, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x109000, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000180)=0x4000000000009) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x0, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r6, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x3bf, 0xf88, 0x14a}}) ioctl$TCSETS2(r6, 0x402c542b, &(0x7f0000000080)={0xfffffe01, 0x9, 0xbf3ffe01, 0x8001, 0x2, "202b9809007d0000cd681ec267a000", 0x6, 0xd}) ioctl$TIOCL_PASTESEL(r6, 0x541c, &(0x7f00000002c0)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5412, &(0x7f00000002c0)=0x31) 2.7580824s ago: executing program 1 (id=76): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f00000145c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x12, &(0x7f0000014640)=@conn_svc_rsp={0x0, 0x0, 0xa, "76b179f7", {0x3, 0x106, 0x0, 0x0, 0x4}}) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, 0x0, 0x0) 813.6047ms ago: executing program 3 (id=77): getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) sendmsg$inet6(r1, &(0x7f0000000540)={&(0x7f00000000c0)={0xa, 0x4e24, 0x8004, @loopback, 0x7fff}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000580)="f0c14138206bff2f8a49720c7fc655c00700003949830a50930d08b5251508921ef983db73fc97d04e03c32c585f933404585b5cff00966c939aa55b471aec8a8dab34b60a26c617e5329c68355784251248496c2ef5c20f5504f45de4efa13a23979e4b37094f0837a6ba63db578a400d4351697546545e006d3cd7e23f3f551ec6681bd171411ecc1214889eb965563d6332e0f80c0e04dc3c424ec505f8982ccb26cca95601440441d19cd613673de7cf442f39e47bce9052e0bd0543e027519cba82cfbc1229870fdffdb78cb951f1ce667439423a9c9679bbe8db3c08c4c7a917b9088ea03bd270b875225a26fda005357b586da4e555f4ecd6abaaae48364a3156525cdb009c5850", 0x10b}], 0x1}, 0x400d4) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000240)={0x9, 0x6, 0xa, 0x1a1, 0xffff, 0xe, 0xbe, 0xffffe654}, &(0x7f0000000340)=0x20) 718.911292ms ago: executing program 0 (id=78): r0 = socket(0x15, 0x5, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e21, 0x1, @ipv4={'\x00', '\xff\xff', @empty}, 0x8}, 0x1c) 639.340874ms ago: executing program 3 (id=79): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x78, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) r1 = fcntl$dupfd(r0, 0x406, r0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfd, 0x0, 0xe4}]}, 0x10) write$binfmt_elf64(r1, &(0x7f0000000f80)=ANY=[], 0x540) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r1) shutdown(r0, 0x1) 529.547997ms ago: executing program 0 (id=80): openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_submit(r0, 0x1, &(0x7f0000000300)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) 475.087328ms ago: executing program 2 (id=81): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x9}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x7, 0x1, 0x6, 0x7a9a, 0x7, 0x5}, {0x9, 0x2, 0x6, 0x8, 0x10, 0x4517926f}, 0x5, 0x80000000, 0x1bb8}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x40) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x4890) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0xd8}, 0x1, 0x0, 0x0, 0x4004041}, 0x20004440) 474.067198ms ago: executing program 3 (id=82): timer_create(0x1, 0x0, &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:05.0/remove\x00', 0x41, 0x0) write(r0, &(0x7f0000000300)='1', 0x1) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) prctl$PR_SET_DUMPABLE(0x4, 0x2) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000080)={'\x00', 0xfff, 0x3, 0x8, 0x5, 0x7, 0x0}) rt_tgsigqueueinfo(r1, 0x0, 0x16, &(0x7f0000000100)={0x33, 0x3d, 0x300000}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) io_setup(0x2, 0x0) 333.598192ms ago: executing program 0 (id=83): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0_to_bond\x00'}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000e00)) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24008000}, 0x800) 309.126123ms ago: executing program 3 (id=84): mq_timedreceive(0xffffffffffffffff, 0x0, 0x0, 0x5, 0x0) 170.247586ms ago: executing program 0 (id=85): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x10000000005) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x80000000000002, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, 0x0, 0x0) capset(0x0, &(0x7f0000000100)={0x200000, 0x200000, 0x1000002, 0x0, 0xd33, 0xd26d}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000980)={0x48, 0x5, r5, 0x0, 0x0, 0x1}) ioctl$IOMMU_IOAS_MAP(r4, 0x3b85, &(0x7f0000000a00)={0x28, 0x7, r5, 0x0, &(0x7f00000a0000)='LLLLLLLLLLLLLLL', 0xf}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES(r4, 0x3ba0, 0x0) 148.709387ms ago: executing program 2 (id=86): pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r1) mount$9p_fd(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000080), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0]) 77.610258ms ago: executing program 3 (id=87): getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0x3, @empty, 0x3}], 0x1c) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000000c0)={0xa, 0x4e24, 0x8004, @loopback, 0x7fff}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000580)="f0c14138206bff2f8a49720c7fc655c00700003949830a50930d08b5251508921ef983db73fc97d04e03c32c585f933404585b5cff00966c939aa55b471aec8a8dab34b60a26c617e5329c68355784251248496c2ef5c20f5504f45de4efa13a23979e4b37094f0837a6ba63db578a400d4351697546545e006d3cd7e23f3f551ec6681bd171411ecc1214889eb965563d6332e0f80c0e04dc3c424ec505f8982ccb26cca95601440441d19cd613673de7cf442f39e47bce9052e0bd0543e027519cba82cfbc1229870fdffdb78cb951f1ce667439423a9c9679bbe8db3c08c4c7a917b9088ea03bd270b875225a26fda005357b586da4e555f4ecd6abaaae48364a3156525cdb009c5850", 0x10b}], 0x1}, 0x400d4) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000240)={0x9, 0x6, 0xa, 0x1a1, 0xffff, 0xe, 0xbe, 0xffffe654}, &(0x7f0000000340)=0x20) 0s ago: executing program 2 (id=88): r0 = socket(0x15, 0x5, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e21, 0x1, @ipv4={'\x00', '\xff\xff', @empty}, 0x8}, 0x1c) kernel console output (not intermixed with test programs): no interfaces have a carrier [ 57.644043][ T5433] 8021q: adding VLAN 0 to HW filter on device bond0 [ 57.662516][ T5433] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.1.102' (ED25519) to the list of known hosts. syzkaller login: [ 79.438445][ T5759] cgroup: Unknown subsys name 'net' [ 79.609050][ T5759] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 81.261939][ T5759] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 83.011871][ T5781] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 83.063355][ T5784] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 83.071010][ T5783] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 83.076832][ T5786] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 83.080443][ T5783] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 83.093178][ T5786] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 83.095657][ T5784] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 83.102352][ T5786] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 83.109910][ T5783] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 83.118764][ T5786] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 83.128731][ T5786] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 83.129331][ T5783] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 83.137132][ T5786] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 83.146402][ T5783] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 83.154813][ T5786] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 83.162204][ T5783] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 83.168067][ T5786] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 83.171033][ T5784] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 83.185978][ T5786] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 83.189871][ T5784] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 83.194665][ T5786] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 83.200929][ T5783] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 83.218271][ T5783] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 83.230331][ T5783] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 83.712516][ T5771] chnl_net:caif_netlink_parms(): no params data found [ 83.744076][ T5772] chnl_net:caif_netlink_parms(): no params data found [ 83.830581][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 83.920550][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 83.985872][ T5772] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.993703][ T5772] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.004163][ T5772] bridge_slave_0: entered allmulticast mode [ 84.011351][ T5772] bridge_slave_0: entered promiscuous mode [ 84.025415][ T5771] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.035294][ T5771] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.042865][ T5771] bridge_slave_0: entered allmulticast mode [ 84.050802][ T5771] bridge_slave_0: entered promiscuous mode [ 84.068203][ T5772] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.075574][ T5772] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.082884][ T5772] bridge_slave_1: entered allmulticast mode [ 84.090681][ T5772] bridge_slave_1: entered promiscuous mode [ 84.103341][ T5771] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.110525][ T5771] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.117650][ T5771] bridge_slave_1: entered allmulticast mode [ 84.125263][ T5771] bridge_slave_1: entered promiscuous mode [ 84.228993][ T5771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.244041][ T5772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.266392][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.274731][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.282144][ T5773] bridge_slave_0: entered allmulticast mode [ 84.289654][ T5773] bridge_slave_0: entered promiscuous mode [ 84.298920][ T5771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.311702][ T5772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.331098][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.338302][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.346322][ T5774] bridge_slave_0: entered allmulticast mode [ 84.353524][ T5774] bridge_slave_0: entered promiscuous mode [ 84.362371][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.370867][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.378083][ T5774] bridge_slave_1: entered allmulticast mode [ 84.385413][ T5774] bridge_slave_1: entered promiscuous mode [ 84.392675][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.402003][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.409260][ T5773] bridge_slave_1: entered allmulticast mode [ 84.416715][ T5773] bridge_slave_1: entered promiscuous mode [ 84.480927][ T5772] team0: Port device team_slave_0 added [ 84.510431][ T5771] team0: Port device team_slave_0 added [ 84.518875][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.530364][ T5772] team0: Port device team_slave_1 added [ 84.539764][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.552197][ T5771] team0: Port device team_slave_1 added [ 84.573094][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.586651][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.659713][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.666721][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.692922][ T5772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.726391][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.733615][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.759745][ T5771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.773798][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.781451][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.807510][ T5771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.819487][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.826549][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.853806][ T5772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.876343][ T5774] team0: Port device team_slave_0 added [ 84.885243][ T5773] team0: Port device team_slave_0 added [ 84.894681][ T5773] team0: Port device team_slave_1 added [ 84.923490][ T5774] team0: Port device team_slave_1 added [ 84.960401][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.967413][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.993564][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.037404][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.044485][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.070631][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.088830][ T5771] hsr_slave_0: entered promiscuous mode [ 85.095516][ T5771] hsr_slave_1: entered promiscuous mode [ 85.103182][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.113378][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.140591][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.167133][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.174218][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.200789][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.232522][ T5772] hsr_slave_0: entered promiscuous mode [ 85.240020][ T5772] hsr_slave_1: entered promiscuous mode [ 85.246375][ T5772] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 85.254958][ T5777] Bluetooth: hci1: command tx timeout [ 85.255317][ T5772] Cannot create hsr debugfs directory [ 85.262831][ T5786] Bluetooth: hci2: command tx timeout [ 85.272107][ T5777] Bluetooth: hci3: command tx timeout [ 85.326545][ T5774] hsr_slave_0: entered promiscuous mode [ 85.332274][ T5783] Bluetooth: hci0: command tx timeout [ 85.338629][ T5774] hsr_slave_1: entered promiscuous mode [ 85.345072][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 85.352925][ T5774] Cannot create hsr debugfs directory [ 85.436001][ T5773] hsr_slave_0: entered promiscuous mode [ 85.443558][ T5773] hsr_slave_1: entered promiscuous mode [ 85.450343][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 85.457957][ T5773] Cannot create hsr debugfs directory [ 85.860417][ T5771] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 85.876633][ T5771] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 85.887922][ T5771] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 85.906216][ T5771] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 85.977374][ T5772] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 86.008148][ T5772] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 86.019051][ T5772] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 86.032430][ T5772] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 86.108864][ T5773] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 86.152407][ T5773] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 86.164921][ T5773] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 86.204605][ T5773] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 86.255914][ T5774] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 86.266937][ T5774] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 86.299347][ T5774] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 86.315993][ T5774] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 86.366723][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.426220][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.468436][ T65] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.475981][ T65] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.497107][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.547975][ T65] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.555218][ T65] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.575984][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.598919][ T5772] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.623863][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.636542][ T65] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.643867][ T65] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.672773][ T65] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.680068][ T65] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.710740][ T65] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.717991][ T65] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.758480][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.765677][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.778391][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.878454][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.928444][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.935724][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.972653][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.979869][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.350094][ T5783] Bluetooth: hci2: command tx timeout [ 87.355607][ T5783] Bluetooth: hci3: command tx timeout [ 87.361290][ T5783] Bluetooth: hci1: command tx timeout [ 87.392315][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.410296][ T5786] Bluetooth: hci0: command tx timeout [ 87.575796][ T5771] veth0_vlan: entered promiscuous mode [ 87.618390][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.638009][ T5771] veth1_vlan: entered promiscuous mode [ 87.651404][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.766995][ T5771] veth0_macvtap: entered promiscuous mode [ 87.796115][ T5771] veth1_macvtap: entered promiscuous mode [ 87.894279][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.916130][ T5774] veth0_vlan: entered promiscuous mode [ 87.931924][ T5772] veth0_vlan: entered promiscuous mode [ 87.947662][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.997336][ T5771] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.006925][ T5771] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.017619][ T5771] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.027062][ T5771] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.060340][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.079933][ T5772] veth1_vlan: entered promiscuous mode [ 88.088997][ T5774] veth1_vlan: entered promiscuous mode [ 88.257834][ T5772] veth0_macvtap: entered promiscuous mode [ 88.313143][ T5774] veth0_macvtap: entered promiscuous mode [ 88.322849][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.334915][ T5773] veth0_vlan: entered promiscuous mode [ 88.346373][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.358045][ T5772] veth1_macvtap: entered promiscuous mode [ 88.388044][ T5774] veth1_macvtap: entered promiscuous mode [ 88.442602][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.453530][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.465946][ T5773] veth1_vlan: entered promiscuous mode [ 88.483121][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.496501][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.510301][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.542069][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.553206][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.565685][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.586504][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.601677][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.615072][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.628204][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.641172][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.659491][ T5774] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.668234][ T5774] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.677837][ T5774] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.687383][ T5774] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.709060][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.732391][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.764429][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.789222][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.804320][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.837710][ T5772] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.857923][ T5772] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.868991][ T5772] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.878695][ T5772] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.906085][ T5773] veth0_macvtap: entered promiscuous mode [ 88.953284][ T5773] veth1_macvtap: entered promiscuous mode [ 89.082249][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.100971][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.116760][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.127798][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.143680][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 89.154870][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.174533][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.211568][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.227060][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.237048][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.253505][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.273951][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 89.286544][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 89.305711][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.377725][ T5773] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.386804][ T5773] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.398585][ T5773] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.412820][ T5773] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.422958][ T5786] Bluetooth: hci1: command tx timeout [ 89.428407][ T5786] Bluetooth: hci3: command tx timeout [ 89.434647][ T5786] Bluetooth: hci2: command tx timeout [ 89.471598][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.489582][ T5786] Bluetooth: hci0: command tx timeout [ 89.489585][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.545455][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.554696][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.625832][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.666031][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.718334][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.747414][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.828624][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.892563][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.056965][ T1081] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.086212][ T1081] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.347846][ C0] Unknown status report in ack skb [ 90.498664][ T5859] sch_tbf: burst 15 is lower than device syzkaller0 mtu (1514) ! [ 90.518623][ T5859] netlink: 180 bytes leftover after parsing attributes in process `syz.3.4'. [ 90.608228][ T5863] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7'. [ 90.739891][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 90.959399][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 90.999581][ T9] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 91.075875][ T9] usb 3-1: config 0 has no interface number 0 [ 91.103846][ T5867] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 91.113118][ T11] Bluetooth: hci4: Frame reassembly failed (-84) [ 91.123329][ T28] audit: type=1326 audit(1788048266.108:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5871 comm="syz.1.11" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f71fd59e159 code=0x0 [ 91.158584][ T9] usb 3-1: config 0 interface 184 has no altsetting 0 [ 91.191430][ T9] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 91.211984][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.222432][ T9] usb 3-1: Product: syz [ 91.232258][ T9] usb 3-1: Manufacturer: syz [ 91.236995][ T9] usb 3-1: SerialNumber: syz [ 91.268818][ T9] usb 3-1: config 0 descriptor?? [ 91.298407][ T9] smsc75xx v1.0.0 [ 91.491201][ T5777] Bluetooth: hci3: command tx timeout [ 91.491238][ T5783] Bluetooth: hci1: command tx timeout [ 91.496707][ T5083] Bluetooth: hci2: command tx timeout [ 91.579628][ T5083] Bluetooth: hci0: command tx timeout [ 91.627993][ T5881] jffs2: notice: (5881) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 92.145426][ T23] cfg80211: failed to load regulatory.db [ 92.227407][ T5889] sch_tbf: burst 15 is lower than device syzkaller0 mtu (1514) ! [ 92.464226][ T5880] syz.0.14 (5880) used greatest stack depth: 20216 bytes left [ 92.565088][ T9] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -71 [ 92.593976][ T9] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 92.620133][ T9] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 92.631488][ T9] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 92.641360][ T9] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 92.651832][ T9] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 92.662115][ T9] smsc75xx: probe of 3-1:0.184 failed with error -71 [ 92.701350][ T9] usb 3-1: USB disconnect, device number 2 [ 94.371426][ T5786] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 94.779182][ C0] sched: RT throttling activated [ 95.592180][ T5906] macsec1: entered allmulticast mode [ 97.104565][ T5921] sch_tbf: burst 15 is lower than device syzkaller0 mtu (1514) ! [ 97.345680][ T5925] Zero length message leads to an empty skb [ 97.734537][ T55] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 98.272130][ T5954] sch_tbf: burst 15 is lower than device syzkaller0 mtu (1514) ! [ 98.419435][ T5814] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 98.619411][ T5814] usb 1-1: Using ep0 maxpacket: 16 [ 98.628665][ T5814] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 98.653434][ T5814] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 98.669392][ T5814] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.687104][ T5814] usb 1-1: Product: syz [ 98.695535][ T5814] usb 1-1: Manufacturer: syz [ 98.715001][ T5814] usb 1-1: SerialNumber: syz [ 98.742266][ T5814] usb 1-1: config 0 descriptor?? [ 98.785852][ T5814] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 98.830527][ T5814] em28xx 1-1:0.0: DVB interface 0 found: bulk [ 99.291259][ T5975] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 99.402614][ T5980] sch_tbf: burst 15 is lower than device syzkaller0 mtu (1514) ! [ 99.436337][ T5814] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 99.947019][ T5994] process 'syz.3.55' launched './cgroup.cpu/cpuset.cpus' with NULL argv: empty string added [ 100.231557][ T5814] em28xx 1-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 100.477603][ T5814] em28xx 1-1:0.0: board has no eeprom [ 100.762825][ T5814] em28xx 1-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 100.783345][ T5814] em28xx 1-1:0.0: dvb set to bulk mode. [ 100.790538][ T5761] em28xx 1-1:0.0: Binding DVB extension [ 100.832678][ T5814] usb 1-1: USB disconnect, device number 2 [ 100.853201][ T5814] em28xx 1-1:0.0: Disconnecting em28xx [ 100.919349][ T5761] em28xx 1-1:0.0: Registering input extension [ 100.932712][ T5814] em28xx 1-1:0.0: Closing input extension [ 101.001373][ T5814] em28xx 1-1:0.0: Freeing device [ 101.030057][ T55] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 101.073324][ T6005] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 101.108796][ T6007] sch_tbf: burst 15 is lower than device syzkaller0 mtu (1514) ! [ 101.229236][ T55] usb 4-1: Using ep0 maxpacket: 32 [ 101.249940][ T55] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 101.262235][ T55] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 101.274273][ T55] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 101.317306][ T55] usb 4-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 101.327105][ T55] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 101.340506][ T5786] Bluetooth: hci4: command 0x1003 tx timeout [ 101.347275][ T5083] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 101.350211][ T55] usb 4-1: config 0 descriptor?? [ 101.722039][ T5814] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 101.978883][ T55] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.0001/input/input6 [ 102.089433][ T5814] usb 1-1: Using ep0 maxpacket: 8 [ 102.104623][ T5814] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 102.120387][ T5814] usb 1-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 102.150283][ T55] input: HID 0458:5011 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0458:5011.0001/input/input7 [ 102.151905][ T5814] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 102.234275][ T5814] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.282072][ T55] kye 0003:0458:5011.0001: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0458:5011] on usb-dummy_hcd.3-1/input0 [ 102.373875][ T55] usb 4-1: USB disconnect, device number 3 [ 102.611702][ T6025] fido_id[6025]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 103.106398][ T6037] sch_tbf: burst 15 is lower than device syzkaller0 mtu (1514) ! [ 104.720163][ T6050] Bluetooth: hci4: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 105.457837][ T5835] usb 1-1: USB disconnect, device number 3 [ 105.712346][ T23] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 105.843461][ T6067] sch_tbf: burst 15 is lower than device syzkaller0 mtu (1514) ! [ 105.924700][ T23] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 105.935985][ T23] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 105.944447][ T23] usb 2-1: Product: syz [ 105.949078][ T23] usb 2-1: Manufacturer: syz [ 105.957611][ T23] usb 2-1: SerialNumber: syz [ 106.145676][ T5761] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 106.449223][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 106.489241][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c0!!! [ 107.103734][ C0] ------------[ cut here ]------------ [ 107.109343][ C0] WARNING: CPU: 0 PID: 0 at net/mac80211/tx.c:5048 __ieee80211_beacon_get+0x1141/0x1520 [ 107.119217][ C0] Modules linked in: [ 107.123252][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 107.130420][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 107.140574][ C0] RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520 [ 107.147021][ C0] Code: f7 4c 89 ef e8 10 ba b7 f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 cb d7 79 f7 0f 0b e9 61 f8 ff ff e8 bf d7 79 f7 <0f> 0b e9 85 fb ff ff e8 b3 d7 79 f7 48 c7 c7 20 c7 65 8e 4c 89 e6 [ 107.166825][ C0] RSP: 0018:ffffc90000007a18 EFLAGS: 00010246 [ 107.173164][ C0] RAX: ffffffff8a0d9ab1 RBX: dffffc0000000000 RCX: ffffffff8ce93440 [ 107.181259][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 107.189387][ C0] RBP: 0000000000000000 R08: ffffffff8ce93440 R09: 0000000000000003 [ 107.197466][ C0] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805b0aa440 [ 107.205544][ C0] R13: ffff888030369c24 R14: ffff88805b0aa930 R15: ffff888030369c00 [ 107.213674][ C0] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 107.222856][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 107.229542][ C0] CR2: 000000110c43a53a CR3: 000000002ce51000 CR4: 00000000003506f0 [ 107.237649][ C0] Call Trace: [ 107.241082][ C0] [ 107.244029][ C0] ? __ieee80211_beacon_get+0x36/0x1520 [ 107.249764][ C0] ieee80211_beacon_get_tim+0xbf/0x580 [ 107.255324][ C0] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 107.262272][ C0] mac80211_hwsim_beacon_tx+0x3bd/0x770 [ 107.267948][ C0] __iterate_interfaces+0x225/0x4c0 [ 107.273437][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 107.279860][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 107.287189][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 107.293589][ C0] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 107.300810][ C0] mac80211_hwsim_beacon+0xbb/0x1b0 [ 107.306129][ C0] ? hw_scan_work+0xf10/0xf10 [ 107.309722][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 107.310964][ C0] __hrtimer_run_queues+0x525/0xc10 [ 107.324633][ C0] ? hrtimer_interrupt+0x980/0x980 [ 107.329348][ T0] NOHZ tick-stop error: local softirq work is pending, handler #180!!! [ 107.329986][ C0] ? read_tsc+0x9/0x20 [ 107.342415][ C0] hrtimer_run_softirq+0x177/0x290 [ 107.347653][ C0] handle_softirqs+0x27d/0x820 [ 107.352571][ C0] ? read_tsc+0x9/0x20 [ 107.356739][ C0] ? ktime_get+0x24b/0x280 [ 107.361338][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 107.366267][ C0] ? do_softirq+0x1a0/0x1a0 [ 107.370958][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 107.376282][ C0] __irq_exit_rcu+0xd3/0x190 [ 107.381018][ C0] ? irq_exit_rcu+0x20/0x20 [ 107.385631][ C0] irq_exit_rcu+0x9/0x20 [ 107.390006][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 107.395776][ C0] [ 107.398786][ C0] [ 107.401845][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 107.407926][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 107.413723][ C0] Code: d9 19 02 c3 cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d a3 a5 38 00 fb f4 66 0f 1f 00 55 41 57 41 56 41 54 53 50 8b 2f eb 2c 89 cb 80 f9 [ 107.433485][ C0] RSP: 0018:ffffffff8ce07d80 EFLAGS: 000002c2 [ 107.439714][ C0] RAX: 96cf6a0c40d98800 RBX: ffffffff81630d54 RCX: 96cf6a0c40d98800 [ 107.447780][ C0] RDX: 0000000000000001 RSI: ffffffff8acacbe0 RDI: ffffffff8b1d3360 [ 107.455863][ C0] RBP: ffffffff8ce07eb8 R08: ffff8880b8e36b6b R09: 1ffff110171c6d6d [ 107.463979][ C0] R10: dffffc0000000000 R11: ffffed10171c6d6e R12: 1ffffffff19c0fbc [ 107.472093][ C0] R13: dffffc0000000000 R14: 1ffffffff19d2688 R15: 0000000000000000 [ 107.480206][ C0] ? do_idle+0x334/0x5c0 [ 107.484618][ C0] default_idle+0x13/0x20 [ 107.489198][ C0] default_idle_call+0x6c/0xa0 [ 107.494063][ C0] do_idle+0x334/0x5c0 [ 107.498248][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 107.499371][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 107.503645][ C0] ? do_idle+0x590/0x5c0 [ 107.516219][ C0] cpu_startup_entry+0x43/0x60 [ 107.521230][ C0] rest_init+0x2e2/0x300 [ 107.525574][ C0] ? time_init+0x40/0x40 [ 107.529965][ C0] arch_call_rest_init+0xe/0x10 [ 107.534923][ C0] start_kernel+0x461/0x4e0 [ 107.539550][ C0] x86_64_start_reservations+0x2a/0x30 [ 107.545132][ C0] x86_64_start_kernel+0x60/0x60 [ 107.550248][ C0] secondary_startup_64_no_verify+0x179/0x17b [ 107.556445][ C0] [ 107.559574][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 107.566901][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 107.573958][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 107.584046][ C0] Call Trace: [ 107.587357][ C0] [ 107.590232][ C0] dump_stack_lvl+0x18c/0x250 [ 107.595006][ C0] ? show_regs_print_info+0x20/0x20 [ 107.600260][ C0] ? load_image+0x420/0x420 [ 107.604821][ C0] panic+0x2ca/0x720 [ 107.608770][ C0] ? bpf_jit_dump+0xd0/0xd0 [ 107.613333][ C0] ? secondary_startup_64_no_verify+0x179/0x17b [ 107.619633][ C0] __warn+0x2e0/0x470 [ 107.623654][ C0] ? __ieee80211_beacon_get+0x1141/0x1520 [ 107.629431][ C0] ? __ieee80211_beacon_get+0x1141/0x1520 [ 107.635201][ C0] report_bug+0x2be/0x4f0 [ 107.639280][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.647745][ C0] ? __ieee80211_beacon_get+0x1141/0x1520 [ 107.653517][ C0] ? __ieee80211_beacon_get+0x1141/0x1520 [ 107.659289][ C0] ? __ieee80211_beacon_get+0x1143/0x1520 [ 107.665070][ C0] handle_bug+0xcf/0x120 [ 107.669388][ C0] exc_invalid_op+0x1a/0x50 [ 107.673919][ C0] asm_exc_invalid_op+0x1a/0x20 [ 107.678831][ C0] RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520 [ 107.685207][ C0] Code: f7 4c 89 ef e8 10 ba b7 f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 cb d7 79 f7 0f 0b e9 61 f8 ff ff e8 bf d7 79 f7 <0f> 0b e9 85 fb ff ff e8 b3 d7 79 f7 48 c7 c7 20 c7 65 8e 4c 89 e6 [ 107.699372][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.713017][ C0] RSP: 0018:ffffc90000007a18 EFLAGS: 00010246 [ 107.719133][ C0] RAX: ffffffff8a0d9ab1 RBX: dffffc0000000000 RCX: ffffffff8ce93440 [ 107.727134][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 107.735157][ C0] RBP: 0000000000000000 R08: ffffffff8ce93440 R09: 0000000000000003 [ 107.743351][ C0] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805b0aa440 [ 107.751442][ C0] R13: ffff888030369c24 R14: ffff88805b0aa930 R15: ffff888030369c00 [ 107.759447][ C0] ? __ieee80211_beacon_get+0x1141/0x1520 [ 107.765206][ C0] ? __ieee80211_beacon_get+0x1141/0x1520 [ 107.770956][ C0] ? __ieee80211_beacon_get+0x36/0x1520 [ 107.776567][ C0] ieee80211_beacon_get_tim+0xbf/0x580 [ 107.782093][ C0] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 107.788989][ C0] mac80211_hwsim_beacon_tx+0x3bd/0x770 [ 107.794585][ C0] __iterate_interfaces+0x225/0x4c0 [ 107.799834][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 107.806116][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 107.813355][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 107.819314][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 107.827870][ C0] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 107.834948][ C0] mac80211_hwsim_beacon+0xbb/0x1b0 [ 107.840174][ C0] ? hw_scan_work+0xf10/0xf10 [ 107.844904][ C0] __hrtimer_run_queues+0x525/0xc10 [ 107.850153][ C0] ? hrtimer_interrupt+0x980/0x980 [ 107.855374][ C0] ? read_tsc+0x9/0x20 [ 107.859502][ C0] hrtimer_run_softirq+0x177/0x290 [ 107.864696][ C0] handle_softirqs+0x27d/0x820 [ 107.869546][ C0] ? read_tsc+0x9/0x20 [ 107.873651][ C0] ? ktime_get+0x24b/0x280 [ 107.878113][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 107.882913][ C0] ? do_softirq+0x1a0/0x1a0 [ 107.887568][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 107.892827][ C0] __irq_exit_rcu+0xd3/0x190 [ 107.897450][ C0] ? irq_exit_rcu+0x20/0x20 [ 107.901982][ C0] irq_exit_rcu+0x9/0x20 [ 107.906284][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 107.911953][ C0] [ 107.914917][ C0] [ 107.917890][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 107.923911][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 107.929594][ C0] Code: d9 19 02 c3 cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d a3 a5 38 00 fb f4 66 0f 1f 00 55 41 57 41 56 41 54 53 50 8b 2f eb 2c 89 cb 80 f9 [ 107.949233][ C0] RSP: 0018:ffffffff8ce07d80 EFLAGS: 000002c2 [ 107.955342][ C0] RAX: 96cf6a0c40d98800 RBX: ffffffff81630d54 RCX: 96cf6a0c40d98800 [ 107.963348][ C0] RDX: 0000000000000001 RSI: ffffffff8acacbe0 RDI: ffffffff8b1d3360 [ 107.971367][ C0] RBP: ffffffff8ce07eb8 R08: ffff8880b8e36b6b R09: 1ffff110171c6d6d [ 107.979372][ C0] R10: dffffc0000000000 R11: ffffed10171c6d6e R12: 1ffffffff19c0fbc [ 107.987371][ C0] R13: dffffc0000000000 R14: 1ffffffff19d2688 R15: 0000000000000000 [ 107.995462][ C0] ? do_idle+0x334/0x5c0 [ 107.999760][ C0] default_idle+0x13/0x20 [ 108.004136][ C0] default_idle_call+0x6c/0xa0 [ 108.008940][ C0] do_idle+0x334/0x5c0 [ 108.013053][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 108.018298][ C0] ? do_idle+0x590/0x5c0 [ 108.022597][ C0] cpu_startup_entry+0x43/0x60 [ 108.027404][ C0] rest_init+0x2e2/0x300 [ 108.031676][ C0] ? time_init+0x40/0x40 [ 108.035952][ C0] arch_call_rest_init+0xe/0x10 [ 108.040851][ C0] start_kernel+0x461/0x4e0 [ 108.045412][ C0] x86_64_start_reservations+0x2a/0x30 [ 108.050965][ C0] x86_64_start_kernel+0x60/0x60 [ 108.055941][ C0] secondary_startup_64_no_verify+0x179/0x17b [ 108.059282][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 108.070201][ C0] [ 108.073823][ C0] Kernel Offset: disabled [ 108.078202][ C0] Rebooting in 86400 seconds..