last executing test programs: 2.680348025s ago: executing program 0 (id=1): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000001c0)={'wlan0\x00', 0x1003}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0), &(0x7f0000000400)=ANY=[@ANYBLOB="d000000008021100000008021100000108021100000000000f010000010882848b960c1218247206030303030303710701010001000000750401000100"], 0x3d) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) 2.50365477s ago: executing program 1 (id=2): r0 = socket$nl_generic(0x10, 0x3, 0x10) write(r0, &(0x7f0000000000)="3c0000001400010001000000000000000a01000025000100534d432d4c4f4f504241434b2d5545494420202020202020202020202020202000000000", 0x3c) write(r0, &(0x7f0000000000)="3c0000001500010001000000000000000a01000025000100534d432d4c4f4f504241434b2d5545494420202020202020202020202020202000000000", 0x3c) write(r0, &(0x7f0000000000)="3c0000001600010001000000000000000a01000025000100534d432d4c4f4f504241434b2d5545494420202020202020202020202020202000000000", 0x3c) r1 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20, @loopback}, 0x10) listen(r1, 0xa) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000100)={0x2, 0x4e20, @loopback}, 0x10) r3 = accept$inet(r1, 0x0, 0x0) close(r3) 2.281218039s ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/cfg80211/parameters/bss_entries_limit\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='1\n', 0x2) close(r0) syz_80211_join_ibss(&(0x7f0000000300)='wlan0\x00', &(0x7f0000000340)=@default_ibss_ssid, 0x6, 0x0) syz_80211_inject_frame(&(0x7f0000000400), &(0x7f0000000440)=@mgmt_frame=@beacon={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000800)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f0000000500), &(0x7f0000000540)=@mgmt_frame=@beacon={{{}, {}, @device_b, @device_b, @from_mac=@device_b}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ibss_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000900)={0x0, 0x2faf080}, 0x0) 2.242743397s ago: executing program 1 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='-2 -3 -4.0 +4.1\n', 0x10) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1\n', 0x2) close(r2) 2.036053288s ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'dummy0\x00'}) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/net/bonding_masters\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='+bond1\n\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/net/bond1/bonding/mode\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='balance-alb\n\x00', 0xc) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/net/bond1/bonding/slaves\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='+dummy0\n\x00', 0x8) close(r3) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000240)={'dummy0\x00', 0x1}) ioctl(r0, 0x8983, &(0x7f0000000300)="00000000626f6e6431000000000000000000000000000000000000000100"/54) ioctl(r0, 0x8914, &(0x7f0000000340)="626f6e64312e310000000000000000000100") 1.875016581s ago: executing program 2 (id=6): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./backing_file\x00', 0x42, 0x1ff) fallocate(r0, 0x0, 0x0, 0x1000000) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) dup2(r1, 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/syz\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/syz/node/node0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/cluster/syz/node/node0/ipv4_port\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='7777\n', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/cluster/syz/node/node0/ipv4_address\x00', 0x2, 0x0) write(r3, &(0x7f0000000440), 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/syz/node/node0/num\x00', 0x2, 0x0) write(r4, &(0x7f0000000340)='0\n', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/syz/node/node0/local\x00', 0x2, 0x0) write(r5, &(0x7f00000004c0)='1\n', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/cluster/syz/heartbeat/hb0/dev\x00', 0x2, 0x0) write(r6, &(0x7f0000000700)='7\n', 0x2) 1.687060498s ago: executing program 0 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/netdevsim/del_device\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='1\x00', 0x2) close(r0) 1.437800523s ago: executing program 3 (id=8): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='md0\n', 0x4) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r1, &(0x7f0000000700)='none\n', 0x5) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r2, &(0x7f0000000900)='raid1\n', 0x6) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r3, &(0x7f0000000b00)='2\n', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000d00)='1:0\n', 0x4) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0) write(r5, &(0x7f0000000f00)='0\n', 0x2) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r6, &(0x7f0000001100)='active\n', 0x7) close(r6) r7 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r7, &(0x7f0000001300)='1:1\n', 0x4) close(r7) r8 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0) write(r8, &(0x7f0000001500)='1\n', 0x2) close(r8) 1.43262101s ago: executing program 2 (id=16): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./backing_file\x00', 0x42, 0x1ff) fallocate(r0, 0x0, 0x0, 0x1000000) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) dup2(r1, 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/syz\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/syz/node/node0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/cluster/syz/node/node0/ipv4_port\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='7777\n', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/cluster/syz/node/node0/ipv4_address\x00', 0x2, 0x0) write(r3, &(0x7f0000000440), 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/syz/node/node0/num\x00', 0x2, 0x0) write(r4, &(0x7f0000000340)='0\n', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/syz/node/node0/local\x00', 0x2, 0x0) write(r5, &(0x7f00000004c0)='1\n', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/cluster/syz/heartbeat/hb0/dev\x00', 0x2, 0x0) write(r6, &(0x7f0000000700)='7\n', 0x2) 1.141965437s ago: executing program 2 (id=9): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'dummy0\x00'}) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/net/bonding_masters\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='+bond1\n\x00', 0x7) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/net/bond1/bonding/mode\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='balance-alb\n\x00', 0xc) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/net/bond1/bonding/slaves\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='+dummy0\n\x00', 0x8) close(r3) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000240)={'dummy0\x00', 0x1}) ioctl(r0, 0x8914, &(0x7f0000000280)="626f6e643100000000000000000000000100") nanosleep(&(0x7f00000002c0)={0x0, 0x5f5e100}, 0x0) ioctl(r0, 0x8983, &(0x7f0000000300)="00000000626f6e6431000000000000000000000000000000000000000100"/54) ioctl(r0, 0x8914, &(0x7f0000000340)="626f6e64312e310000000000000000000100") ioctl(r0, 0x8924, &(0x7f0000000380)="626f6e643100000000000000000000000100001122334455") ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000780)={'bond_slave_0\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000007c0)={'bond_slave_1\x00'}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r4, &(0x7f0000000480)='-bond_slave_0\n\x00', 0xe) write(r4, &(0x7f00000004c0)='-bond_slave_1\n\x00', 0xe) close(r4) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000500)={'bond0\x00'}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/class/net/bond0/bonding/mode\x00', 0x2, 0x0) write(r5, &(0x7f0000000580)='balance-alb\n\x00', 0xc) close(r5) openat(0xffffffffffffff9c, &(0x7f00000005c0)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000680)={0x0, 'bond0\x00', {0x1}}) 1.043906183s ago: executing program 3 (id=10): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000200)='md0\x00', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./img\x00', 0x42, 0x1b6) ftruncate(r1, 0x2000000) pwrite64(r1, &(0x7f0000000280)="6269746d040000000010000005000000000000", 0x13, 0x1000) r2 = syz_open_dev$loop(&(0x7f00000002c0), 0x0, 0x2) ioctl$LOOP_SET_FD(r2, 0x4c00, r1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r3, 0x40480923, &(0x7f0000000400)="000000000000000000000000000000000100000000040000010000000100000000000000010000000000000000000000010000000100"/72) ioctl(r3, 0x40140921, &(0x7f0000000500)="0000000007000000000000000000000006000000") r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/dev-loop0/offset\x00', 0x2, 0x0) write(r4, &(0x7f0000000700)='16\x00', 0x3) close(r4) r5 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r5, &(0x7f0000000840)='65500\x00', 0x6) ioctl(r3, 0x400c0930, &(0x7f0000000700)='\x00'/12) r6 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/bitmap/location\x00', 0x2, 0x0) write(r6, &(0x7f0000000940)='8\x00', 0x2) close(r6) 772.012376ms ago: executing program 3 (id=11): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000200)=0x2, 0x4) setsockopt(r0, 0x84, 0x7d, &(0x7f0000000240)="0000000001000000", 0x8) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000280)=0x800, 0x4) bind$inet(r0, 0x0, 0x0) listen(r0, 0x5) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000200)=0x2, 0x4) setsockopt(r1, 0x84, 0x7d, &(0x7f0000000240)="0000000001000000", 0x8) setsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000340)=@assoc_value={0x0, 0x200}, 0x8) connect$inet(r1, &(0x7f0000000300)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r1, &(0x7f0000001000)='\x00'/32768, 0x8000, 0x0, 0x0, 0x0) 720.55417ms ago: executing program 0 (id=12): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x1}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x1}, @NL80211_ATTR_STA_SUPPORTED_RATES={0xc, 0x13, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}]}, 0x44}}, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x34, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x34}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) bind$packet(r3, &(0x7f0000000440)={0x11, 0x300, r2, 0x1, 0x0, 0x6, @random}, 0x14) write(r3, &(0x7f0000000480)="0802110000010802110000000800450000280000000040007ce70a0000010a000002", 0x2e) sendmsg$NL80211_CMD_DEL_INTERFACE(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x1c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}}, 0x0) 541.447182ms ago: executing program 2 (id=13): r0 = socket$nl_generic(0x10, 0x3, 0x10) write(r0, &(0x7f0000000000)="3c0000001400010001000000000000000a01000025000100534d432d4c4f4f504241434b2d5545494420202020202020202020202020202000000000", 0x3c) write(r0, &(0x7f0000000000)="3c0000001500010001000000000000000a01000025000100534d432d4c4f4f504241434b2d5545494420202020202020202020202020202000000000", 0x3c) r1 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e20, @loopback}, 0x10) listen(r1, 0xa) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000100)={0x2, 0x4e20, @loopback}, 0x10) r3 = accept$inet(r1, 0x0, 0x0) close(r3) 476.887988ms ago: executing program 3 (id=14): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000100)={'\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000100)={'\x00', 0x1}) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x20, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5, 0x29, 0x1}]}, 0x20}}, 0x0) sendmsg$IEEE802154_LLSEC_ADD_KEY(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x4c, r1, 0x601, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_USAGE_FRAME_TYPES={0x5, 0x31, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_BYTES={0x14}]}, 0x4c}}, 0x0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x44, r1, 0x601, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}]}, 0x44}}, 0x0) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={0x34, r1, 0x601, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x1}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0xff}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}]}, 0x34}}, 0x0) 476.394023ms ago: executing program 1 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'dummy0\x00'}) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/net/bonding_masters\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='+bond1\n\x00', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/net/bond1/bonding/mode\x00', 0x2, 0x0) write(r2, &(0x7f0000000180)='balance-alb\n\x00', 0xc) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/class/net/bond1/bonding/slaves\x00', 0x2, 0x0) write(r3, &(0x7f0000000200)='+dummy0\n\x00', 0x8) close(r3) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000240)={'dummy0\x00', 0x1}) ioctl(r0, 0x8983, &(0x7f0000000300)="00000000626f6e6431000000000000000000000000000000000000000100"/54) ioctl(r0, 0x8914, &(0x7f0000000340)="626f6e64312e310000000000000000000100") 271.716228ms ago: executing program 2 (id=17): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000001c0)={'wlan0\x00', 0x1003}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0), &(0x7f0000000400)=ANY=[@ANYBLOB="d000000008021100000008021100000108021100000000000f010000010882848b960c1218247206030303030303710701010001000000750401000100"], 0x3d) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) 89.899125ms ago: executing program 1 (id=18): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./backing_file\x00', 0x42, 0x1ff) fallocate(r0, 0x0, 0x0, 0x1000000) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) dup2(r1, 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/syz\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/syz/node/node0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/cluster/syz/node/node0/ipv4_port\x00', 0x2, 0x0) write(r2, &(0x7f00000003c0)='7777\n', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/cluster/syz/node/node0/ipv4_address\x00', 0x2, 0x0) write(r3, &(0x7f0000000440), 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/syz/node/node0/num\x00', 0x2, 0x0) write(r4, &(0x7f0000000340)='0\n', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/cluster/syz/node/node0/local\x00', 0x2, 0x0) write(r5, &(0x7f00000004c0)='1\n', 0x2) r6 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/cluster/syz/heartbeat/hb0/dev\x00', 0x2, 0x0) write(r6, &(0x7f0000000700)='7\n', 0x2) 343.144µs ago: executing program 0 (id=19): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='md0\n', 0x4) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r1, &(0x7f0000000700)='none\n', 0x5) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r2, &(0x7f0000000900)='raid1\n', 0x6) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r3, &(0x7f0000000b00)='2\n', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000d00)='1:0\n', 0x4) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0) write(r5, &(0x7f0000000f00)='0\n', 0x2) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r6, &(0x7f0000001100)='active\n', 0x7) close(r6) r7 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r7, &(0x7f0000001300)='1:1\n', 0x4) close(r7) r8 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0) write(r8, &(0x7f0000001500)='1\n', 0x2) close(r8) 0s ago: executing program 3 (id=20): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000200)='md0\x00', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./img\x00', 0x42, 0x1b6) ftruncate(r1, 0x2000000) pwrite64(r1, &(0x7f0000000280)="6269746d040000000010000005000000000000", 0x13, 0x1000) r2 = syz_open_dev$loop(&(0x7f00000002c0), 0x0, 0x2) ioctl$LOOP_SET_FD(r2, 0x4c00, r1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r3, 0x40480923, &(0x7f0000000400)="000000000000000000000000000000000100000000040000010000000100000000000000010000000000000000000000010000000100"/72) ioctl(r3, 0x40140921, &(0x7f0000000500)="0000000007000000000000000000000006000000") r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/dev-loop0/offset\x00', 0x2, 0x0) write(r4, &(0x7f0000000700)='16\x00', 0x3) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/dev-loop0/size\x00', 0x2, 0x0) write(r5, 0x0, 0x0) ioctl(r3, 0x400c0930, &(0x7f0000000700)='\x00'/12) r6 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/block/md0/md/bitmap/location\x00', 0x2, 0x0) write(r6, &(0x7f0000000940)='8\x00', 0x2) close(r6) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.83' (ED25519) to the list of known hosts. [ 74.216082][ T5601] cgroup: Unknown subsys name 'net' [ 74.366758][ T5601] cgroup: Unknown subsys name 'cpuset' [ 74.370201][ T5601] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 75.981015][ T5601] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 79.552902][ T4931] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 79.554939][ T5622] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 79.559063][ T5622] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 79.559861][ T5622] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 79.560370][ T5622] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 79.561241][ T5622] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 79.562392][ T5622] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 79.570970][ T5622] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 79.571601][ T5622] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 79.572258][ T5622] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 79.596897][ T5622] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 79.597275][ T5622] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 79.604718][ T5622] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 79.605260][ T5622] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 79.616424][ T5625] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 79.616986][ T5625] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 79.621808][ T5622] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 79.622324][ T5625] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 79.630906][ T5622] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 79.647089][ T5615] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 81.151855][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.153300][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.153439][ T5610] bridge_slave_0: entered allmulticast mode [ 81.155398][ T5610] bridge_slave_0: entered promiscuous mode [ 81.205111][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.205218][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.205624][ T5610] bridge_slave_1: entered allmulticast mode [ 81.207099][ T5610] bridge_slave_1: entered promiscuous mode [ 81.303942][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.339176][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.366597][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.366726][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.366808][ T5611] bridge_slave_0: entered allmulticast mode [ 81.367910][ T5611] bridge_slave_0: entered promiscuous mode [ 81.421314][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.421435][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.421962][ T5611] bridge_slave_1: entered allmulticast mode [ 81.434160][ T5611] bridge_slave_1: entered promiscuous mode [ 81.439345][ T5610] team0: Port device team_slave_0 added [ 81.460511][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.460626][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.460721][ T5612] bridge_slave_0: entered allmulticast mode [ 81.461932][ T5612] bridge_slave_0: entered promiscuous mode [ 81.474824][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.474931][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.475066][ T5612] bridge_slave_1: entered allmulticast mode [ 81.476880][ T5612] bridge_slave_1: entered promiscuous mode [ 81.517389][ T5610] team0: Port device team_slave_1 added [ 81.537475][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.581358][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.609288][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.624948][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.624961][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.624978][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.626026][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.626202][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.626342][ T5613] bridge_slave_0: entered allmulticast mode [ 81.628519][ T5613] bridge_slave_0: entered promiscuous mode [ 81.640436][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.659627][ T5611] team0: Port device team_slave_0 added [ 81.662694][ T5611] team0: Port device team_slave_1 added [ 81.663859][ T5622] Bluetooth: hci2: command tx timeout [ 81.663965][ T5622] Bluetooth: hci0: command tx timeout [ 81.686093][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.686109][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.686133][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.687002][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.687103][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.687224][ T5613] bridge_slave_1: entered allmulticast mode [ 81.689174][ T5613] bridge_slave_1: entered promiscuous mode [ 81.743798][ T53] Bluetooth: hci3: command tx timeout [ 81.743815][ T5622] Bluetooth: hci1: command tx timeout [ 81.778024][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.779369][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.779382][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.779405][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.874797][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.886742][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.886758][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.886780][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.973294][ T5610] hsr_slave_0: entered promiscuous mode [ 81.974774][ T5610] hsr_slave_1: entered promiscuous mode [ 82.051589][ T5612] team0: Port device team_slave_0 added [ 82.060798][ T5613] team0: Port device team_slave_0 added [ 82.095851][ T5611] hsr_slave_0: entered promiscuous mode [ 82.097051][ T5611] hsr_slave_1: entered promiscuous mode [ 82.097910][ T5611] debugfs: 'hsr0' already exists in 'hsr' [ 82.097990][ T5611] Cannot create hsr debugfs directory [ 82.101378][ T5613] team0: Port device team_slave_1 added [ 82.103759][ T5612] team0: Port device team_slave_1 added [ 82.219913][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.219933][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.219958][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.290010][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.290030][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.290055][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.344258][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.344276][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.344298][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.375611][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.375629][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.375651][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.513677][ T5612] hsr_slave_0: entered promiscuous mode [ 82.514382][ T5612] hsr_slave_1: entered promiscuous mode [ 82.514845][ T5612] debugfs: 'hsr0' already exists in 'hsr' [ 82.514865][ T5612] Cannot create hsr debugfs directory [ 82.538362][ T5613] hsr_slave_0: entered promiscuous mode [ 82.539717][ T5613] hsr_slave_1: entered promiscuous mode [ 82.540454][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 82.540472][ T5613] Cannot create hsr debugfs directory [ 82.917455][ T5610] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 82.934708][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 82.936151][ T5610] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 82.941183][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 82.972119][ T5610] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 82.988961][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 82.989942][ T5610] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 82.995647][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.071883][ T5611] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 83.084670][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.085482][ T5611] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 83.089559][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.090376][ T5611] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 83.094932][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.124726][ T5611] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 83.137235][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.235167][ T5613] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 83.240242][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.241694][ T5613] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 83.266386][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.267433][ T5613] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 83.270777][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.272371][ T5613] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 83.305142][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.406697][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.439911][ T5612] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 83.455850][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.461236][ T5612] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 83.479122][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.495593][ T5610] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.499283][ T5612] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 83.501831][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.531414][ T5612] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 83.543752][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.565681][ T1038] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.565879][ T1038] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.604081][ T1038] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.604240][ T1038] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.654796][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.719348][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.743950][ T5622] Bluetooth: hci0: command tx timeout [ 83.743987][ T5622] Bluetooth: hci2: command tx timeout [ 83.749390][ T1038] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.749484][ T1038] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.782359][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.808895][ T732] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.809014][ T732] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.822897][ T5622] Bluetooth: hci1: command tx timeout [ 83.827779][ T5622] Bluetooth: hci3: command tx timeout [ 83.868187][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.908804][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.908924][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.952541][ T1038] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.952670][ T1038] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.009922][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.095648][ T5612] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.140048][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.140164][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.158384][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.158522][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.306956][ T5612] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 84.948508][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.173245][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.178903][ T5610] veth0_vlan: entered promiscuous mode [ 85.218415][ T5610] veth1_vlan: entered promiscuous mode [ 85.248272][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.342730][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.350533][ T5613] veth0_vlan: entered promiscuous mode [ 85.369692][ T5610] veth0_macvtap: entered promiscuous mode [ 85.389285][ T5610] veth1_macvtap: entered promiscuous mode [ 85.405091][ T5613] veth1_vlan: entered promiscuous mode [ 85.420617][ T5611] veth0_vlan: entered promiscuous mode [ 85.451845][ T5611] veth1_vlan: entered promiscuous mode [ 85.460466][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.486470][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.530905][ T5612] veth0_vlan: entered promiscuous mode [ 85.557065][ T5611] veth0_macvtap: entered promiscuous mode [ 85.572393][ T5613] veth0_macvtap: entered promiscuous mode [ 85.579951][ T5611] veth1_macvtap: entered promiscuous mode [ 85.590724][ T5612] veth1_vlan: entered promiscuous mode [ 85.618465][ T5613] veth1_macvtap: entered promiscuous mode [ 85.660812][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.694013][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.694909][ T50] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.722932][ T1038] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.747760][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.764181][ T5612] veth0_macvtap: entered promiscuous mode [ 85.792185][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.796783][ T5612] veth1_macvtap: entered promiscuous mode [ 85.815461][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.815484][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.825962][ T5622] Bluetooth: hci2: command tx timeout [ 85.825997][ T5622] Bluetooth: hci0: command tx timeout [ 85.843144][ T51] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.843189][ T51] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.843222][ T51] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.843255][ T51] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.843305][ T51] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.903533][ T53] Bluetooth: hci3: command tx timeout [ 85.903553][ T5622] Bluetooth: hci1: command tx timeout [ 85.905784][ T50] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.962892][ T51] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.966837][ T732] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.966861][ T732] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.968844][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.020129][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.052190][ T732] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.052214][ T732] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.106356][ T51] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.106648][ T51] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.153915][ T5610] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 86.201307][ T1038] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.201328][ T1038] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.255447][ T51] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.298493][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.298528][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.313357][ T51] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.313403][ T51] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.313436][ T51] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.313469][ T51] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.507187][ T51] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.507210][ T51] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.555146][ T5770] netlink: 'syz.1.2': attribute type 1 has an invalid length. [ 86.561287][ T5767] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 86.601583][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.601608][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.795017][ T51] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.795081][ T51] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.834044][ T5774] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 86.901500][ T5774] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 86.968033][ T5777] bonding: bond1 is being created... [ 87.006314][ T5777] bond1: (slave dummy0): making interface the new active one [ 87.007439][ T5777] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 87.041656][ T987] cfg80211: failed to load regulatory.db [ 87.378758][ T5783] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.527926][ T5783] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.719551][ T5783] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.740038][ T5789] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 87.861585][ T5783] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.899918][ T5792] bonding: bond1 is being created... [ 87.909806][ T53] Bluetooth: hci2: command tx timeout [ 87.909853][ T5622] Bluetooth: hci0: command tx timeout [ 87.926792][ T5792] bonding: bond1 already exists [ 87.962662][ T5792] bond1: option mode: unable to set because the bond device has slaves [ 87.963242][ T5775] NFSD: Unable to initialize client recovery tracking! (-110) [ 87.963261][ T5775] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 87.963271][ T5775] NFSD: starting 90-second grace period (net f000044c) [ 87.984319][ T5622] Bluetooth: hci1: command tx timeout [ 87.990219][ T5622] Bluetooth: hci3: command tx timeout [ 88.007110][ T5796] bond1: (slave dummy0): Error: Device is in use and cannot be enslaved [ 88.007137][ T5796] bond1: option slaves: unable to set because the bond device is up [ 88.018670][ T5794] md: array md0 already has disks! [ 88.033855][ T5792] 8021q: adding VLAN 0 to HW filter on device bond1 [ 88.066381][ T5794] md: loop0 has zero or unknown size, marking faulty! [ 88.066481][ T5794] md: md_import_device returned -22 [ 88.130193][ T5796] bond0: (slave bond_slave_0): Releasing backup interface [ 88.192336][ T5792] bond0: (slave bond_slave_1): Releasing backup interface [ 88.499409][ T5800] bonding: bond1 is being created... [ 88.558582][ T5807] netlink: 'syz.2.13': attribute type 1 has an invalid length. [ 88.612199][ T5800] bond1: (slave dummy0): making interface the new active one [ 88.626651][ T5800] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 88.718813][ T5813] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14'. [ 88.876223][ T5815] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 89.085463][ T5823] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 89.132657][ C0] ------------[ cut here ]------------ [ 89.132669][ C0] !oldest [ 89.132675][ C0] WARNING: net/wireless/scan.c:513 at __cfg80211_bss_update+0x1267/0x2010, CPU#0: syz.1.18/5819 [ 89.152354][ C0] Modules linked in: [ 89.152969][ T5824] md: array md0 already has disks! [ 89.161952][ C0] CPU: 0 UID: 0 PID: 5819 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full) [ 89.171138][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 89.181226][ C0] RIP: 0010:__cfg80211_bss_update+0x1267/0x2010 [ 89.187528][ C0] Code: c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 51 a9 f7 f6 49 ff 06 e9 ae 01 00 00 e8 24 80 87 f6 e9 a4 01 00 00 e8 1a 80 87 f6 90 <0f> 0b 90 4c 8b 2c 24 48 c7 c0 90 e2 9b 90 48 c1 e8 03 0f b6 04 28 [ 89.207199][ C0] RSP: 0018:ffffc900000071c8 EFLAGS: 00010246 [ 89.213339][ C0] RAX: ffffffff8b409256 RBX: ffff88807e6fbc00 RCX: ffff88801e378000 [ 89.221366][ C0] RDX: 8000000000000300 RSI: 0000000000000100 RDI: 0000000000000000 [ 89.229494][ C0] RBP: dffffc0000000000 R08: 0000000000000100 R09: 1ffff11004d6d109 [ 89.237543][ C0] R10: dffffc0000000000 R11: ffffed1004d6d10a R12: ffff888069110190 [ 89.245593][ C0] R13: ffff888069110190 R14: ffff88807e6fbc00 R15: 0000000000000001 [ 89.253735][ C0] FS: 00007f59858116c0(0000) GS:ffff88812485b000(0000) knlGS:0000000000000000 [ 89.262801][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 89.269567][ C0] CR2: 0000001b3381cff8 CR3: 00000000783da000 CR4: 00000000003526f0 [ 89.277627][ C0] Call Trace: [ 89.280941][ C0] [ 89.283868][ C0] ? cfg80211_inform_single_bss_data+0x990/0x1be0 [ 89.290346][ C0] cfg80211_inform_single_bss_data+0xc4a/0x1be0 [ 89.296657][ C0] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10 [ 89.303573][ C0] ? queue_work_on+0x117/0x1d0 [ 89.308367][ C0] ? cfg80211_inform_bss_data+0x24b/0x3cc0 [ 89.314320][ C0] cfg80211_inform_bss_data+0x263/0x3cc0 [ 89.319985][ C0] ? ieee80211_rx_handlers+0xc849/0xc8b0 [ 89.325658][ C0] ? __local_bh_enable_ip+0xd6/0x140 [ 89.331023][ C0] ? ieee80211_rx_handlers+0xc849/0xc8b0 [ 89.336747][ C0] ? __local_bh_enable_ip+0xd6/0x140 [ 89.342071][ C0] ? ieee80211_rx_handlers+0xc849/0xc8b0 [ 89.347776][ C0] ? __pfx_cfg80211_inform_bss_data+0x10/0x10 [ 89.353931][ C0] ? __pfx_ieee80211_rx_handlers+0x10/0x10 [ 89.359752][ C0] ? lock_acquire+0x115/0x350 [ 89.364489][ C0] ? __lock_acquire+0x747/0x2de0 [ 89.369468][ C0] cfg80211_inform_bss_frame_data+0x3c7/0x840 [ 89.375598][ C0] ? ieee80211_bss_info_update+0x30f/0xa50 [ 89.381434][ C0] ieee80211_bss_info_update+0x791/0xa50 [ 89.387152][ C0] ? __pfx_ieee80211_bss_info_update+0x10/0x10 [ 89.393381][ C0] ? kcov_remote_start+0x9c/0x7e0 [ 89.398471][ C0] ? ieee80211_get_channel_khz+0x15b/0x8a0 [ 89.404345][ C0] ieee80211_scan_rx+0x552/0xa40 [ 89.409336][ C0] ieee80211_rx_list+0x2d0e/0x3b00 [ 89.414521][ C0] ? __pfx_ieee80211_rx_list+0x10/0x10 [ 89.420041][ C0] ? lock_acquire+0x115/0x350 [ 89.424873][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 89.429949][ C0] ? ieee80211_rx_napi+0xd1/0x3d0 [ 89.435050][ C0] ieee80211_rx_napi+0x1ad/0x3d0 [ 89.440025][ C0] ? __pfx_ieee80211_rx_napi+0x10/0x10 [ 89.445523][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 89.451373][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 89.457247][ C0] ? skb_dequeue+0x124/0x160 [ 89.461885][ C0] ieee80211_handle_queued_frames+0xe4/0x1d0 [ 89.468005][ C0] tasklet_action_common+0x2d7/0x490 [ 89.473364][ C0] handle_softirqs+0x226/0x860 [ 89.478218][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 89.483030][ C0] __irq_exit_rcu+0xcb/0x220 [ 89.487648][ C0] irq_exit_rcu+0x9/0x30 [ 89.491906][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 89.497595][ C0] [ 89.500545][ C0] [ 89.503532][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 89.509534][ C0] RIP: 0010:finish_task_switch+0x413/0xc60 [ 89.515420][ C0] Code: 04 00 00 41 c7 84 24 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 77 dc 62 0a e8 12 12 3a 00 fb 4c 8b 65 c8 <49> 8d bc 24 10 17 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 [ 89.535076][ C0] RSP: 0018:ffffc90004b6f560 EFLAGS: 00000202 [ 89.541208][ C0] RAX: 000000000000847f RBX: ffff8880b843cb20 RCX: 8000000000000001 [ 89.549237][ C0] RDX: 0000000000000006 RSI: ffffffff8e59e74c RDI: ffffffff8c6f0580 [ 89.557260][ C0] RBP: ffffc90004b6f5b0 R08: ffffffff909bb37f R09: 1ffffffff213766f [ 89.565284][ C0] R10: dffffc0000000000 R11: fffffbfff2137670 R12: ffff88801e378000 [ 89.573310][ C0] R13: ffff88801e378000 R14: dffffc0000000000 R15: 1ffff11017087964 [ 89.581334][ C0] __schedule+0x17e5/0x5940 [ 89.585939][ C0] ? __pfx___schedule+0x10/0x10 [ 89.590834][ C0] ? irqentry_exit+0x218/0x910 [ 89.595668][ C0] ? irqentry_exit+0x218/0x910 [ 89.600469][ C0] ? trace_irq_disable+0x3b/0x140 [ 89.605566][ C0] ? preempt_schedule_thunk+0x16/0x40 [ 89.611010][ C0] preempt_schedule_common+0x7f/0xd0 [ 89.616368][ C0] preempt_schedule_thunk+0x16/0x40 [ 89.621615][ C0] _raw_spin_unlock_irq+0x47/0x50 [ 89.626702][ C0] shmem_add_to_page_cache+0xa5e/0xd40 [ 89.632216][ C0] ? __pfx_shmem_add_to_page_cache+0x10/0x10 [ 89.638367][ C0] shmem_alloc_and_add_folio+0x854/0xf60 [ 89.644070][ C0] ? filemap_get_entry+0xcd/0x3f0 [ 89.649152][ C0] ? __pfx_filemap_get_entry+0x10/0x10 [ 89.654689][ C0] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 89.660877][ C0] ? shmem_allowable_huge_orders+0x325/0x6c0 [ 89.666926][ C0] shmem_get_folio_gfp+0x594/0x1330 [ 89.672269][ C0] shmem_fallocate+0x996/0xf10 [ 89.677126][ C0] ? __pfx_shmem_fallocate+0x10/0x10 [ 89.682448][ C0] ? lock_acquire+0x115/0x350 [ 89.687207][ C0] vfs_fallocate+0x65a/0x7e0 [ 89.691828][ C0] ? __fget_files+0x2a/0x420 [ 89.696590][ C0] ? __pfx_vfs_fallocate+0x10/0x10 [ 89.701751][ C0] __x64_sys_fallocate+0xbf/0x110 [ 89.706841][ C0] do_syscall_64+0x166/0x520 [ 89.711456][ C0] ? trace_irq_disable+0x3b/0x140 [ 89.716538][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.722834][ C0] ? clear_bhb_loop+0x70/0xc0 [ 89.727544][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.733486][ C0] RIP: 0033:0x7f598499e159 [ 89.737953][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 89.757620][ C0] RSP: 002b:00007f5985811028 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 89.766114][ C0] RAX: ffffffffffffffda RBX: 00007f5984c25fa0 RCX: 00007f598499e159 [ 89.774153][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 89.782156][ C0] RBP: 00007f5984a3506b R08: 0000000000000000 R09: 0000000000000000 [ 89.790199][ C0] R10: 0000000001000000 R11: 0000000000000246 R12: 0000000000000000 [ 89.798248][ C0] R13: 00007f5984c26038 R14: 00007f5984c25fa0 R15: 00007fff0a19a588 [ 89.806308][ C0] [ 89.809360][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 89.816667][ C0] CPU: 0 UID: 0 PID: 5819 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full) [ 89.825819][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 89.835904][ C0] Call Trace: [ 89.839215][ C0] [ 89.842175][ C0] vpanic+0x56d/0xa70 [ 89.846205][ C0] ? __pfx__printk+0x10/0x10 [ 89.850836][ C0] ? __pfx_vpanic+0x10/0x10 [ 89.855383][ C0] ? is_bpf_text_address+0x292/0x2b0 [ 89.860692][ C0] ? is_bpf_text_address+0x26/0x2b0 [ 89.865927][ C0] panic+0xc5/0xd0 [ 89.869688][ C0] ? __pfx_panic+0x10/0x10 [ 89.874156][ C0] __warn+0x315/0x4c0 [ 89.878170][ C0] ? __cfg80211_bss_update+0x1267/0x2010 [ 89.883835][ C0] ? __cfg80211_bss_update+0x1267/0x2010 [ 89.889494][ C0] __report_bug+0x276/0x570 [ 89.894039][ C0] ? tasklet_action_common+0x2d7/0x490 [ 89.899537][ C0] ? handle_softirqs+0x226/0x860 [ 89.904505][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 89.909573][ C0] ? __cfg80211_bss_update+0x1267/0x2010 [ 89.915239][ C0] ? __pfx___report_bug+0x10/0x10 [ 89.920315][ C0] ? vfs_fallocate+0x65a/0x7e0 [ 89.925127][ C0] ? __x64_sys_fallocate+0xbf/0x110 [ 89.930366][ C0] ? do_syscall_64+0x166/0x520 [ 89.935162][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.941282][ C0] ? __cfg80211_bss_update+0x1267/0x2010 [ 89.947045][ C0] report_bug+0x16b/0x220 [ 89.951426][ C0] ? __cfg80211_bss_update+0x1267/0x2010 [ 89.957090][ C0] ? __cfg80211_bss_update+0x1269/0x2010 [ 89.962771][ C0] handle_bug+0x9c/0x200 [ 89.967059][ C0] exc_invalid_op+0x1a/0x50 [ 89.971688][ C0] asm_exc_invalid_op+0x1a/0x20 [ 89.976747][ C0] RIP: 0010:__cfg80211_bss_update+0x1267/0x2010 [ 89.983029][ C0] Code: c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 51 a9 f7 f6 49 ff 06 e9 ae 01 00 00 e8 24 80 87 f6 e9 a4 01 00 00 e8 1a 80 87 f6 90 <0f> 0b 90 4c 8b 2c 24 48 c7 c0 90 e2 9b 90 48 c1 e8 03 0f b6 04 28 [ 90.002672][ C0] RSP: 0018:ffffc900000071c8 EFLAGS: 00010246 [ 90.008767][ C0] RAX: ffffffff8b409256 RBX: ffff88807e6fbc00 RCX: ffff88801e378000 [ 90.016753][ C0] RDX: 8000000000000300 RSI: 0000000000000100 RDI: 0000000000000000 [ 90.024743][ C0] RBP: dffffc0000000000 R08: 0000000000000100 R09: 1ffff11004d6d109 [ 90.032734][ C0] R10: dffffc0000000000 R11: ffffed1004d6d10a R12: ffff888069110190 [ 90.040906][ C0] R13: ffff888069110190 R14: ffff88807e6fbc00 R15: 0000000000000001 [ 90.049126][ C0] ? __cfg80211_bss_update+0x1fe6/0x2010 [ 90.054797][ C0] ? __cfg80211_bss_update+0x1fe6/0x2010 [ 90.060463][ C0] ? cfg80211_inform_single_bss_data+0x990/0x1be0 [ 90.066914][ C0] cfg80211_inform_single_bss_data+0xc4a/0x1be0 [ 90.073182][ C0] ? __pfx_cfg80211_inform_single_bss_data+0x10/0x10 [ 90.079906][ C0] ? queue_work_on+0x117/0x1d0 [ 90.084697][ C0] ? cfg80211_inform_bss_data+0x24b/0x3cc0 [ 90.090532][ C0] cfg80211_inform_bss_data+0x263/0x3cc0 [ 90.096211][ C0] ? ieee80211_rx_handlers+0xc849/0xc8b0 [ 90.102148][ C0] ? __local_bh_enable_ip+0xd6/0x140 [ 90.107658][ C0] ? ieee80211_rx_handlers+0xc849/0xc8b0 [ 90.113324][ C0] ? __local_bh_enable_ip+0xd6/0x140 [ 90.118639][ C0] ? ieee80211_rx_handlers+0xc849/0xc8b0 [ 90.124302][ C0] ? __pfx_cfg80211_inform_bss_data+0x10/0x10 [ 90.130412][ C0] ? __pfx_ieee80211_rx_handlers+0x10/0x10 [ 90.136330][ C0] ? lock_acquire+0x115/0x350 [ 90.141049][ C0] ? __lock_acquire+0x747/0x2de0 [ 90.146040][ C0] cfg80211_inform_bss_frame_data+0x3c7/0x840 [ 90.152143][ C0] ? ieee80211_bss_info_update+0x30f/0xa50 [ 90.157974][ C0] ieee80211_bss_info_update+0x791/0xa50 [ 90.163658][ C0] ? __pfx_ieee80211_bss_info_update+0x10/0x10 [ 90.170026][ C0] ? kcov_remote_start+0x9c/0x7e0 [ 90.175091][ C0] ? ieee80211_get_channel_khz+0x15b/0x8a0 [ 90.181005][ C0] ieee80211_scan_rx+0x552/0xa40 [ 90.186063][ C0] ieee80211_rx_list+0x2d0e/0x3b00 [ 90.191221][ C0] ? __pfx_ieee80211_rx_list+0x10/0x10 [ 90.196706][ C0] ? lock_acquire+0x115/0x350 [ 90.201412][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 90.206476][ C0] ? ieee80211_rx_napi+0xd1/0x3d0 [ 90.211513][ C0] ieee80211_rx_napi+0x1ad/0x3d0 [ 90.216482][ C0] ? __pfx_ieee80211_rx_napi+0x10/0x10 [ 90.221970][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 90.227851][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 90.233709][ C0] ? skb_dequeue+0x124/0x160 [ 90.238349][ C0] ieee80211_handle_queued_frames+0xe4/0x1d0 [ 90.244378][ C0] tasklet_action_common+0x2d7/0x490 [ 90.249702][ C0] handle_softirqs+0x226/0x860 [ 90.254503][ C0] ? __irq_exit_rcu+0xcb/0x220 [ 90.259395][ C0] __irq_exit_rcu+0xcb/0x220 [ 90.264024][ C0] irq_exit_rcu+0x9/0x30 [ 90.268298][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 90.273954][ C0] [ 90.276904][ C0] [ 90.279946][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 90.286034][ C0] RIP: 0010:finish_task_switch+0x413/0xc60 [ 90.291850][ C0] Code: 04 00 00 41 c7 84 24 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 77 dc 62 0a e8 12 12 3a 00 fb 4c 8b 65 c8 <49> 8d bc 24 10 17 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 [ 90.311497][ C0] RSP: 0018:ffffc90004b6f560 EFLAGS: 00000202 [ 90.317603][ C0] RAX: 000000000000847f RBX: ffff8880b843cb20 RCX: 8000000000000001 [ 90.325600][ C0] RDX: 0000000000000006 RSI: ffffffff8e59e74c RDI: ffffffff8c6f0580 [ 90.333591][ C0] RBP: ffffc90004b6f5b0 R08: ffffffff909bb37f R09: 1ffffffff213766f [ 90.341586][ C0] R10: dffffc0000000000 R11: fffffbfff2137670 R12: ffff88801e378000 [ 90.349592][ C0] R13: ffff88801e378000 R14: dffffc0000000000 R15: 1ffff11017087964 [ 90.357603][ C0] __schedule+0x17e5/0x5940 [ 90.362166][ C0] ? __pfx___schedule+0x10/0x10 [ 90.367049][ C0] ? irqentry_exit+0x218/0x910 [ 90.371841][ C0] ? irqentry_exit+0x218/0x910 [ 90.376654][ C0] ? trace_irq_disable+0x3b/0x140 [ 90.381704][ C0] ? preempt_schedule_thunk+0x16/0x40 [ 90.387144][ C0] preempt_schedule_common+0x7f/0xd0 [ 90.392476][ C0] preempt_schedule_thunk+0x16/0x40 [ 90.397697][ C0] _raw_spin_unlock_irq+0x47/0x50 [ 90.402741][ C0] shmem_add_to_page_cache+0xa5e/0xd40 [ 90.408249][ C0] ? __pfx_shmem_add_to_page_cache+0x10/0x10 [ 90.414362][ C0] shmem_alloc_and_add_folio+0x854/0xf60 [ 90.420020][ C0] ? filemap_get_entry+0xcd/0x3f0 [ 90.425078][ C0] ? __pfx_filemap_get_entry+0x10/0x10 [ 90.430547][ C0] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 90.436720][ C0] ? shmem_allowable_huge_orders+0x325/0x6c0 [ 90.442731][ C0] shmem_get_folio_gfp+0x594/0x1330 [ 90.447967][ C0] shmem_fallocate+0x996/0xf10 [ 90.452766][ C0] ? __pfx_shmem_fallocate+0x10/0x10 [ 90.458080][ C0] ? lock_acquire+0x115/0x350 [ 90.462801][ C0] vfs_fallocate+0x65a/0x7e0 [ 90.467428][ C0] ? __fget_files+0x2a/0x420 [ 90.472051][ C0] ? __pfx_vfs_fallocate+0x10/0x10 [ 90.477275][ C0] __x64_sys_fallocate+0xbf/0x110 [ 90.482334][ C0] do_syscall_64+0x166/0x520 [ 90.486944][ C0] ? trace_irq_disable+0x3b/0x140 [ 90.491988][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.498154][ C0] ? clear_bhb_loop+0x70/0xc0 [ 90.502863][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.508784][ C0] RIP: 0033:0x7f598499e159 [ 90.513206][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.532819][ C0] RSP: 002b:00007f5985811028 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 90.541511][ C0] RAX: ffffffffffffffda RBX: 00007f5984c25fa0 RCX: 00007f598499e159 [ 90.549507][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 90.557499][ C0] RBP: 00007f5984a3506b R08: 0000000000000000 R09: 0000000000000000 [ 90.565487][ C0] R10: 0000000001000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.573490][ C0] R13: 00007f5984c26038 R14: 00007f5984c25fa0 R15: 00007fff0a19a588 [ 90.581503][ C0] [ 90.584880][ C0] Kernel Offset: disabled [ 90.589297][ C0] Rebooting in 86400 seconds..