last executing test programs: 1m7.616117016s ago: executing program 0 (id=410): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000000)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000340)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x7ee, @empty, 0x1}, {0xa, 0x4e21, 0x8, @dev={0xfe, 0x80, '\x00', 0x37}, 0x108}, r1, 0xb}}, 0x48) write$RDMA_USER_CM_CMD_DESTROY_ID(r0, &(0x7f0000000f80)={0x1, 0x10, 0xfa00, {&(0x7f00000001c0), r1}}, 0x18) 58.052435225s ago: executing program 0 (id=412): r0 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) ftruncate(r0, 0x80079a0) sendfile(r0, r0, 0x0, 0x2000000000000011) ftruncate(r0, 0x40006d9) 57.536706515s ago: executing program 1 (id=413): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$l2tp(r0, &(0x7f00000000c0), 0x10) sendto$l2tp(r0, &(0x7f0000000040)="e5786a0d000000000000c83b", 0xc, 0x0, &(0x7f0000000100)={0x2, 0x0, @loopback}, 0x10) recvfrom$inet(r0, 0x0, 0x0, 0x40000140, 0x0, 0x0) 50.935992875s ago: executing program 1 (id=414): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000009, 0x4c831, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) 48.055898082s ago: executing program 0 (id=415): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x82581, 0x0) ioctl$TCSETSW(r0, 0x5403, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000026c0)=0x3d) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000100)={0xffffffff, 0x6e3, 0x6, 0x6, 0x17, "c7d92c0155b6056ee613657246ec62b016d5a9"}) 40.600552369s ago: executing program 1 (id=416): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, 0x0, 0x0) bind$can_raw(r0, &(0x7f0000000000), 0x10) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000100)=[{{0x0, 0x0, 0x1, 0x1}, {0x1}}], 0x8) 33.947103261s ago: executing program 0 (id=417): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000004c0)={'syz_tun\x00', 0x0}) r2 = socket(0x1d, 0x2, 0x6) bind$can_j1939(r2, &(0x7f0000000040)={0x1d, r1, 0x8000000000000002, {0x2, 0x1}}, 0x10) 28.426986489s ago: executing program 1 (id=418): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00020076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) close(0x3) 17.676780321s ago: executing program 0 (id=419): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'team_slave_0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @private0={0xfc, 0x0, '\x00', 0x1}, [], [0xff], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4ea4, 0x0, @local, 0x9}, 0x1c) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0x58c}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 3.231360986s ago: executing program 0 (id=420): r0 = socket(0x2, 0x1, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_CLEAR_SOCK(r1, 0xab04) 3.231226026s ago: executing program 1 (id=421): r0 = socket$can_raw(0x1d, 0x3, 0x1) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000080)="18", 0x1, 0x800, &(0x7f00000000c0)={0x11, 0xe, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) 0s ago: executing program 1 (id=422): bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0xc, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000200)={r0, 0x0, 0x0}, 0x10) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:21085' (ED25519) to the list of known hosts. syzkaller login: [ 659.102642][ T3233] cgroup: Unknown subsys name 'net' [ 660.112532][ T3233] cgroup: Unknown subsys name 'cpuset' [ 660.330696][ T3233] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 764.355872][ T3233] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 900.131377][ T3249] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 901.319582][ T3249] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 902.394073][ T3246] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 903.154566][ T3246] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 921.127373][ T3249] hsr_slave_0: entered promiscuous mode [ 921.187395][ T3249] hsr_slave_1: entered promiscuous mode [ 923.464839][ T3246] hsr_slave_0: entered promiscuous mode [ 923.516350][ T3246] hsr_slave_1: entered promiscuous mode [ 923.620313][ T3246] debugfs: 'hsr0' already exists in 'hsr' [ 923.624799][ T3246] Cannot create hsr debugfs directory [ 941.984568][ T3249] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 942.677150][ T3249] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 942.901607][ T3249] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 943.315922][ T3249] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 943.476161][ T3249] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 943.722742][ T3249] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 943.960887][ T3249] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 944.456375][ T3249] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 949.447290][ T3246] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 949.754314][ T3246] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 949.871016][ T3246] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 950.353389][ T3246] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 950.535418][ T3246] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 951.211413][ T3246] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 951.614756][ T3246] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 951.911761][ T3246] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 972.665372][ T3249] 8021q: adding VLAN 0 to HW filter on device bond0 [ 980.774469][ T3246] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1066.788343][ T3249] veth0_vlan: entered promiscuous mode [ 1069.870686][ T3249] veth1_vlan: entered promiscuous mode [ 1071.564101][ T3246] veth0_vlan: entered promiscuous mode [ 1075.494482][ T3246] veth1_vlan: entered promiscuous mode [ 1076.186660][ T3249] veth0_macvtap: entered promiscuous mode [ 1077.876455][ T3249] veth1_macvtap: entered promiscuous mode [ 1080.891172][ T3246] veth0_macvtap: entered promiscuous mode [ 1082.831741][ T3246] veth1_macvtap: entered promiscuous mode [ 1085.043161][ T981] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1085.196281][ T3380] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1085.213623][ T3380] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1085.316571][ T3380] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1092.164656][ T3380] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1092.185745][ T3380] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1092.279168][ T3380] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1092.306855][ T3380] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1100.947390][ T3249] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 1226.313262][ C0] Illegal XDP return value 16128 on prog (id 2) dev lo, expect packet loss! [ 1229.492621][ T3892] A link change request failed with some changes committed already. Interface sit0 may have been left with an inconsistent configuration, please check. [ 1371.692759][ T3936] macvlan0: entered allmulticast mode [ 1371.704920][ T3936] veth1_vlan: entered allmulticast mode [ 1378.659254][ T3938] input: syz1 as /devices/virtual/input/input0 [ 1421.071415][ T3956] mmap: syz.0.31 (3956) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 1421.765415][ T876] block nbd0: Receive control failed (result -32) [ 1421.790894][ T876] block nbd0: Receive control failed (result -32) [ 1421.912136][ T3953] nbd0: detected capacity change from 0 to 63 [ 1475.899826][ T3975] veth1_macvtap: left promiscuous mode [ 1475.933169][ T3975] macsec0: entered promiscuous mode [ 1478.550173][ T3976] veth1_macvtap: entered promiscuous mode [ 1478.723951][ T3976] macsec0: left promiscuous mode [ 1636.527163][ T4021] netlink: 16 bytes leftover after parsing attributes in process `syz.1.50'. [ 1734.949566][ T4048] netlink: 32 bytes leftover after parsing attributes in process `syz.1.61'. [ 1812.757267][ T4092] input: syz1 as /devices/virtual/input/input1 [ 1834.078625][ T4102] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 1834.078625][ T4102] The task syz.0.71 (4102) triggered the difference, watch for misbehavior. [ 1981.934873][ T4153] binder: BC_ATTEMPT_ACQUIRE not supported [ 1982.051401][ T4153] binder: 4152:4153 ioctl c0306201 2000000001c0 returned -22 [ 2032.072322][ T4172] netlink: 8 bytes leftover after parsing attributes in process `syz.0.91'. [ 2032.091396][ T4172] netlink: 12 bytes leftover after parsing attributes in process `syz.0.91'. [ 2059.464033][ T4183] ======================================================= [ 2059.464033][ T4183] WARNING: The mand mount option has been deprecated and [ 2059.464033][ T4183] and is ignored by this kernel. Remove the mand [ 2059.464033][ T4183] option from the mount to silence this warning. [ 2059.464033][ T4183] ======================================================= [ 2111.383518][ T4197] capability: warning: `syz.0.101' uses deprecated v2 capabilities in a way that may be insecure [ 2177.167049][ T4225] netlink: 36 bytes leftover after parsing attributes in process `syz.0.111'. [ 2205.275554][ T4234] syz.1.114 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 2225.761294][ T4239] binder: BC_ATTEMPT_ACQUIRE not supported [ 2225.886829][ T4239] binder: 4238:4239 ioctl c0306201 2000000001c0 returned -22 [ 2587.677197][ T4340] input: syz1 as /devices/virtual/input/input3 [ 2609.545070][ T4354] process 'syz.0.158' launched './file1' with NULL argv: empty string added [ 2846.733703][ T4433] block nbd1: shutting down sockets [ 2937.576896][ T4461] netlink: 'syz.0.196': attribute type 1 has an invalid length. [ 3064.451762][ T4502] netlink: 8 bytes leftover after parsing attributes in process `syz.0.210'. [ 3178.990628][ T4538] wireguard: wg1: Could not create IPv4 socket [ 3209.099841][ T4548] netlink: 20 bytes leftover after parsing attributes in process `syz.1.227'. [ 3350.917204][ T4589] netlink: 59 bytes leftover after parsing attributes in process `syz.1.242'. [ 3376.192640][ T4596] Zero length message leads to an empty skb [ 3384.625419][ T4598] binder: 4597:4598 ioctl c018620c 200000000000 returned -22 [ 3443.874519][ T4614] input: syz1 as /devices/virtual/input/input5 [ 3527.901265][ T4640] netlink: 8 bytes leftover after parsing attributes in process `syz.1.260'. [ 3615.692130][ T4665] netlink: 'syz.1.267': attribute type 3 has an invalid length. [ 3791.369859][ T4720] faux_driver vgem: [drm] Unknown color mode 11173; guessing buffer size. [ 3985.594214][ T4781] netlink: 8 bytes leftover after parsing attributes in process `syz.1.310'. [ 3985.631860][ T4781] netlink: 'syz.1.310': attribute type 5 has an invalid length. [ 4039.103449][ T4798] trusted_key: encrypted_key: keyword 'updat' not recognized [ 4051.396443][ T4806] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 4067.273497][ T4808] netlink: 16 bytes leftover after parsing attributes in process `syz.1.320'. [ 4160.145696][ T4845] netlink: 8 bytes leftover after parsing attributes in process `syz.0.331'. [ 4229.876025][ T4871] IPv6: NLM_F_CREATE should be specified when creating new route [ 4347.040567][ T4905] netlink: 8 bytes leftover after parsing attributes in process `syz.1.354'. [ 4347.054482][ T4905] netlink: 4 bytes leftover after parsing attributes in process `syz.1.354'. [ 4351.518741][ T4227] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 4351.592781][ T4227] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 4351.627269][ T4227] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 4351.670565][ T4227] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 4533.749685][ T4966] netlink: 'syz.0.379': attribute type 12 has an invalid length. [ 4776.174438][ T5079] [ 4776.175062][ T1040] block nbd0: Dead connection, failed to find a fallback [ 4776.176240][ T5079] ====================================================== [ 4776.176794][ T1040] block nbd0: shutting down sockets [ 4776.178041][ T5079] WARNING: possible circular locking dependency detected [ 4776.179918][ T5079] syzkaller #0 Tainted: G W L [ 4776.181019][ T5079] ------------------------------------------------------ [ 4776.182092][ T5079] syz.0.420/5079 is trying to acquire lock: [ 4776.183160][ T5079] ffffaf801f26c468 (&nsock->tx_lock){+.+.}-{4:4}, at: nbd_queue_rq+0x372/0xe44 [ 4776.187229][ T5079] [ 4776.187229][ T5079] but task is already holding lock: [ 4776.188361][ T5079] ffffaf8033d47338 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc4/0xe44 [ 4776.191087][ T5079] [ 4776.191087][ T5079] which lock already depends on the new lock. [ 4776.191087][ T5079] [ 4776.192347][ T5079] [ 4776.192347][ T5079] the existing dependency chain (in reverse order) is: [ 4776.193449][ T5079] [ 4776.193449][ T5079] -> #6 [ 4776.193256][ T1040] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 2 prio class 2 [ 4776.195144][ T5079] (&cmd->lock){+.+.}-{4:4}: [ 4776.196100][ T1040] Buffer I/O error on dev nbd0, logical block 0, async page read [ 4776.197673][ T5079] lock_acquire+0x246/0x500 [ 4776.199094][ T5079] __mutex_lock+0x164/0x18f4 [ 4776.199963][ T1040] Buffer I/O error on dev nbd0, logical block 1, async page read [ 4776.200274][ T5079] mutex_lock_nested+0x14/0x1c [ 4776.200827][ T5079] nbd_queue_rq+0xc4/0xe44 [ 4776.202751][ T5079] blk_mq_dispatch_rq_list+0x3cc/0x1ac0 [ 4776.203401][ T1040] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 4776.204530][ T1040] Buffer I/O error on dev nbd0, logical block 2, async page read [ 4776.205729][ T5079] __blk_mq_sched_dispatch_requests+0xe12/0x13cc [ 4776.207382][ T5079] blk_mq_sched_dispatch_requests+0xb2/0x174 [ 4776.208894][ T5079] blk_mq_run_hw_queue+0x274/0x6ec [ 4776.210396][ T5079] blk_mq_dispatch_list+0x53e/0x1430 [ 4776.212245][ T5079] blk_mq_flush_plug_list+0x114/0x55c [ 4776.213855][ T5079] __blk_flush_plug+0x270/0x464 [ 4776.215259][ T5079] __submit_bio+0x42e/0x504 [ 4776.216744][ T5079] submit_bio_noacct_nocheck+0x458/0xdec [ 4776.218435][ T5079] submit_bio_noacct+0x6fe/0x2168 [ 4776.219976][ T5079] submit_bio+0xb6/0x5b8 [ 4776.221430][ T5079] submit_bh_wbc+0x4d8/0x6bc [ 4776.222709][ T5079] block_read_full_folio+0x3f2/0x788 [ 4776.224125][ T5079] blkdev_read_folio+0x26/0x30 [ 4776.225638][ T5079] filemap_read_folio+0xc2/0x270 [ 4776.226892][ T5079] do_read_cache_folio+0x22e/0x518 [ 4776.228144][ T5079] read_cache_folio+0x4e/0x68 [ 4776.229356][ T5079] read_part_sector+0xbc/0x408 [ 4776.230832][ T5079] read_lba+0x1b6/0x32c [ 4776.232293][ T5079] find_valid_gpt.constprop.0+0x212/0x21ec [ 4776.234173][ T5079] efi_partition+0xfa/0xae0 [ 4776.235690][ T5079] bdev_disk_changed+0x5b8/0x11b4 [ 4776.237215][ T5079] blkdev_get_whole+0x168/0x25c [ 4776.238822][ T5079] bdev_open+0x288/0xcc4 [ 4776.240304][ T5079] blkdev_open+0x2ec/0x454 [ 4776.242034][ T5079] do_dentry_open+0x418/0x1170 [ 4776.243508][ T5079] vfs_open+0xba/0x3a8 [ 4776.244889][ T5079] path_openat+0x144e/0x2f28 [ 4776.246323][ T5079] do_file_open+0x1ae/0x398 [ 4776.247723][ T5079] do_sys_openat2+0xfe/0x1c0 [ 4776.249294][ T5079] __riscv_sys_openat+0x122/0x1e4 [ 4776.250904][ T5079] syscall_handler+0x92/0x114 [ 4776.252377][ T5079] do_trap_ecall_u+0x3dc/0x61c [ 4776.253749][ T5079] handle_exception+0x15e/0x16a [ 4776.255432][ T5079] [ 4776.255432][ T5079] -> #5 (set->srcu){.+.+}-{0:0}: [ 4776.257921][ T5079] lock_sync+0xea/0x1cc [ 4776.259510][ T5079] __synchronize_srcu+0xd4/0x2a8 [ 4776.261117][ T5079] synchronize_srcu+0x194/0x9e4 [ 4776.262743][ T5079] blk_mq_quiesce_queue+0x124/0x194 [ 4776.264232][ T5079] elevator_switch+0x16a/0x4e4 [ 4776.265594][ T5079] elevator_change+0x2f4/0x4ac [ 4776.266965][ T5079] elevator_set_default+0x280/0x370 [ 4776.268306][ T5079] blk_register_queue+0x40c/0x598 [ 4776.269589][ T5079] __add_disk+0x69a/0xda4 [ 4776.270963][ T5079] add_disk_fwnode+0xe8/0x48c [ 4776.272359][ T5079] device_add_disk+0x28/0x38 [ 4776.273673][ T5079] nbd_dev_add+0x692/0xaec [ 4776.274844][ T5079] nbd_init+0x3d4/0x3f8 [ 4776.276171][ T5079] do_one_initcall+0x18c/0xcc8 [ 4776.277444][ T5079] kernel_init_freeable+0x6d2/0x7bc [ 4776.278987][ T5079] kernel_init+0x28/0x240 [ 4776.280463][ T5079] ret_from_fork_kernel+0x94/0xef8 [ 4776.281890][ T5079] ret_from_fork_kernel_asm+0x16/0x18 [ 4776.283432][ T5079] [ 4776.283432][ T5079] -> #4 (&q->elevator_lock){+.+.}-{4:4}: [ 4776.285671][ T5079] lock_acquire+0x246/0x500 [ 4776.287031][ T5079] __mutex_lock+0x164/0x18f4 [ 4776.288253][ T5079] mutex_lock_nested+0x14/0x1c [ 4776.289487][ T5079] elevator_change+0x192/0x4ac [ 4776.290782][ T5079] elevator_set_none+0xa8/0x120 [ 4776.292111][ T5079] blk_mq_update_nr_hw_queues+0x43a/0x13a0 [ 4776.293712][ T5079] nbd_start_device+0x156/0xb74 [ 4776.295009][ T5079] nbd_genl_connect+0xe74/0x1a4c [ 4776.296378][ T5079] genl_family_rcv_msg_doit+0x1f6/0x2d8 [ 4776.297889][ T5079] genl_rcv_msg+0x4b2/0x73c [ 4776.299267][ T5079] netlink_rcv_skb+0x1e8/0x394 [ 4776.300688][ T5079] genl_rcv+0x32/0x4c [ 4776.301981][ T5079] netlink_unicast+0x4f6/0x7c0 [ 4776.303317][ T5079] netlink_sendmsg+0x7e0/0xd64 [ 4776.304696][ T5079] __sock_sendmsg+0xca/0x160 [ 4776.306055][ T5079] ____sys_sendmsg+0x636/0x794 [ 4776.307380][ T5079] ___sys_sendmsg+0x1a4/0x1e8 [ 4776.308665][ T5079] __sys_sendmsg+0x18e/0x234 [ 4776.310060][ T5079] __riscv_sys_sendmsg+0x70/0xa4 [ 4776.311464][ T5079] syscall_handler+0x92/0x114 [ 4776.312815][ T5079] do_trap_ecall_u+0x3dc/0x61c [ 4776.314171][ T5079] handle_exception+0x15e/0x16a [ 4776.315592][ T5079] [ 4776.315592][ T5079] -> #3 (&q->q_usage_counter(io)#19){++++}-{0:0}: [ 4776.318175][ T5079] lock_acquire+0x246/0x500 [ 4776.319517][ T5079] blk_alloc_queue+0x5b4/0x6f4 [ 4776.320970][ T5079] blk_mq_alloc_queue+0x15e/0x250 [ 4776.322206][ T5079] __blk_mq_alloc_disk+0x2a/0xd8 [ 4776.323380][ T5079] nbd_dev_add+0x426/0xaec [ 4776.324617][ T5079] nbd_init+0x3d4/0x3f8 [ 4776.325988][ T5079] do_one_initcall+0x18c/0xcc8 [ 4776.327238][ T5079] kernel_init_freeable+0x6d2/0x7bc [ 4776.328717][ T5079] kernel_init+0x28/0x240 [ 4776.330215][ T5079] ret_from_fork_kernel+0x94/0xef8 [ 4776.331565][ T5079] ret_from_fork_kernel_asm+0x16/0x18 [ 4776.333065][ T5079] [ 4776.333065][ T5079] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 4776.335254][ T5079] lock_acquire+0x246/0x500 [ 4776.336716][ T5079] fs_reclaim_acquire+0xc6/0x100 [ 4776.338103][ T5079] kmem_cache_alloc_node_noprof+0x40/0x6e8 [ 4776.339661][ T5079] __alloc_skb+0x17c/0x778 [ 4776.340953][ T5079] tcp_stream_alloc_skb+0x2e/0x4d8 [ 4776.342504][ T5079] tcp_sendmsg_locked+0xe1a/0x3f98 [ 4776.344028][ T5079] tcp_sendmsg+0x32/0x50 [ 4776.345533][ T5079] inet_sendmsg+0x9a/0xd8 [ 4776.346847][ T5079] __sock_sendmsg+0xca/0x160 [ 4776.348104][ T5079] sock_write_iter+0x298/0x3e8 [ 4776.349403][ T5079] vfs_write+0x648/0xc78 [ 4776.350933][ T5079] ksys_write+0x1f4/0x238 [ 4776.352097][ T5079] __riscv_sys_write+0x6e/0x94 [ 4776.353288][ T5079] syscall_handler+0x92/0x114 [ 4776.354698][ T5079] do_trap_ecall_u+0x3dc/0x61c [ 4776.356329][ T5079] handle_exception+0x15e/0x16a [ 4776.357902][ T5079] [ 4776.357902][ T5079] -> #1 (sk_lock-AF_INET){+.+.}-{0:0}: [ 4776.360178][ T5079] lock_acquire+0x246/0x500 [ 4776.361538][ T5079] lock_sock_nested+0x38/0xf8 [ 4776.363046][ T5079] inet_shutdown+0x68/0x3c0 [ 4776.364289][ T5079] kernel_sock_shutdown+0x58/0x7c [ 4776.365643][ T5079] nbd_mark_nsock_dead+0xaa/0x510 [ 4776.367549][ T5079] sock_shutdown+0x144/0x238 [ 4776.369113][ T5079] nbd_ioctl+0x22c/0xbd4 [ 4776.370301][ T5079] blkdev_ioctl+0x4cc/0x12e4 [ 4776.371615][ T5079] __riscv_sys_ioctl+0x17c/0x1e4 [ 4776.373033][ T5079] syscall_handler+0x92/0x114 [ 4776.374458][ T5079] do_trap_ecall_u+0x3dc/0x61c [ 4776.375935][ T5079] handle_exception+0x15e/0x16a [ 4776.377329][ T5079] [ 4776.377329][ T5079] -> #0 (&nsock->tx_lock){+.+.}-{4:4}: [ 4776.379542][ T5079] check_noncircular+0x138/0x14c [ 4776.381014][ T5079] __lock_acquire+0xe9c/0x25ac [ 4776.382565][ T5079] lock_acquire+0x246/0x500 [ 4776.383843][ T5079] __mutex_lock+0x164/0x18f4 [ 4776.385074][ T5079] mutex_lock_nested+0x14/0x1c [ 4776.386364][ T5079] nbd_queue_rq+0x372/0xe44 [ 4776.387734][ T5079] blk_mq_dispatch_rq_list+0x3cc/0x1ac0 [ 4776.389384][ T5079] __blk_mq_sched_dispatch_requests+0xe12/0x13cc [ 4776.390907][ T5079] blk_mq_sched_dispatch_requests+0xb2/0x174 [ 4776.392346][ T5079] blk_mq_run_hw_queue+0x274/0x6ec [ 4776.393753][ T5079] blk_mq_dispatch_list+0x53e/0x1430 [ 4776.395351][ T5079] blk_mq_flush_plug_list+0x114/0x55c [ 4776.396914][ T5079] __blk_flush_plug+0x270/0x464 [ 4776.398441][ T5079] __submit_bio+0x42e/0x504 [ 4776.399916][ T5079] submit_bio_noacct_nocheck+0x458/0xdec [ 4776.401465][ T5079] submit_bio_noacct+0x6fe/0x2168 [ 4776.402971][ T5079] submit_bio+0xb6/0x5b8 [ 4776.404359][ T5079] submit_bh_wbc+0x4d8/0x6bc [ 4776.405616][ T5079] block_read_full_folio+0x3f2/0x788 [ 4776.406991][ T5079] blkdev_read_folio+0x26/0x30 [ 4776.408516][ T5079] filemap_read_folio+0xc2/0x270 [ 4776.409726][ T5079] do_read_cache_folio+0x22e/0x518 [ 4776.411104][ T5079] read_cache_folio+0x4e/0x68 [ 4776.412309][ T5079] read_part_sector+0xbc/0x408 [ 4776.413700][ T5079] read_lba+0x1b6/0x32c [ 4776.415119][ T5079] find_valid_gpt.constprop.0+0x212/0x21ec [ 4776.416724][ T5079] efi_partition+0xfa/0xae0 [ 4776.418208][ T5079] bdev_disk_changed+0x5b8/0x11b4 [ 4776.419732][ T5079] blkdev_get_whole+0x168/0x25c [ 4776.421208][ T5079] bdev_open+0x288/0xcc4 [ 4776.422668][ T5079] blkdev_open+0x2ec/0x454 [ 4776.424061][ T5079] do_dentry_open+0x418/0x1170 [ 4776.425497][ T5079] vfs_open+0xba/0x3a8 [ 4776.426906][ T5079] path_openat+0x144e/0x2f28 [ 4776.428248][ T5079] do_file_open+0x1ae/0x398 [ 4776.429554][ T5079] do_sys_openat2+0xfe/0x1c0 [ 4776.431014][ T5079] __riscv_sys_openat+0x122/0x1e4 [ 4776.432510][ T5079] syscall_handler+0x92/0x114 [ 4776.433889][ T5079] do_trap_ecall_u+0x3dc/0x61c [ 4776.435265][ T5079] handle_exception+0x15e/0x16a [ 4776.436695][ T5079] [ 4776.436695][ T5079] other info that might help us debug this: [ 4776.436695][ T5079] [ 4776.438066][ T5079] Chain exists of: [ 4776.438066][ T5079] &nsock->tx_lock --> set->srcu --> &cmd->lock [ 4776.438066][ T5079] [ 4776.440949][ T5079] Possible unsafe locking scenario: [ 4776.440949][ T5079] [ 4776.442107][ T5079] CPU0 CPU1 [ 4776.443013][ T5079] ---- ---- [ 4776.443863][ T5079] lock(&cmd->lock); [ 4776.445171][ T5079] lock(set->srcu); [ 4776.446733][ T5079] lock(&cmd->lock); [ 4776.448245][ T5079] lock(&nsock->tx_lock); [ 4776.449543][ T5079] [ 4776.449543][ T5079] *** DEADLOCK *** [ 4776.449543][ T5079] [ 4776.450660][ T5079] 3 locks held by syz.0.420/5079: [ 4776.451755][ T5079] #0: ffffaf801a8d1350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x3c4/0xcc4 [ 4776.454951][ T5079] #1: ffffaf801a0b8a18 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_hw_queue+0x22c/0x6ec [ 4776.458290][ T5079] #2: ffffaf8033d47338 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc4/0xe44 [ 4776.461243][ T5079] [ 4776.461243][ T5079] stack backtrace: [ 4776.462721][ T5079] CPU: 1 UID: 0 PID: 5079 Comm: syz.0.420 Tainted: G W L syzkaller #0 PREEMPT [ 4776.463640][ T5079] Tainted: [W]=WARN, [L]=SOFTLOCKUP [ 4776.463890][ T5079] Hardware name: riscv-virtio,qemu (DT) [ 4776.464188][ T5079] Call Trace: [ 4776.464446][ T5079] [] dump_backtrace+0x2e/0x3c [ 4776.465332][ T5079] [] show_stack+0x30/0x3c [ 4776.465953][ T5079] [] dump_stack_lvl+0x114/0x1ac [ 4776.466859][ T5079] [] dump_stack+0x1c/0x28 [ 4776.467726][ T5079] [] print_circular_bug+0x250/0x29c [ 4776.468424][ T5079] [] check_noncircular+0x138/0x14c [ 4776.469116][ T5079] [] __lock_acquire+0xe9c/0x25ac [ 4776.469829][ T5079] [] lock_acquire+0x246/0x500 [ 4776.470501][ T5079] [] __mutex_lock+0x164/0x18f4 [ 4776.471120][ T5079] [] mutex_lock_nested+0x14/0x1c [ 4776.471719][ T5079] [] nbd_queue_rq+0x372/0xe44 [ 4776.472328][ T5079] [] blk_mq_dispatch_rq_list+0x3cc/0x1ac0 [ 4776.473211][ T5079] [] __blk_mq_sched_dispatch_requests+0xe12/0x13cc [ 4776.473933][ T5079] [] blk_mq_sched_dispatch_requests+0xb2/0x174 [ 4776.474631][ T5079] [] blk_mq_run_hw_queue+0x274/0x6ec [ 4776.475492][ T5079] [] blk_mq_dispatch_list+0x53e/0x1430 [ 4776.476388][ T5079] [] blk_mq_flush_plug_list+0x114/0x55c [ 4776.477295][ T5079] [] __blk_flush_plug+0x270/0x464 [ 4776.478156][ T5079] [] __submit_bio+0x42e/0x504 [ 4776.479004][ T5079] [] submit_bio_noacct_nocheck+0x458/0xdec [ 4776.479899][ T5079] [] submit_bio_noacct+0x6fe/0x2168 [ 4776.480734][ T5079] [] submit_bio+0xb6/0x5b8 [ 4776.481548][ T5079] [] submit_bh_wbc+0x4d8/0x6bc [ 4776.482216][ T5079] [] block_read_full_folio+0x3f2/0x788 [ 4776.482894][ T5079] [] blkdev_read_folio+0x26/0x30 [ 4776.483675][ T5079] [] filemap_read_folio+0xc2/0x270 [ 4776.484265][ T5079] [] do_read_cache_folio+0x22e/0x518 [ 4776.484894][ T5079] [] read_cache_folio+0x4e/0x68 [ 4776.485496][ T5079] [] read_part_sector+0xbc/0x408 [ 4776.486355][ T5079] [] read_lba+0x1b6/0x32c [ 4776.487163][ T5079] [] find_valid_gpt.constprop.0+0x212/0x21ec [ 4776.488058][ T5079] [] efi_partition+0xfa/0xae0 [ 4776.488892][ T5079] [] bdev_disk_changed+0x5b8/0x11b4 [ 4776.489721][ T5079] [] blkdev_get_whole+0x168/0x25c [ 4776.490578][ T5079] [] bdev_open+0x288/0xcc4 [ 4776.491393][ T5079] [] blkdev_open+0x2ec/0x454 [ 4776.492242][ T5079] [] do_dentry_open+0x418/0x1170 [ 4776.492985][ T5079] [] vfs_open+0xba/0x3a8 [ 4776.493712][ T5079] [] path_openat+0x144e/0x2f28 [ 4776.494418][ T5079] [] do_file_open+0x1ae/0x398 [ 4776.495113][ T5079] [] do_sys_openat2+0xfe/0x1c0 [ 4776.495939][ T5079] [] __riscv_sys_openat+0x122/0x1e4 [ 4776.496780][ T5079] [] syscall_handler+0x92/0x114 [ 4776.497504][ T5079] [] do_trap_ecall_u+0x3dc/0x61c [ 4776.498293][ T5079] [] handle_exception+0x15e/0x16a [ 4776.662126][ T5079] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 SYZFAIL: failed to recv rpc [ 4776.695743][ T5079] Buffer I/O error on dev nbd0, logical block 3, async page read fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 4776.943232][ T5079] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 4776.996795][ T5079] Buffer I/O error on dev nbd0, logical block 0, async page read [ 4777.092903][ T5079] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 4777.133652][ T5079] Buffer I/O error on dev nbd0, logical block 1, async page read [ 4777.137338][ T5079] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 4777.203610][ T5079] Buffer I/O error on dev nbd0, logical block 2, async page read [ 4777.243543][ T5079] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 4777.272286][ T5079] Buffer I/O error on dev nbd0, logical block 3, async page read [ 4777.323878][ T5079] nbd0: unable to read partition table