last executing test programs: 1.646736164s ago: executing program 1 (id=2): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000440), r0) sendmsg$IEEE802154_START_REQ(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000280)={0x14, r1, 0x101, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x8080) 1.509130546s ago: executing program 1 (id=5): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6gretap0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x25dedbfd, {0x0, 0x0, 0x0, r1, {0xb, 0xd}, {0xc, 0x2}, {0x8, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x48050}, 0x40004) 1.291561655s ago: executing program 1 (id=6): r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) epoll_pwait(r0, &(0x7f0000000140)=[{}], 0x1, 0x2d516fb6, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r3, 0x408c5333, &(0x7f0000000100)={0x6, 0x1, 0x1, 'queue1\x00', 0x9}) 1.032160199s ago: executing program 3 (id=4): r0 = syz_open_dev$video(&(0x7f0000000100), 0x3, 0x2000) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000080)=0x3ff) write$dsp(r4, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_emit_ethernet(0x6a, &(0x7f00000002c0)={@local, @broadcast, @void, {@ipv4={0x800, @tipc={{0xc, 0x4, 0x0, 0x3c, 0x5c, 0x67, 0x0, 0x3, 0x6, 0x0, @rand_addr=0x64010100, @local, {[@rr={0x7, 0xf, 0x7, [@initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0xa}, @multicast2]}, @ssrr={0x89, 0x7, 0x1e, [@multicast1]}, @lsrr={0x83, 0x3, 0x93}]}}, @payload_mcast={{{{{{0x2c, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x2, 0x5, 0x0, 0x1, 0x1, 0x0, 0x1, 0x800, 0x1, 0x1, 0x4e21, 0x4e22}, 0x1}, 0x3}, 0x1}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502000000e0000001"], 0x40}}, 0x0) sendmsg$key(r5, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0cc5605, &(0x7f00000025c0)={0x1, @vbi={0x8, 0x449, 0x47524247, 0x0, [0x4, 0x3], [0x40, 0x2], 0x13a}}) 454.802199ms ago: executing program 2 (id=3): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000006c0)="0000000000aa303e97380e90231bdbdaf6a4bd77eabcd3866226b7cdb7c268", 0x1f}, {&(0x7f0000000d00)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fbc84589ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe953054720185010000f1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac395430", 0x35d}], 0x2}, 0x0) setsockopt$RDS_CONG_MONITOR(r1, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x40) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'veth1_virt_wifi\x00'}) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x15) r5 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0xfffffffd, 0xb6}, 0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(0x0, r6, 0x0) io_uring_enter(r5, 0x47f6, 0x0, 0x4, 0x0, 0x0) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=ANY=[@ANYRES16=r7, @ANYBLOB="ad43000000f454000000"], 0x14}}, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x100000}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6a9}, 0x0, 0x0) 448.14681ms ago: executing program 0 (id=1): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x20000800) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0xb4, r1, 0x5, 0x4, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x76, 0xe, {{{}, {0x1}, @device_b, @broadcast, @from_mac}, 0x0, @default, 0x0, @void, @void, @val={0x3, 0x1, 0xb9}, @void, @void, @val={0x5, 0x1c, {0x1, 0x1b, 0x6, "b6dfa0316bbdde2d135a32243990e15178d061dfce4116d9a2"}}, @void, @void, @void, @val={0x2d, 0x1a, {0x20, 0x2, 0x1, 0x0, {0x7fffffffffffffff, 0x4, 0x0, 0x2, 0x0, 0x0, 0x1, 0x1}, 0x6, 0x2, 0xc0}}, @val={0x72, 0x6}, @val={0x71, 0x7, {0x1, 0x1, 0x0, 0x1, 0x1, 0xf0, 0x8}}, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}], @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x200}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x2}]}, 0xb4}}, 0x0) 0s ago: executing program 0 (id=7): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000810087406d040e0a759400000001090212000100000000090400200003"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.109' (ED25519) to the list of known hosts. [ 69.509723][ T5753] cgroup: Unknown subsys name 'net' [ 69.707031][ T5753] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 71.400154][ T5753] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 71.731539][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.739396][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 73.520457][ T5780] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 73.525015][ T5777] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 73.536106][ T5777] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 73.543630][ T5780] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 73.558646][ T5780] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 73.559113][ T5782] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 73.572743][ T5780] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 73.582328][ T5782] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 73.587771][ T5780] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 73.598769][ T5778] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 73.598935][ T5782] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 73.614952][ T5782] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 73.618107][ T5778] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 73.624305][ T5782] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 73.629354][ T5780] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 73.637561][ T5782] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 73.644814][ T5780] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 73.651415][ T5782] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 73.665452][ T5778] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 73.665855][ T5782] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 73.679823][ T5778] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 73.682413][ T5782] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 73.709571][ T5774] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 73.728212][ T5774] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 74.085052][ T5766] chnl_net:caif_netlink_parms(): no params data found [ 74.160323][ T5767] chnl_net:caif_netlink_parms(): no params data found [ 74.302865][ T5766] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.310665][ T5766] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.318247][ T5766] bridge_slave_0: entered allmulticast mode [ 74.325149][ T5766] bridge_slave_0: entered promiscuous mode [ 74.338173][ T5766] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.345449][ T5766] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.353088][ T5766] bridge_slave_1: entered allmulticast mode [ 74.360659][ T5766] bridge_slave_1: entered promiscuous mode [ 74.389881][ T5768] chnl_net:caif_netlink_parms(): no params data found [ 74.422424][ T5766] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.431784][ T5767] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.447786][ T5767] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.455129][ T5767] bridge_slave_0: entered allmulticast mode [ 74.469820][ T5767] bridge_slave_0: entered promiscuous mode [ 74.485715][ T5766] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.505337][ T5767] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.513279][ T5767] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.522729][ T5767] bridge_slave_1: entered allmulticast mode [ 74.530509][ T5767] bridge_slave_1: entered promiscuous mode [ 74.591762][ T5765] chnl_net:caif_netlink_parms(): no params data found [ 74.614124][ T5766] team0: Port device team_slave_0 added [ 74.623392][ T5767] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.635943][ T5767] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.658565][ T5766] team0: Port device team_slave_1 added [ 74.732655][ T5768] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.740044][ T5768] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.747464][ T5768] bridge_slave_0: entered allmulticast mode [ 74.754667][ T5768] bridge_slave_0: entered promiscuous mode [ 74.782287][ T5767] team0: Port device team_slave_0 added [ 74.790330][ T5766] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.797312][ T5766] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 74.824419][ T5766] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 74.836818][ T5768] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.844654][ T5768] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.852246][ T5768] bridge_slave_1: entered allmulticast mode [ 74.860030][ T5768] bridge_slave_1: entered promiscuous mode [ 74.873409][ T5767] team0: Port device team_slave_1 added [ 74.891912][ T5766] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 74.900897][ T5766] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 74.930685][ T5766] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.003464][ T5768] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.016523][ T5768] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.026919][ T5767] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.034736][ T5767] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.061506][ T5767] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.106868][ T5767] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.114220][ T5767] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.140592][ T5767] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.152607][ T5765] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.162258][ T5765] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.170443][ T5765] bridge_slave_0: entered allmulticast mode [ 75.177270][ T5765] bridge_slave_0: entered promiscuous mode [ 75.187006][ T5765] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.194592][ T5765] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.202728][ T5765] bridge_slave_1: entered allmulticast mode [ 75.210382][ T5765] bridge_slave_1: entered promiscuous mode [ 75.222853][ T5766] hsr_slave_0: entered promiscuous mode [ 75.229403][ T5766] hsr_slave_1: entered promiscuous mode [ 75.270699][ T5768] team0: Port device team_slave_0 added [ 75.303905][ T5765] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.326422][ T5768] team0: Port device team_slave_1 added [ 75.344773][ T5765] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.372999][ T5767] hsr_slave_0: entered promiscuous mode [ 75.380644][ T5767] hsr_slave_1: entered promiscuous mode [ 75.387095][ T5767] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 75.395144][ T5767] Cannot create hsr debugfs directory [ 75.444088][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.451432][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.477988][ T5768] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.496589][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.504057][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.531368][ T5768] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.546753][ T5765] team0: Port device team_slave_0 added [ 75.586964][ T5765] team0: Port device team_slave_1 added [ 75.677506][ T5768] hsr_slave_0: entered promiscuous mode [ 75.685213][ T5768] hsr_slave_1: entered promiscuous mode [ 75.691798][ T5768] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 75.700048][ T5768] Cannot create hsr debugfs directory [ 75.706343][ T5765] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.713700][ T5765] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.728767][ T5774] Bluetooth: hci0: command tx timeout [ 75.740661][ T5765] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.746484][ T5782] Bluetooth: hci3: command tx timeout [ 75.759307][ T5765] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.762785][ T5771] Bluetooth: hci1: command tx timeout [ 75.769512][ T5765] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 75.803038][ T5765] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.814090][ T5782] Bluetooth: hci2: command tx timeout [ 75.955361][ T5765] hsr_slave_0: entered promiscuous mode [ 75.962337][ T5765] hsr_slave_1: entered promiscuous mode [ 75.969634][ T5765] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 75.977373][ T5765] Cannot create hsr debugfs directory [ 76.182041][ T5766] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 76.197443][ T5766] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 76.223792][ T5766] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 76.247975][ T5766] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 76.359142][ T5767] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 76.373001][ T5767] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 76.385797][ T5767] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 76.395633][ T5767] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 76.497142][ T5768] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 76.510292][ T5768] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 76.524442][ T5768] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 76.536609][ T5768] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 76.609657][ T5766] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.641026][ T5765] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 76.652745][ T5765] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 76.663039][ T5765] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 76.688760][ T5765] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 76.738545][ T5767] 8021q: adding VLAN 0 to HW filter on device bond0 [ 76.767559][ T5766] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.812127][ T5767] 8021q: adding VLAN 0 to HW filter on device team0 [ 76.825982][ T1136] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.833505][ T1136] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.861054][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.868307][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.882286][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.889530][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.921330][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.928568][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.016935][ T5768] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.085650][ T5765] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.131361][ T5768] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.201519][ T1136] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.208939][ T1136] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.238599][ T5765] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.275643][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.282896][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.321677][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.329104][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.381406][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.388656][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.470400][ T5768] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 77.552326][ T5766] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.683716][ T5767] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.716589][ T5766] veth0_vlan: entered promiscuous mode [ 77.781141][ T5766] veth1_vlan: entered promiscuous mode [ 77.810344][ T5782] Bluetooth: hci3: command tx timeout [ 77.815926][ T5782] Bluetooth: hci1: command tx timeout [ 77.821592][ T5771] Bluetooth: hci0: command tx timeout [ 77.889590][ T5782] Bluetooth: hci2: command tx timeout [ 77.895702][ T5767] veth0_vlan: entered promiscuous mode [ 77.942620][ T5766] veth0_macvtap: entered promiscuous mode [ 77.971184][ T5766] veth1_macvtap: entered promiscuous mode [ 78.004438][ T5765] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.012437][ T5767] veth1_vlan: entered promiscuous mode [ 78.036703][ T5768] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.072238][ T5766] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.086419][ T5766] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.113798][ T5766] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.123969][ T5766] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.133441][ T5766] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.142757][ T5766] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.191324][ T5767] veth0_macvtap: entered promiscuous mode [ 78.223295][ T5767] veth1_macvtap: entered promiscuous mode [ 78.261703][ T5765] veth0_vlan: entered promiscuous mode [ 78.272228][ T5768] veth0_vlan: entered promiscuous mode [ 78.311568][ T5768] veth1_vlan: entered promiscuous mode [ 78.330492][ T5765] veth1_vlan: entered promiscuous mode [ 78.363954][ T5767] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 78.383830][ T5767] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.397166][ T5767] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.409253][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.422563][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.443306][ T5767] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 78.456366][ T5767] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.471272][ T5767] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.513406][ T5767] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.522334][ T5767] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.532164][ T5767] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.541066][ T5767] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.574174][ T5768] veth0_macvtap: entered promiscuous mode [ 78.580362][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.593703][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.638663][ T5768] veth1_macvtap: entered promiscuous mode [ 78.647383][ T5765] veth0_macvtap: entered promiscuous mode [ 78.691303][ T5765] veth1_macvtap: entered promiscuous mode [ 78.716721][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 78.743539][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.754294][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 78.765486][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.778231][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.811779][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 78.823312][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.834291][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 78.858502][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 78.883697][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.928362][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.937966][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.938580][ T5768] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.965892][ T5768] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.977093][ T5768] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.988373][ T5768] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.055477][ T5765] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.069871][ T5765] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.080087][ T5765] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.091304][ T5765] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.102001][ T5765] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 79.114622][ T5765] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.126443][ T5765] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.156198][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.169582][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.186372][ T5765] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.218924][ T5765] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.234532][ T5765] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.246722][ T5765] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.260259][ T5765] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 79.271161][ T5765] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 79.282402][ T5765] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.305661][ T5765] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.315969][ T5765] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.325658][ T5765] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.335824][ T5765] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.501122][ T5862] syz.1.6[5862]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 79.543457][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.564233][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.603822][ T3454] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.619216][ T3454] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.694639][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.720454][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.799466][ T4550] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.807357][ T4550] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.815143][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 79.823840][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 79.889977][ T5782] Bluetooth: hci1: command tx timeout [ 79.895640][ T5774] Bluetooth: hci0: command tx timeout [ 79.901323][ T5774] Bluetooth: hci3: command tx timeout [ 79.968041][ T5782] Bluetooth: hci2: command tx timeout [ 80.058682][ T5866] Zero length message leads to an empty skb [ 80.638401][ C1] ------------[ cut here ]------------ [ 80.644246][ C1] no supported rates for sta (null) (0xffffffff, band 0) in rate_mask 0xfff with flags 0x40 [ 80.655281][ C1] WARNING: CPU: 1 PID: 5865 at net/mac80211/rate.c:385 __rate_control_send_low+0x635/0x880 [ 80.665822][ C1] Modules linked in: [ 80.669881][ C1] CPU: 1 PID: 5865 Comm: syz.3.4 Not tainted syzkaller #0 [ 80.677039][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 80.687281][ C1] RIP: 0010:__rate_control_send_low+0x635/0x880 [ 80.693723][ C1] Code: 30 42 0f b6 04 28 84 c0 0f 85 e6 01 00 00 41 8b 0e 48 c7 c7 80 cc de 8b 48 8b 74 24 10 44 8b 44 24 1c 45 89 e1 e8 9b 91 56 f7 <0f> 0b e9 78 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 03 fa ff [ 80.713515][ C1] RSP: 0000:ffffc900001f0540 EFLAGS: 00010246 [ 80.719677][ C1] RAX: afa970393ce85a00 RBX: 000000000000000c RCX: ffff88802bb15a00 [ 80.727736][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002 [ 80.735866][ C1] RBP: 0000000000000084 R08: ffffc900001f0147 R09: 1ffff9200003e028 [ 80.743935][ C1] R10: dffffc0000000000 R11: fffff5200003e029 R12: 0000000000000040 [ 80.752103][ C1] R13: dffffc0000000000 R14: ffff88807d61b358 R15: ffff88802cc9c2a8 [ 80.760330][ C1] FS: 00007fcce9ef56c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 80.769354][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 80.775992][ C1] CR2: 0000200000277030 CR3: 000000005bd86000 CR4: 00000000003506e0 [ 80.784071][ C1] Call Trace: [ 80.787393][ C1] [ 80.790801][ C1] rate_control_send_low+0x194/0x790 [ 80.796153][ C1] rate_control_get_rate+0x20b/0x5d0 [ 80.801551][ C1] ieee80211_beacon_get_finish+0x3a2/0x6e0 [ 80.807499][ C1] ? ieee80211_set_beacon_cntdwn+0x660/0x660 [ 80.813744][ C1] ? __local_bh_enable_ip+0x13a/0x1c0 [ 80.819423][ C1] ? _local_bh_enable+0xa0/0xa0 [ 80.824327][ C1] ieee80211_beacon_get_ap+0x15a7/0x1b20 [ 80.830251][ C1] ? ieee80211_tx_8023+0x3c0/0x3c0 [ 80.835438][ C1] ? read_lock_is_recursive+0x20/0x20 [ 80.841001][ C1] ? __ieee80211_beacon_get+0x36/0x1600 [ 80.846854][ C1] __ieee80211_beacon_get+0x10eb/0x1600 [ 80.852663][ C1] ? __ieee80211_beacon_get+0x36/0x1600 [ 80.858298][ C1] ieee80211_beacon_get_tim+0xbf/0x580 [ 80.863845][ C1] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 80.870740][ C1] mac80211_hwsim_beacon_tx+0x3c7/0x780 [ 80.876363][ C1] __iterate_interfaces+0x243/0x500 [ 80.881671][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 80.888034][ C1] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 80.895294][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 80.901644][ C1] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 80.908824][ C1] mac80211_hwsim_beacon+0xbb/0x1b0 [ 80.914126][ C1] __hrtimer_run_queues+0x52a/0xc40 [ 80.919449][ C1] ? hw_scan_work+0xf60/0xf60 [ 80.924141][ C1] ? hrtimer_interrupt+0x9c0/0x9c0 [ 80.929280][ C1] ? ktime_get_update_offsets_now+0x3d2/0x3f0 [ 80.935356][ C1] hrtimer_run_softirq+0x187/0x2b0 [ 80.940504][ C1] handle_softirqs+0x280/0x820 [ 80.945361][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 80.950171][ C1] ? do_softirq+0x1a0/0x1a0 [ 80.954767][ C1] __irq_exit_rcu+0xd3/0x190 [ 80.959501][ C1] ? irq_exit_rcu+0x20/0x20 [ 80.964032][ C1] irq_exit_rcu+0x9/0x20 [ 80.968308][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 80.973963][ C1] [ 80.976932][ C1] [ 80.980228][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 80.986215][ C1] RIP: 0010:lock_is_held_type+0x13e/0x190 [ 80.991975][ C1] Code: 75 40 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 75 46 41 f7 c5 00 02 00 00 74 01 fb 65 48 8b 04 25 28 00 00 00 <48> 3b 44 24 08 75 3c 89 e8 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f [ 81.011898][ C1] RSP: 0000:ffffc90004d47ad8 EFLAGS: 00000206 [ 81.018026][ C1] RAX: afa970393ce85a00 RBX: ffff88802bb15a00 RCX: afa970393ce85a00 [ 81.026027][ C1] RDX: 0000000000000000 RSI: ffffffff8acada80 RDI: ffffffff8b1c81e0 [ 81.034046][ C1] RBP: 0000000000000000 R08: ffffc90004d476a7 R09: 1ffff920009a8ed4 [ 81.042155][ C1] R10: dffffc0000000000 R11: fffff520009a8ed5 R12: dffffc0000000000 [ 81.050358][ C1] R13: 0000000000000246 R14: ffffffff8d132000 R15: 00000000ffffffff [ 81.058469][ C1] __might_resched+0x9f/0x630 [ 81.063165][ C1] ? __might_sleep+0xe0/0xe0 [ 81.067790][ C1] ? __lock_acquire+0x7d40/0x7d40 [ 81.072936][ C1] __might_fault+0x71/0x120 [ 81.077470][ C1] do_recvmmsg+0x3c3/0x870 [ 81.082067][ C1] ? __sys_recvmmsg+0x290/0x290 [ 81.087033][ C1] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 81.092979][ C1] __x64_sys_recvmmsg+0x199/0x250 [ 81.098222][ C1] ? do_recvmmsg+0x870/0x870 [ 81.102950][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 81.108952][ C1] do_syscall_64+0x55/0xa0 [ 81.113525][ C1] ? clear_bhb_loop+0x40/0x90 [ 81.118281][ C1] ? clear_bhb_loop+0x40/0x90 [ 81.122991][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 81.128992][ C1] RIP: 0033:0x7fcce8f9c629 [ 81.133758][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 81.153785][ C1] RSP: 002b:00007fcce9ef5028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 81.162335][ C1] RAX: ffffffffffffffda RBX: 00007fcce9216090 RCX: 00007fcce8f9c629 [ 81.170545][ C1] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005 [ 81.178554][ C1] RBP: 00007fcce9032b39 R08: 0000000000000000 R09: 0000000000000000 [ 81.186631][ C1] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 81.194685][ C1] R13: 00007fcce9216128 R14: 00007fcce9216090 R15: 00007ffc607e7bd8 [ 81.202910][ C1] [ 81.206044][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 81.213418][ C1] CPU: 1 PID: 5865 Comm: syz.3.4 Not tainted syzkaller #0 [ 81.220618][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 81.230666][ C1] Call Trace: [ 81.233942][ C1] [ 81.237038][ C1] dump_stack_lvl+0x18c/0x250 [ 81.241720][ C1] ? show_regs_print_info+0x20/0x20 [ 81.247091][ C1] ? load_image+0x400/0x400 [ 81.251699][ C1] panic+0x2dc/0x730 [ 81.255702][ C1] ? bpf_jit_dump+0xd0/0xd0 [ 81.260323][ C1] __warn+0x2e0/0x470 [ 81.264400][ C1] ? __rate_control_send_low+0x635/0x880 [ 81.270033][ C1] ? __rate_control_send_low+0x635/0x880 [ 81.275867][ C1] report_bug+0x2be/0x4f0 [ 81.280198][ C1] ? __rate_control_send_low+0x635/0x880 [ 81.285930][ C1] ? __rate_control_send_low+0x635/0x880 [ 81.291680][ C1] ? __rate_control_send_low+0x637/0x880 [ 81.297357][ C1] handle_bug+0xcf/0x120 [ 81.301642][ C1] exc_invalid_op+0x1a/0x50 [ 81.306509][ C1] asm_exc_invalid_op+0x1a/0x20 [ 81.311368][ C1] RIP: 0010:__rate_control_send_low+0x635/0x880 [ 81.317783][ C1] Code: 30 42 0f b6 04 28 84 c0 0f 85 e6 01 00 00 41 8b 0e 48 c7 c7 80 cc de 8b 48 8b 74 24 10 44 8b 44 24 1c 45 89 e1 e8 9b 91 56 f7 <0f> 0b e9 78 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 03 fa ff [ 81.337860][ C1] RSP: 0000:ffffc900001f0540 EFLAGS: 00010246 [ 81.343931][ C1] RAX: afa970393ce85a00 RBX: 000000000000000c RCX: ffff88802bb15a00 [ 81.351901][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002 [ 81.359972][ C1] RBP: 0000000000000084 R08: ffffc900001f0147 R09: 1ffff9200003e028 [ 81.368214][ C1] R10: dffffc0000000000 R11: fffff5200003e029 R12: 0000000000000040 [ 81.376392][ C1] R13: dffffc0000000000 R14: ffff88807d61b358 R15: ffff88802cc9c2a8 [ 81.384481][ C1] rate_control_send_low+0x194/0x790 [ 81.389771][ C1] rate_control_get_rate+0x20b/0x5d0 [ 81.395054][ C1] ieee80211_beacon_get_finish+0x3a2/0x6e0 [ 81.400907][ C1] ? ieee80211_set_beacon_cntdwn+0x660/0x660 [ 81.406904][ C1] ? __local_bh_enable_ip+0x13a/0x1c0 [ 81.412278][ C1] ? _local_bh_enable+0xa0/0xa0 [ 81.417144][ C1] ieee80211_beacon_get_ap+0x15a7/0x1b20 [ 81.422813][ C1] ? ieee80211_tx_8023+0x3c0/0x3c0 [ 81.427941][ C1] ? read_lock_is_recursive+0x20/0x20 [ 81.433337][ C1] ? __ieee80211_beacon_get+0x36/0x1600 [ 81.438924][ C1] __ieee80211_beacon_get+0x10eb/0x1600 [ 81.444492][ C1] ? __ieee80211_beacon_get+0x36/0x1600 [ 81.450066][ C1] ieee80211_beacon_get_tim+0xbf/0x580 [ 81.455553][ C1] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 81.462528][ C1] mac80211_hwsim_beacon_tx+0x3c7/0x780 [ 81.468105][ C1] __iterate_interfaces+0x243/0x500 [ 81.473307][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 81.479550][ C1] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 81.487015][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 81.493340][ C1] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 81.500461][ C1] mac80211_hwsim_beacon+0xbb/0x1b0 [ 81.506016][ C1] __hrtimer_run_queues+0x52a/0xc40 [ 81.511227][ C1] ? hw_scan_work+0xf60/0xf60 [ 81.515983][ C1] ? hrtimer_interrupt+0x9c0/0x9c0 [ 81.521147][ C1] ? ktime_get_update_offsets_now+0x3d2/0x3f0 [ 81.527415][ C1] hrtimer_run_softirq+0x187/0x2b0 [ 81.532644][ C1] handle_softirqs+0x280/0x820 [ 81.537542][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 81.542316][ C1] ? do_softirq+0x1a0/0x1a0 [ 81.546827][ C1] __irq_exit_rcu+0xd3/0x190 [ 81.551422][ C1] ? irq_exit_rcu+0x20/0x20 [ 81.555949][ C1] irq_exit_rcu+0x9/0x20 [ 81.560228][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 81.565861][ C1] [ 81.568901][ C1] [ 81.571968][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 81.578005][ C1] RIP: 0010:lock_is_held_type+0x13e/0x190 [ 81.583738][ C1] Code: 75 40 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 75 46 41 f7 c5 00 02 00 00 74 01 fb 65 48 8b 04 25 28 00 00 00 <48> 3b 44 24 08 75 3c 89 e8 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f [ 81.603709][ C1] RSP: 0000:ffffc90004d47ad8 EFLAGS: 00000206 [ 81.609914][ C1] RAX: afa970393ce85a00 RBX: ffff88802bb15a00 RCX: afa970393ce85a00 [ 81.617900][ C1] RDX: 0000000000000000 RSI: ffffffff8acada80 RDI: ffffffff8b1c81e0 [ 81.625978][ C1] RBP: 0000000000000000 R08: ffffc90004d476a7 R09: 1ffff920009a8ed4 [ 81.634152][ C1] R10: dffffc0000000000 R11: fffff520009a8ed5 R12: dffffc0000000000 [ 81.642160][ C1] R13: 0000000000000246 R14: ffffffff8d132000 R15: 00000000ffffffff [ 81.650331][ C1] __might_resched+0x9f/0x630 [ 81.655029][ C1] ? __might_sleep+0xe0/0xe0 [ 81.659634][ C1] ? __lock_acquire+0x7d40/0x7d40 [ 81.664674][ C1] __might_fault+0x71/0x120 [ 81.669176][ C1] do_recvmmsg+0x3c3/0x870 [ 81.673594][ C1] ? __sys_recvmmsg+0x290/0x290 [ 81.678555][ C1] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 81.684817][ C1] __x64_sys_recvmmsg+0x199/0x250 [ 81.689865][ C1] ? do_recvmmsg+0x870/0x870 [ 81.694457][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 81.699651][ C1] do_syscall_64+0x55/0xa0 [ 81.704103][ C1] ? clear_bhb_loop+0x40/0x90 [ 81.709041][ C1] ? clear_bhb_loop+0x40/0x90 [ 81.713836][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 81.720000][ C1] RIP: 0033:0x7fcce8f9c629 [ 81.724516][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 81.744241][ C1] RSP: 002b:00007fcce9ef5028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 81.752681][ C1] RAX: ffffffffffffffda RBX: 00007fcce9216090 RCX: 00007fcce8f9c629 [ 81.760852][ C1] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005 [ 81.768843][ C1] RBP: 00007fcce9032b39 R08: 0000000000000000 R09: 0000000000000000 [ 81.777578][ C1] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 81.785661][ C1] R13: 00007fcce9216128 R14: 00007fcce9216090 R15: 00007ffc607e7bd8 [ 81.793781][ C1] [ 81.797039][ C1] Kernel Offset: disabled [ 81.801393][ C1] Rebooting in 86400 seconds..