Warning: Permanently added '10.128.0.186' (ED25519) to the list of known hosts. 2026/09/15 05:39:17 parsed 1 programs 2026/09/15 05:39:17 serving rpc on tcp://46563 [ 80.647496][ T4284] cgroup: Unknown subsys name 'net' [ 80.783833][ T4284] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 82.530191][ T4284] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 84.140038][ T4302] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 84.148873][ T4302] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 84.156712][ T4302] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 84.165474][ T4302] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 84.173067][ T4302] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 84.180542][ T4302] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 84.774759][ T41] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.786396][ T41] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.796702][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 84.816771][ T41] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.826586][ T41] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.834835][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 86.586207][ T4355] chnl_net:caif_netlink_parms(): no params data found [ 86.631130][ T4355] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.639178][ T4355] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.647314][ T4355] device bridge_slave_0 entered promiscuous mode [ 86.666201][ T4355] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.673368][ T4355] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.681822][ T4355] device bridge_slave_1 entered promiscuous mode [ 86.701457][ T4355] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.714112][ T4355] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.746953][ T4355] team0: Port device team_slave_0 added [ 86.754128][ T4355] team0: Port device team_slave_1 added [ 86.760777][ T22] cfg80211: failed to load regulatory.db [ 86.780093][ T4355] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.787086][ T4355] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.814021][ T4355] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.840972][ T4355] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.848175][ T4355] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.874666][ T4355] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.913240][ T4355] device hsr_slave_0 entered promiscuous mode [ 86.920437][ T4355] device hsr_slave_1 entered promiscuous mode [ 87.032376][ T4355] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 87.042926][ T4355] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 87.053102][ T4355] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 87.062522][ T4355] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 87.133499][ T4355] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.154213][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 87.164143][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.174813][ T4355] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.185860][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 87.197396][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 87.210742][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.218083][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.228678][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 87.241951][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 87.251594][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 87.262019][ T4312] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.269192][ T4312] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.285402][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 87.311231][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 87.326682][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 87.336641][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 87.357020][ T4355] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 87.369943][ T4355] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 87.383288][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 87.391844][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 87.401256][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 87.410337][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 87.419386][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 87.434203][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 87.620230][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 87.627736][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 87.651837][ T4355] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.668607][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 87.693335][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 87.703129][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 87.711085][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 87.721226][ T4355] device veth0_vlan entered promiscuous mode [ 87.738174][ T4355] device veth1_vlan entered promiscuous mode [ 87.758855][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 87.766976][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 87.776017][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 87.790427][ T4355] device veth0_macvtap entered promiscuous mode [ 87.800394][ T4355] device veth1_macvtap entered promiscuous mode [ 87.816804][ T4355] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.825820][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 87.834437][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 87.843332][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 87.855492][ T4355] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.867753][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 87.876502][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 87.888417][ T4355] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.897239][ T4355] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.906285][ T4355] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.915049][ T4355] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.239626][ T57] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 2026/09/15 05:39:27 executed programs: 0 [ 88.915629][ T4302] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.924703][ T4302] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.932607][ T4302] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.941244][ T4302] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.949606][ T4302] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 88.956780][ T4302] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 89.074231][ T4384] chnl_net:caif_netlink_parms(): no params data found [ 89.118945][ T4384] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.126112][ T4384] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.134041][ T4384] device bridge_slave_0 entered promiscuous mode [ 89.142195][ T4384] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.149456][ T4384] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.157152][ T4384] device bridge_slave_1 entered promiscuous mode [ 89.179095][ T4384] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.189929][ T4384] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.212466][ T4384] team0: Port device team_slave_0 added [ 89.220025][ T4384] team0: Port device team_slave_1 added [ 89.241980][ T4384] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.249191][ T4384] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.275417][ T4384] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.287289][ T4384] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.294300][ T4384] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.320920][ T4384] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.354139][ T4384] device hsr_slave_0 entered promiscuous mode [ 89.361241][ T4384] device hsr_slave_1 entered promiscuous mode [ 89.367716][ T4384] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.375608][ T4384] Cannot create hsr debugfs directory [ 90.648600][ T57] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.998964][ T4302] Bluetooth: hci0: command 0x0409 tx timeout [ 92.867511][ T57] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.940153][ T57] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.079021][ T49] Bluetooth: hci0: command 0x041b tx timeout [ 93.823299][ T4384] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 93.834482][ T4384] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 93.863569][ T4384] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 93.875426][ T4384] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 93.915151][ T57] device hsr_slave_0 left promiscuous mode [ 93.922302][ T57] device hsr_slave_1 left promiscuous mode [ 93.930532][ T57] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 93.938319][ T57] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 93.947569][ T57] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 93.956000][ T57] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 93.964378][ T57] device bridge_slave_1 left promiscuous mode [ 93.971823][ T57] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.984046][ T57] device bridge_slave_0 left promiscuous mode [ 93.991763][ T57] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.020856][ T57] device veth1_macvtap left promiscuous mode [ 94.027368][ T57] device veth0_macvtap left promiscuous mode [ 94.034123][ T57] device veth1_vlan left promiscuous mode [ 94.040758][ T57] device veth0_vlan left promiscuous mode [ 94.390174][ T57] team0 (unregistering): Port device team_slave_1 removed [ 94.420043][ T57] team0 (unregistering): Port device team_slave_0 removed [ 94.449737][ T57] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 94.479499][ T57] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 94.671602][ T57] bond0 (unregistering): Released all slaves [ 94.817403][ T4384] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.843782][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 94.857485][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 94.875919][ T4384] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.885298][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 94.894070][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 94.903270][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.910417][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.935629][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 94.953453][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 94.962858][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 94.972227][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.979518][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.987717][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 94.997169][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 95.009963][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 95.019839][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 95.033773][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 95.052122][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 95.062619][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 95.073908][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 95.083236][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 95.098691][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 95.107276][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 95.118570][ T4384] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 95.158386][ T49] Bluetooth: hci0: command 0x040f tx timeout [ 95.325246][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 95.333518][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 95.361243][ T4384] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.377333][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 95.386121][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 95.404013][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 95.412929][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 95.421612][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 95.430289][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 95.441001][ T4384] device veth0_vlan entered promiscuous mode [ 95.452564][ T4384] device veth1_vlan entered promiscuous mode [ 95.469840][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 95.479883][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 95.488875][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 95.497406][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 95.513769][ T4384] device veth0_macvtap entered promiscuous mode [ 95.523144][ T4384] device veth1_macvtap entered promiscuous mode [ 95.540439][ T4384] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.547767][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 95.557656][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 95.565758][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 95.575193][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 95.592344][ T4384] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.600003][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 95.609261][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 95.619764][ T4384] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.628896][ T4384] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.637607][ T4384] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.647162][ T4384] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.706341][ T4312] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.722118][ T4312] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.741151][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 95.757208][ T4312] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.765875][ T4312] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.774671][ T4312] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 95.837525][ T4428] device syzkaller0 entered promiscuous mode [ 95.847039][ T4428] [ 95.849391][ T4428] ============================================ [ 95.855553][ T4428] WARNING: possible recursive locking detected [ 95.861700][ T4428] syzkaller #0 Not tainted [ 95.866111][ T4428] -------------------------------------------- [ 95.872271][ T4428] syz.0.17/4428 is trying to acquire lock: [ 95.878071][ T4428] ffff888027ea4108 (&sch->root_lock_key#43){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 [ 95.888126][ T4428] [ 95.888126][ T4428] but task is already holding lock: [ 95.895506][ T4428] ffff888027ea4108 (&sch->root_lock_key#43){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 [ 95.905527][ T4428] [ 95.905527][ T4428] other info that might help us debug this: [ 95.913575][ T4428] Possible unsafe locking scenario: [ 95.913575][ T4428] [ 95.921016][ T4428] CPU0 [ 95.924287][ T4428] ---- [ 95.927557][ T4428] lock(&sch->root_lock_key#43); [ 95.932579][ T4428] lock(&sch->root_lock_key#43); [ 95.937601][ T4428] [ 95.937601][ T4428] *** DEADLOCK *** [ 95.937601][ T4428] [ 95.945939][ T4428] May be due to missing lock nesting notation [ 95.945939][ T4428] [ 95.954260][ T4428] 3 locks held by syz.0.17/4428: [ 95.959204][ T4428] #0: ffffffff8cb2d840 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x281/0x3810 [ 95.969249][ T4428] #1: ffff888027ea4108 (&sch->root_lock_key#43){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 [ 95.979690][ T4428] #2: ffffffff8cb2d840 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x281/0x3810 [ 95.989603][ T4428] [ 95.989603][ T4428] stack backtrace: [ 95.995501][ T4428] CPU: 0 PID: 4428 Comm: syz.0.17 Not tainted syzkaller #0 [ 96.002795][ T4428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 96.012857][ T4428] Call Trace: [ 96.016156][ T4428] [ 96.019084][ T4428] dump_stack_lvl+0x188/0x24e [ 96.023759][ T4428] ? show_regs_print_info+0x12/0x12 [ 96.028956][ T4428] ? load_image+0x410/0x410 [ 96.033458][ T4428] __lock_acquire+0x12c8/0x7c40 [ 96.038324][ T4428] ? lockdep_lock+0x1f0/0x1f0 [ 96.043023][ T4428] ? verify_lock_unused+0x140/0x140 [ 96.048227][ T4428] ? add_lock_to_list+0x191/0x280 [ 96.053247][ T4428] ? verify_lock_unused+0x140/0x140 [ 96.058440][ T4428] ? __lock_acquire+0x28d6/0x7c40 [ 96.063486][ T4428] lock_acquire+0x1bb/0x4a0 [ 96.067985][ T4428] ? __dev_queue_xmit+0xe46/0x3810 [ 96.073114][ T4428] ? read_lock_is_recursive+0x10/0x10 [ 96.078490][ T4428] ? rcu_lockdep_current_cpu_online+0x33/0x120 [ 96.084666][ T4428] ? rcu_read_lock_bh_held+0x76/0xf0 [ 96.089954][ T4428] ? rcu_read_lock_held+0x40/0x40 [ 96.094974][ T4428] _raw_spin_lock+0x2a/0x40 [ 96.099562][ T4428] ? __dev_queue_xmit+0xe46/0x3810 [ 96.104695][ T4428] __dev_queue_xmit+0xe46/0x3810 [ 96.109640][ T4428] ? __dev_queue_xmit+0x281/0x3810 [ 96.114764][ T4428] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 96.120752][ T4428] ? __lock_acquire+0x7c40/0x7c40 [ 96.125773][ T4428] ? netdev_core_pick_tx+0x360/0x360 [ 96.131056][ T4428] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 96.137083][ T4428] ? lockdep_hardirqs_on+0x94/0x140 [ 96.142279][ T4428] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 96.148257][ T4428] ? _raw_spin_unlock+0x40/0x40 [ 96.153102][ T4428] ? stack_trace_save+0xa6/0xf0 [ 96.157959][ T4428] ? stack_trace_snprint+0xe0/0xe0 [ 96.163067][ T4428] ? tcf_mirred_offload_act_setup+0xb00/0xb00 [ 96.169136][ T4428] sch_frag_xmit_hook+0x2a4/0x11c0 [ 96.174262][ T4428] ? kasan_set_track+0x60/0x70 [ 96.179026][ T4428] ? kasan_set_track+0x4b/0x70 [ 96.183781][ T4428] ? slab_post_alloc_hook+0x4b/0x490 [ 96.189109][ T4428] ? kmem_cache_alloc+0x18b/0x2f0 [ 96.194131][ T4428] ? skb_clone+0x1e7/0x370 [ 96.198545][ T4428] ? tcf_mirred_act+0x563/0x1640 [ 96.203482][ T4428] ? tcf_action_exec+0x174/0x590 [ 96.208424][ T4428] ? basic_classify+0x1ae/0x2c0 [ 96.213279][ T4428] ? tcf_classify+0x33e/0xbf0 [ 96.217961][ T4428] ? qfq_enqueue+0x31c/0x12c0 [ 96.222636][ T4428] ? dev_qdisc_enqueue+0x4c/0x2b0 [ 96.227657][ T4428] ? __dev_queue_xmit+0x1031/0x3810 [ 96.232858][ T4428] ? packet_sendmsg+0x3a9e/0x4c30 [ 96.237881][ T4428] ? ____sys_sendmsg+0x5ed/0x9a0 [ 96.242836][ T4428] ? mq_dump_class_stats+0x490/0x490 [ 96.248119][ T4428] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 96.254221][ T4428] ? lockdep_lock+0xf1/0x1f0 [ 96.258808][ T4428] ? __copy_skb_header+0x3ba/0x4f0 [ 96.263911][ T4428] ? memcpy+0x3c/0x60 [ 96.267889][ T4428] ? __copy_skb_header+0x3ba/0x4f0 [ 96.273009][ T4428] ? __skb_clone+0x446/0x6c0 [ 96.277600][ T4428] ? skb_clone+0x21b/0x370 [ 96.282012][ T4428] ? tcf_mirred_act+0x552/0x1640 [ 96.286962][ T4428] tcf_mirred_act+0xb1c/0x1640 [ 96.291725][ T4428] tcf_action_exec+0x174/0x590 [ 96.296482][ T4428] basic_classify+0x1ae/0x2c0 [ 96.301154][ T4428] tcf_classify+0x33e/0xbf0 [ 96.305652][ T4428] qfq_enqueue+0x31c/0x12c0 [ 96.310250][ T4428] ? sch_tree_lock+0x1b0/0x1b0 [ 96.315011][ T4428] ? do_raw_spin_lock+0x128/0x2f0 [ 96.320041][ T4428] ? __rwlock_init+0x140/0x140 [ 96.324798][ T4428] dev_qdisc_enqueue+0x4c/0x2b0 [ 96.329660][ T4428] __dev_queue_xmit+0x1031/0x3810 [ 96.334700][ T4428] ? __dev_queue_xmit+0x281/0x3810 [ 96.339806][ T4428] ? _copy_from_iter+0x5df/0x1130 [ 96.344829][ T4428] ? netdev_core_pick_tx+0x360/0x360 [ 96.350110][ T4428] ? virtio_net_hdr_to_skb+0x938/0x12b0 [ 96.355652][ T4428] ? packet_extra_vlan_len_allowed+0x200/0x200 [ 96.361818][ T4428] ? dev_get_by_index+0x1e/0x2d0 [ 96.366786][ T4428] ? skb_put+0x10e/0x200 [ 96.371036][ T4428] packet_sendmsg+0x3a9e/0x4c30 [ 96.375921][ T4428] ? verify_lock_unused+0x140/0x140 [ 96.381123][ T4428] ? aa_sk_perm+0x81f/0x950 [ 96.385630][ T4428] ? aa_af_perm+0x340/0x340 [ 96.390153][ T4428] ? packet_getsockopt+0x980/0x980 [ 96.395263][ T4428] ? apparmor_socket_sendmsg+0x8a/0x330 [ 96.400825][ T4428] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 96.406125][ T4428] ? security_socket_sendmsg+0x7c/0xa0 [ 96.411577][ T4428] ? packet_getsockopt+0x980/0x980 [ 96.416685][ T4428] ____sys_sendmsg+0x5ed/0x9a0 [ 96.421447][ T4428] ? __sys_sendmsg_sock+0x30/0x30 [ 96.426466][ T4428] ? __import_iovec+0x306/0x510 [ 96.431316][ T4428] ? import_iovec+0x6f/0xa0 [ 96.435833][ T4428] ___sys_sendmsg+0x2a2/0x360 [ 96.440506][ T4428] ? lock_chain_count+0x20/0x20 [ 96.445357][ T4428] ? __sys_sendmsg+0x2a0/0x2a0 [ 96.450128][ T4428] ? __local_bh_enable_ip+0x136/0x1c0 [ 96.455583][ T4428] ? futex_wake+0x3f6/0x4f0 [ 96.460088][ T4428] __se_sys_sendmsg+0x1c3/0x2b0 [ 96.464955][ T4428] ? __x64_sys_sendmsg+0x80/0x80 [ 96.469900][ T4428] ? lockdep_hardirqs_on+0x94/0x140 [ 96.475116][ T4428] do_syscall_64+0x4c/0xa0 [ 96.479538][ T4428] ? clear_bhb_loop+0x60/0xb0 [ 96.484210][ T4428] ? clear_bhb_loop+0x60/0xb0 [ 96.488880][ T4428] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 96.494773][ T4428] RIP: 0033:0x7f6362f9e159 [ 96.499191][ T4428] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.518803][ T4428] RSP: 002b:00007ffd6aaf61d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 96.527256][ T4428] RAX: ffffffffffffffda RBX: 00007f6363225fa0 RCX: 00007f6362f9e159 [ 96.535656][ T4428] RDX: 0000000000004005 RSI: 0000200000000280 RDI: 0000000000000006 [ 96.543622][ T4428] RBP: 00007f636303503b R08: 0000000000000000 R09: 0000000000000000 [ 96.551588][ T4428] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.559569][ T4428] R13: 00007f6363225fac R14: 00007f6363225fa0 R15: 00007f6363225fa0 [ 96.567538][ T4428]