last executing test programs: 3.93153942s ago: executing program 2 (id=15): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004b41460860163209ea800102030109021e0001000000000904"], 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_RDWR(r0, 0x707, &(0x7f00000003c0)={&(0x7f0000000180)=[{0x180, 0x4c01, 0x23, &(0x7f00000000c0)="01fcf573eb8a6c645f41754ca2c1e20095901f0c5292d15617c035d36b853e86cf4387"}], 0x1}) 3.04520838s ago: executing program 0 (id=22): r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) r1 = syz_usb_connect$cdc_ncm(0x0, 0x6e, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_connect$uac1(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x0, 0x0, 0x2, {0x0, 0x1}, {0x3a, 0x22}, @const={0x80}}) write$char_usb(r0, &(0x7f0000000040)="e2", 0x2250) 3.011243748s ago: executing program 3 (id=23): fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) 2.878845588s ago: executing program 3 (id=24): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e20, @loopback}}, 0x0, 0x0, 0x4, 0x0, "e83ae75240c2d6d8ec87bb53679fd0450078548ceb6c4414fab091000000000000000776aea5922406b64cddaeb9d339ba3c01c2c7d0df8e61740b9af2d4e499d58654a4cf0fa0ce1f830c3279cffcfd"}, 0xd8) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) sendmsg$inet(r0, 0x0, 0x4040000) 2.785201696s ago: executing program 3 (id=25): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000480)={0x34, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa}]}, 0x34}, 0x1, 0x0, 0x0, 0x4091}, 0x0) 2.78494643s ago: executing program 3 (id=26): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000001140), 0x700, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0xffffffffffff8000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') 2.522828339s ago: executing program 0 (id=27): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='1\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='1\n', 0x2) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='/dev/nullb1\n', 0xc) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) write(r4, &(0x7f0000000600)='1\n', 0x2) close(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r5, &(0x7f0000000740)='loop\n', 0x5) close(r5) symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/subsystems/testsubsys\x00') r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0) write(r6, &(0x7f0000000900)='transport=loop,nqn=testsubsys\n', 0x1e) 2.375778023s ago: executing program 1 (id=28): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendfile(r1, r0, 0x0, 0x7fffffffffffffff) 2.325656186s ago: executing program 2 (id=29): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x4c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x4}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xd4}}, 0x4000840) 2.287770008s ago: executing program 1 (id=30): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x0, 0x20}, 0xc) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x5, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$sock(r0, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="11", 0xfffd}], 0x1}}], 0x1, 0x8015) 2.238308788s ago: executing program 0 (id=31): sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x440d0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) io_setup(0x200, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f0000000440)=[&(0x7f00000000c0)={0x0, 0x0, 0xa1, 0x1, 0x4, r0, &(0x7f0000000040)="1d", 0xfdef, 0x801}]) 2.104192406s ago: executing program 1 (id=32): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)="000000000902190001010080320904000001ff000000070581024000000902190001010080320904000001ff00000007058102000200120100020000004034127856000100000001", 0x48) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./gadget/ep1in-bulk\x00', 0x2, 0x24) preadv(r1, &(0x7f0000000040)=[{&(0x7f0000000780)=""/14, 0x30}], 0x1, 0x2, 0x9) 2.080666527s ago: executing program 2 (id=33): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000002280)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dd4603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa89f69c47a63133708cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa84fcd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfde5f05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de1594b75e5371a81c2c32d0c4a028a5aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dbfaf8eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4d0948a6e219b5769480e6d0a9bf0da9a5212f3dbc", 0x258}], 0x1, 0x0, 0x0, 0x900}}], 0x1, 0x20004080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/92, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 1.99662395s ago: executing program 2 (id=34): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000540)='cpuacct.stat\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xfffffe3b, 0x100000000000001) 1.905160128s ago: executing program 0 (id=35): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/class/block/zram0/disksize\x00', 0x1, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ptmx(0xffffffffffffff9c, 0x0, 0x101e01, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x53, &(0x7f0000000000)={0x0, 0x0}, 0x10) 1.904798449s ago: executing program 1 (id=36): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000540)=ANY=[@ANYBLOB="030083204ba238e4008631a7c2004e2300020009ff01000000000000000000000000000108000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000101"], 0x90) 1.870577776s ago: executing program 3 (id=37): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) setpriority(0x0, 0xffffffffffffffff, 0x800) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) setsockopt$nfc_llcp_NFC_LLCP_RW(r4, 0x118, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x840, 0x0, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x9, 0x12, 0xffffffffffffffff, 0x9a903000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000001380)=""/4080, 0xfffffffffffffdcc, 0x0, 0x0, 0xffffffffffffff87}, &(0x7f0000000000)=0x40) 1.796640202s ago: executing program 1 (id=38): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x28, r1, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) 456.851992ms ago: executing program 3 (id=39): r0 = mq_open(&(0x7f0000000500)='\x05\x0e7i\xc1\xb9\xdb\xea$E\xba\x85\xd1e\xdb\xe1\x81 \xc6\xe7\x90\x8eb\xff.\x82P\x05\x1a\r#\x16\xce\x055\xad\xb1\x00\x00\x10\xfd\xad\xe8o\xa2\xda\x01\x06\xba>3j\xbc\xa8\xcch\f\x7f}0\xbdfy~\x9c\xc6N\xd1\x8d\xa5\x03\v\xfc\x10\xe2\x86\xee\xb58\xf5\xce\xd1\x12\x15\\\x89\xe1\xc6\xc7W*+\xa2\xa2\x88\xf9\xc5?@\x827\xb8\x83)Q\xf1\xcb2B\x1d\x92\x13\x93\r\xd4\xca\x80H\xf1r\xa9G\xc9C\x89\xbf\xc1\xbfG0l&p\xa6\xa4\xc0\xe3\x9d\xca\xe5P\x85r$\x88\xe5\xb9\x8b\xa2z4\xccy\xef`\xff\x89D\xbd<\xc1#\xb0t\xa0\x90\b\xd4\x05\xe2\x1a\vU\x95\xf9\nqP\xda\\3y\x86?#\xc6\x8c\x8d\x80\xfa\x80\x9e\x91\xed\xf7\x88y\\\x0e\xa2\xa3[!`\xf7\xa5s\xb5\'@1j\x03|]\x83\xdf\xc8\xde\xd7\x93:9b\xacz,\x9d\x81\xd2]aG\x88\x8an\xfe=\x00', 0x2, 0x30, 0x0) gettid() r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x14}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x42, 0x300, 0x70bd2b, 0x25dfdbfc, {0x5}, [@typed={0x8, 0x3a, 0x0, 0x0, @fd=r0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x10) pipe2(0x0, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) write$input_event(0xffffffffffffffff, &(0x7f0000000140)={{0x0, 0xea60}, 0x15, 0x8}, 0x18) read$FUSE(0xffffffffffffffff, 0x0, 0x0) msgsnd(0x0, 0x0, 0x8, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) mprotect(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) r2 = syz_open_dev$evdev(&(0x7f000001fa80), 0x0, 0x3f) ioctl$EVIOCSCLOCKID(r2, 0x40084504, &(0x7f0000ffcffc)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) r5 = fcntl$dupfd(r4, 0x406, r4) sendto$inet(r4, 0x0, 0x0, 0x200047fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) modify_ldt$write2(0x11, &(0x7f0000000200)={0x77b, 0x0, 0x0, 0x1}, 0x10) rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) modify_ldt$read(0x0, &(0x7f0000002140)=""/4098, 0xfffffffffffffe8e) mount(0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_linger(r5, 0x1, 0x3c, &(0x7f00000001c0)={0x200000000000001, 0x3}, 0x8) sendmsg$NFT_BATCH(r5, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x4004001) 284.024099ms ago: executing program 2 (id=40): r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0) write(r0, &(0x7f0000000900)='transport=loop,nqn=testsubsys\n', 0x1e) close(r0) 191.544395ms ago: executing program 0 (id=41): openat$nullb(0xffffffffffffff9c, 0x0, 0x169802, 0x0) setns(0xc9, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x100) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/ipv4/tcp_ehash_entries\x00', 0x0, 0x0) read(r0, 0x0, 0xeffd) 190.465742ms ago: executing program 1 (id=42): syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/udp6\x00') socket$packet(0x11, 0x3, 0x300) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) unshare(0x22020600) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000, 0x401}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x18c6}, 0x0, 0x0) 2.602119ms ago: executing program 0 (id=43): mkdir(&(0x7f00000003c0)='./file0\x00', 0x83) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f00000087c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000004200)={0x50, 0x0, r1, {0x7, 0x29, 0x0, 0xffffffff85010014, 0x4, 0x7, 0x0, 0x0, 0x0, 0x0, 0x1, 0x5}}, 0x50) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x4b) syz_fuse_handle_req(r0, &(0x7f00000042c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x40000000000, {0x0, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f00000067c0), 0x2000, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="780000000000000002000000000000040000000000000000000000000000000004"], 0x0, 0x0, 0x0, 0x0}) getdents64(r2, &(0x7f0000000280)=""/235, 0x20000) 0s ago: executing program 2 (id=44): setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="01002cbd7000ffdbdf250400000014c11874732162"], 0x14}, 0x1, 0x0, 0x0, 0x20048001}, 0x800) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.94' (ED25519) to the list of known hosts. [ 63.700956][ T5593] cgroup: Unknown subsys name 'net' [ 63.831150][ T5593] cgroup: Unknown subsys name 'cpuset' [ 63.840621][ T5593] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 65.136429][ T5593] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 67.341434][ T5604] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 67.342515][ T5604] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 67.355472][ T5609] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 67.368950][ T5612] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 67.370680][ T5612] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 67.372656][ T5612] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 67.373138][ T5612] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 67.373521][ T5612] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 67.374283][ T5612] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 67.374842][ T5612] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 67.380569][ T4925] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 67.380993][ T4925] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 67.383067][ T4925] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 67.383242][ T4925] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 67.384015][ T4925] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 67.386318][ T4925] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 67.400109][ T5612] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 67.404987][ T4925] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 67.412141][ T5612] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 67.421332][ T4925] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 68.425361][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.426101][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.426231][ T5608] bridge_slave_0: entered allmulticast mode [ 68.427626][ T5608] bridge_slave_0: entered promiscuous mode [ 68.455703][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.455835][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.456174][ T5608] bridge_slave_1: entered allmulticast mode [ 68.458046][ T5608] bridge_slave_1: entered promiscuous mode [ 68.530915][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 68.533874][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 68.587465][ T5608] team0: Port device team_slave_0 added [ 68.601364][ T5608] team0: Port device team_slave_1 added [ 68.667634][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 68.667651][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.667670][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 68.731965][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 68.731980][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 68.732000][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 68.892835][ T5608] hsr_slave_0: entered promiscuous mode [ 68.893492][ T5608] hsr_slave_1: entered promiscuous mode [ 68.937027][ T5606] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.937189][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.937302][ T5606] bridge_slave_0: entered allmulticast mode [ 68.939603][ T5606] bridge_slave_0: entered promiscuous mode [ 68.971816][ T5606] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.971951][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.972060][ T5606] bridge_slave_1: entered allmulticast mode [ 68.973764][ T5606] bridge_slave_1: entered promiscuous mode [ 69.044344][ T5606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.076027][ T5606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.093205][ T5602] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.093362][ T5602] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.093474][ T5602] bridge_slave_0: entered allmulticast mode [ 69.095006][ T5602] bridge_slave_0: entered promiscuous mode [ 69.129386][ T5602] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.129507][ T5602] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.129581][ T5602] bridge_slave_1: entered allmulticast mode [ 69.130560][ T5602] bridge_slave_1: entered promiscuous mode [ 69.161260][ T5606] team0: Port device team_slave_0 added [ 69.193220][ T5606] team0: Port device team_slave_1 added [ 69.213514][ T5602] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.242489][ T5602] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.250510][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.250522][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.250541][ T5606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.253594][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.253605][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.253625][ T5606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.254444][ T5607] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.254609][ T5607] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.254717][ T5607] bridge_slave_0: entered allmulticast mode [ 69.256429][ T5607] bridge_slave_0: entered promiscuous mode [ 69.375495][ T5607] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.375593][ T5607] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.375776][ T5607] bridge_slave_1: entered allmulticast mode [ 69.376699][ T5607] bridge_slave_1: entered promiscuous mode [ 69.408822][ T5609] Bluetooth: hci3: command tx timeout [ 69.432796][ T5602] team0: Port device team_slave_0 added [ 69.451063][ T5606] hsr_slave_0: entered promiscuous mode [ 69.451778][ T5606] hsr_slave_1: entered promiscuous mode [ 69.452325][ T5606] debugfs: 'hsr0' already exists in 'hsr' [ 69.452384][ T5606] Cannot create hsr debugfs directory [ 69.466150][ T5602] team0: Port device team_slave_1 added [ 69.478071][ T5607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.496268][ T5609] Bluetooth: hci0: command tx timeout [ 69.496363][ T5604] Bluetooth: hci2: command tx timeout [ 69.496370][ T5609] Bluetooth: hci1: command tx timeout [ 69.503661][ T5607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.544944][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.544955][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.544973][ T5602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.609273][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.609286][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.609305][ T5602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.616361][ T5607] team0: Port device team_slave_0 added [ 69.634223][ T5607] team0: Port device team_slave_1 added [ 69.712471][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.712486][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.712505][ T5607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.742757][ T5602] hsr_slave_0: entered promiscuous mode [ 69.743677][ T5602] hsr_slave_1: entered promiscuous mode [ 69.744351][ T5602] debugfs: 'hsr0' already exists in 'hsr' [ 69.744368][ T5602] Cannot create hsr debugfs directory [ 69.745116][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.745126][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.745146][ T5607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.887321][ T5607] hsr_slave_0: entered promiscuous mode [ 69.887939][ T5607] hsr_slave_1: entered promiscuous mode [ 69.888935][ T5607] debugfs: 'hsr0' already exists in 'hsr' [ 69.888952][ T5607] Cannot create hsr debugfs directory [ 69.924424][ T5608] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 69.931659][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 69.932826][ T5608] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 69.943341][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 69.967968][ T5608] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 69.977619][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 69.978628][ T5608] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 69.990809][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.150261][ T5606] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 70.153344][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.153956][ T5606] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 70.158064][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.184315][ T5606] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 70.193472][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.194615][ T5606] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 70.197541][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.294165][ T5602] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 70.297407][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.298146][ T5602] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 70.309739][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.324287][ T5602] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 70.332133][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.344024][ T5602] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 70.345880][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.414395][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.444280][ T5607] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 70.447060][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 70.447922][ T5607] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 70.466648][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 70.479524][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.479790][ T5607] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 70.482103][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 70.482931][ T5607] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 70.485223][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 70.523152][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.523305][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.550406][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.550460][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.590830][ T5606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.639703][ T5606] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.663652][ T1387] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.663749][ T1387] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.711867][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.711966][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.767838][ T5602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.835488][ T5602] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.855829][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.855884][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.864810][ T5607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.887489][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.887546][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.921264][ T5607] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.948618][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.948717][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.991103][ T95] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.991501][ T95] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.011284][ T5602] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.332298][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.332367][ T1313] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.485584][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.494996][ T5609] Bluetooth: hci3: command tx timeout [ 71.568505][ T5609] Bluetooth: hci1: command tx timeout [ 71.568540][ T5609] Bluetooth: hci0: command tx timeout [ 71.568598][ T4925] Bluetooth: hci2: command tx timeout [ 71.667744][ T5608] veth0_vlan: entered promiscuous mode [ 71.685626][ T5608] veth1_vlan: entered promiscuous mode [ 71.733879][ T5608] veth0_macvtap: entered promiscuous mode [ 71.737973][ T5608] veth1_macvtap: entered promiscuous mode [ 71.843709][ T5607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.848122][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.882217][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.915009][ T5602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.985714][ T5606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.033217][ T5607] veth0_vlan: entered promiscuous mode [ 72.044104][ T95] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.044267][ T95] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.044321][ T95] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.073421][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.100276][ T5602] veth0_vlan: entered promiscuous mode [ 72.106778][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.106803][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.126023][ T5607] veth1_vlan: entered promiscuous mode [ 72.147637][ T5602] veth1_vlan: entered promiscuous mode [ 72.182117][ T45] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.182133][ T45] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.235120][ T5606] veth0_vlan: entered promiscuous mode [ 72.261051][ T5607] veth0_macvtap: entered promiscuous mode [ 72.267557][ T5608] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 72.281899][ T5606] veth1_vlan: entered promiscuous mode [ 72.283359][ T5602] veth0_macvtap: entered promiscuous mode [ 72.295209][ T5607] veth1_macvtap: entered promiscuous mode [ 72.321331][ T5602] veth1_macvtap: entered promiscuous mode [ 72.363035][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.393248][ T5749] netlink: 'syz.3.4': attribute type 1 has an invalid length. [ 72.393301][ T5749] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4'. [ 72.396966][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.444997][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.475844][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.500649][ T45] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.500705][ T45] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.500736][ T45] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.500766][ T45] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.501146][ T5606] veth0_macvtap: entered promiscuous mode [ 72.583529][ T5606] veth1_macvtap: entered promiscuous mode [ 72.589917][ T95] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.590035][ T95] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.590063][ T95] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.590090][ T95] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.706570][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.736540][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.737085][ T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.737098][ T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.932513][ T45] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.932529][ T45] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.025317][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.025335][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.069100][ T51] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.126474][ T51] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.126491][ T51] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.188416][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.188456][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.188488][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.229948][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.229964][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.290838][ T95] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.290856][ T95] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.568437][ T4925] Bluetooth: hci3: command tx timeout [ 73.649434][ T4925] Bluetooth: hci0: command tx timeout [ 73.649466][ T4925] Bluetooth: hci2: command tx timeout [ 73.649487][ T4925] Bluetooth: hci1: command tx timeout [ 73.739351][ T1221] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 73.941149][ T1221] usb 2-1: Using ep0 maxpacket: 16 [ 73.953762][ T1221] usb 2-1: New USB device found: idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 73.963080][ T1221] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 73.978702][ T1221] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 73.978722][ T1221] usb 2-1: Product: syz [ 73.978734][ T1221] usb 2-1: Manufacturer: syz [ 73.978747][ T1221] usb 2-1: SerialNumber: syz [ 73.995482][ T1221] usb 2-1: config 0 descriptor?? [ 74.089802][ T1221] hub 2-1:0.0: bad descriptor, ignoring hub [ 74.089985][ T1221] hub 2-1:0.0: probe with driver hub failed with error -5 [ 74.116419][ T1221] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 74.412780][ T33] audit: type=1400 audit(1790486034.724:2): apparmor="STATUS" info="failed to unpack profile capabilities" error=-71 profile="unconfined" name=223A6F pid=5756 comm="syz.0.1" name=223A6F offset=61 [ 74.676598][ T1221] usb 2-1: USB disconnect, device number 2 [ 74.726202][ T5774] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9'. [ 74.824124][ T5782] FAULT_INJECTION: forcing a failure. [ 74.824124][ T5782] name failslab, interval 1, probability 0, space 0, times 1 [ 74.824162][ T5782] CPU: 0 UID: 0 PID: 5782 Comm: syz.2.11 Not tainted syzkaller #0 PREEMPT(full) [ 74.824183][ T5782] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 74.824200][ T5782] Call Trace: [ 74.824210][ T5782] [ 74.824218][ T5782] dump_stack_lvl+0xe8/0x150 [ 74.824253][ T5782] should_fail_ex+0x3eb/0x540 [ 74.824285][ T5782] should_failslab+0xa8/0x100 [ 74.824311][ T5782] __kmalloc_noprof+0xf9/0x710 [ 74.824329][ T5782] ? asymmetric_key_generate_id+0x60/0x170 [ 74.824348][ T5782] ? asymmetric_key_generate_id+0x60/0x170 [ 74.824368][ T5782] ? asymmetric_key_generate_id+0x60/0x170 [ 74.824387][ T5782] ? asymmetric_key_generate_id+0x60/0x170 [ 74.824408][ T5782] ? __asan_memcpy+0x40/0x70 [ 74.824429][ T5782] asymmetric_key_generate_id+0x60/0x170 [ 74.824454][ T5782] x509_akid_note_kid+0xa7/0x200 [ 74.824482][ T5782] asn1_ber_decoder+0xed5/0x2590 [ 74.824527][ T5782] ? __pfx_asn1_ber_decoder+0x10/0x10 [ 74.824557][ T5782] ? __kasan_kmalloc+0x93/0xb0 [ 74.824582][ T5782] ? __kmalloc_cache_noprof+0x148/0x600 [ 74.824600][ T5782] ? x509_cert_parse+0x16a/0x7a0 [ 74.824630][ T5782] x509_cert_parse+0x227/0x7a0 [ 74.824657][ T5782] x509_key_preparse+0x64/0x6d0 [ 74.824681][ T5782] ? down_read+0x2b9/0x320 [ 74.824705][ T5782] asymmetric_key_preparse+0xb9/0x1b0 [ 74.824728][ T5782] __key_create_or_update+0x3a4/0xa70 [ 74.824766][ T5782] ? __pfx___key_create_or_update+0x10/0x10 [ 74.824798][ T5782] ? lookup_user_key+0xc82/0x1360 [ 74.824840][ T5782] ? __pfx_lookup_user_key_possessed+0x10/0x10 [ 74.824866][ T5782] ? __pfx_keyring_search_iterator+0x10/0x10 [ 74.824889][ T5782] key_create_or_update+0x42/0x60 [ 74.824919][ T5782] __se_sys_add_key+0x349/0x420 [ 74.824943][ T5782] ? __pfx___se_sys_add_key+0x10/0x10 [ 74.824973][ T5782] ? __x64_sys_add_key+0x20/0xc0 [ 74.824995][ T5782] do_syscall_64+0x166/0x520 [ 74.825011][ T5782] ? trace_irq_disable+0x3b/0x140 [ 74.825032][ T5782] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.825051][ T5782] ? clear_bhb_loop+0x70/0xc0 [ 74.825074][ T5782] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.825092][ T5782] RIP: 0033:0x7ffa6899e159 [ 74.825115][ T5782] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.825129][ T5782] RSP: 002b:00007ffa6980f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 74.825150][ T5782] RAX: ffffffffffffffda RBX: 00007ffa68c25fa0 RCX: 00007ffa6899e159 [ 74.825163][ T5782] RDX: 0000200000000780 RSI: 0000000000000000 RDI: 0000200000000040 [ 74.825175][ T5782] RBP: 00007ffa68a3506b R08: 0000000004c5bb4e R09: 0000000000000000 [ 74.825188][ T5782] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 74.825199][ T5782] R13: 00007ffa68c26038 R14: 00007ffa68c25fa0 R15: 00007fff9b6505e8 [ 74.825230][ T5782] [ 74.825238][ T5782] X.509: Couldn't decode AuthKeyIdentifier [ 75.366327][ T5788] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint [ 75.449599][ T5787] nvmet: adding nsid 1 to subsystem testsubsys [ 75.457064][ T5787] nvmet: failed to open block device /dev/nullb1: (-2) [ 75.561440][ T5798] virtio-fs: tag not found [ 75.649077][ T5609] Bluetooth: hci3: command tx timeout [ 75.651804][ T45] nvmet: Created nvm controller 1 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:6009352e-9ca0-4144-a7e7-1f42b5b0f9ed. [ 75.693117][ T5787] nvme nvme0: creating 2 I/O queues. [ 75.704617][ T5787] nvme nvme0: new ctrl: "testsubsys" [ 75.720054][ T5707] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 75.739770][ T5609] Bluetooth: hci1: command tx timeout [ 75.739799][ T5609] Bluetooth: hci2: command tx timeout [ 75.739818][ T5609] Bluetooth: hci0: command tx timeout [ 75.869936][ T5707] usb 3-1: Using ep0 maxpacket: 8 [ 75.871016][ T5707] usb 3-1: New USB device found: idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 75.875347][ T5707] usb 3-1: config index 0 descriptor too short (expected 30, got 18) [ 75.890582][ T5707] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 75.890602][ T5707] usb 3-1: Product: syz [ 75.890626][ T5707] usb 3-1: Manufacturer: syz [ 75.890639][ T5707] usb 3-1: SerialNumber: syz [ 75.919994][ T5707] usb 3-1: config 0 descriptor?? [ 75.936957][ T5707] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 75.937018][ T5707] usb 3-1: setting power ON [ 75.937341][ T5707] dvb-usb: bulk message failed: -22 (2/0) [ 75.985148][ T5707] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 75.986698][ T5707] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 75.986750][ T5707] usb 3-1: media controller created [ 76.067627][ T5707] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 76.102318][ T5707] usb 3-1: selecting invalid altsetting 6 [ 76.102339][ T5707] usb 3-1: digital interface selection failed (-22) [ 76.102356][ T5707] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 76.105145][ T5707] usb 3-1: setting power OFF [ 76.105187][ T5707] dvb-usb: bulk message failed: -22 (2/0) [ 76.105200][ T5707] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 76.105210][ T5707] (NULL device *): no alternate interface [ 76.136394][ T5794] dvb-usb: bulk message failed: -22 (3/0) [ 76.136413][ T5794] dvb-usb: bulk message failed: -22 (4/0) [ 76.136423][ T5794] cxusb: i2c read failed [ 76.191568][ T5707] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 76.206792][ T5707] usb 3-1: USB disconnect, device number 2 [ 76.614719][ T5825] null_blk: nullb1: using native zone append [ 76.640406][ T5825] null_blk: disk nullb1 created [ 76.647517][ T5825] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 76.649308][ T95] nvme nvme0: rescanning namespaces. [ 76.744469][ T1387] nvmet: Created nvm controller 2 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:6009352e-9ca0-4144-a7e7-1f42b5b0f9ed. [ 76.775771][ T5825] nvme nvme1: creating 2 I/O queues. [ 76.819048][ T5825] nvme nvme1: new ctrl: "testsubsys" [ 77.065243][ T5842] gadgetfs: bound to dummy_udc driver [ 79.012838][ T51] nvmet: Created nvm controller 3 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:6009352e-9ca0-4144-a7e7-1f42b5b0f9ed. [ 79.019846][ T5861] nvme nvme2: creating 2 I/O queues. [ 79.039697][ T5861] nvme nvme2: new ctrl: "testsubsys" [ 79.117586][ T51] [ 79.119947][ T51] ====================================================== [ 79.126959][ T51] WARNING: possible circular locking dependency detected [ 79.133978][ T51] syzkaller #0 Not tainted [ 79.138383][ T51] ------------------------------------------------------ [ 79.145389][ T51] kworker/u8:3/51 is trying to acquire lock: [ 79.151357][ T51] ffff88802bed0450 (&disk->zone_revalidate_mutex){+.+.}-{4:4}, at: blk_revalidate_disk_zones+0x1c5/0x1650 [ 79.162670][ T51] [ 79.162670][ T51] but task is already holding lock: [ 79.170027][ T51] ffff8880268609b0 (&q->q_usage_counter(io)#74){++++}-{0:0}, at: nvme_update_ns_info+0x3ac/0x1200 [ 79.180643][ T51] [ 79.180643][ T51] which lock already depends on the new lock. [ 79.180643][ T51] [ 79.191029][ T51] [ 79.191029][ T51] the existing dependency chain (in reverse order) is: [ 79.200025][ T51] [ 79.200025][ T51] -> #3 (&q->q_usage_counter(io)#74){++++}-{0:0}: [ 79.208612][ T51] blk_alloc_queue+0x544/0x690 [ 79.213885][ T51] __blk_alloc_disk+0xe3/0x1d0 [ 79.219153][ T51] nvme_mpath_alloc_disk+0x5c2/0x8b0 [ 79.224950][ T51] nvme_scan_ns+0x2e22/0x46c0 [ 79.230134][ T51] async_run_entry_fn+0x9d/0x430 [ 79.235582][ T51] process_scheduled_works+0xc3d/0x1630 [ 79.241633][ T51] worker_thread+0xa47/0xfb0 [ 79.246731][ T51] kthread+0x38b/0x480 [ 79.251308][ T51] ret_from_fork+0x514/0xb70 [ 79.256409][ T51] ret_from_fork_asm+0x1a/0x30 [ 79.261681][ T51] [ 79.261681][ T51] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 79.268871][ T51] fs_reclaim_acquire+0x71/0x100 [ 79.274314][ T51] __kmalloc_cache_node_noprof+0x66/0x620 [ 79.280542][ T51] init_rescuer+0x167/0x530 [ 79.285549][ T51] workqueue_init+0x214/0x680 [ 79.290736][ T51] kernel_init_freeable+0x26b/0x3e0 [ 79.296444][ T51] kernel_init+0x22/0x1d0 [ 79.301278][ T51] ret_from_fork+0x514/0xb70 [ 79.306376][ T51] ret_from_fork_asm+0x1a/0x30 [ 79.311646][ T51] [ 79.311646][ T51] -> #1 (wq_pool_mutex){+.+.}-{4:4}: [ 79.319097][ T51] __mutex_lock+0x197/0x15a0 [ 79.324191][ T51] __alloc_workqueue+0xe8d/0x21d0 [ 79.329714][ T51] alloc_workqueue_noprof+0xe3/0x210 [ 79.335504][ T51] blk_revalidate_disk_zones+0x8d1/0x1650 [ 79.341726][ T51] null_add_dev+0x12b8/0x1d70 [ 79.346907][ T51] nullb_device_power_store+0x240/0x380 [ 79.352955][ T51] configfs_write_iter+0x337/0x430 [ 79.358573][ T51] vfs_write+0x612/0xba0 [ 79.363318][ T51] ksys_write+0x150/0x270 [ 79.368146][ T51] do_syscall_64+0x166/0x520 [ 79.373235][ T51] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.379632][ T51] [ 79.379632][ T51] -> #0 (&disk->zone_revalidate_mutex){+.+.}-{4:4}: [ 79.388387][ T51] __lock_acquire+0x164c/0x2de0 [ 79.393750][ T51] lock_acquire+0x115/0x350 [ 79.398758][ T51] __mutex_lock+0x197/0x15a0 [ 79.403851][ T51] blk_revalidate_disk_zones+0x1c5/0x1650 [ 79.410071][ T51] nvme_mpath_revalidate_zones+0x106/0x1c0 [ 79.416381][ T51] nvme_update_ns_info+0x984/0x1200 [ 79.422082][ T51] nvme_scan_ns+0x34c1/0x46c0 [ 79.427266][ T51] async_run_entry_fn+0x9d/0x430 [ 79.432709][ T51] process_scheduled_works+0xc3d/0x1630 [ 79.438760][ T51] worker_thread+0xa47/0xfb0 [ 79.443855][ T51] kthread+0x38b/0x480 [ 79.448423][ T51] ret_from_fork+0x514/0xb70 [ 79.453523][ T51] ret_from_fork_asm+0x1a/0x30 [ 79.458793][ T51] [ 79.458793][ T51] other info that might help us debug this: [ 79.458793][ T51] [ 79.468997][ T51] Chain exists of: [ 79.468997][ T51] &disk->zone_revalidate_mutex --> fs_reclaim --> &q->q_usage_counter(io)#74 [ 79.468997][ T51] [ 79.483664][ T51] Possible unsafe locking scenario: [ 79.483664][ T51] [ 79.491092][ T51] CPU0 CPU1 [ 79.496437][ T51] ---- ---- [ 79.501783][ T51] lock(&q->q_usage_counter(io)#74); [ 79.507142][ T51] lock(fs_reclaim); [ 79.513624][ T51] lock(&q->q_usage_counter(io)#74); [ 79.521513][ T51] lock(&disk->zone_revalidate_mutex); [ 79.527041][ T51] [ 79.527041][ T51] *** DEADLOCK *** [ 79.527041][ T51] [ 79.535161][ T51] locks held by kworker/u8:3/51: 4, last CPU#1: [ 79.541380][ T51] #0: ffff88801c29b948 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 79.552240][ T51] #1: ffffc90000bb7c40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 79.564049][ T51] #2: ffff8880268609b0 (&q->q_usage_counter(io)#74){++++}-{0:0}, at: nvme_update_ns_info+0x3ac/0x1200 [ 79.575080][ T51] #3: ffff8880268609e8 (&q->q_usage_counter(queue)#59){+.+.}-{0:0}, at: nvme_update_ns_info+0x3ac/0x1200 [ 79.586373][ T51] [ 79.586373][ T51] stack backtrace: [ 79.592242][ T51] CPU: 1 UID: 0 PID: 51 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) [ 79.601502][ T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 79.611542][ T51] Workqueue: async async_run_entry_fn [ 79.616909][ T51] Call Trace: [ 79.620174][ T51] [ 79.623091][ T51] dump_stack_lvl+0xe8/0x150 [ 79.627669][ T51] print_circular_bug+0x2e2/0x300 [ 79.632681][ T51] check_noncircular+0x12f/0x150 [ 79.637606][ T51] __lock_acquire+0x164c/0x2de0 [ 79.642445][ T51] lock_acquire+0x115/0x350 [ 79.646932][ T51] ? blk_revalidate_disk_zones+0x1c5/0x1650 [ 79.652812][ T51] __mutex_lock+0x197/0x15a0 [ 79.657385][ T51] ? blk_revalidate_disk_zones+0x1c5/0x1650 [ 79.663262][ T51] ? blk_revalidate_disk_zones+0x1c5/0x1650 [ 79.669138][ T51] ? __pfx___mutex_lock+0x10/0x10 [ 79.674143][ T51] ? trace_sched_exit_tp+0x3a/0x130 [ 79.679327][ T51] ? __schedule+0x1b5d/0x5c60 [ 79.683989][ T51] blk_revalidate_disk_zones+0x1c5/0x1650 [ 79.689696][ T51] ? __pfx_blk_revalidate_disk_zones+0x10/0x10 [ 79.695833][ T51] ? irqentry_exit+0x218/0x910 [ 79.700578][ T51] ? lockdep_hardirqs_on+0x7b/0x110 [ 79.705765][ T51] ? irqentry_exit+0x218/0x910 [ 79.710513][ T51] ? __pfx_blk_revalidate_zone_cb+0x10/0x10 [ 79.716392][ T51] ? queue_work_on+0x162/0x1d0 [ 79.721143][ T51] nvme_mpath_revalidate_zones+0x106/0x1c0 [ 79.726942][ T51] nvme_update_ns_info+0x984/0x1200 [ 79.732128][ T51] ? __pfx_nvme_update_ns_info+0x10/0x10 [ 79.737748][ T51] ? __pfx_number+0x10/0x10 [ 79.742240][ T51] ? vsnprintf+0xe42/0xef0 [ 79.746648][ T51] ? __cancel_work+0x17f/0x230 [ 79.751398][ T51] ? lockdep_hardirqs_on+0x7b/0x110 [ 79.756586][ T51] ? __cancel_work+0x1dd/0x230 [ 79.761337][ T51] nvme_scan_ns+0x34c1/0x46c0 [ 79.766010][ T51] ? __pfx_nvme_scan_ns+0x10/0x10 [ 79.771018][ T51] ? try_to_wake_up+0x8c5/0x14d0 [ 79.775940][ T51] ? raise_softirq+0x2e/0x60 [ 79.780512][ T51] ? lockdep_hardirqs_on+0x7b/0x110 [ 79.785697][ T51] ? __lock_acquire+0x747/0x2de0 [ 79.790618][ T51] ? nvme_should_fail+0x202/0x2b0 [ 79.795626][ T51] ? __lock_acquire+0x747/0x2de0 [ 79.800554][ T51] ? register_lock_class+0x31/0x2e0 [ 79.805742][ T51] ? __lock_acquire+0x747/0x2de0 [ 79.810669][ T51] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 79.816813][ T51] ? lockdep_hardirqs_on+0x7b/0x110 [ 79.822000][ T51] ? __pfx_nvme_scan_ns_async+0x10/0x10 [ 79.827531][ T51] ? __pfx_nvme_scan_ns_async+0x10/0x10 [ 79.833063][ T51] async_run_entry_fn+0x9d/0x430 [ 79.837989][ T51] ? process_scheduled_works+0x97a/0x1630 [ 79.843691][ T51] process_scheduled_works+0xc3d/0x1630 [ 79.849232][ T51] ? __pfx_process_scheduled_works+0x10/0x10 [ 79.855199][ T51] ? assign_work+0x3cf/0x5d0 [ 79.859777][ T51] worker_thread+0xa47/0xfb0 [ 79.864359][ T51] kthread+0x38b/0x480 [ 79.868411][ T51] ? __pfx_worker_thread+0x10/0x10 [ 79.873508][ T51] ? __pfx_kthread+0x10/0x10 [ 79.878078][ T51] ret_from_fork+0x514/0xb70 [ 79.882656][ T51] ? __pfx_ret_from_fork+0x10/0x10 [ 79.887754][ T51] ? __switch_to+0xc78/0x1410 [ 79.892417][ T51] ? __pfx_kthread+0x10/0x10 [ 79.896989][ T51] ret_from_fork_asm+0x1a/0x30 [ 79.901747][ T51] [ 81.569303][ T27] cfg80211: failed to load regulatory.db