last executing test programs:

718.950175ms ago: executing program 2 (id=567):
unshare(0x22020400)
r0 = socket(0x10, 0x803, 0x0)
bind$bt_hci(r0, 0x0, 0xc00)

660.844641ms ago: executing program 2 (id=569):
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001880)=@newtaction={0x6c, 0x30, 0x109, 0x0, 0x0, {}, [{0x58, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @remote, @local}}]}, {0xb074739e4276a0a0}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0)

660.412135ms ago: executing program 2 (id=572):
r0 = socket$kcm(0xa, 0x3, 0x3a)
sendmsg$kcm(r0, &(0x7f00000031c0)={&(0x7f00000006c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000b00)=[{0x10, 0x29, 0x3e}], 0x10}, 0x0)

600.06309ms ago: executing program 2 (id=573):
r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3)
setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, 0x0, 0x0)

550.926304ms ago: executing program 2 (id=576):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe)
r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6)
ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000340)={r0, r0, 0x8, 0x0, 0x0, 0x82, 0x4a, 0x15c2, 0x5886, 0x801, 0x0, 0x8, 'syz1\x00'})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
ioctl$sock_bt_hidp_HIDPGETCONNLIST(r1, 0x800448d2, &(0x7f0000000040)={0x1, &(0x7f0000000440)=[{@fixed}]})
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0)

489.276288ms ago: executing program 1 (id=580):
r0 = socket$kcm(0x2a, 0x2, 0x0)
sendmsg$kcm(r0, &(0x7f0000001540)={&(0x7f0000000040)=@qipcrtr={0x2a, 0xffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0)

441.538697ms ago: executing program 0 (id=581):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000001c0)=@newsa={0x144, 0x10, 0x713, 0x0, 0x0, {{@in=@broadcast, @in6=@mcast1, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x20}, {@in=@local, 0x0, 0x32}, @in6=@mcast1, {}, {}, {}, 0x0, 0x0, 0xa, 0x1}, [@tfcpad={0x8}, @algo_auth_trunc={0x4c, 0x14, {{'cmac(aes)\x00'}}}]}, 0x144}}, 0x0)

441.269606ms ago: executing program 2 (id=582):
r0 = socket$inet6(0xa, 0x3, 0x8)
ioctl$SIOCGSTAMP(r0, 0x8906, 0x0)
sendmmsg$inet6(r0, &(0x7f0000004580)=[{{&(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='$\x00\x00'], 0x28}}], 0x1, 0x0)
recvfrom$inet6(r0, 0x0, 0x0, 0x10000, &(0x7f0000000040)={0xa, 0x4e21, 0x6, @private0, 0x23}, 0x1c)

439.875571ms ago: executing program 1 (id=587):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075000000850000000800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000280)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x2111, 0x300, &(0x7f0000000100), 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50)

351.931527ms ago: executing program 1 (id=583):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0x2, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x8, 0x1}]}]}}, &(0x7f0000000180)=""/41, 0x2e, 0x29, 0x1, 0xa}, 0x28)

351.561411ms ago: executing program 0 (id=584):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00'}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r0}, 0x18)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

302.123294ms ago: executing program 1 (id=585):
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
getsockopt$bt_BT_RCVMTU(r0, 0x11, 0xd, 0x0, &(0x7f0000001c80))

301.864256ms ago: executing program 0 (id=586):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newtaction={0x6c, 0x30, 0xffff, 0x0, 0x0, {}, [{0x58, 0x1, [@m_gact={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18}, @TCA_GACT_PROB={0xc, 0x3, {0x2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0)

251.973919ms ago: executing program 1 (id=588):
socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5)
close(0x4)
syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00')
unshare(0x6a040000)
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10)
connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @local}, 0x10)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
sendto$inet(r0, &(0x7f00000000c0)="4000b86c0d", 0x5, 0xe61e2840a154b0c4, &(0x7f0000000000)={0x2, 0x4e22, @loopback}, 0x10)

251.562467ms ago: executing program 0 (id=589):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x24, 0x3e, 0x107, 0xfffffffc, 0x25dfdbfd, {0x2, 0x7c}, [@nested={0x4, 0x136}, @nested={0xc, 0x9, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x8e\n'}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x488c0}, 0xc050)

170.643153ms ago: executing program 0 (id=590):
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x8001}, 0x4)
r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f288476d2688a84c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48)

258.531µs ago: executing program 0 (id=591):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000007c0), 0xffffffffffffffff)
sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000140)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000ffdbdf25010000000c00040002000000000000000c00060001000000000000000c00020007000000000000000c00080001000000000000001c0007"], 0x60}}, 0x0)

0s ago: executing program 1 (id=592):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="5000000013000100000000008000000000000000", @ANYBLOB="00020000000000001c001a8018000a8029e2b2cc2eb278f200f5fffffffffeffe0000001140031"], 0x50}}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:10228' (ED25519) to the list of known hosts.
syzkaller login: [   56.729761][ T5816] cgroup: Unknown subsys name 'net'
[   56.831287][ T5816] cgroup: Unknown subsys name 'cpuset'
[   56.838196][ T5816] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   58.423260][ T5816] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   62.642530][ T5836] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   62.648155][ T5836] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   62.657283][ T5836] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   62.660373][ T5836] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   62.663082][ T5836] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   62.672346][ T5838] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   62.680978][ T5836] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   62.684637][ T5836] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   62.688669][ T5836] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   62.699569][ T5836] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   62.700757][   T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   62.706021][ T5222] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   62.709167][ T5222] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   62.716076][ T5222] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   62.720812][ T5222] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   63.013908][ T5840] chnl_net:caif_netlink_parms(): no params data found
[   63.066262][ T5832] chnl_net:caif_netlink_parms(): no params data found
[   63.084374][ T5831] chnl_net:caif_netlink_parms(): no params data found
[   63.163358][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.165970][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.169345][ T5840] bridge_slave_0: entered allmulticast mode
[   63.173198][ T5840] bridge_slave_0: entered promiscuous mode
[   63.185283][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.188412][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.191584][ T5840] bridge_slave_1: entered allmulticast mode
[   63.195373][ T5840] bridge_slave_1: entered promiscuous mode
[   63.255442][ T5831] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.258059][ T5831] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.260380][ T5831] bridge_slave_0: entered allmulticast mode
[   63.263115][ T5831] bridge_slave_0: entered promiscuous mode
[   63.276515][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.281620][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.284752][ T5831] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.288132][ T5831] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.290674][ T5831] bridge_slave_1: entered allmulticast mode
[   63.293569][ T5831] bridge_slave_1: entered promiscuous mode
[   63.296088][ T5832] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.301290][ T5832] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.304073][ T5832] bridge_slave_0: entered allmulticast mode
[   63.308500][ T5832] bridge_slave_0: entered promiscuous mode
[   63.346129][ T5832] bridge0: port 2(bridge_slave_1) entered blocking state
[   63.348773][ T5832] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.351077][ T5832] bridge_slave_1: entered allmulticast mode
[   63.353685][ T5832] bridge_slave_1: entered promiscuous mode
[   63.365967][ T5840] team0: Port device team_slave_0 added
[   63.370536][ T5831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.383904][ T5840] team0: Port device team_slave_1 added
[   63.388292][ T5832] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   63.392536][ T5831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.397598][ T5832] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   63.452474][ T5831] team0: Port device team_slave_0 added
[   63.456503][ T5831] team0: Port device team_slave_1 added
[   63.460596][ T5832] team0: Port device team_slave_0 added
[   63.463530][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.465773][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.474525][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.490441][ T5832] team0: Port device team_slave_1 added
[   63.493441][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.495696][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.505874][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.541590][ T5832] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.544343][ T5832] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.555974][ T5832] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.561941][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_0
[   63.564676][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.574708][ T5831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   63.581318][ T5832] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.583609][ T5832] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.592884][ T5832] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.603653][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_1
[   63.606099][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   63.614577][ T5831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   63.668867][ T5840] hsr_slave_0: entered promiscuous mode
[   63.671184][ T5840] hsr_slave_1: entered promiscuous mode
[   63.685582][ T5831] hsr_slave_0: entered promiscuous mode
[   63.688004][ T5831] hsr_slave_1: entered promiscuous mode
[   63.690513][ T5831] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   63.693009][ T5831] Cannot create hsr debugfs directory
[   63.700020][ T5832] hsr_slave_0: entered promiscuous mode
[   63.702956][ T5832] hsr_slave_1: entered promiscuous mode
[   63.705148][ T5832] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   63.708668][ T5832] Cannot create hsr debugfs directory
[   63.990811][ T5840] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   64.002237][ T5840] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   64.009846][ T5840] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   64.025612][ T5840] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   64.078659][ T5831] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   64.086236][ T5831] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   64.097636][ T5831] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   64.115392][ T5831] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   64.181816][ T5832] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   64.190162][ T5832] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   64.196621][ T5832] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   64.208841][ T5832] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   64.276018][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.311659][ T5831] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.325429][ T5840] 8021q: adding VLAN 0 to HW filter on device team0
[   64.336172][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.339164][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.354139][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.356749][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.362873][ T5831] 8021q: adding VLAN 0 to HW filter on device team0
[   64.394238][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.396540][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.408093][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.410927][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.434894][ T5832] 8021q: adding VLAN 0 to HW filter on device bond0
[   64.489136][ T5832] 8021q: adding VLAN 0 to HW filter on device team0
[   64.510792][ T1085] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.513818][ T1085] bridge0: port 1(bridge_slave_0) entered forwarding state
[   64.537871][ T1085] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.540830][ T1085] bridge0: port 2(bridge_slave_1) entered forwarding state
[   64.662828][ T5831] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.723861][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.734305][ T5831] veth0_vlan: entered promiscuous mode
[   64.740839][ T5838] Bluetooth: hci1: command tx timeout
[   64.743381][ T5838] Bluetooth: hci2: command tx timeout
[   64.745807][ T5838] Bluetooth: hci0: command tx timeout
[   64.754577][ T5831] veth1_vlan: entered promiscuous mode
[   64.804338][ T5832] 8021q: adding VLAN 0 to HW filter on device batadv0
[   64.814238][ T5831] veth0_macvtap: entered promiscuous mode
[   64.826422][ T5831] veth1_macvtap: entered promiscuous mode
[   64.831524][ T5840] veth0_vlan: entered promiscuous mode
[   64.846012][ T5840] veth1_vlan: entered promiscuous mode
[   64.862927][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_0
[   64.875191][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_1
[   64.901485][ T5831] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   64.905111][ T5831] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   64.910658][ T5831] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   64.914189][ T5831] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   64.926308][ T5832] veth0_vlan: entered promiscuous mode
[   64.944249][ T5840] veth0_macvtap: entered promiscuous mode
[   64.950996][ T5832] veth1_vlan: entered promiscuous mode
[   64.958796][ T5840] veth1_macvtap: entered promiscuous mode
[   64.999585][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.019856][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.035686][ T5832] veth0_macvtap: entered promiscuous mode
[   65.040956][ T1085] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.041826][ T5840] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.043967][ T1085] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.048674][ T5840] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.054943][ T5840] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.059107][ T5840] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.079898][ T5832] veth1_macvtap: entered promiscuous mode
[   65.110305][ T1086] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.117994][ T1086] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.138365][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.156196][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.162570][ T5832] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.168138][ T5832] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.171305][ T5832] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.174588][ T5832] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.196362][ T5831] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   65.199489][   T32] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.222283][   T32] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.268948][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.271863][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.289325][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.293378][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.337946][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.359795][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.386549][ T5900] warning: `syz.2.3' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   65.394291][ T5902] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4'.
[   65.748420][ T5918] bridge0: port 2(bridge_slave_1) entered disabled state
[   65.751295][ T5918] bridge0: port 1(bridge_slave_0) entered disabled state
[   65.801095][ T5921] syz.0.10 uses obsolete (PF_INET,SOCK_PACKET)
[   65.922720][ T5918] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   65.928048][ T5918] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   65.964243][ T5918] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   65.968467][ T5918] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   65.971346][ T5918] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   65.974413][ T5918] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   66.003836][ T5933] netlink: 32 bytes leftover after parsing attributes in process `syz.2.17'.
[   66.159996][ T5942] netlink: 'syz.0.21': attribute type 2 has an invalid length.
[   66.828818][   T54] Bluetooth: hci1: command tx timeout
[   66.831740][ T5838] Bluetooth: hci2: command tx timeout
[   66.935728][ T5992] netlink: 'syz.2.45': attribute type 2 has an invalid length.
[   66.994325][ T5995] Zero length message leads to an empty skb
[   67.414595][ T6027] netlink: 'syz.1.60': attribute type 3 has an invalid length.
[   67.499464][ T6031] netlink: 'syz.2.62': attribute type 10 has an invalid length.
[   67.564771][ T6033] netlink: 4 bytes leftover after parsing attributes in process `syz.0.64'.
[   67.574274][ T6033] netlink: 12 bytes leftover after parsing attributes in process `syz.0.64'.
[   67.780573][ T6052] netlink: 4 bytes leftover after parsing attributes in process `syz.0.70'.
[   67.853815][ T6058] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT
[   68.006470][ T6071] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.76'.
[   68.249024][ T6088] netlink: 8 bytes leftover after parsing attributes in process `syz.1.81'.
[   68.339777][ T6090] pim6reg1: entered promiscuous mode
[   68.342021][ T6090] pim6reg1: entered allmulticast mode
[   68.811665][ T6124] netlink: 28 bytes leftover after parsing attributes in process `syz.0.100'.
[   68.815402][ T6124] netlink: 28 bytes leftover after parsing attributes in process `syz.0.100'.
[   68.846227][ T6124] gretap0: entered promiscuous mode
[   68.852742][ T6124] gretap0: left promiscuous mode
[   68.897126][ T5838] Bluetooth: hci2: command tx timeout
[   68.899659][ T5838] Bluetooth: hci1: command tx timeout
[   69.032066][ T6138] netlink: 'syz.0.108': attribute type 11 has an invalid length.
[   69.034980][ T6138] netlink: 224 bytes leftover after parsing attributes in process `syz.0.108'.
[   69.331221][ T6164] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode balance-alb(6)
[   69.831625][ T6205] ieee802154 phy0 wpan0: encryption failed: -22
[   70.017939][ T6213] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   70.829128][ T6221] Driver unsupported XDP return value 0 on prog  (id 21) dev N/A, expect packet loss!
[   70.981317][ T5838] Bluetooth: hci1: command tx timeout
[   70.987290][ T5838] Bluetooth: hci2: command tx timeout
[   71.062878][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[   71.065736][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
[   71.080316][ T6240] netlink: 'syz.2.151': attribute type 1 has an invalid length.
[   71.196046][ T6252] mac80211_hwsim hwsim4 wlan0: (WE) : Wireless Event (cmd=0x8B1A) too big (33)
[   71.285001][ T6262] __nla_validate_parse: 2 callbacks suppressed
[   71.285011][ T6262] netlink: 12 bytes leftover after parsing attributes in process `syz.1.161'.
[   71.336276][ T6262] bond1: (slave vcan1): The slave device specified does not support setting the MAC address
[   71.343932][ T6262] bond1: (slave vcan1): Error -95 calling set_mac_address
[   71.448683][ T6277] netlink: 8 bytes leftover after parsing attributes in process `syz.1.169'.
[   71.607327][ T6291] (unnamed net_device) (uninitialized): option all_slaves_active: invalid value (3)
[   71.638548][ T6293] (unnamed net_device) (uninitialized): option active_slave: mode dependency failed, not supported in mode broadcast(3)
[   71.762989][ T6305] netlink: 4 bytes leftover after parsing attributes in process `syz.0.183'.
[   71.811687][ T6311] openvswitch: netlink: EtherType 10 is less than min 600
[   73.222961][ T6373] team0: Device gtp0 is of different type
[   73.503816][ T6391] netlink: 24 bytes leftover after parsing attributes in process `syz.0.224'.
[   73.517070][ T6391] netlink: 8 bytes leftover after parsing attributes in process `syz.0.224'.
[   73.548021][   T32] wlan0: Trigger new scan to find an IBSS to join
[   73.807977][ T6403] Bluetooth: MGMT ver 1.23
[   73.925500][ T6413] netlink: 8 bytes leftover after parsing attributes in process `syz.0.235'.
[   74.535195][ T6463] netlink: 'syz.1.259': attribute type 1 has an invalid length.
[   74.577888][ T6463] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link
[   74.593419][ T6463] veth3: entered promiscuous mode
[   74.600633][ T6463] bond2: (slave veth3): Enslaving as a backup interface with a down link
[   75.043290][ T6499] netlink: 72 bytes leftover after parsing attributes in process `syz.2.276'.
[   76.577052][   T32] wlan0: Trigger new scan to find an IBSS to join
[   76.591061][ T6562] Cannot find add_set index 0 as target
[   76.641007][ T6564] netlink: 8 bytes leftover after parsing attributes in process `syz.0.307'.
[   78.115262][ T6640] netlink: 'syz.1.341': attribute type 1 has an invalid length.
[   78.124746][ T6640] netlink: 'syz.1.341': attribute type 2 has an invalid length.
[   78.446444][ T6670] netlink: 8 bytes leftover after parsing attributes in process `syz.1.356'.
[   78.452228][ T6670] netlink: 4 bytes leftover after parsing attributes in process `syz.1.356'.
[   78.515457][ T6671] netlink: 'syz.0.355': attribute type 11 has an invalid length.
[   78.814846][ T6686] netlink: 'syz.0.360': attribute type 9 has an invalid length.
[   78.822941][ T6686] netlink: 'syz.0.360': attribute type 6 has an invalid length.
[   79.473544][ T6724] netlink: 'syz.2.370': attribute type 33 has an invalid length.
[   79.481855][ T6724] netlink: 152 bytes leftover after parsing attributes in process `syz.2.370'.
[   79.617948][ T6733] netlink: 1300 bytes leftover after parsing attributes in process `syz.0.373'.
[   79.799440][ T6747] netlink: 'syz.0.379': attribute type 5 has an invalid length.
[   80.380467][ T6800] netlink: 4 bytes leftover after parsing attributes in process `syz.2.403'.
[   80.421519][ T6800] team0: Port device team_slave_0 removed
[   80.768175][   T47] IPVS: starting estimator thread 0...
[   80.858936][ T6830] IPVS: using max 46 ests per chain, 110400 per kthread
[   80.985383][ T6845] syzkaller1: entered promiscuous mode
[   80.990390][ T6845] syzkaller1: entered allmulticast mode
[   81.109041][ T6856] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   81.242025][ T6867] netlink: 24 bytes leftover after parsing attributes in process `syz.2.435'.
[   81.543175][ T6898] netlink: 8 bytes leftover after parsing attributes in process `syz.2.449'.
[   81.832677][ T6914] bridge0: port 2(bridge_slave_1) entered disabled state
[   81.835710][ T6914] bridge0: port 1(bridge_slave_0) entered disabled state
[   81.938931][   T54] Bluetooth: hci2: command 0x0405 tx timeout
[   81.955203][ T6914] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   81.964276][ T6914] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   82.018847][ T6914] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.021872][ T6914] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.024654][ T6914] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.027681][ T6914] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.271766][ T6948] syzkaller1: entered promiscuous mode
[   82.274169][ T6948] syzkaller1: entered allmulticast mode
[   82.300228][ T6952] netlink: 'syz.0.473': attribute type 6 has an invalid length.
[   82.308994][ T6950] netlink: 'syz.1.472': attribute type 1 has an invalid length.
[   82.311697][ T6950] netlink: 600 bytes leftover after parsing attributes in process `syz.1.472'.
[   82.563464][ T6970] netlink: 16 bytes leftover after parsing attributes in process `syz.0.482'.
[   82.729707][ T6982] 8021q: adding VLAN 0 to HW filter on device macvlan2
[   82.790822][ T6994] netlink: 'syz.0.493': attribute type 1 has an invalid length.
[   82.828978][ T6998] netlink: 4 bytes leftover after parsing attributes in process `syz.0.495'.
[   82.913274][ T7004] netlink: 8 bytes leftover after parsing attributes in process `syz.0.498'.
[   83.475462][ T7053] netlink: 8 bytes leftover after parsing attributes in process `syz.0.522'.
[   83.638292][ T7074] netlink: 4 bytes leftover after parsing attributes in process `syz.0.528'.
[   83.670035][ T7076] netlink: 20 bytes leftover after parsing attributes in process `syz.2.530'.
[   83.900683][ T7094] netlink: 28 bytes leftover after parsing attributes in process `syz.1.535'.
[   83.904858][ T7094] netlink: 28 bytes leftover after parsing attributes in process `syz.1.535'.
[   84.073086][ T7106] can: request_module (can-proto-3) failed.
[   84.130400][ T7112] netlink: 20 bytes leftover after parsing attributes in process `syz.2.540'.
[   84.410545][ T7131] (unnamed net_device) (uninitialized): up delay (1024) is not a multiple of miimon (100), value rounded to 1000 ms
[   84.415771][ T7131] (unnamed net_device) (uninitialized): down delay (4) is not a multiple of miimon (100), value rounded to 0 ms
[   84.518166][ T7136] x_tables: duplicate underflow at hook 4
[   84.528431][ T7136] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[   84.534200][ T7136] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[   84.538278][ T7136] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[   84.541832][ T7136] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[   84.804991][ T7143] netlink: 'syz.1.553': attribute type 21 has an invalid length.
[   84.809351][ T7143] netlink: 'syz.1.553': attribute type 1 has an invalid length.
[   85.425518][ T7163] netlink: 'syz.2.563': attribute type 1 has an invalid length.
[   85.428574][ T7163] netlink: 'syz.2.563': attribute type 2 has an invalid length.
[   85.729916][ T7190] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[   86.017209][   T54] Bluetooth: hci2: command 0x0405 tx timeout
[   86.266440][ T7230] netlink: 'syz.1.592': attribute type 10 has an invalid length.
[   86.273790][ T7230] netlink: 'syz.1.592': attribute type 49 has an invalid length.
[   86.291701][ T4036] 
[   86.292836][ T4036] ======================================================
[   86.295751][ T4036] WARNING: possible circular locking dependency detected
[   86.298685][ T4036] 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 Not tainted
[   86.302964][ T4036] ------------------------------------------------------
[   86.306887][ T4036] kworker/u9:5/4036 is trying to acquire lock:
[   86.312206][ T4036] ffff8880221c6358 (&disk->open_mutex){+.+.}-{4:4}, at: __del_gendisk+0x129/0x9e0
[   86.316060][ T4036] 
[   86.316060][ T4036] but task is already holding lock:
[   86.319137][ T4036] ffff8880221d5988 (&set->update_nr_hwq_lock){++++}-{4:4}, at: del_gendisk+0xe0/0x160
[   86.323075][ T4036] 
[   86.323075][ T4036] which lock already depends on the new lock.
[   86.323075][ T4036] 
[   86.327363][ T4036] 
[   86.327363][ T4036] the existing dependency chain (in reverse order) is:
[   86.331093][ T4036] 
[   86.331093][ T4036] -> #2 (&set->update_nr_hwq_lock){++++}-{4:4}:
[   86.334621][ T4036]        lock_acquire+0x120/0x360
[   86.336712][ T4036]        down_write+0x96/0x1f0
[   86.338720][ T4036]        blk_mq_update_nr_hw_queues+0x3b/0x14c0
[   86.341330][ T4036]        nbd_start_device+0x16c/0xac0
[   86.343610][ T4036]        nbd_genl_connect+0x1250/0x1930
[   86.345941][ T4036]        genl_family_rcv_msg_doit+0x215/0x300
[   86.348476][ T4036]        genl_rcv_msg+0x60e/0x790
[   86.350629][ T4036]        netlink_rcv_skb+0x208/0x470
[   86.352823][ T4036]        genl_rcv+0x28/0x40
[   86.354726][ T4036]        netlink_unicast+0x75b/0x8d0
[   86.356930][ T4036]        netlink_sendmsg+0x805/0xb30
[   86.359197][ T4036]        __sock_sendmsg+0x21c/0x270
[   86.361411][ T4036]        ____sys_sendmsg+0x505/0x830
[   86.363608][ T4036]        ___sys_sendmsg+0x21f/0x2a0
[   86.365809][ T4036]        __x64_sys_sendmsg+0x19b/0x260
[   86.368109][ T4036]        do_syscall_64+0xfa/0x3b0
[   86.370238][ T4036]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   86.372902][ T4036] 
[   86.372902][ T4036] -> #1 (&nbd->config_lock){+.+.}-{4:4}:
[   86.376134][ T4036]        lock_acquire+0x120/0x360
[   86.378233][ T4036]        __mutex_lock+0x182/0xe80
[   86.380387][ T4036]        refcount_dec_and_mutex_lock+0x30/0xa0
[   86.383035][ T4036]        nbd_config_put+0x2c/0x790
[   86.385284][ T4036]        nbd_release+0xfe/0x140
[   86.387392][ T4036]        bdev_release+0x536/0x650
[   86.389521][ T4036]        blkdev_release+0x15/0x20
[   86.391672][ T4036]        __fput+0x44c/0xa70
[   86.393634][ T4036]        fput_close_sync+0x119/0x200
[   86.395875][ T4036]        __x64_sys_close+0x7f/0x110
[   86.398121][ T4036]        do_syscall_64+0xfa/0x3b0
[   86.400251][ T4036]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   86.402915][ T4036] 
[   86.402915][ T4036] -> #0 (&disk->open_mutex){+.+.}-{4:4}:
[   86.406140][ T4036]        validate_chain+0xb9b/0x2140
[   86.408340][ T4036]        __lock_acquire+0xab9/0xd20
[   86.410514][ T4036]        lock_acquire+0x120/0x360
[   86.412684][ T4036]        __mutex_lock+0x182/0xe80
[   86.414874][ T4036]        __del_gendisk+0x129/0x9e0
[   86.417064][ T4036]        del_gendisk+0xe8/0x160
[   86.419128][ T4036]        nbd_dev_remove_work+0x47/0xe0
[   86.421411][ T4036]        process_scheduled_works+0xae1/0x17b0
[   86.424034][ T4036]        worker_thread+0x8a0/0xda0
[   86.426211][ T4036]        kthread+0x711/0x8a0
[   86.428150][ T4036]        ret_from_fork+0x3fc/0x770
[   86.430271][ T4036]        ret_from_fork_asm+0x1a/0x30
[   86.432449][ T4036] 
[   86.432449][ T4036] other info that might help us debug this:
[   86.432449][ T4036] 
[   86.436614][ T4036] Chain exists of:
[   86.436614][ T4036]   &disk->open_mutex --> &nbd->config_lock --> &set->update_nr_hwq_lock
[   86.436614][ T4036] 
[   86.442421][ T4036]  Possible unsafe locking scenario:
[   86.442421][ T4036] 
[   86.445448][ T4036]        CPU0                    CPU1
[   86.447697][ T4036]        ----                    ----
[   86.449921][ T4036]   rlock(&set->update_nr_hwq_lock);
[   86.452179][ T4036]                                lock(&nbd->config_lock);
[   86.455150][ T4036]                                lock(&set->update_nr_hwq_lock);
[   86.458388][ T4036]   lock(&disk->open_mutex);
[   86.460334][ T4036] 
[   86.460334][ T4036]  *** DEADLOCK ***
[   86.460334][ T4036] 
[   86.463750][ T4036] 3 locks held by kworker/u9:5/4036:
[   86.465944][ T4036]  #0: ffff888106883148 ((wq_completion)nbd-del){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[   86.470439][ T4036]  #1: ffffc90009947bc0 ((work_completion)(&nbd->remove_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[   86.475395][ T4036]  #2: ffff8880221d5988 (&set->update_nr_hwq_lock){++++}-{4:4}, at: del_gendisk+0xe0/0x160
[   86.479518][ T4036] 
[   86.479518][ T4036] stack backtrace:
[   86.481974][ T4036] CPU: 0 UID: 0 PID: 4036 Comm: kworker/u9:5 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[   86.481991][ T4036] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   86.482000][ T4036] Workqueue: nbd-del nbd_dev_remove_work
[   86.482018][ T4036] Call Trace:
[   86.482024][ T4036]  <TASK>
[   86.482030][ T4036]  dump_stack_lvl+0x189/0x250
[   86.482046][ T4036]  ? __pfx_dump_stack_lvl+0x10/0x10
[   86.482059][ T4036]  ? __pfx__printk+0x10/0x10
[   86.482075][ T4036]  ? print_lock_name+0xde/0x100
[   86.482090][ T4036]  print_circular_bug+0x2ee/0x310
[   86.482106][ T4036]  check_noncircular+0x134/0x160
[   86.482121][ T4036]  validate_chain+0xb9b/0x2140
[   86.482137][ T4036]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[   86.482153][ T4036]  ? arch_stack_walk+0x11c/0x150
[   86.482169][ T4036]  __lock_acquire+0xab9/0xd20
[   86.482182][ T4036]  ? __del_gendisk+0x129/0x9e0
[   86.482195][ T4036]  lock_acquire+0x120/0x360
[   86.482205][ T4036]  ? __del_gendisk+0x129/0x9e0
[   86.482219][ T4036]  ? check_path+0x21/0x40
[   86.482232][ T4036]  __mutex_lock+0x182/0xe80
[   86.482244][ T4036]  ? __del_gendisk+0x129/0x9e0
[   86.482258][ T4036]  ? __del_gendisk+0x129/0x9e0
[   86.482271][ T4036]  ? __pfx___mutex_lock+0x10/0x10
[   86.482282][ T4036]  ? __pfx___might_resched+0x10/0x10
[   86.482324][ T4036]  ? __lock_acquire+0xab9/0xd20
[   86.482336][ T4036]  ? disk_del_events+0xb5/0x210
[   86.482349][ T4036]  ? __del_gendisk+0xc1/0x9e0
[   86.482367][ T4036]  __del_gendisk+0x129/0x9e0
[   86.482380][ T4036]  ? del_gendisk+0xe0/0x160
[   86.482393][ T4036]  ? __pfx___del_gendisk+0x10/0x10
[   86.482407][ T4036]  ? down_read+0x1ad/0x2e0
[   86.482419][ T4036]  del_gendisk+0xe8/0x160
[   86.482431][ T4036]  nbd_dev_remove_work+0x47/0xe0
[   86.482443][ T4036]  ? process_scheduled_works+0x9ef/0x17b0
[   86.482457][ T4036]  process_scheduled_works+0xae1/0x17b0
[   86.482477][ T4036]  ? __pfx_process_scheduled_works+0x10/0x10
[   86.482494][ T4036]  worker_thread+0x8a0/0xda0
[   86.482508][ T4036]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   86.482525][ T4036]  ? __kthread_parkme+0x7b/0x200
[   86.482541][ T4036]  kthread+0x711/0x8a0
[   86.482557][ T4036]  ? __pfx_worker_thread+0x10/0x10
[   86.482570][ T4036]  ? __pfx_kthread+0x10/0x10
[   86.482586][ T4036]  ? _raw_spin_unlock_irq+0x23/0x50
[   86.482601][ T4036]  ? lockdep_hardirqs_on+0x9c/0x150
[   86.482610][ T4036]  ? __pfx_kthread+0x10/0x10
[   86.482625][ T4036]  ret_from_fork+0x3fc/0x770
[   86.482638][ T4036]  ? __pfx_ret_from_fork+0x10/0x10
[   86.482650][ T4036]  ? __switch_to_asm+0x39/0x70
[   86.482664][ T4036]  ? __switch_to_asm+0x33/0x70
[   86.482678][ T4036]  ? __pfx_kthread+0x10/0x10
[   86.482693][ T4036]  ret_from_fork_asm+0x1a/0x30
[   86.482712][ T4036]  </TASK>
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   86.602528][   T10] cfg80211: failed to load regulatory.db
[   86.927453][ T5861] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   87.001169][ T5861] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   87.062096][ T5861] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   87.140934][ T5861] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   87.231055][ T5861] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[   87.286122][ T5861] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[   87.356508][ T5861] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[   87.412454][ T5861] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[   87.464919][ T5861] bridge_slave_1: left allmulticast mode
[   87.472721][ T5861] bridge_slave_1: left promiscuous mode
[   87.475241][ T5861] bridge0: port 2(bridge_slave_1) entered disabled state
[   87.496689][ T5861] bridge_slave_0: left allmulticast mode
[   87.499609][ T5861] bridge_slave_0: left promiscuous mode
[   87.502214][ T5861] bridge0: port 1(bridge_slave_0) entered disabled state
[   87.511543][ T5861] bridge_slave_1: left allmulticast mode
[   87.513670][ T5861] bridge_slave_1: left promiscuous mode
[   87.515802][ T5861] bridge0: port 2(bridge_slave_1) entered disabled state
[   87.520764][ T5861] bridge_slave_0: left allmulticast mode
[   87.523129][ T5861] bridge_slave_0: left promiscuous mode
[   87.525628][ T5861] bridge0: port 1(bridge_slave_0) entered disabled state
[   87.557321][ T5861] bond2 (unregistering): (slave ip6gretap1): Releasing backup interface
[   87.560961][ T5861] bond2 (unregistering): (slave ip6gretap1): the permanent HWaddr of slave - 6e:27:98:ec:43:84 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts
[   87.644847][ T5861] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   87.650005][ T5861] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   87.654272][ T5861] bond0 (unregistering): Released all slaves
[   87.660392][ T5861] bond1 (unregistering): Released all slaves
[   87.669700][ T5861] bond2 (unregistering): (slave veth3): Releasing backup interface
[   87.673818][ T5861] bond2 (unregistering): Released all slaves
[   87.848058][ T5861] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   87.852603][ T5861] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   87.857022][ T5861] bond0 (unregistering): Released all slaves
[   87.863847][ T5861] bond1 (unregistering): Released all slaves
[   88.173818][ T5861] hsr_slave_0: left promiscuous mode
[   88.176538][ T5861] hsr_slave_1: left promiscuous mode
[   88.178792][ T5861] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   88.181353][ T5861] batman_adv: batadv0: Removing interface: batadv_slave_0
[   88.183898][ T5861] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   88.186358][ T5861] batman_adv: batadv0: Removing interface: batadv_slave_1
[   88.191403][ T5861] hsr_slave_0: left promiscuous mode
[   88.193398][ T5861] hsr_slave_1: left promiscuous mode
[   88.195360][ T5861] batman_adv: batadv0: Removing interface: batadv_slave_0
[   88.199830][ T5861] batman_adv: batadv0: Removing interface: batadv_slave_1
[   88.203610][ T5861] veth1_macvtap: left promiscuous mode
[   88.205454][ T5861] veth0_macvtap: left promiscuous mode
[   88.207702][ T5861] veth1_vlan: left promiscuous mode
[   88.209457][ T5861] veth0_vlan: left promiscuous mode
[   88.306554][ T5861] team0 (unregistering): Port device team_slave_1 removed
[   88.321261][ T5861] team0 (unregistering): Port device team_slave_0 removed
[   88.568790][ T5861] team0 (unregistering): Port device team_slave_1 removed
[   88.582921][ T5861] team0 (unregistering): Port device team_slave_0 removed
[   89.152715][ T5861] IPVS: stop unused estimator thread 0...

VM DIAGNOSIS:
17:20:21  Registers:
info registers vcpu 0

CPU#0
RAX=000000000000007a RBX=000000000000007a RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90009946e10
R8 =ffff8881064a0237 R9 =1ffff11020c94046 R10=dffffc0000000000 R11=ffffffff85475610
R12=dffffc0000000000 R13=ffffffff99af78e5 R14=ffffffff99dfc760 R15=0000000000000000
RIP=ffffffff8547568c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000110c3a2c57 CR3=0000000028280000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=ffffffffffffffff ffff00ff00000000 XMM05=0000000065666666 0000556620662560
XMM06=ffffffff00000000 0000000000000000 XMM07=0000000000000000 00000000ff000000
XMM08=ffffffff00000000 ffff000000000000 XMM09=0000000065666666 6666666666666666
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=1ffffd400013fef0 RBX=ffffea00009ff780 RCX=ffffffff8211cf17 RDX=0000000000000000
RSI=0000000000000008 RDI=ffffea00009ff780 RBP=0000000000000001 RSP=ffffc90003187310
R8 =ffffea00009ff787 R9 =1ffffd400013fef0 R10=dffffc0000000000 R11=fffff9400013fef1
R12=ffffea00009ff780 R13=ffff888027da9980 R14=0000000000000000 R15=dffffc0000000000
RIP=ffffffff8211cf23 RFL=00000a06 [-O---P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f24a8d246c0 ffffffff 00c00000
GS =0000 ffff8881a3c1d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055ae9538f7e8 CR3=0000000027784000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffff81745e1b ffffffff81686ddf
XMM02=00007f40aa784478 ffffffff81cf47dd XMM03=00007f40aa784488 00007f40aa784480
XMM04=00007f40ab2ed100 00007f40aa784440 XMM05=00007f40aa784458 00007f40aa7844a0
XMM06=00007f40aa784498 00007f40aa784490 XMM07=00007f40aa784488 00007f40aa784480
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f40aa611c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
