last executing test programs:

1.160614287s ago: executing program 1 (id=402):
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0)
r1 = openat$cgroup_devices(r0, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0)
write$cgroup_devices(r1, &(0x7f00000002c0)={'b', ' *:* ', 'w\x00'}, 0x8)

1.093286722s ago: executing program 1 (id=404):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
bind$bt_l2cap(r0, &(0x7f0000000000), 0xe)
listen(r0, 0x0)
setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000200)=0x20004, 0x4)

1.036775148s ago: executing program 1 (id=407):
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000010000000000000000000000711229000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

969.254964ms ago: executing program 1 (id=408):
pipe(&(0x7f0000000040))
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
listen(r0, 0x4000)
close(r0)

918.096404ms ago: executing program 1 (id=410):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000100)={0x3a}, 0x8)
sendto$inet6(r0, &(0x7f0000000040)="bb", 0x1, 0x4004881, &(0x7f0000000080)={0xa, 0x0, 0x9, @private0, 0x152a}, 0x1c)
listen(r0, 0x100101)
accept4(r0, 0x0, 0x0, 0x0)

307.899232ms ago: executing program 0 (id=429):
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x114}], 0x1}, 0x0)
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40482, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140))
pwritev(r0, &(0x7f0000000040)=[{&(0x7f0000000180)="80fd06000040", 0x27}], 0x2, 0x0, 0x4)

218.077664ms ago: executing program 2 (id=431):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_CTHELPER_GET(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000200)={&(0x7f0000000000)={0x4c, 0x1, 0x9, 0x801, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFCTH_TUPLE={0x2c, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x2a}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @NFCTH_TUPLE={0xc, 0x2, [@CTA_TUPLE_ZONE={0x4, 0x3, 0x1, 0x0, 0x3}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x0)

217.841334ms ago: executing program 0 (id=432):
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f000000aac0)={'ip6_vti0\x00', 0x0})

217.685474ms ago: executing program 0 (id=433):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
close(r0)
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
close(r1)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000))
ioctl$SIOCSIFHWADDR(r0, 0x8943, &(0x7f0000000300)={'dummy0\x00', @random="62eec89c62d0"})

217.497627ms ago: executing program 2 (id=434):
unshare(0x2040400)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x8, 0xa, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x64}, @initr0, @exit]}, &(0x7f00000000c0)='syzkaller\x00', 0x4}, 0x90)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000240)={r0, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0xffffff13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10)

168.23307ms ago: executing program 0 (id=435):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000d40)={0x24, r1, 0x1, 0x0, 0x0, {}, [@GTPA_LINK={0x8}, @GTPA_VERSION={0x8}]}, 0x24}}, 0x20000800)

107.970976ms ago: executing program 2 (id=436):
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r1}, 0x10)
write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0)
bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000380)={@map, 0x5, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40)

107.644433ms ago: executing program 0 (id=437):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000980)=ANY=[@ANYBLOB="84000000", @ANYRES16=r1, @ANYBLOB="010000000000fbdbdf250100000008000200000000000500050000000000080003000100000048000180050002"], 0x84}}, 0x0)

104.283561ms ago: executing program 2 (id=438):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_DIR={0x5, 0x17, 0xfe}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}]}}}]}, 0x4c}}, 0x0)

2.803172ms ago: executing program 2 (id=439):
r0 = syz_init_net_socket$ax25(0x3, 0x3, 0xcd)
getsockopt$ax25_int(r0, 0x101, 0x8, &(0x7f0000000140), &(0x7f0000000180)=0x4)

2.306199ms ago: executing program 1 (id=440):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000007c0), 0xffffffffffffffff)
sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000140)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000ffdbdf25010000000c00040002000000000000000c00060001000000000000000c00020007000000000000000c00080001000000000000001c0007"], 0x60}}, 0x0)

1.825675ms ago: executing program 2 (id=441):
r0 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0)
getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYBLOB="01980000000000002000128008000100677265001400028008000100", @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0)
r3 = socket(0x10, 0x3, 0x0)
getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14)
sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800)
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001600)=@newtfilter={0x30, 0x28, 0xd27, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r4, {0xfff3, 0x9}, {0xf}, {0x2, 0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x20008890}, 0x8c4)

0s ago: executing program 0 (id=442):
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xa0}}, 0x0)
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000840)=ANY=[@ANYBLOB="240000001900010028bd7000fbdbdf251d01020008000900", @ANYRES32, @ANYBLOB="08000a00e1"], 0x24}, 0x1, 0x0, 0x0, 0x4048855}, 0x30004016)
sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:11142' (ED25519) to the list of known hosts.
syzkaller login: [   56.189190][ T5810] cgroup: Unknown subsys name 'net'
[   56.292599][ T5810] cgroup: Unknown subsys name 'cpuset'
[   56.299240][ T5810] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   58.290108][ T5810] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   63.445417][ T5831] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   63.461170][ T5835] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   63.464877][ T5835] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   63.467973][ T5835] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   63.472935][ T5835] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   63.475822][ T5835] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   63.489831][ T5835] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   63.514885][ T5840] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   63.517354][ T5836] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   63.520404][ T5840] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   63.550460][ T5219] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   63.555881][ T5219] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   63.559191][ T5219] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   63.563306][ T5219] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   63.565878][ T5219] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   63.791994][ T5833] chnl_net:caif_netlink_parms(): no params data found
[   63.797357][ T5829] chnl_net:caif_netlink_parms(): no params data found
[   63.836087][ T5837] chnl_net:caif_netlink_parms(): no params data found
[   63.964841][ T5833] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.968229][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.971142][ T5833] bridge_slave_0: entered allmulticast mode
[   63.973920][ T5833] bridge_slave_0: entered promiscuous mode
[   63.985962][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.988210][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.990952][ T5837] bridge_slave_0: entered allmulticast mode
[   63.993636][ T5837] bridge_slave_0: entered promiscuous mode
[   63.996322][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state
[   63.998493][ T5829] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.001179][ T5829] bridge_slave_0: entered allmulticast mode
[   64.003932][ T5829] bridge_slave_0: entered promiscuous mode
[   64.007058][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.009822][ T5829] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.012114][ T5829] bridge_slave_1: entered allmulticast mode
[   64.014892][ T5829] bridge_slave_1: entered promiscuous mode
[   64.018412][ T5833] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.021879][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.024699][ T5833] bridge_slave_1: entered allmulticast mode
[   64.028468][ T5833] bridge_slave_1: entered promiscuous mode
[   64.032439][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.035227][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.038067][ T5837] bridge_slave_1: entered allmulticast mode
[   64.042758][ T5837] bridge_slave_1: entered promiscuous mode
[   64.113270][ T5829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.118502][ T5833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.124643][ T5837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.131115][ T5833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.136005][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.150622][ T5837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.220058][ T5829] team0: Port device team_slave_0 added
[   64.224753][ T5837] team0: Port device team_slave_0 added
[   64.230206][ T5833] team0: Port device team_slave_0 added
[   64.233921][ T5829] team0: Port device team_slave_1 added
[   64.237462][ T5833] team0: Port device team_slave_1 added
[   64.241722][ T5837] team0: Port device team_slave_1 added
[   64.304289][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.306671][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.315784][ T5837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.321239][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.323343][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.331443][ T5837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.335766][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.337892][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.346721][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.351039][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.353797][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.364795][ T5833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.374212][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.376635][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.385586][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.393662][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.396269][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   64.406054][ T5833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.454942][ T5837] hsr_slave_0: entered promiscuous mode
[   64.457208][ T5837] hsr_slave_1: entered promiscuous mode
[   64.486449][ T5833] hsr_slave_0: entered promiscuous mode
[   64.490144][ T5833] hsr_slave_1: entered promiscuous mode
[   64.493655][ T5833] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   64.496888][ T5833] Cannot create hsr debugfs directory
[   64.514329][ T5829] hsr_slave_0: entered promiscuous mode
[   64.516559][ T5829] hsr_slave_1: entered promiscuous mode
[   64.518842][ T5829] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   64.521230][ T5829] Cannot create hsr debugfs directory
[   64.813324][ T5829] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   64.819772][ T5829] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   64.832781][ T5829] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   64.843025][ T5829] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   64.875789][ T5837] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   64.882269][ T5837] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   64.894505][ T5837] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   64.907523][ T5837] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   64.962747][ T5833] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   64.975128][ T5833] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   64.985273][ T5833] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   64.991244][ T5833] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   65.098301][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.119421][ T5837] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.135782][ T5829] 8021q: adding VLAN 0 to HW filter on device team0
[   65.146920][ T5837] 8021q: adding VLAN 0 to HW filter on device team0
[   65.158128][ T1088] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.160630][ T1088] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.177002][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.179977][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.194170][ T5833] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.201584][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.203857][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.207400][   T26] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.210368][   T26] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.254892][ T5833] 8021q: adding VLAN 0 to HW filter on device team0
[   65.283298][ T1089] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.285541][ T1089] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.292404][ T1089] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.295186][ T1089] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.355978][ T5833] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[   65.359870][ T5833] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   65.467706][ T5837] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.502605][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.520928][ T5833] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.545752][ T5837] veth0_vlan: entered promiscuous mode
[   65.570458][ T5837] veth1_vlan: entered promiscuous mode
[   65.599618][ T5829] veth0_vlan: entered promiscuous mode
[   65.608348][ T5833] veth0_vlan: entered promiscuous mode
[   65.610250][ T5219] Bluetooth: hci2: command tx timeout
[   65.610450][ T5219] Bluetooth: hci1: command tx timeout
[   65.614400][ T5835] Bluetooth: hci0: command tx timeout
[   65.616935][ T5833] veth1_vlan: entered promiscuous mode
[   65.633615][ T5829] veth1_vlan: entered promiscuous mode
[   65.646867][ T5837] veth0_macvtap: entered promiscuous mode
[   65.660836][ T5833] veth0_macvtap: entered promiscuous mode
[   65.666912][ T5837] veth1_macvtap: entered promiscuous mode
[   65.674612][ T5833] veth1_macvtap: entered promiscuous mode
[   65.684960][ T5829] veth0_macvtap: entered promiscuous mode
[   65.704192][ T5829] veth1_macvtap: entered promiscuous mode
[   65.713886][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.723631][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.727596][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.736215][ T5837] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.742160][ T5837] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.744938][ T5837] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.747673][ T5837] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.760707][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.767767][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.775260][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.784718][ T5833] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.787385][ T5833] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.792314][ T5833] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.794963][ T5833] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.802441][ T5829] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.805162][ T5829] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.808325][ T5829] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.812026][ T5829] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.910637][   T90] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.913155][   T90] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.943817][   T68] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.946977][   T68] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.996102][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.000693][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.022038][   T68] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.024540][   T68] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.037488][   T68] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.048285][   T68] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.063555][ T5837] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   66.066597][   T68] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   66.073721][   T68] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   66.151304][ T5900] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3'.
[   66.545446][ T5862] IPVS: starting estimator thread 0...
[   66.629428][ T5928] IPVS: using max 44 ests per chain, 105600 per kthread
[   66.638931][ T5930] nbd0: detected capacity change from 0 to 127
[   66.647692][   T56] block nbd0: Receive control failed (result -104)
[   66.767027][ T5941] netlink: 'syz.2.21': attribute type 1 has an invalid length.
[   66.771122][ T5941] netlink: 68 bytes leftover after parsing attributes in process `syz.2.21'.
[   66.986418][ T5954] netlink: 'syz.1.27': attribute type 1 has an invalid length.
[   67.153727][ T5960] netlink: 'syz.0.30': attribute type 1 has an invalid length.
[   67.164058][ T5960] dummy0: entered promiscuous mode
[   67.165865][ T5960] dummy0: entered allmulticast mode
[   67.313011][ T5974] netlink: 'syz.1.37': attribute type 1 has an invalid length.
[   67.315469][ T5974] netlink: 'syz.1.37': attribute type 2 has an invalid length.
[   67.395378][ T5978] netlink: 'syz.1.39': attribute type 3 has an invalid length.
[   67.405838][ T5978] netlink: 666 bytes leftover after parsing attributes in process `syz.1.39'.
[   67.689418][ T5219] Bluetooth: hci1: command tx timeout
[   67.691694][ T5219] Bluetooth: hci0: command tx timeout
[   67.693417][ T5219] Bluetooth: hci2: command tx timeout
[   68.127981][ T6015] syz.1.52 uses obsolete (PF_INET,SOCK_PACKET)
[   69.152008][ T6044] netlink: 8 bytes leftover after parsing attributes in process `syz.1.66'.
[   69.214804][ T6048] openvswitch: netlink: IPv4 tun info is not correct
[   69.452153][ T6060] netlink: 1 bytes leftover after parsing attributes in process `syz.1.73'.
[   69.460375][ T6060] netlink: 1 bytes leftover after parsing attributes in process `syz.1.73'.
[   69.463079][ T6060] netlink: 56 bytes leftover after parsing attributes in process `syz.1.73'.
[   69.513037][ T6063] netlink: 2 bytes leftover after parsing attributes in process `syz.0.74'.
[   69.703706][ T6074] netlink: 8 bytes leftover after parsing attributes in process `syz.0.80'.
[   69.706479][ T6074] netlink: 8 bytes leftover after parsing attributes in process `syz.0.80'.
[   69.769464][ T5840] Bluetooth: hci2: command tx timeout
[   69.769503][ T5219] Bluetooth: hci0: command tx timeout
[   69.771255][ T5840] Bluetooth: hci1: command tx timeout
[   69.947467][ T6082] Zero length message leads to an empty skb
[   70.840378][ T6130] netlink: 'syz.0.102': attribute type 10 has an invalid length.
[   70.886241][ T6130] bond0: (slave wlan1): Enslaving as an active interface with an up link
[   70.924748][ T6128] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[   71.058950][ T1362] ieee802154 phy0 wpan0: encryption failed: -22
[   71.061721][ T1362] ieee802154 phy1 wpan1: encryption failed: -22
[   71.776836][ T6142] xt_ipcomp: unknown flags F7
[   71.848891][ T5835] Bluetooth: hci0: command tx timeout
[   71.849045][ T5840] Bluetooth: hci1: command tx timeout
[   71.850777][ T5835] Bluetooth: hci2: command tx timeout
[   71.890083][ T6144] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   72.055253][ T6150] warning: `syz.2.111' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   72.087507][ T6150] __nla_validate_parse: 2 callbacks suppressed
[   72.087521][ T6150] netlink: 4 bytes leftover after parsing attributes in process `syz.2.111'.
[   72.246411][ T6156] xt_CHECKSUM: CHECKSUM should be avoided.  If really needed, restrict with "-p udp" and only use in OUTPUT
[   72.252721][ T6156] ipt_ECN: cannot use operation on non-tcp rule
[   73.319707][ T6200] netlink: 16 bytes leftover after parsing attributes in process `syz.0.132'.
[   73.680155][ T6219] netlink: 8 bytes leftover after parsing attributes in process `syz.1.139'.
[   73.882125][   T33] audit: type=1800 audit(1752266411.843:2): pid=6215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.139" name="cgroup.controllers" dev="tmpfs" ino=274 res=0 errno=0
[   73.928832][ T5835] Bluetooth: hci2: command 0x0405 tx timeout
[   74.787599][ T6280] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   74.856806][ T6280] netlink: 4 bytes leftover after parsing attributes in process `syz.1.167'.
[   74.862797][ T6280] bridge_slave_1: left allmulticast mode
[   74.865202][ T6280] bridge_slave_1: left promiscuous mode
[   74.868856][ T6280] bridge0: port 2(bridge_slave_1) entered disabled state
[   74.885912][ T6280] bridge_slave_0: left allmulticast mode
[   74.888400][ T6280] bridge_slave_0: left promiscuous mode
[   74.895611][ T6280] bridge0: port 1(bridge_slave_0) entered disabled state
[   75.466804][ T6286] team0 (unregistering): Port device team_slave_0 removed
[   75.473290][ T6286] team0 (unregistering): Port device team_slave_1 removed
[   75.554894][ T6290] syzkaller0: entered allmulticast mode
[   75.581567][ T6290] syz.0.171 uses old SIOCAX25GETINFO
[   75.601772][ T6292] netlink: 'syz.2.172': attribute type 9 has an invalid length.
[   76.734170][ T6302] netlink: 8 bytes leftover after parsing attributes in process `syz.1.176'.
[   76.897233][ T6312] netlink: 'syz.1.181': attribute type 1 has an invalid length.
[   76.900804][ T6312] netlink: 'syz.1.181': attribute type 2 has an invalid length.
[   77.118202][ T6327] Bluetooth: MGMT ver 1.23
[   77.179759][ T6332] veth0: entered promiscuous mode
[   77.182566][ T6332] netlink: 4 bytes leftover after parsing attributes in process `syz.0.185'.
[   77.292159][ T6336] IPv6: syztnl1: Disabled Multicast RS
[   78.111520][ T6386] netlink: 156 bytes leftover after parsing attributes in process `syz.2.199'.
[   78.123841][ T6386] netlink: 12 bytes leftover after parsing attributes in process `syz.2.199'.
[   78.396032][ T6406] mac80211_hwsim hwsim4 wlan1: entered allmulticast mode
[   78.827729][ T6440] netlink: 'syz.1.213': attribute type 21 has an invalid length.
[   79.342682][ T6476] tipc: Started in network mode
[   79.344713][ T6476] tipc: Node identity e6ed460f4c16, cluster identity 4711
[   79.348097][ T6476] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[   79.354369][ T6476] syzkaller0: entered promiscuous mode
[   79.357204][ T6476] syzkaller0: entered allmulticast mode
[   79.384330][ T6479] netlink: 8 bytes leftover after parsing attributes in process `syz.1.224'.
[   79.413270][ T6476] tipc: Resetting bearer <eth:syzkaller0>
[   79.434911][ T6475] tipc: Resetting bearer <eth:syzkaller0>
[   79.463106][ T6475] tipc: Disabling bearer <eth:syzkaller0>
[   80.603792][ T6567] netlink: 'syz.0.250': attribute type 3 has an invalid length.
[   80.606911][ T6567] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.250'.
[   80.759847][ T6574] macvlan1: entered promiscuous mode
[   80.775192][ T6574] ipvlan0: entered promiscuous mode
[   80.778549][ T6574] ipvlan0: left promiscuous mode
[   80.783590][ T6574] macvlan1: left promiscuous mode
[   81.055910][ T6592] vlan0: entered promiscuous mode
[   81.361585][ T6600] xt_CT: No such helper "syz0"
[   81.473689][ T6605] bridge0: port 2(bridge_slave_1) entered disabled state
[   81.477922][ T6605] bridge0: port 1(bridge_slave_0) entered disabled state
[   81.482683][ T6609] netlink: 8 bytes leftover after parsing attributes in process `syz.1.269'.
[   81.486193][ T6609] netlink: 12 bytes leftover after parsing attributes in process `syz.1.269'.
[   81.525715][ T6611] tls_set_device_offload_rx: netdev not found
[   81.562274][ T6605] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   81.580200][ T6605] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   81.671047][ T6605] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   81.674427][ T6605] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   81.677478][ T6605] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   81.684037][ T6605] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   81.869940][ T6620] netlink: 16 bytes leftover after parsing attributes in process `syz.2.273'.
[   81.956441][ T6616] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   81.982254][ T6616] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   82.037102][ T6616] vlan0: left promiscuous mode
[   82.041544][ T6625] netlink: 8 bytes leftover after parsing attributes in process `syz.2.275'.
[   82.074694][ T6616] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.078223][ T6616] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.083726][ T6616] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.087129][ T6616] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   82.366175][ T6635] delete_channel: no stack
[   82.722386][ T6659] bridge1: entered promiscuous mode
[   82.930311][ T6677] openvswitch: netlink: ERSPAN option length err (len 256, max 255).
[   82.968175][ T6680] netlink: 'syz.2.303': attribute type 1 has an invalid length.
[   82.974975][ T6680] netlink: 'syz.2.303': attribute type 2 has an invalid length.
[   83.174054][ T6693] netlink: 4768 bytes leftover after parsing attributes in process `syz.2.309'.
[   83.188162][ T6691] netlink: 'syz.1.308': attribute type 12 has an invalid length.
[   83.192156][ T6691] netlink: 9472 bytes leftover after parsing attributes in process `syz.1.308'.
[   83.311426][ T6699] netlink: 56 bytes leftover after parsing attributes in process `syz.0.312'.
[   83.427596][ T6709] netlink: 'syz.2.317': attribute type 1 has an invalid length.
[   83.524974][ T6713] netlink: 24 bytes leftover after parsing attributes in process `syz.0.318'.
[   83.995178][ T6736] netlink: 8 bytes leftover after parsing attributes in process `syz.0.330'.
[   84.040877][ T6736] bridge0: port 1(bridge_slave_0) entered disabled state
[   84.047149][ T6736] bridge0: port 2(bridge_slave_1) entered disabled state
[   84.070794][ T6741] Illegal XDP return value 4294967289 on prog  (id 44) dev N/A, expect packet loss!
[   84.154387][ T6745] netlink: 32 bytes leftover after parsing attributes in process `syz.1.334'.
[   84.288506][ T6749] netlink: 92 bytes leftover after parsing attributes in process `syz.1.335'.
[   84.293455][ T6749] netem: unknown loss type 0
[   84.295604][ T6749] netem: change failed
[   84.327884][ T6755] netlink: 92 bytes leftover after parsing attributes in process `syz.0.339'.
[   84.557691][ T6769] netlink: 8 bytes leftover after parsing attributes in process `syz.0.346'.
[   84.690492][ T6778] netlink: 24 bytes leftover after parsing attributes in process `syz.0.349'.
[   85.105555][ T6798] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check.
[   85.615480][ T6844] xt_hashlimit: size too large, truncated to 1048576
[   85.902795][ T6853] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   86.420874][  T792] cfg80211: failed to load regulatory.db
[   86.527101][ T6897] netlink: 'syz.0.406': attribute type 4 has an invalid length.
[   86.738193][ T6921] Cannot find add_set index 0 as target
[   86.852937][ T6928] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   87.592496][ T1089] 
[   87.593532][ T1089] ======================================================
[   87.596225][ T1089] WARNING: possible circular locking dependency detected
[   87.598975][ T1089] 6.16.0-rc5-syzkaller-00159-g47c84997c686-dirty #0 Not tainted
[   87.603090][ T1089] ------------------------------------------------------
[   87.605821][ T1089] kworker/u10:6/1089 is trying to acquire lock:
[   87.608230][ T1089] ffff888020ff5358 (&disk->open_mutex){+.+.}-{4:4}, at: __del_gendisk+0x129/0x9e0
[   87.611822][ T1089] 
[   87.611822][ T1089] but task is already holding lock:
[   87.614734][ T1089] ffff88802100d988 (&set->update_nr_hwq_lock){++++}-{4:4}, at: del_gendisk+0xe0/0x160
[   87.618489][ T1089] 
[   87.618489][ T1089] which lock already depends on the new lock.
[   87.618489][ T1089] 
[   87.622453][ T1089] 
[   87.622453][ T1089] the existing dependency chain (in reverse order) is:
[   87.625966][ T1089] 
[   87.625966][ T1089] -> #2 (&set->update_nr_hwq_lock){++++}-{4:4}:
[   87.629193][ T1089]        lock_acquire+0x120/0x360
[   87.631145][ T1089]        down_write+0x96/0x1f0
[   87.633052][ T1089]        blk_mq_update_nr_hw_queues+0x3b/0x14c0
[   87.635441][ T1089]        nbd_start_device+0x16c/0xac0
[   87.637564][ T1089]        nbd_genl_connect+0x1250/0x1930
[   87.639751][ T1089]        genl_family_rcv_msg_doit+0x215/0x300
[   87.642125][ T1089]        genl_rcv_msg+0x60e/0x790
[   87.644104][ T1089]        netlink_rcv_skb+0x208/0x470
[   87.646211][ T1089]        genl_rcv+0x28/0x40
[   87.648023][ T1089]        netlink_unicast+0x75c/0x8e0
[   87.650058][ T1089]        netlink_sendmsg+0x805/0xb30
[   87.651693][ T1089]        __sock_sendmsg+0x21c/0x270
[   87.653315][ T1089]        ____sys_sendmsg+0x505/0x830
[   87.655069][ T1089]        ___sys_sendmsg+0x21f/0x2a0
[   87.656764][ T1089]        __x64_sys_sendmsg+0x19b/0x260
[   87.658508][ T1089]        do_syscall_64+0xfa/0x3b0
[   87.660075][ T1089]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   87.662194][ T1089] 
[   87.662194][ T1089] -> #1 (&nbd->config_lock){+.+.}-{4:4}:
[   87.664633][ T1089]        lock_acquire+0x120/0x360
[   87.666535][ T1089]        __mutex_lock+0x182/0xe80
[   87.668477][ T1089]        refcount_dec_and_mutex_lock+0x30/0xa0
[   87.670656][ T1089]        nbd_config_put+0x2c/0x790
[   87.672266][ T1089]        nbd_release+0xfe/0x140
[   87.673784][ T1089]        bdev_release+0x536/0x650
[   87.675324][ T1089]        blkdev_release+0x15/0x20
[   87.676925][ T1089]        __fput+0x44c/0xa70
[   87.678676][ T1089]        fput_close_sync+0x119/0x200
[   87.680598][ T1089]        __x64_sys_close+0x7f/0x110
[   87.682441][ T1089]        do_syscall_64+0xfa/0x3b0
[   87.684370][ T1089]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   87.686722][ T1089] 
[   87.686722][ T1089] -> #0 (&disk->open_mutex){+.+.}-{4:4}:
[   87.689133][ T1089]        validate_chain+0xb9b/0x2140
[   87.690753][ T1089]        __lock_acquire+0xab9/0xd20
[   87.692361][ T1089]        lock_acquire+0x120/0x360
[   87.694084][ T1089]        __mutex_lock+0x182/0xe80
[   87.696051][ T1089]        __del_gendisk+0x129/0x9e0
[   87.697949][ T1089]        del_gendisk+0xe8/0x160
[   87.699817][ T1089]        nbd_dev_remove_work+0x47/0xe0
[   87.701435][ T1089]        process_scheduled_works+0xae1/0x17b0
[   87.703446][ T1089]        worker_thread+0x8a0/0xda0
[   87.705439][ T1089]        kthread+0x711/0x8a0
[   87.707288][ T1089]        ret_from_fork+0x3fc/0x770
[   87.709119][ T1089]        ret_from_fork_asm+0x1a/0x30
[   87.710794][ T1089] 
[   87.710794][ T1089] other info that might help us debug this:
[   87.710794][ T1089] 
[   87.713828][ T1089] Chain exists of:
[   87.713828][ T1089]   &disk->open_mutex --> &nbd->config_lock --> &set->update_nr_hwq_lock
[   87.713828][ T1089] 
[   87.718204][ T1089]  Possible unsafe locking scenario:
[   87.718204][ T1089] 
[   87.720567][ T1089]        CPU0                    CPU1
[   87.722204][ T1089]        ----                    ----
[   87.723826][ T1089]   rlock(&set->update_nr_hwq_lock);
[   87.725477][ T1089]                                lock(&nbd->config_lock);
[   87.728152][ T1089]                                lock(&set->update_nr_hwq_lock);
[   87.730942][ T1089]   lock(&disk->open_mutex);
[   87.732443][ T1089] 
[   87.732443][ T1089]  *** DEADLOCK ***
[   87.732443][ T1089] 
[   87.734921][ T1089] 3 locks held by kworker/u10:6/1089:
[   87.736699][ T1089]  #0: ffff888020fbe948 ((wq_completion)nbd-del){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[   87.740231][ T1089]  #1: ffffc90007017bc0 ((work_completion)(&nbd->remove_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[   87.744208][ T1089]  #2: ffff88802100d988 (&set->update_nr_hwq_lock){++++}-{4:4}, at: del_gendisk+0xe0/0x160
[   87.747709][ T1089] 
[   87.747709][ T1089] stack backtrace:
[   87.749909][ T1089] CPU: 1 UID: 0 PID: 1089 Comm: kworker/u10:6 Not tainted 6.16.0-rc5-syzkaller-00159-g47c84997c686-dirty #0 PREEMPT(full) 
[   87.749926][ T1089] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   87.749933][ T1089] Workqueue: nbd-del nbd_dev_remove_work
[   87.749946][ T1089] Call Trace:
[   87.749951][ T1089]  <TASK>
[   87.749956][ T1089]  dump_stack_lvl+0x189/0x250
[   87.749968][ T1089]  ? __pfx_dump_stack_lvl+0x10/0x10
[   87.749976][ T1089]  ? __pfx__printk+0x10/0x10
[   87.749986][ T1089]  ? print_lock_name+0xde/0x100
[   87.749996][ T1089]  print_circular_bug+0x2ee/0x310
[   87.750007][ T1089]  check_noncircular+0x134/0x160
[   87.750017][ T1089]  validate_chain+0xb9b/0x2140
[   87.750027][ T1089]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[   87.750038][ T1089]  ? arch_stack_walk+0x11c/0x150
[   87.750049][ T1089]  __lock_acquire+0xab9/0xd20
[   87.750058][ T1089]  ? __del_gendisk+0x129/0x9e0
[   87.750066][ T1089]  lock_acquire+0x120/0x360
[   87.750073][ T1089]  ? __del_gendisk+0x129/0x9e0
[   87.750081][ T1089]  ? check_path+0x21/0x40
[   87.750090][ T1089]  __mutex_lock+0x182/0xe80
[   87.750099][ T1089]  ? __del_gendisk+0x129/0x9e0
[   87.750107][ T1089]  ? __del_gendisk+0x129/0x9e0
[   87.750115][ T1089]  ? __pfx___mutex_lock+0x10/0x10
[   87.750122][ T1089]  ? __pfx___might_resched+0x10/0x10
[   87.750132][ T1089]  ? __lock_acquire+0xab9/0xd20
[   87.750139][ T1089]  ? disk_del_events+0xb5/0x210
[   87.750147][ T1089]  ? __del_gendisk+0xc1/0x9e0
[   87.750155][ T1089]  __del_gendisk+0x129/0x9e0
[   87.750162][ T1089]  ? del_gendisk+0xe0/0x160
[   87.750174][ T1089]  ? __pfx___del_gendisk+0x10/0x10
[   87.750183][ T1089]  ? down_read+0x1ad/0x2e0
[   87.750191][ T1089]  del_gendisk+0xe8/0x160
[   87.750203][ T1089]  nbd_dev_remove_work+0x47/0xe0
[   87.750215][ T1089]  ? process_scheduled_works+0x9ef/0x17b0
[   87.750229][ T1089]  process_scheduled_works+0xae1/0x17b0
[   87.750249][ T1089]  ? __pfx_process_scheduled_works+0x10/0x10
[   87.750268][ T1089]  worker_thread+0x8a0/0xda0
[   87.750288][ T1089]  kthread+0x711/0x8a0
[   87.750306][ T1089]  ? __pfx_worker_thread+0x10/0x10
[   87.750321][ T1089]  ? __pfx_kthread+0x10/0x10
[   87.750337][ T1089]  ? _raw_spin_unlock_irq+0x23/0x50
[   87.750347][ T1089]  ? lockdep_hardirqs_on+0x9c/0x150
[   87.750357][ T1089]  ? __pfx_kthread+0x10/0x10
[   87.750367][ T1089]  ret_from_fork+0x3fc/0x770
[   87.750376][ T1089]  ? __pfx_ret_from_fork+0x10/0x10
[   87.750384][ T1089]  ? __switch_to_asm+0x39/0x70
[   87.750394][ T1089]  ? __switch_to_asm+0x33/0x70
[   87.750402][ T1089]  ? __pfx_kthread+0x10/0x10
[   87.750435][ T1089]  ret_from_fork_asm+0x1a/0x30
[   87.750448][ T1089]  </TASK>
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   88.364549][   T12] bridge_slave_1: left allmulticast mode
[   88.366490][   T12] bridge_slave_1: left promiscuous mode
[   88.368568][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[   88.372141][   T12] bridge_slave_0: left allmulticast mode
[   88.374329][   T12] bridge_slave_0: left promiscuous mode
[   88.376643][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[   88.547030][   T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   88.550398][   T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   88.553682][   T12] bond0 (unregistering): Released all slaves
[   88.595047][   T12] tipc: Left network mode
[   88.762899][   T12] hsr_slave_0: left promiscuous mode
[   88.765410][   T12] hsr_slave_1: left promiscuous mode
[   88.769210][   T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[   88.773610][   T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[   89.365504][   T12] IPVS: stop unused estimator thread 0...
[   89.461967][   T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   89.530844][   T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   89.583647][   T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   89.631916][   T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   89.727321][   T12] bridge_slave_1: left allmulticast mode
[   89.729864][   T12] bridge_slave_1: left promiscuous mode
[   89.732249][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[   89.735923][   T12] bridge_slave_0: left allmulticast mode
[   89.738082][   T12] bridge_slave_0: left promiscuous mode
[   89.742514][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[   89.855339][   T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   89.860363][   T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   89.865030][   T12] bond0 (unregistering): (slave wlan1): Releasing backup interface
[   89.870465][   T12] bond0 (unregistering): Released all slaves
[   90.040324][   T12] hsr_slave_0: left promiscuous mode
[   90.042875][   T12] hsr_slave_1: left promiscuous mode
[   90.045398][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   90.048284][   T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[   90.052352][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   90.055341][   T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[   90.062450][   T12] veth1_macvtap: left promiscuous mode
[   90.064674][   T12] veth0_macvtap: left promiscuous mode
[   90.066920][   T12] veth1_vlan: left promiscuous mode
[   90.069572][   T12] veth0_vlan: left promiscuous mode
[   90.217041][   T12] team0 (unregistering): Port device team_slave_1 removed
[   90.233618][   T12] team0 (unregistering): Port device team_slave_0 removed
[   96.668805][   T60] block nbd0: Possible stuck request ffff8880210d8000: control (read@0,1024B). Runtime 30 seconds
[   96.672125][   T60] block nbd0: Possible stuck request ffff8880210d8200: control (read@1024,1024B). Runtime 30 seconds
[   96.675452][   T60] block nbd0: Possible stuck request ffff8880210d8400: control (read@2048,1024B). Runtime 30 seconds
[   96.678894][   T60] block nbd0: Possible stuck request ffff8880210d8600: control (read@3072,1024B). Runtime 30 seconds

VM DIAGNOSIS:
20:40:25  Registers:
info registers vcpu 0

CPU#0
RAX=ffff88804b032f58 RBX=ffff88804b032f58 RCX=2664947585ed0500 RDX=0000000000000000
RSI=ffffffff8be29da0 RDI=ffffffff8be29d60 RBP=00000032706f6f6c RSP=ffffc9000324f710
R8 =ffff88802b4533d3 R9 =1ffff1100568a67a R10=dffffc0000000000 R11=ffffed100568a67b
R12=dffffc0000000000 R13=ffffffff823b01d6 R14=ffffffff8dbbec70 R15=dffffc0000000000
RIP=ffffffff81a73001 RFL=00000283 [--S---C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f469fb09c80 ffffffff 00c00000
GS =0000 ffff8880b861b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000555570ede5c8 CR3=000000001f070000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=00ff000000000000 ff00000000000000 XMM05=6c67656b2f650061 642e7269662f302e
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=000000000000ff00 0000000000000000 XMM09=756765722f657261 776d7269662f302e
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000064 RBX=0000000000000064 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc90007016e10
R8 =ffff888107938237 R9 =1ffff11020f27046 R10=dffffc0000000000 R11=ffffffff85478780
R12=dffffc0000000000 R13=ffffffff99af98c1 R14=ffffffff99dfe6e0 R15=0000000000000000
RIP=ffffffff854787fc RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f0dfff7f2d8 CR3=000000010d516000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=ffffffffffffffff ffff00ff00000000 XMM05=000034312f650061 642e7269662f302e
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffff00000000ff00 0000000000000000 XMM09=756765722f657261 776d7269662f302e
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
