last executing test programs:

550.705409ms ago: executing program 2 (id=1758):
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
accept4$rose(r0, 0x0, 0x0, 0x800)

479.602435ms ago: executing program 2 (id=1759):
r0 = socket$can_raw(0x1d, 0x3, 0x1)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f00000000c0)=0x47ca, 0x4)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan0\x00', <r1=>0x0})
setsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x5, &(0x7f0000000180)=0x1, 0x4)
sendmsg$can_raw(r0, &(0x7f0000000340)={&(0x7f0000000080)={0x1d, r1}, 0x10, &(0x7f0000000000)={&(0x7f00000001c0)=@canfd={{}, 0x2e, 0x0, 0x0, 0x0, "4e4e488e419039dda425818c34de45852abd1372621b404219373c9a72cdb611ef256a70bf66c39d7082f2809cbc3da9bb3c86e0c5e53cff15d561c53fe9ae3a"}, 0x48}}, 0x1)

448.690872ms ago: executing program 2 (id=1762):
r0 = syz_init_net_socket$llc(0x1a, 0x801, 0x0)
bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10)
connect$llc(r0, &(0x7f0000000240)={0x1a, 0x20, 0x0, 0x9, 0x2, 0x0, @random='\x00\x00\x00\x00\x00\a'}, 0x10)
r1 = syz_init_net_socket$llc(0x1a, 0x801, 0x0)
bind$llc(r1, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x10)

360.934224ms ago: executing program 2 (id=1765):
r0 = socket$inet6(0xa, 0x3, 0x3a)
getsockopt$inet6_mreq(r0, 0x29, 0x7, 0x0, &(0x7f0000000100))

360.41391ms ago: executing program 0 (id=1769):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="500000000102010800000000000000000a0000003c0001802c0001801400030000000000000000000000ffffac1e000114000400"], 0x50}}, 0x0)

292.302184ms ago: executing program 2 (id=1770):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}}, 0x0)
sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020301"], 0x1c}}, 0x0)
sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000010401010000000000000000000004000500010001"], 0x1c}}, 0x0)
sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="200000000104"], 0x20}, 0x1, 0x0, 0x0, 0x20048805}, 0x0)

291.980839ms ago: executing program 0 (id=1772):
unshare(0x62040200)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10008095, 0x0, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
sendto$inet6(r0, &(0x7f00000000c0)="e9", 0x1, 0x20008045, &(0x7f00000001c0)={0xa, 0x2, 0x1000, @empty}, 0x1c)
r1 = socket$inet6(0xa, 0x800000000000002, 0x0)
setsockopt$inet6_mtu(r1, 0x29, 0x17, 0x0, 0x0)
sendto$inet6(r1, 0x0, 0x0, 0x2400ed80, 0x0, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100001400a0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x80)

291.763599ms ago: executing program 2 (id=1773):
pselect6(0x0, 0x0, &(0x7f0000000100)={0x5, 0x3, 0x101, 0xb21b, 0x0, 0x8000000000000001, 0x10001, 0x6}, 0x0, 0x0, 0x0)
r0 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$inet(r0, &(0x7f0000002780)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1400000000000000100100000d00000001000000000000001800000000000000100100000d"], 0x30}, 0x0)

241.541142ms ago: executing program 1 (id=1775):
r0 = socket$inet6(0xa, 0x80002, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x50, 0x20}, {0x20, 0x0, 0x0, 0xfffff010}, {0x6}]}, 0x10)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x5}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000000600)=[{{0x0, 0x0, 0x0}}], 0x1, 0x50d41de21d476b07)

183.340235ms ago: executing program 1 (id=1776):
r0 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r0, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0258ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000008000100090810000000000000040000", 0x58}], 0x1)

182.997192ms ago: executing program 0 (id=1777):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
unshare(0x2c020400)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0)
r2 = openat$cgroup_devices(r1, &(0x7f0000000240)='devices.allow\x00', 0x2, 0x0)
sendfile(r2, r2, &(0x7f00000001c0)=0x1000000000e17, 0x400000000004)
sendmmsg$inet(r0, &(0x7f00000039c0), 0x0, 0x2000c044)
r3 = socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$inet6_udp_int(r3, 0x11, 0xa, &(0x7f0000000040)=0x6, 0x4)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff)
r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
sendmsg$ETHTOOL_MSG_COALESCE_SET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000001400000008000f00fc00000018000180140002006e657464657673696d300000000000000800060000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES64=r6], 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x88010)
accept4$inet6(r3, &(0x7f0000000140), &(0x7f0000000200)=0x1c, 0x800)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="3000000010000100"/19, @ANYRES32=0x0, @ANYBLOB="8000000002000200080004000000000008001b"], 0x30}}, 0x0)
r8 = socket$inet_udplite(0x2, 0x2, 0x88)
setsockopt$inet_buf(r8, 0x0, 0x4, 0x0, 0x0)

182.718352ms ago: executing program 1 (id=1778):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x6c, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4, 0x0, @loopback={0xfec0ffffffffffff}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @empty}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x6c}}, 0x0)

93.005479ms ago: executing program 0 (id=1779):
pipe(&(0x7f00000045c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
vmsplice(r1, &(0x7f0000000440)=[{&(0x7f00000000c0)="3b256c7a40ff8cf30d776a89d5cfc3ce7467bd24", 0x14}], 0x1, 0x0)
r2 = socket$inet(0x2, 0x3, 0x7f)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0)
syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff)
setsockopt$inet_int(r2, 0x0, 0x3, &(0x7f0000000080)=0xfffffffa, 0x4)
connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10)
splice(r0, 0x0, r2, 0x0, 0x8000, 0x0)

92.871732ms ago: executing program 1 (id=1780):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
unshare(0x24040400)
connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x8, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe)
connect$bt_l2cap(r0, &(0x7f0000000a40)={0x1f, 0xd, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x0, 0x2}, 0xe)

92.757252ms ago: executing program 0 (id=1781):
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000025c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x7, &(0x7f0000000100)="fbffffff", 0x4)

89.739003ms ago: executing program 1 (id=1782):
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000), 0x48)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r0, 0x0)

332.436µs ago: executing program 0 (id=1783):
socket$nl_route(0x10, 0x3, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
socket$inet6_sctp(0xa, 0x1, 0x84)
socket$inet_smc(0x2b, 0x1, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x275a, 0x0)
syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x90)
socketpair(0x1, 0x1, 0x0, &(0x7f0000000000))
syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/time_for_children\x00')
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x30, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x8}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x30}}, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000005100000000000000000a200000000900010073797a30000000001400000010"], 0x48}}, 0x20050800)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff})
sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000c000597ff000000000000000c0002000000000000000000040007800c000800000000000000000008000a00000000004400078008000100", @ANYRES32, @ANYBLOB="32000100", @ANYRES32=r3], 0x90}}, 0x0)

0s ago: executing program 1 (id=1784):
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x26e1, 0x0)
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
splice(r0, 0x0, r2, 0x0, 0x100000000, 0x4)
vmsplice(r1, &(0x7f0000000780)=[{&(0x7f0000000180)="15", 0x1}], 0x1, 0x1)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:35313' (ED25519) to the list of known hosts.
syzkaller login: [   47.986774][ T5802] cgroup: Unknown subsys name 'net'
[   48.090405][ T5802] cgroup: Unknown subsys name 'cpuset'
[   48.094128][ T5802] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   49.427576][ T5802] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   53.078657][ T5205] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   53.082019][ T5205] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   53.084675][ T5205] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   53.087502][ T5205] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   53.090044][ T5205] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   53.159733][ T5205] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   53.162789][ T5205] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   53.165729][ T5205] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   53.168668][ T5205] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   53.171458][ T5205] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   53.255970][   T55] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   53.258735][   T55] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   53.261696][   T55] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   53.264954][   T55] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   53.268193][   T55] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   53.385829][ T5813] chnl_net:caif_netlink_parms(): no params data found
[   53.482035][ T5818] chnl_net:caif_netlink_parms(): no params data found
[   53.555307][ T5813] bridge0: port 1(bridge_slave_0) entered blocking state
[   53.559765][ T5813] bridge0: port 1(bridge_slave_0) entered disabled state
[   53.563199][ T5813] bridge_slave_0: entered allmulticast mode
[   53.567875][ T5813] bridge_slave_0: entered promiscuous mode
[   53.596340][ T5813] bridge0: port 2(bridge_slave_1) entered blocking state
[   53.599443][ T5813] bridge0: port 2(bridge_slave_1) entered disabled state
[   53.602525][ T5813] bridge_slave_1: entered allmulticast mode
[   53.607064][ T5813] bridge_slave_1: entered promiscuous mode
[   53.692326][ T5813] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   53.701595][ T5813] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   53.743786][ T5818] bridge0: port 1(bridge_slave_0) entered blocking state
[   53.748692][ T5818] bridge0: port 1(bridge_slave_0) entered disabled state
[   53.752640][ T5818] bridge_slave_0: entered allmulticast mode
[   53.757672][ T5818] bridge_slave_0: entered promiscuous mode
[   53.777006][ T5821] chnl_net:caif_netlink_parms(): no params data found
[   53.785185][ T5818] bridge0: port 2(bridge_slave_1) entered blocking state
[   53.788362][ T5818] bridge0: port 2(bridge_slave_1) entered disabled state
[   53.790793][ T5818] bridge_slave_1: entered allmulticast mode
[   53.794084][ T5818] bridge_slave_1: entered promiscuous mode
[   53.799983][ T5813] team0: Port device team_slave_0 added
[   53.818968][ T5813] team0: Port device team_slave_1 added
[   53.864011][ T5818] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   53.889056][ T5818] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   53.893667][ T5813] batman_adv: batadv0: Adding interface: batadv_slave_0
[   53.898745][ T5813] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   53.909324][ T5813] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   53.934468][ T5813] batman_adv: batadv0: Adding interface: batadv_slave_1
[   53.937878][ T5813] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   53.948335][ T5813] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   53.997167][ T5818] team0: Port device team_slave_0 added
[   54.001384][ T5821] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.004387][ T5821] bridge0: port 1(bridge_slave_0) entered disabled state
[   54.009326][ T5821] bridge_slave_0: entered allmulticast mode
[   54.013205][ T5821] bridge_slave_0: entered promiscuous mode
[   54.018583][ T5821] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.021473][ T5821] bridge0: port 2(bridge_slave_1) entered disabled state
[   54.024445][ T5821] bridge_slave_1: entered allmulticast mode
[   54.028406][ T5821] bridge_slave_1: entered promiscuous mode
[   54.034144][ T5818] team0: Port device team_slave_1 added
[   54.102462][ T5813] hsr_slave_0: entered promiscuous mode
[   54.107369][ T5813] hsr_slave_1: entered promiscuous mode
[   54.124111][ T5818] batman_adv: batadv0: Adding interface: batadv_slave_0
[   54.127253][ T5818] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.138413][ T5818] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   54.145103][ T5821] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   54.150817][ T5821] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   54.154325][ T5818] batman_adv: batadv0: Adding interface: batadv_slave_1
[   54.157451][ T5818] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.169541][ T5818] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   54.212305][ T5821] team0: Port device team_slave_0 added
[   54.216408][ T5821] team0: Port device team_slave_1 added
[   54.279674][ T5818] hsr_slave_0: entered promiscuous mode
[   54.282812][ T5818] hsr_slave_1: entered promiscuous mode
[   54.286332][ T5818] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   54.289680][ T5818] Cannot create hsr debugfs directory
[   54.299932][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_0
[   54.302181][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.312692][ T5821] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   54.319518][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_1
[   54.322368][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   54.332965][ T5821] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   54.432134][ T5821] hsr_slave_0: entered promiscuous mode
[   54.435274][ T5821] hsr_slave_1: entered promiscuous mode
[   54.439453][ T5821] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   54.442611][ T5821] Cannot create hsr debugfs directory
[   54.653945][ T5813] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   54.671402][ T5813] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   54.694411][ T5813] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   54.703743][ T5813] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   54.753954][ T5818] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   54.764684][ T5818] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   54.772037][ T5818] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   54.785056][ T5818] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   54.831078][ T5821] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   54.846920][ T5821] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   54.852440][ T5821] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   54.864227][ T5821] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   54.922682][ T5813] 8021q: adding VLAN 0 to HW filter on device bond0
[   54.951585][ T5813] 8021q: adding VLAN 0 to HW filter on device team0
[   54.964910][ T5818] 8021q: adding VLAN 0 to HW filter on device bond0
[   54.971662][ T4468] bridge0: port 1(bridge_slave_0) entered blocking state
[   54.974564][ T4468] bridge0: port 1(bridge_slave_0) entered forwarding state
[   54.991655][ T4468] bridge0: port 2(bridge_slave_1) entered blocking state
[   54.993979][ T4468] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.007403][ T5818] 8021q: adding VLAN 0 to HW filter on device team0
[   55.029337][   T32] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.032475][   T32] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.051437][   T32] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.054621][   T32] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.090234][ T5821] 8021q: adding VLAN 0 to HW filter on device bond0
[   55.126791][ T5821] 8021q: adding VLAN 0 to HW filter on device team0
[   55.135403][   T32] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.137944][   T32] bridge0: port 1(bridge_slave_0) entered forwarding state
[   55.141190][ T5824] Bluetooth: hci0: command tx timeout
[   55.151203][   T32] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.153602][   T32] bridge0: port 2(bridge_slave_1) entered forwarding state
[   55.215676][ T5824] Bluetooth: hci1: command tx timeout
[   55.220678][ T5813] 8021q: adding VLAN 0 to HW filter on device batadv0
[   55.285131][ T5813] veth0_vlan: entered promiscuous mode
[   55.298016][ T5824] Bluetooth: hci2: command tx timeout
[   55.299543][ T5818] 8021q: adding VLAN 0 to HW filter on device batadv0
[   55.322673][ T5813] veth1_vlan: entered promiscuous mode
[   55.368677][ T5818] veth0_vlan: entered promiscuous mode
[   55.371637][ T5813] veth0_macvtap: entered promiscuous mode
[   55.379555][ T5821] 8021q: adding VLAN 0 to HW filter on device batadv0
[   55.383970][ T5813] veth1_macvtap: entered promiscuous mode
[   55.387931][ T5818] veth1_vlan: entered promiscuous mode
[   55.410976][ T5813] batman_adv: batadv0: Interface activated: batadv_slave_0
[   55.427106][ T5813] batman_adv: batadv0: Interface activated: batadv_slave_1
[   55.435213][ T5818] veth0_macvtap: entered promiscuous mode
[   55.438808][ T5813] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   55.441896][ T5813] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   55.444604][ T5813] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   55.449538][ T5813] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   55.463749][ T5818] veth1_macvtap: entered promiscuous mode
[   55.473804][ T5821] veth0_vlan: entered promiscuous mode
[   55.492225][ T5818] batman_adv: batadv0: Interface activated: batadv_slave_0
[   55.509395][ T5821] veth1_vlan: entered promiscuous mode
[   55.514983][ T5818] batman_adv: batadv0: Interface activated: batadv_slave_1
[   55.524411][ T5818] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   55.532850][ T5818] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   55.536508][ T5818] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   55.539509][ T5818] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   55.576299][ T1086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.582664][ T1086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.615111][ T5821] veth0_macvtap: entered promiscuous mode
[   55.652055][ T5821] veth1_macvtap: entered promiscuous mode
[   55.658847][ T1086] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.662101][ T1086] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.691912][ T2271] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.695236][ T2271] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.701580][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_0
[   55.721767][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_1
[   55.723696][ T5813] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   55.726172][ T5821] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   55.731571][ T5821] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   55.734340][ T5821] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   55.737862][ T5821] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   55.761485][ T4499] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.768034][ T4499] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.803155][ T5878] Zero length message leads to an empty skb
[   55.832068][ T2271] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.849187][ T2271] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   55.869704][ T4468] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   55.875043][ T4468] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   56.161485][ T5905] netlink: 16 bytes leftover after parsing attributes in process `syz.0.14'.
[   56.457212][ T5917] netlink: 60 bytes leftover after parsing attributes in process `syz.0.19'.
[   56.463837][ T5917] netlink: 16 bytes leftover after parsing attributes in process `syz.0.19'.
[   56.597731][ T5925] No such timeout policy "syz1"
[   57.216732][ T5824] Bluetooth: hci0: command tx timeout
[   57.296138][ T5824] Bluetooth: hci1: command tx timeout
[   57.375700][ T5816] Bluetooth: hci2: command tx timeout
[   57.997546][ T5967] netlink: 56 bytes leftover after parsing attributes in process `syz.0.44'.
[   58.000887][ T5967] netlink: 24 bytes leftover after parsing attributes in process `syz.0.44'.
[   58.122752][ T5979] netlink: 4 bytes leftover after parsing attributes in process `syz.0.50'.
[   58.128735][ T5979] netlink: 'syz.0.50': attribute type 1 has an invalid length.
[   58.132316][ T5979] netlink: 44 bytes leftover after parsing attributes in process `syz.0.50'.
[   58.159910][ T5980] netlink: 28 bytes leftover after parsing attributes in process `syz.2.49'.
[   58.172583][   T33] audit: type=1804 audit(1751658023.551:2): pid=5980 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.49" name="/newroot/6/cgroup.controllers" dev="tmpfs" ino=49 res=1 errno=0
[   58.206167][   T33] audit: type=1800 audit(1751658023.561:3): pid=5980 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.49" name="cgroup.controllers" dev="tmpfs" ino=49 res=0 errno=0
[   58.324762][ T5989] syz.2.55 uses obsolete (PF_INET,SOCK_PACKET)
[   58.432259][ T5993] "syz.0.56" (5993) uses obsolete ecb(arc4) skcipher
[   58.469423][ T6005] netlink: 20 bytes leftover after parsing attributes in process `syz.0.61'.
[   58.530652][ T6009] netlink: 4 bytes leftover after parsing attributes in process `syz.2.63'.
[   58.650254][ T6019] pimreg3: entered allmulticast mode
[   58.662567][ T6018] pimreg3: left allmulticast mode
[   59.024449][   T10] hid-generic 0005:046D:FFF9.0001: item fetching failed at offset 0/1
[   59.039041][   T10] hid-generic 0005:046D:FFF9.0001: probe with driver hid-generic failed with error -22
[   59.297176][ T5816] Bluetooth: hci0: command tx timeout
[   59.377506][ T5816] Bluetooth: hci1: command tx timeout
[   59.455764][ T5816] Bluetooth: hci2: command tx timeout
[   59.490851][ T6065] unknown channel width for channel at 909000KHz?
[   59.493513][ T6065] unknown channel width for channel at 909000KHz?
[   59.503029][ T6065] unknown channel width for channel at 909000KHz?
[   59.745832][ T6080] netlink: 'syz.1.94': attribute type 3 has an invalid length.
[   59.892380][ T6091] xt_CT: You must specify a L4 protocol and not use inversions on it
[   60.078712][ T6108] netlink: 'syz.0.106': attribute type 11 has an invalid length.
[   60.438338][ T6132] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   61.189254][ T6203] xt_CHECKSUM: CHECKSUM should be avoided.  If really needed, restrict with "-p udp" and only use in OUTPUT
[   61.225065][ T6200] netlink: 'syz.1.142': attribute type 20 has an invalid length.
[   61.376014][ T5816] Bluetooth: hci0: command tx timeout
[   61.467172][ T5816] Bluetooth: hci1: command tx timeout
[   61.485199][ T6227] __nla_validate_parse: 8 callbacks suppressed
[   61.485209][ T6227] netlink: 24 bytes leftover after parsing attributes in process `syz.2.154'.
[   61.554174][ T5816] Bluetooth: hci2: command tx timeout
[   61.569067][ T6235] netlink: 8 bytes leftover after parsing attributes in process `syz.0.156'.
[   61.627861][ T6238] team0: No ports can be present during mode change
[   61.642936][ T6240] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   61.733518][ T6250] netlink: 'syz.1.165': attribute type 3 has an invalid length.
[   61.850626][ T6254] netlink: 27 bytes leftover after parsing attributes in process `syz.2.167'.
[   62.318216][ T6292] sch_tbf: burst 19872 is lower than device lo mtu (65550) !
[   62.341497][ T6292] sch_fq: defrate 1 ignored.
[   62.435195][ T6300] xt_policy: neither incoming nor outgoing policy selected
[   62.596536][ T6311] netlink: 16 bytes leftover after parsing attributes in process `syz.0.193'.
[   62.731455][ T6318] netlink: 'syz.0.196': attribute type 3 has an invalid length.
[   62.734299][ T6318] netlink: 64 bytes leftover after parsing attributes in process `syz.0.196'.
[   62.749442][ T6318] netlink: 'syz.0.196': attribute type 3 has an invalid length.
[   62.759405][ T6320] netlink: 8 bytes leftover after parsing attributes in process `syz.2.198'.
[   62.962618][ T6339] netlink: 'syz.1.207': attribute type 1 has an invalid length.
[   62.974243][ T6339] netlink: 'syz.1.207': attribute type 11 has an invalid length.
[   62.982263][ T6339] netlink: 220 bytes leftover after parsing attributes in process `syz.1.207'.
[   63.052013][ T6344] netlink: 8 bytes leftover after parsing attributes in process `syz.0.209'.
[   63.054907][ T6344] netlink: 8 bytes leftover after parsing attributes in process `syz.0.209'.
[   63.169167][ T6354] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   63.172600][ T6354] IPv6: NLM_F_CREATE should be set when creating new route
[   63.532532][ T6378] 8021q: adding VLAN 0 to HW filter on device bond1
[   63.616068][ T5816] Bluetooth: hci2: command tx timeout
[   63.698325][ T6397] bridge1: entered promiscuous mode
[   63.802992][ T6403] netlink: 'syz.0.238': attribute type 29 has an invalid length.
[   63.829472][ T6403] netlink: 'syz.0.238': attribute type 29 has an invalid length.
[   63.840431][ T6403] netlink: 500 bytes leftover after parsing attributes in process `syz.0.238'.
[   64.553242][ T6464] xfrm1: entered promiscuous mode
[   64.554947][ T6464] xfrm1: entered allmulticast mode
[   64.619167][ T6466] xt_TCPMSS: Only works on TCP SYN packets
[   64.622750][ T6464] xt_hashlimit: size too large, truncated to 1048576
[   65.127311][ T6480] vcan0: tx drop: invalid sa for name 0x0000000000000001
[   65.264922][ T6490] netlink: 'syz.2.278': attribute type 10 has an invalid length.
[   65.285371][ T6490] bond0: (slave netdevsim0): Enslaving as an active interface with an up link
[   65.890384][ T6544] batadv0: entered promiscuous mode
[   65.892727][ T6544] vlan2: entered promiscuous mode
[   66.045944][ T6558] netlink: 'syz.1.309': attribute type 13 has an invalid length.
[   66.048626][ T6558] netlink: 'syz.1.309': attribute type 17 has an invalid length.
[   66.116000][ T6558] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[   66.228510][ T6570] gretap1: entered promiscuous mode
[   66.298896][ T6572] Bluetooth: MGMT ver 1.23
[   66.662371][ T6599] warning: `syz.1.330' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   66.703582][ T6603] __nla_validate_parse: 14 callbacks suppressed
[   66.703594][ T6603] netlink: 36 bytes leftover after parsing attributes in process `syz.1.332'.
[   66.715691][ T6603] netlink: 36 bytes leftover after parsing attributes in process `syz.1.332'.
[   66.770576][ T6607] netlink: 8 bytes leftover after parsing attributes in process `syz.0.333'.
[   66.773743][ T6607] netlink: 12 bytes leftover after parsing attributes in process `syz.0.333'.
[   66.943673][ T6617] netlink: 8 bytes leftover after parsing attributes in process `syz.1.339'.
[   67.042816][ T6627] netlink: 'syz.1.344': attribute type 12 has an invalid length.
[   67.043100][ T6625] tipc: Failed to remove unknown binding: 66,1,1/0:2387295089/2387295091
[   67.047731][ T6627] netlink: 9472 bytes leftover after parsing attributes in process `syz.1.344'.
[   67.050445][ T6625] tipc: Failed to remove unknown binding: 66,1,1/0:2387295089/2387295091
[   67.829319][ T6684] ipt_ECN: cannot use operation on non-tcp rule
[   68.004419][ T6689] syzkaller0: entered allmulticast mode
[   68.021048][ T6689] syzkaller0 (unregistering): left allmulticast mode
[   68.298764][ T6698] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.376'.
[   69.179184][ T6750] sctp: [Deprecated]: syz.1.398 (pid 6750) Use of int in max_burst socket option.
[   69.179184][ T6750] Use struct sctp_assoc_value instead
[   70.309033][ T6775] xt_CHECKSUM: unsupported CHECKSUM operation 68
[   70.352840][ T6781] netem: change failed
[   70.441423][ T6784] netlink: 8 bytes leftover after parsing attributes in process `syz.2.409'.
[   70.445256][ T6784] netlink: 8 bytes leftover after parsing attributes in process `syz.2.409'.
[   70.472502][ T6792] netlink: 8 bytes leftover after parsing attributes in process `syz.0.417'.
[   70.812204][ T6811] bridge_slave_1: left allmulticast mode
[   70.814162][ T6811] bridge_slave_1: left promiscuous mode
[   70.821008][ T1360] ieee802154 phy0 wpan0: encryption failed: -22
[   70.823537][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
[   70.828278][ T6811] bridge0: port 2(bridge_slave_1) entered disabled state
[   70.834629][ T6811] bridge_slave_0: left allmulticast mode
[   70.838123][ T6811] bridge_slave_0: left promiscuous mode
[   70.840643][ T6811] bridge0: port 1(bridge_slave_0) entered disabled state
[   71.067628][ T6815] bridge0: port 2(bridge_slave_1) entered disabled state
[   71.071082][ T6815] bridge0: port 1(bridge_slave_0) entered disabled state
[   71.128778][ T6815] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   71.137243][ T6815] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   71.202957][ T6815] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   71.206891][ T6815] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   71.210543][ T6815] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   71.214160][ T6815] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   71.251374][ T6815] bridge1: left promiscuous mode
[   71.274551][ T6833] syzkaller1: tun_chr_ioctl cmd 1074025672
[   71.276690][ T6833] syzkaller1: ignored: set checksum enabled
[   71.668798][ T6869] xt_TPROXY: Can be used only with -p tcp or -p udp
[   71.805953][ T6884] __nla_validate_parse: 50 callbacks suppressed
[   71.805964][ T6884] netlink: 32 bytes leftover after parsing attributes in process `syz.2.458'.
[   72.513237][ T6936] netlink: 24 bytes leftover after parsing attributes in process `syz.1.482'.
[   72.582451][ T6942] netdevsim netdevsim2 netdevsim0: entered promiscuous mode
[   72.601114][ T6942] bond0: (slave netdevsim0): Releasing backup interface
[   72.606248][ T6942] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[   73.066713][ T6961] Bluetooth: MGMT ver 1.23
[   73.188812][ T6982] netlink: 16 bytes leftover after parsing attributes in process `syz.2.501'.
[   73.392737][ T7007] netlink: 56 bytes leftover after parsing attributes in process `syz.0.516'.
[   73.465163][ T7016] policy can only be matched on NF_INET_PRE_ROUTING
[   73.465177][ T7016] unable to load match
[   73.469136][ T7019] netlink: 'syz.2.520': attribute type 1 has an invalid length.
[   73.704245][ T7036] netlink: 16 bytes leftover after parsing attributes in process `syz.2.528'.
[   73.709609][ T7036] netlink: 'syz.2.528': attribute type 1 has an invalid length.
[   73.712188][ T7036] netlink: 224 bytes leftover after parsing attributes in process `syz.2.528'.
[   74.534645][ T7060] netlink: 27 bytes leftover after parsing attributes in process `syz.1.537'.
[   74.614838][ T7066] netlink: 'syz.1.542': attribute type 29 has an invalid length.
[   74.636885][ T7066] netlink: 'syz.1.542': attribute type 29 has an invalid length.
[   74.648565][ T7066] netlink: 44 bytes leftover after parsing attributes in process `syz.1.542'.
[   74.761499][ T7080] netlink: 56 bytes leftover after parsing attributes in process `syz.1.548'.
[   74.765418][ T7080] netlink: 8 bytes leftover after parsing attributes in process `syz.1.548'.
[   75.055282][ T7103] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input4
[   75.145734][ T5816] Bluetooth: hci0: command tx timeout
[   75.314838][ T7122] netlink: 'syz.0.568': attribute type 1 has an invalid length.
[   75.323354][ T7126] netlink: 'syz.2.570': attribute type 4 has an invalid length.
[   75.440057][ T7136] IPv6: syztnl1: Disabled Multicast RS
[   75.594412][ T7146] openvswitch: netlink: Either Ethernet header or EtherType is required.
[   75.940024][ T7167] netlink: 'syz.1.589': attribute type 2 has an invalid length.
[   76.099745][ T7175] netlink: 'syz.2.588': attribute type 8 has an invalid length.
[   76.112847][ T7170] bridge_slave_0: left allmulticast mode
[   76.122054][ T7170] bridge_slave_0: left promiscuous mode
[   76.130439][ T7170] bridge0: port 1(bridge_slave_0) entered disabled state
[   76.138162][ T7170] bridge_slave_1: left allmulticast mode
[   76.141246][ T7170] bridge_slave_1: left promiscuous mode
[   76.144351][ T7170] bridge0: port 2(bridge_slave_1) entered disabled state
[   76.156508][ T7170] bond0: (slave bond_slave_0): Releasing backup interface
[   76.161977][ T7170] bond0: (slave bond_slave_1): Releasing backup interface
[   76.170801][ T7170] team0: Port device team_slave_0 removed
[   76.174725][ T7170] team0: Port device team_slave_1 removed
[   76.179295][ T7170] batman_adv: batadv0: Removing interface: batadv_slave_0
[   76.182628][ T7170] batman_adv: batadv0: Removing interface: batadv_slave_1
[   76.559827][ T7193] netlink: 'syz.0.600': attribute type 5 has an invalid length.
[   76.670983][ T7203] netdevsim netdevsim1 netdevsim0: entered promiscuous mode
[   76.771644][ T7214] netlink: 'syz.1.610': attribute type 1 has an invalid length.
[   76.814635][ T7214] bond2: (slave gretap2): making interface the new active one
[   76.818313][ T7214] bond2: (slave gretap2): Enslaving as an active interface with an up link
[   76.837889][ T7214] syz.1.610 (7214) used greatest stack depth: 18712 bytes left
[   76.951784][ T7227] openvswitch: netlink: VXLAN extension message has 1 unknown bytes.
[   77.214350][ T7252] __nla_validate_parse: 5 callbacks suppressed
[   77.214360][ T7252] netlink: 12 bytes leftover after parsing attributes in process `syz.2.629'.
[   77.299129][ T7259] netlink: 4 bytes leftover after parsing attributes in process `syz.1.631'.
[   78.139131][ T7336] netlink: 12 bytes leftover after parsing attributes in process `syz.2.668'.
[   78.152948][ T7338] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw'
[   78.440245][ T7358] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   78.490715][ T7361] sctp: [Deprecated]: syz.1.676 (pid 7361) Use of int in max_burst socket option.
[   78.490715][ T7361] Use struct sctp_assoc_value instead
[   80.040528][ T7448] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input5
[   80.140101][ T7451] validate_nla: 3 callbacks suppressed
[   80.140137][ T7451] netlink: 'syz.1.714': attribute type 1 has an invalid length.
[   80.144495][ T7451] netlink: 224 bytes leftover after parsing attributes in process `syz.1.714'.
[   80.297292][ T7460] netlink: 4 bytes leftover after parsing attributes in process `syz.0.719'.
[   80.436254][ T7466] netlink: 12 bytes leftover after parsing attributes in process `syz.0.722'.
[   80.659756][ T7476] netlink: 'syz.2.727': attribute type 1 has an invalid length.
[   80.692069][ T7476] 8021q: adding VLAN 0 to HW filter on device bond2
[   80.729944][ T7476] 8021q: adding VLAN 0 to HW filter on device bond2
[   80.746091][ T7476] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address
[   80.750467][ T7476] bond2: (slave vxcan3): Error -95 calling set_mac_address
[   80.775237][ T7480] veth1: entered promiscuous mode
[   80.780884][ T7480] bond2: (slave veth1): Enslaving as an active interface with a down link
[   80.816575][ T2271] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   80.819312][ T2271] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   81.068173][  T789] cfg80211: failed to load regulatory.db
[   82.331263][ T7557] netlink: 'syz.0.762': attribute type 2 has an invalid length.
[   82.449132][ T7570] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.769'.
[   82.768309][ T7598] netlink: 8 bytes leftover after parsing attributes in process `syz.2.783'.
[   82.773720][ T7598] netlink: 8 bytes leftover after parsing attributes in process `syz.2.783'.
[   82.956575][ T7614] netlink: 24 bytes leftover after parsing attributes in process `syz.2.790'.
[   83.060304][ T7620] netlink: 16 bytes leftover after parsing attributes in process `syz.0.792'.
[   83.251575][ T7636] netlink: 8 bytes leftover after parsing attributes in process `syz.0.800'.
[   83.299828][ T7640] netlink: 68 bytes leftover after parsing attributes in process `syz.0.802'.
[   83.432143][ T7652] gretap1: entered allmulticast mode
[   83.592126][ T7671] netlink: 'syz.0.816': attribute type 9 has an invalid length.
[   83.595466][ T7671] netlink: 212260 bytes leftover after parsing attributes in process `syz.0.816'.
[   83.703542][ T7678] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   83.753827][ T7678] batman_adv: batadv0: Removing interface: batadv_slave_1
[   83.980699][ T7708] nbd: must specify a size in bytes for the device
[   84.460976][ T7756] openvswitch: netlink: Either Ethernet header or EtherType is required.
[   84.479845][ T7754] netlink: 52 bytes leftover after parsing attributes in process `syz.1.849'.
[   84.494551][ T7754] netlink: 52 bytes leftover after parsing attributes in process `syz.1.849'.
[   85.393295][ T7822] SET target dimension over the limit!
[   86.874726][ T7917] xt_cgroup: xt_cgroup: no path or classid specified
[   86.996527][ T7925] Cannot find set identified by id 2 to match
[   87.720548][ T7971] __nla_validate_parse: 7 callbacks suppressed
[   87.720562][ T7971] netlink: 132 bytes leftover after parsing attributes in process `syz.0.954'.
[   87.765115][ T7973] netlink: 4 bytes leftover after parsing attributes in process `syz.0.955'.
[   87.857413][ T7977] tipc: Can't bind to reserved service type 0
[   88.088359][ T7994] netlink: 12 bytes leftover after parsing attributes in process `syz.0.965'.
[   88.131371][ T7996] netlink: 240 bytes leftover after parsing attributes in process `syz.0.966'.
[   88.189847][ T7998] bond0: entered promiscuous mode
[   88.191582][ T7998] bond_slave_0: entered promiscuous mode
[   88.193821][ T7998] bond_slave_1: entered promiscuous mode
[   88.200855][ T7998] 8021q: adding VLAN 0 to HW filter on device macvlan2
[   88.203905][ T7998] bond0: left promiscuous mode
[   88.206187][ T7998] bond_slave_0: left promiscuous mode
[   88.208163][ T7998] bond_slave_1: left promiscuous mode
[   88.470667][ T8011] netlink: 508 bytes leftover after parsing attributes in process `syz.1.972'.
[   88.678770][ T8028] netlink: 44 bytes leftover after parsing attributes in process `syz.0.981'.
[   88.940501][   T10] hid-generic 0005:16BF:5505.0002: unknown main item tag 0x0
[   88.950961][   T10] hid-generic 0005:16BF:5505.0002: unknown main item tag 0x0
[   88.958810][   T10] hid-generic 0005:16BF:5505.0002: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa
[   88.983335][ T8046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.989'.
[   89.001222][ T8047] xt_hashlimit: size too large, truncated to 1048576
[   89.082042][ T8038] netlink: 14 bytes leftover after parsing attributes in process `syz.0.984'.
[   89.202903][ T8038] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   89.208895][ T8038] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   89.213293][ T8038] bond0 (unregistering): Released all slaves
[   89.561555][ T8049] netlink: 'syz.2.990': attribute type 6 has an invalid length.
[   89.895121][ T8074] batadv_slave_0: entered promiscuous mode
[   90.009879][ T8086] netlink: 'syz.1.1006': attribute type 1 has an invalid length.
[   90.054875][ T8091] netlink: 'syz.1.1008': attribute type 1 has an invalid length.
[   90.063469][ T8093] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1009'.
[   90.206027][ T8103] "syz.0.1014" (8103) uses obsolete ecb(arc4) skcipher
[   90.742552][ T8127] vlan2: entered promiscuous mode
[   90.744886][ T8127] bond0: entered promiscuous mode
[   90.747823][ T8127] bond_slave_0: entered promiscuous mode
[   90.750577][ T8127] bond_slave_1: entered promiscuous mode
[   90.753817][ T8127] bond0: (slave vlan2): Opening slave failed
[   90.911144][ T8133] netlink: 'syz.1.1027': attribute type 1 has an invalid length.
[   90.967135][ T8137] netlink: 'syz.1.1029': attribute type 1 has an invalid length.
[   90.989722][ T8137] netlink: 'syz.1.1029': attribute type 3 has an invalid length.
[   90.992876][ T8137] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1029'.
[   91.105935][ T8147] ip6gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue
[   91.992651][ T8228] netlink: 'syz.0.1064': attribute type 1 has an invalid length.
[   91.995198][ T8228] netlink: 'syz.0.1064': attribute type 2 has an invalid length.
[   91.998313][ T8228] netlink: 'syz.0.1064': attribute type 1 has an invalid length.
[   92.058917][ T8235] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add()
[   92.157398][ T8241] IPv6: addrconf: prefix option has invalid lifetime
[   92.738669][ T8295] Driver unsupported XDP return value 0 on prog  (id 144) dev N/A, expect packet loss!
[   92.769535][ T8299] x_tables: duplicate underflow at hook 1
[   92.880339][ T8309] xt_HMARK: proto mask must be zero with L3 mode
[   93.370944][ T8361] netlink: 'syz.0.1123': attribute type 21 has an invalid length.
[   93.374047][ T8361] __nla_validate_parse: 4 callbacks suppressed
[   93.374058][ T8361] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1123'.
[   93.380918][ T8361] netlink: 3 bytes leftover after parsing attributes in process `syz.0.1123'.
[   93.626897][ T8387] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1137'.
[   93.632891][ T8387] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1137'.
[   93.669467][ T8393] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1139'.
[   93.902901][ T8412] trusted_key: syz.2.1148 sent an empty control message without MSG_MORE.
[   93.935432][ T8403] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1145'.
[   94.235955][ T8444] Dead loop on virtual device ip6_vti0, fix it urgently!
[   94.371768][ T8450] xt_CT: No such helper "syz0"
[   94.428855][ T8453] netlink: 16166 bytes leftover after parsing attributes in process `syz.1.1165'.
[   95.020069][ T8477] netlink: 4388 bytes leftover after parsing attributes in process `syz.0.1175'.
[   95.081249][ T8484] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1179'.
[   95.149272][ T8490] xt_limit: Overflow, try lower: 0/0
[   95.195460][ T8491] validate_nla: 1 callbacks suppressed
[   95.208539][ T8491] netlink: 'syz.0.1181': attribute type 16 has an invalid length.
[   95.214792][ T8491] netlink: 'syz.0.1181': attribute type 17 has an invalid length.
[   95.308981][ T8503] IPv6: NLM_F_REPLACE set, but no existing node found!
[   95.427314][ T8491] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   95.440488][ T8491] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   95.486845][ T8510] netlink: 'syz.2.1190': attribute type 2 has an invalid length.
[   95.554742][ T8491] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[   95.558467][ T8491] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[   95.561710][ T8491] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[   95.564852][ T8491] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[   95.706013][ T8518] netdevsim netdevsim0 netdevsim0: entered promiscuous mode
[   95.714020][ T8518] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[   95.931172][ T8535] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode
[   95.935869][ T8535] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[   96.051628][ T8545] netlink: 'syz.2.1206': attribute type 1 has an invalid length.
[   96.054231][ T8545] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1206'.
[   96.779422][ T8621] tap0: tun_chr_ioctl cmd 1074025676
[   96.781617][ T8621] tap0: owner set to 0
[   97.309803][ T8675] batadv_slave_1: entered promiscuous mode
[   97.312779][ T8675] batman_adv: batadv0: Interface activated: batadv_slave_1
[   97.567940][ T8702] Bluetooth: MGMT ver 1.23
[  100.276762][ T8848] team0: Port device team_slave_0 removed
[  100.282874][ T8848] team0: Port device team_slave_1 removed
[  100.285897][ T8848] batman_adv: batadv0: Removing interface: batadv_slave_0
[  100.289899][ T8848] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  100.293275][ T8848] batman_adv: batadv0: Removing interface: batadv_slave_1
[  100.397129][ T8860] __nla_validate_parse: 9 callbacks suppressed
[  100.397143][ T8860] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1343'.
[  100.884643][ T8888] netlink: 504 bytes leftover after parsing attributes in process `syz.1.1357'.
[  100.920048][ T8890] xt_TPROXY: Can be used only with -p tcp or -p udp
[  101.002922][ T8896] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1361'.
[  101.005969][ T8896] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1361'.
[  101.113900][ T8908] netlink: 'syz.1.1367': attribute type 2 has an invalid length.
[  101.193738][ T8918] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1372'.
[  101.301538][ T8933] netlink: 'syz.2.1379': attribute type 10 has an invalid length.
[  101.363309][ T8929] syzkaller0: entered promiscuous mode
[  101.368633][ T8929] syzkaller0: entered allmulticast mode
[  102.471949][ T8960] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1388'.
[  103.372742][ T8988] tipc: Started in network mode
[  103.375000][ T8988] tipc: Node identity e0000001, cluster identity 4711
[  103.379839][ T8988] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  103.412189][ T8991] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1404'.
[  103.483866][ T8998] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1408'.
[  103.489544][ T8998] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1408'.
[  103.563879][ T9002] netlink: 1041 bytes leftover after parsing attributes in process `syz.1.1409'.
[  103.637039][ T9011] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable
[  104.330280][ T9063] xt_TCPMSS: Only works on TCP SYN packets
[  104.698228][ T9093] netlink: 'syz.1.1449': attribute type 5 has an invalid length.
[  104.835244][ T9108] netlink: 'syz.1.1456': attribute type 21 has an invalid length.
[  104.838632][ T9108] netlink: 'syz.1.1456': attribute type 5 has an invalid length.
[  104.841144][ T9108] netlink: 'syz.1.1456': attribute type 6 has an invalid length.
[  104.871605][ T9111] netlink: 'syz.1.1458': attribute type 6 has an invalid length.
[  105.189819][ T9145] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  105.306809][ T9158] (unnamed net_device) (uninitialized): option arp_validate: invalid value (18446744073709551614)
[  105.476560][ T9179] __nla_validate_parse: 4 callbacks suppressed
[  105.476570][ T9179] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1488'.
[  105.577967][ T9192] IPv6: sit2: Disabled Multicast RS
[  105.841883][    T9] IPVS: starting estimator thread 0...
[  105.935669][ T9221] IPVS: using max 79 ests per chain, 189600 per kthread
[  106.092000][ T9239] netlink: 'syz.1.1516': attribute type 13 has an invalid length.
[  106.095395][ T9239] netlink: 'syz.1.1516': attribute type 17 has an invalid length.
[  106.107925][ T9239] 8021q: adding VLAN 0 to HW filter on device bond0
[  106.129186][ T9239] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  106.473774][ T9256] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1524'.
[  106.550903][ T9260] netlink: 'syz.0.1526': attribute type 10 has an invalid length.
[  106.553985][ T9260] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1526'.
[  106.558013][ T9260] dummy0: entered promiscuous mode
[  106.560095][ T9260] dummy0: entered allmulticast mode
[  106.564584][ T9260] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check.
[  107.062279][ T9283] sch_tbf: burst 0 is lower than device veth1_virt_wifi mtu (1514) !
[  107.550743][ T9317] netlink: 'syz.1.1553': attribute type 1 has an invalid length.
[  107.554802][ T9317] netlink: 180 bytes leftover after parsing attributes in process `syz.1.1553'.
[  107.947152][ T9344] netlink: 56 bytes leftover after parsing attributes in process `syz.2.1566'.
[  107.951053][ T9344] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1566'.
[  108.059132][ T9354] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1570'.
[  108.421848][ T9377] netlink: 'syz.2.1583': attribute type 1 has an invalid length.
[  108.433950][ T9377] netlink: 232 bytes leftover after parsing attributes in process `syz.2.1583'.
[  108.442104][ T9377] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1583'.
[  108.923394][ T9419] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1600'.
[  109.413202][ T9454] netlink: 'syz.0.1619': attribute type 5 has an invalid length.
[  109.811771][ T9486] bridge0: entered promiscuous mode
[  110.427643][ T9523] (unnamed net_device) (uninitialized): option active_slave: mode dependency failed, not supported in mode balance-xor(2)
[  111.112157][ T9576] netlink: 'syz.0.1670': attribute type 4 has an invalid length.
[  111.115328][ T9576] netlink: 'syz.0.1670': attribute type 17 has an invalid length.
[  111.178811][ T9584] __nla_validate_parse: 7 callbacks suppressed
[  111.178821][ T9584] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1672'.
[  111.193797][ T9584] netlink: 'syz.1.1672': attribute type 9 has an invalid length.
[  111.208514][ T9584] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode
[  111.216666][ T9584] macvlan2: entered allmulticast mode
[  111.218480][ T9584] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode
[  111.605816][ T9632] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  111.712888][ T9642] syzkaller0: entered allmulticast mode
[  111.721794][ T9642] syzkaller0 (unregistering): left allmulticast mode
[  111.849047][ T9656] sctp: [Deprecated]: syz.0.1703 (pid 9656) Use of struct sctp_assoc_value in delayed_ack socket option.
[  111.849047][ T9656] Use struct sctp_sack_info instead
[  111.974886][ T9670] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1710'.
[  112.485874][ T9711] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1725'.
[  112.534031][ T9717] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1727'.
[  112.771567][ T9742] syzkaller1: entered promiscuous mode
[  112.773481][ T9742] syzkaller1: entered allmulticast mode
[  112.874349][ T9747] netlink: 'syz.1.1742': attribute type 3 has an invalid length.
[  113.582031][ T9757] xt_socket: unknown flags 0xfc
[  113.724729][ T9761] x_tables: ip6_tables: sctp match: only valid for protocol 132
[  114.008698][ T9785] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1760'.
[  114.160684][ T9802] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1769'.
[  114.181568][ T9804] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1770'.
[  114.190118][ T9806] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1771'.
[  114.322386][ T9823] tipc: Started in network mode
[  114.324452][ T9819] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1777'.
[  114.328338][ T9823] tipc: Node identity fec0ffffffffffff0000000000000001, cluster identity 4711
[  114.331390][ T9823] tipc: Enabling of bearer <udp:syz1> rejected, failed to enable media
[  114.483969][ T9835] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1783'.
[  114.487849][ T9835] netlink: 'syz.0.1783': attribute type 1 has an invalid length.
[  114.516351][ T9835] 
[  114.517507][ T9835] ======================================================
[  114.520488][ T9835] WARNING: possible circular locking dependency detected
[  114.523458][ T9835] 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 Not tainted
[  114.527700][ T9835] ------------------------------------------------------
[  114.530739][ T9835] syz.0.1783/9835 is trying to acquire lock:
[  114.533351][ T9835] ffff888022a73188 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0x3b/0x14c0
[  114.537889][ T9835] 
[  114.537889][ T9835] but task is already holding lock:
[  114.540888][ T9835] ffff888022a73230 (&nbd->config_lock){+.+.}-{4:4}, at: nbd_genl_connect+0x94f/0x1930
[  114.544979][ T9835] 
[  114.544979][ T9835] which lock already depends on the new lock.
[  114.544979][ T9835] 
[  114.549260][ T9835] 
[  114.549260][ T9835] the existing dependency chain (in reverse order) is:
[  114.552910][ T9835] 
[  114.552910][ T9835] -> #2 (&nbd->config_lock){+.+.}-{4:4}:
[  114.556262][ T9835]        lock_acquire+0x120/0x360
[  114.558435][ T9835]        __mutex_lock+0x182/0xe80
[  114.560623][ T9835]        refcount_dec_and_mutex_lock+0x30/0xa0
[  114.563304][ T9835]        nbd_config_put+0x2c/0x790
[  114.565475][ T9835]        nbd_release+0xfe/0x140
[  114.567573][ T9835]        bdev_release+0x536/0x650
[  114.569777][ T9835]        blkdev_release+0x15/0x20
[  114.571878][ T9835]        __fput+0x44c/0xa70
[  114.573808][ T9835]        fput_close_sync+0x119/0x200
[  114.576087][ T9835]        __x64_sys_close+0x7f/0x110
[  114.578350][ T9835]        do_syscall_64+0xfa/0x3b0
[  114.580508][ T9835]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.583265][ T9835] 
[  114.583265][ T9835] -> #1 (&disk->open_mutex){+.+.}-{4:4}:
[  114.586589][ T9835]        lock_acquire+0x120/0x360
[  114.588715][ T9835]        __mutex_lock+0x182/0xe80
[  114.590862][ T9835]        __del_gendisk+0x129/0x9e0
[  114.593055][ T9835]        del_gendisk+0xe8/0x160
[  114.595072][ T9835]        nbd_dev_remove_work+0x47/0xe0
[  114.597468][ T9835]        process_scheduled_works+0xae1/0x17b0
[  114.600101][ T9835]        worker_thread+0x8a0/0xda0
[  114.602351][ T9835]        kthread+0x711/0x8a0
[  114.604353][ T9835]        ret_from_fork+0x3fc/0x770
[  114.606550][ T9835]        ret_from_fork_asm+0x1a/0x30
[  114.608858][ T9835] 
[  114.608858][ T9835] -> #0 (&set->update_nr_hwq_lock){++++}-{4:4}:
[  114.612381][ T9835]        validate_chain+0xb9b/0x2140
[  114.614600][ T9835]        __lock_acquire+0xab9/0xd20
[  114.616777][ T9835]        lock_acquire+0x120/0x360
[  114.618960][ T9835]        down_write+0x96/0x1f0
[  114.621060][ T9835]        blk_mq_update_nr_hw_queues+0x3b/0x14c0
[  114.623702][ T9835]        nbd_start_device+0x16c/0xac0
[  114.625994][ T9835]        nbd_genl_connect+0x1250/0x1930
[  114.628353][ T9835]        genl_family_rcv_msg_doit+0x215/0x300
[  114.630944][ T9835]        genl_rcv_msg+0x60e/0x790
[  114.633121][ T9835]        netlink_rcv_skb+0x208/0x470
[  114.635420][ T9835]        genl_rcv+0x28/0x40
[  114.637396][ T9835]        netlink_unicast+0x75b/0x8d0
[  114.639659][ T9835]        netlink_sendmsg+0x805/0xb30
[  114.641926][ T9835]        __sock_sendmsg+0x21c/0x270
[  114.644211][ T9835]        ____sys_sendmsg+0x505/0x830
[  114.646497][ T9835]        ___sys_sendmsg+0x21f/0x2a0
[  114.648764][ T9835]        __x64_sys_sendmsg+0x19b/0x260
[  114.651118][ T9835]        do_syscall_64+0xfa/0x3b0
[  114.653300][ T9835]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.656196][ T9835] 
[  114.656196][ T9835] other info that might help us debug this:
[  114.656196][ T9835] 
[  114.660485][ T9835] Chain exists of:
[  114.660485][ T9835]   &set->update_nr_hwq_lock --> &disk->open_mutex --> &nbd->config_lock
[  114.660485][ T9835] 
[  114.666459][ T9835]  Possible unsafe locking scenario:
[  114.666459][ T9835] 
[  114.669633][ T9835]        CPU0                    CPU1
[  114.671831][ T9835]        ----                    ----
[  114.674090][ T9835]   lock(&nbd->config_lock);
[  114.676107][ T9835]                                lock(&disk->open_mutex);
[  114.679086][ T9835]                                lock(&nbd->config_lock);
[  114.682158][ T9835]   lock(&set->update_nr_hwq_lock);
[  114.684421][ T9835] 
[  114.684421][ T9835]  *** DEADLOCK ***
[  114.684421][ T9835] 
[  114.687751][ T9835] 3 locks held by syz.0.1783/9835:
[  114.689887][ T9835]  #0: ffffffff8f576230 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
[  114.693357][ T9835]  #1: ffffffff8f576048 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790
[  114.696990][ T9835]  #2: ffff888022a73230 (&nbd->config_lock){+.+.}-{4:4}, at: nbd_genl_connect+0x94f/0x1930
[  114.701245][ T9835] 
[  114.701245][ T9835] stack backtrace:
SYZFAIL: failed to recv rpc
[  114.703703][ T9835] CPU: 0 UID: 0 PID: 9835 Comm: syz.0.1783 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  114.703719][ T9835] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  114.703727][ T9835] Call Trace:
[  114.703734][ T9835]  <TASK>
[  114.703741][ T9835]  dump_stack_lvl+0x189/0x250
[  114.703764][ T9835]  ? __pfx_dump_stack_lvl+0x10/0x10
[  114.703781][ T9835]  ? __pfx__printk+0x10/0x10
[  114.703794][ T9835]  ? print_lock_name+0xde/0x100
[  114.703807][ T9835]  print_circular_bug+0x2ee/0x310
[  114.703820][ T9835]  check_noncircular+0x134/0x160
[  114.703835][ T9835]  validate_chain+0xb9b/0x2140
[  114.703851][ T9835]  __lock_acquire+0xab9/0xd20
[  114.703869][ T9835]  ? blk_mq_update_nr_hw_queues+0x3b/0x14c0
[  114.703887][ T9835]  lock_acquire+0x120/0x360
[  114.703901][ T9835]  ? blk_mq_update_nr_hw_queues+0x3b/0x14c0
[  114.703918][ T9835]  ? __mutex_unlock_slowpath+0x1cd/0x700
[  114.703937][ T9835]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  114.703954][ T9835]  down_write+0x96/0x1f0
[  114.703964][ T9835]  ? blk_mq_update_nr_hw_queues+0x3b/0x14c0
[  114.703981][ T9835]  ? __pfx_down_write+0x10/0x10
[  114.703994][ T9835]  blk_mq_update_nr_hw_queues+0x3b/0x14c0
[  114.704013][ T9835]  ? nbd_add_socket+0x688/0x9a0
[  114.704029][ T9835]  ? nbd_add_socket+0x688/0x9a0
[  114.704047][ T9835]  nbd_start_device+0x16c/0xac0
[  114.704065][ T9835]  ? __nla_parse+0x40/0x60
[  114.704084][ T9835]  nbd_genl_connect+0x1250/0x1930
[  114.704104][ T9835]  ? __pfx_nbd_genl_connect+0x10/0x10
[  114.704124][ T9835]  ? __nla_parse+0x40/0x60
[  114.704141][ T9835]  ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0
[  114.704161][ T9835]  genl_family_rcv_msg_doit+0x215/0x300
[  114.704214][ T9835]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  114.704238][ T9835]  genl_rcv_msg+0x60e/0x790
[  114.704255][ T9835]  ? __pfx_genl_rcv_msg+0x10/0x10
[  114.704269][ T9835]  ? __pfx_nbd_genl_connect+0x10/0x10
[  114.704288][ T9835]  netlink_rcv_skb+0x208/0x470
[  114.704301][ T9835]  ? __pfx_genl_rcv_msg+0x10/0x10
[  114.704317][ T9835]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  114.704332][ T9835]  ? down_read+0x1ad/0x2e0
[  114.704343][ T9835]  genl_rcv+0x28/0x40
[  114.704357][ T9835]  netlink_unicast+0x75b/0x8d0
[  114.704369][ T9835]  netlink_sendmsg+0x805/0xb30
[  114.704383][ T9835]  ? __pfx_netlink_sendmsg+0x10/0x10
[  114.704396][ T9835]  ? aa_sock_msg_perm+0x94/0x160
[  114.704411][ T9835]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  114.704426][ T9835]  ? __pfx_netlink_sendmsg+0x10/0x10
[  114.704438][ T9835]  __sock_sendmsg+0x21c/0x270
[  114.704456][ T9835]  ____sys_sendmsg+0x505/0x830
[  114.704471][ T9835]  ? __pfx_____sys_sendmsg+0x10/0x10
[  114.704487][ T9835]  ? import_iovec+0x74/0xa0
[  114.704499][ T9835]  ___sys_sendmsg+0x21f/0x2a0
[  114.704513][ T9835]  ? __pfx____sys_sendmsg+0x10/0x10
[  114.704536][ T9835]  ? __fget_files+0x2a/0x420
[  114.704548][ T9835]  ? __fget_files+0x3a0/0x420
[  114.704563][ T9835]  __x64_sys_sendmsg+0x19b/0x260
[  114.704577][ T9835]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  114.704593][ T9835]  ? __sys_socketpair+0x4a9/0x560
[  114.704604][ T9835]  ? do_syscall_64+0xbe/0x3b0
[  114.704623][ T9835]  do_syscall_64+0xfa/0x3b0
[  114.704633][ T9835]  ? lockdep_hardirqs_on+0x9c/0x150
[  114.704649][ T9835]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.704662][ T9835]  ? exc_page_fault+0x9f/0xf0
[  114.704679][ T9835]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  114.704691][ T9835] RIP: 0033:0x7f09b738e929
[  114.704702][ T9835] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  114.704712][ T9835] RSP: 002b:00007f09b81a5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  114.704726][ T9835] RAX: ffffffffffffffda RBX: 00007f09b75b5fa0 RCX: 00007f09b738e929
[  114.704734][ T9835] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000012
[  114.704743][ T9835] RBP: 00007f09b7410b39 R08: 0000000000000000 R09: 0000000000000000
[  114.704750][ T9835] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  114.704757][ T9835] R13: 0000000000000000 R14: 00007f09b75b5fa0 R15: 00007ffcf58f9b68
[  114.704768][ T9835]  </TASK>
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[  114.895335][   T56] block nbd1: Receive control failed (result -107)
[  115.089671][ T8043] ==================================================================
[  115.093017][ T8043] BUG: KASAN: slab-use-after-free in __mutex_lock+0x738/0xe80
[  115.096198][ T8043] Read of size 8 at addr ffff88810a2e80a0 by task khidpd_16bf5505/8043
[  115.099041][ T8043] 
[  115.100142][ T8043] CPU: 1 UID: 0 PID: 8043 Comm: khidpd_16bf5505 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  115.100157][ T8043] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  115.100191][ T8043] Call Trace:
[  115.100198][ T8043]  <TASK>
[  115.100204][ T8043]  dump_stack_lvl+0x189/0x250
[  115.100223][ T8043]  ? __virt_addr_valid+0x1c8/0x5c0
[  115.100236][ T8043]  ? rcu_is_watching+0x15/0xb0
[  115.100253][ T8043]  ? __pfx_dump_stack_lvl+0x10/0x10
[  115.100269][ T8043]  ? rcu_is_watching+0x15/0xb0
[  115.100284][ T8043]  ? lock_release+0x4b/0x3e0
[  115.100301][ T8043]  ? __virt_addr_valid+0x1c8/0x5c0
[  115.100312][ T8043]  ? __virt_addr_valid+0x4a5/0x5c0
[  115.100323][ T8043]  print_report+0xd2/0x2b0
[  115.100338][ T8043]  ? __mutex_lock+0x738/0xe80
[  115.100354][ T8043]  kasan_report+0x118/0x150
[  115.100364][ T8043]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  115.100379][ T8043]  ? __mutex_lock+0x738/0xe80
[  115.100397][ T8043]  __mutex_lock+0x738/0xe80
[  115.100413][ T8043]  ? __mutex_lock+0x51b/0xe80
[  115.100429][ T8043]  ? l2cap_unregister_user+0x6a/0x1b0
[  115.100446][ T8043]  ? __pfx___mutex_lock+0x10/0x10
[  115.100463][ T8043]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  115.100480][ T8043]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  115.100496][ T8043]  l2cap_unregister_user+0x6a/0x1b0
[  115.100513][ T8043]  hidp_session_thread+0x3c9/0x410
[  115.100531][ T8043]  ? __pfx_hidp_session_thread+0x10/0x10
[  115.100546][ T8043]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  115.100561][ T8043]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  115.100579][ T8043]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  115.100595][ T8043]  ? __kthread_parkme+0x7b/0x200
[  115.100606][ T8043]  ? __kthread_parkme+0x1a1/0x200
[  115.100624][ T8043]  kthread+0x711/0x8a0
[  115.100637][ T8043]  ? __pfx_hidp_session_thread+0x10/0x10
[  115.100653][ T8043]  ? __pfx_kthread+0x10/0x10
[  115.100665][ T8043]  ? _raw_spin_unlock_irq+0x23/0x50
[  115.100679][ T8043]  ? lockdep_hardirqs_on+0x9c/0x150
[  115.100694][ T8043]  ? __pfx_kthread+0x10/0x10
[  115.100705][ T8043]  ret_from_fork+0x3fc/0x770
[  115.100721][ T8043]  ? __pfx_ret_from_fork+0x10/0x10
[  115.100737][ T8043]  ? __switch_to_asm+0x39/0x70
[  115.100748][ T8043]  ? __switch_to_asm+0x33/0x70
[  115.100759][ T8043]  ? __pfx_kthread+0x10/0x10
[  115.100771][ T8043]  ret_from_fork_asm+0x1a/0x30
[  115.100787][ T8043]  </TASK>
[  115.100791][ T8043] 
[  115.198207][ T8043] Allocated by task 5821:
[  115.200072][ T8043]  kasan_save_track+0x3e/0x80
[  115.202098][ T8043]  __kasan_kmalloc+0x93/0xb0
[  115.204077][ T8043]  __kmalloc_noprof+0x27a/0x4f0
[  115.206186][ T8043]  hci_alloc_dev_priv+0x28/0x2040
[  115.208310][ T8043]  vhci_create_device+0x120/0x6e0
[  115.210428][ T8043]  vhci_write+0x3ce/0x4a0
[  115.212321][ T8043]  vfs_write+0x54b/0xa90
[  115.214190][ T8043]  ksys_write+0x145/0x250
[  115.216026][ T8043]  do_syscall_64+0xfa/0x3b0
[  115.217995][ T8043]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  115.220582][ T8043] 
[  115.221637][ T8043] Freed by task 9816:
[  115.223374][ T8043]  kasan_save_track+0x3e/0x80
[  115.225437][ T8043]  kasan_save_free_info+0x46/0x50
[  115.227640][ T8043]  __kasan_slab_free+0x62/0x70
[  115.229720][ T8043]  kfree+0x18e/0x440
[  115.231404][ T8043]  bt_host_release+0x82/0x90
[  115.233333][ T8043]  device_release+0x9c/0x1c0
[  115.235223][ T8043]  kobject_put+0x22b/0x480
[  115.237065][ T8043]  vhci_release+0x88/0xd0
[  115.238976][ T8043]  __fput+0x44c/0xa70
[  115.240700][ T8043]  task_work_run+0x1d4/0x260
[  115.242707][ T8043]  do_exit+0x6b5/0x22e0
[  115.244536][ T8043]  do_group_exit+0x21c/0x2d0
[  115.246523][ T8043]  get_signal+0x1286/0x1340
[  115.248484][ T8043]  arch_do_signal_or_restart+0x9a/0x750
[  115.250864][ T8043]  exit_to_user_mode_loop+0x75/0x110
[  115.253145][ T8043]  do_syscall_64+0x2bd/0x3b0
[  115.255191][ T8043]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  115.257753][ T8043] 
[  115.258806][ T8043] Last potentially related work creation:
[  115.261260][ T8043]  kasan_save_stack+0x3e/0x60
[  115.262967][ T8043]  kasan_record_aux_stack+0xbd/0xd0
[  115.265105][ T8043]  insert_work+0x3d/0x330
[  115.266975][ T8043]  __queue_work+0xbd9/0xfe0
[  115.268912][ T8043]  queue_work_on+0x181/0x270
[  115.270920][ T8043]  hci_cmd_sync_submit+0x285/0x2b0
[  115.273133][ T8043]  process_scheduled_works+0xae1/0x17b0
[  115.275505][ T8043]  worker_thread+0x8a0/0xda0
[  115.277459][ T8043]  kthread+0x711/0x8a0
[  115.279125][ T8043]  ret_from_fork+0x3fc/0x770
[  115.281077][ T8043]  ret_from_fork_asm+0x1a/0x30
[  115.283049][ T8043] 
[  115.284122][ T8043] Second to last potentially related work creation:
[  115.286854][ T8043]  kasan_save_stack+0x3e/0x60
[  115.288882][ T8043]  kasan_record_aux_stack+0xbd/0xd0
[  115.291118][ T8043]  insert_work+0x3d/0x330
[  115.292923][ T8043]  __queue_work+0xbd9/0xfe0
[  115.294709][ T8043]  queue_work_on+0x181/0x270
[  115.296604][ T8043]  hci_abort_conn+0x1e4/0x330
[  115.298654][ T8043]  process_scheduled_works+0xae1/0x17b0
[  115.301025][ T8043]  worker_thread+0x8a0/0xda0
[  115.303062][ T8043]  kthread+0x711/0x8a0
[  115.304840][ T8043]  ret_from_fork+0x3fc/0x770
[  115.306866][ T8043]  ret_from_fork_asm+0x1a/0x30
[  115.308954][ T8043] 
[  115.310004][ T8043] The buggy address belongs to the object at ffff88810a2e8000
[  115.310004][ T8043]  which belongs to the cache kmalloc-8k of size 8192
[  115.315420][ T8043] The buggy address is located 160 bytes inside of
[  115.315420][ T8043]  freed 8192-byte region [ffff88810a2e8000, ffff88810a2ea000)
[  115.321157][ T8043] 
[  115.322227][ T8043] The buggy address belongs to the physical page:
[  115.324856][ T8043] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a2e8
[  115.327963][ T8043] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  115.331571][ T8043] flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[  115.334785][ T8043] page_type: f5(slab)
[  115.336513][ T8043] raw: 057ff00000000040 ffff88801a442280 dead000000000122 0000000000000000
[  115.340092][ T8043] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[  115.343661][ T8043] head: 057ff00000000040 ffff88801a442280 dead000000000122 0000000000000000
[  115.347371][ T8043] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[  115.351037][ T8043] head: 057ff00000000003 ffffea000428ba01 00000000ffffffff 00000000ffffffff
[  115.354719][ T8043] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  115.358443][ T8043] page dumped because: kasan: bad access detected
[  115.361225][ T8043] page_owner tracks the page as allocated
[  115.363591][ T8043] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5821, tgid 5821 (syz-executor), ts 53239324615, free_ts 53236462349
[  115.372358][ T8043]  post_alloc_hook+0x240/0x2a0
[  115.374453][ T8043]  get_page_from_freelist+0x21e4/0x22c0
[  115.376755][ T8043]  __alloc_frozen_pages_noprof+0x181/0x370
[  115.379251][ T8043]  alloc_pages_mpol+0x232/0x4a0
[  115.381312][ T8043]  allocate_slab+0x8a/0x3b0
[  115.383253][ T8043]  ___slab_alloc+0xbfc/0x1480
[  115.385317][ T8043]  __kmalloc_noprof+0x305/0x4f0
[  115.387357][ T8043]  hci_alloc_dev_priv+0x28/0x2040
[  115.389527][ T8043]  vhci_create_device+0x120/0x6e0
[  115.391724][ T8043]  vhci_write+0x3ce/0x4a0
[  115.393510][ T8043]  vfs_write+0x54b/0xa90
[  115.395248][ T8043]  ksys_write+0x145/0x250
[  115.397015][ T8043]  do_syscall_64+0xfa/0x3b0
[  115.398918][ T8043]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  115.401436][ T8043] page last free pid 5205 tgid 5205 stack trace:
[  115.404120][ T8043]  register_failure_stack+0x89/0xe0
[  115.406414][ T8043]  init_page_owner+0x2e/0x7d0
[  115.408505][ T8043]  page_ext_init+0x7ec/0x850
[  115.410418][ T8043]  mm_core_init+0x5b/0x70
[  115.412317][ T8043] 
[  115.413385][ T8043] Memory state around the buggy address:
[  115.415785][ T8043]  ffff88810a2e7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  115.419152][ T8043]  ffff88810a2e8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  115.422482][ T8043] >ffff88810a2e8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  115.425913][ T8043]                                ^
[  115.428040][ T8043]  ffff88810a2e8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  115.431460][ T8043]  ffff88810a2e8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  115.434884][ T8043] ==================================================================
[  115.438753][ T8043] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  115.441824][ T8043] CPU: 1 UID: 0 PID: 8043 Comm: khidpd_16bf5505 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[  115.447201][ T8043] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  115.451408][ T8043] Call Trace:
[  115.452852][ T8043]  <TASK>
[  115.454148][ T8043]  dump_stack_lvl+0x99/0x250
[  115.455951][ T8043]  ? __asan_memcpy+0x40/0x70
[  115.457871][ T8043]  ? __pfx_dump_stack_lvl+0x10/0x10
[  115.459988][ T8043]  ? __pfx__printk+0x10/0x10
[  115.461936][ T8043]  panic+0x2db/0x790
[  115.463569][ T8043]  ? __pfx_panic+0x10/0x10
[  115.465369][ T8043]  ? _raw_spin_unlock_irqrestore+0xa8/0x110
[  115.467814][ T8043]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  115.470326][ T8043]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  115.473090][ T8043]  ? print_memory_metadata+0x314/0x400
[  115.475401][ T8043]  ? __mutex_lock+0x738/0xe80
[  115.477388][ T8043]  check_panic_on_warn+0x89/0xb0
[  115.479454][ T8043]  ? __mutex_lock+0x738/0xe80
[  115.481480][ T8043]  end_report+0x78/0x160
[  115.483274][ T8043]  kasan_report+0x129/0x150
[  115.485219][ T8043]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  115.487739][ T8043]  ? __mutex_lock+0x738/0xe80
[  115.489782][ T8043]  __mutex_lock+0x738/0xe80
[  115.491793][ T8043]  ? __mutex_lock+0x51b/0xe80
[  115.493858][ T8043]  ? l2cap_unregister_user+0x6a/0x1b0
[  115.496145][ T8043]  ? __pfx___mutex_lock+0x10/0x10
[  115.498294][ T8043]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  115.500754][ T8043]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  115.503236][ T8043]  l2cap_unregister_user+0x6a/0x1b0
[  115.505408][ T8043]  hidp_session_thread+0x3c9/0x410
[  115.507552][ T8043]  ? __pfx_hidp_session_thread+0x10/0x10
[  115.509942][ T8043]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  115.512436][ T8043]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  115.515231][ T8043]  ? __pfx_hidp_session_wake_function+0x10/0x10
[  115.517866][ T8043]  ? __kthread_parkme+0x7b/0x200
[  115.520003][ T8043]  ? __kthread_parkme+0x1a1/0x200
[  115.522084][ T8043]  kthread+0x711/0x8a0
[  115.523873][ T8043]  ? __pfx_hidp_session_thread+0x10/0x10
[  115.526196][ T8043]  ? __pfx_kthread+0x10/0x10
[  115.528203][ T8043]  ? _raw_spin_unlock_irq+0x23/0x50
[  115.530456][ T8043]  ? lockdep_hardirqs_on+0x9c/0x150
[  115.532678][ T8043]  ? __pfx_kthread+0x10/0x10
[  115.534685][ T8043]  ret_from_fork+0x3fc/0x770
[  115.536711][ T8043]  ? __pfx_ret_from_fork+0x10/0x10
[  115.538911][ T8043]  ? __switch_to_asm+0x39/0x70
[  115.540979][ T8043]  ? __switch_to_asm+0x33/0x70
[  115.543076][ T8043]  ? __pfx_kthread+0x10/0x10
[  115.545038][ T8043]  ret_from_fork_asm+0x1a/0x30
[  115.547073][ T8043]  </TASK>
[  115.549141][ T8043] Kernel Offset: disabled
[  115.550988][ T8043] Rebooting in 86400 seconds..

VM DIAGNOSIS:
19:41:20  Registers:
info registers vcpu 0

CPU#0
RAX=000000000000006c RBX=000000000000006c RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000001e40 RDI=0000000000001e41 RBP=00000000000003f8 RSP=ffffc900040de710
R8 =ffff888021438237 R9 =1ffff11004287046 R10=dffffc0000000000 R11=ffffffff85474610
R12=dffffc0000000000 R13=ffffffff99ac48e9 R14=ffffffff99dc9760 R15=0000000000000000
RIP=ffffffff8547468c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f09b81a56c0 ffffffff 00c00000
GS =0000 ffff8880b8650000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f09b7374980 CR3=000000011cdd8000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000018 0000000000000001
XMM02=0d00000110000000 0000000018000000 XMM03=0000000001000000 0d00000110000000
XMM04=00007f47f7ced100 00007f47f7184440 XMM05=00007f47f7184458 00007f47f71844a0
XMM06=00007f47f7184498 00007f47f7184490 XMM07=00007f47f7184488 00007f47f7184480
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f47f7011c91
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=4ffb859d629b8100 RBX=ffffffff81974d58 RCX=4ffb859d629b8100 RDX=0000000000000001
RSI=ffffffff8be28d20 RDI=ffffffff81974d58 RBP=ffffc90000177f20 RSP=ffffc90000177de0
R8 =ffff888136632f5b R9 =1ffff11026cc65eb R10=dffffc0000000000 R11=ffffed1026cc65ec
R12=ffffffff8fa10df0 R13=0000000000000001 R14=0000000000000001 R15=1ffff110200d6000
RIP=ffffffff8b66c4a3 RFL=00000286 [--S--P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c50000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b2f409ff8 CR3=000000001d296000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 00000000000001a4 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
