last executing test programs:

998.629513ms ago: executing program 1 (id=66):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05000000050000000200000004"], 0x48)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x4, 0xfff, 0x7}, 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b703000000000000850000007000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000300)='tlb_flush\x00', r1}, 0x10)

940.331939ms ago: executing program 1 (id=68):
socket$can_bcm(0x1d, 0x2, 0x2)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5)
r0 = socket(0x10, 0x3, 0x0)
write(r0, &(0x7f0000000000)="3c00000058001f000307f4f9002304000a04d65f0800010002010002170003800500000099db973b91aa057972513500b0406700912deb5b85932234", 0x3c)

838.124645ms ago: executing program 1 (id=69):
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xe0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa9, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000340), 0x8, 0x35, 0x8, 0x0, 0x0}}, 0x10)
sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x4040004)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[], 0x10448)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000003c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x288, 0x0, 0x4c, 0x1a, 0x0, 0x75, 0x258, 0x258, 0x258, 0x258, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @empty, [], [], 'wg2\x00', 'macvlan1\x00'}, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2e8)

770.250965ms ago: executing program 1 (id=72):
r0 = socket$inet_smc(0x2b, 0x1, 0x0)
listen(r0, 0x0)
ppoll(&(0x7f0000000300)=[{r0, 0x100}], 0x1, &(0x7f00000003c0)={0x0, 0x3938700}, 0x0, 0x0)

708.167763ms ago: executing program 1 (id=76):
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18)
r1 = accept4(r0, 0x0, 0x0, 0x0)
sendmmsg$alg(r1, &(0x7f0000000400)=[{0x0, 0x0, 0x0}], 0x1, 0x0)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/73, 0x49}], 0x1}, 0x0)

539.863464ms ago: executing program 1 (id=77):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x3, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}]}, &(0x7f00000002c0)=0x10)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={<r2=>0x0}, &(0x7f0000000300)=0x8)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000500)={r2, @in={{0x2, 0x4e21, @empty}}, 0xa, 0x401}, 0x90)

398.177423ms ago: executing program 2 (id=81):
r0 = socket$inet6(0xa, 0x5, 0x0)
listen(r0, 0x50)
r1 = socket$netlink(0x10, 0x3, 0x4)
writev(r1, &(0x7f0000000080)=[{&(0x7f0000000000)="480000001400190d09004beafc0d8c560a8447608004000000000000000000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1)

300.641341ms ago: executing program 2 (id=83):
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r0, &(0x7f00000005c0), 0x10)
setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000280)=0x2, 0x4)
recvmmsg(r0, &(0x7f0000001600)=[{{0x0, 0x0, &(0x7f0000001700)=[{0x0}, {&(0x7f0000004340)=""/49, 0x31}], 0x2}, 0x40}], 0x1, 0x10002, 0x0)
sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0)

220.549954ms ago: executing program 0 (id=84):
r0 = socket(0x10, 0x803, 0x0)
r1 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x58, 0x2c, 0xd2b, 0x70bd2b, 0x35dfdbfe, {0x0, 0x0, 0x0, r2, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_flower={{0xb}, {0x28, 0x2, [@TCA_FLOWER_KEY_CT_MARK={0x8, 0x5f, 0x69}, @TCA_FLOWER_KEY_IPV6_SRC={0x14, 0xe, @empty}, @TCA_FLOWER_KEY_MPLS_TC={0x5, 0x45, 0x2}]}}]}, 0x58}}, 0x24040084)

220.420132ms ago: executing program 2 (id=85):
sendmsg$AUDIT_TRIM(0xffffffffffffffff, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000840)={0x10, 0x3f6, 0x10, 0x70bd2a, 0x25dfdbfd}, 0x10}}, 0x4c840)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000200)=ANY=[], 0x32600)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000640), 0x8)

220.202945ms ago: executing program 0 (id=86):
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb010018000000000000000c0000001634d0f0b36abe7c89ae882e5fd6d33ead1949145aae3fd575b5b0c77780d0d17284cb8caae21a92992e89a15d8988fd96b15e4c5d058f0c8dbb41da611f7ab2b0694681088afece7bb4f309fe105c249eb04f9e7c2ecf0c38f09196a033bd000000000000"], &(0x7f0000001f80)=""/226, 0x26, 0x81, 0x2}, 0x20)

158.390203ms ago: executing program 2 (id=87):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='sched_switch\x00', r0}, 0x10)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x5, 0x1, 0x8e, 0xe7c9, 0x1}, 0x50)
listen(0xffffffffffffffff, 0xc)
syz_init_net_socket$rose(0xb, 0x5, 0x0)
socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2, &(0x7f00000002c0)=0xffff, 0x4)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x18, 0x16, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000006000000000000000900000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000001836000003000000000000000000000018120000", @ANYRES32, @ANYBLOB="00000000850000000c000000b700000000000000bf9100000000000048d7cbe7000000008500000084000000b7000000000000009500000000000000"], &(0x7f00000000c0)='syzkaller\x00', 0x9, 0x4a, &(0x7f00000003c0)=""/74, 0x41000, 0x30, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0xa, 0x2}, 0x8, 0x10, &(0x7f00000004c0)={0x4, 0x6, 0x0, 0x7fffffff}, 0x10, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000500)=[{0x5, 0x3, 0xf, 0x1}, {0x5, 0x3, 0x9, 0x5}, {0x1, 0x1, 0xf}, {0x1, 0x4, 0x1, 0x5}]}, 0x94)
bpf$MAP_DELETE_BATCH(0x18, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xe30a, r1}, 0x38)

158.281763ms ago: executing program 0 (id=88):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x9, [@union={0x3, 0x1, 0x0, 0x5, 0x0, 0x0, [{0x6, 0x5}]}]}, {0x0, [0x30, 0x5f, 0x61, 0x5f, 0x2e, 0x61, 0x5f]}}, 0x0, 0x39, 0x0, 0x1, 0xfffffff8}, 0x28)

99.967053ms ago: executing program 0 (id=89):
socket$nl_route(0x10, 0x3, 0x0)
socket(0x10, 0x803, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket(0x10, 0x3, 0x0)
socket$alg(0x26, 0x5, 0x0)
pipe(&(0x7f00000001c0))
socket$packet(0x11, 0x2, 0x300)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000003c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94)
pipe(&(0x7f00000001c0))
socket(0x10, 0x3, 0x0)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$unix(0x1, 0x1, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100))
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="aeaa000000000000711013000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94)
socket$key(0xf, 0x3, 0x2)
socket$vsock_stream(0x28, 0x1, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)=ANY=[@ANYRES32, @ANYRES32, @ANYRES64=r0, @ANYRES64=0x0], 0x20)

99.757111ms ago: executing program 2 (id=90):
r0 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10)
getpeername$packet(r0, 0x0, &(0x7f0000000440))

75.636043ms ago: executing program 2 (id=91):
r0 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32})
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r1, &(0x7f0000000200)={@val={0xa}, @void, @eth={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \x00', 0x8, 0x11, 0xff, @empty, @mcast2, {[], {0x4f19, 0x4e20, 0x8}}}}}}}, 0x42)
r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
sendto(r3, &(0x7f00000000c0)="7eaf9d668116879c47349548e696c4f047b21e974af5ae0221bfdd649a73ba538d5ada928c315be4935b585715b92e74f2541365538fd58c169fcaae8b0294082d47e8783b2fb3f20ebae357e2946872ab0cc940b086a62345", 0x59, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYRES64], 0x48)
r4 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x200}, 0x8)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00'}, 0x10)
r5 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendto$inet6(r5, 0x0, 0x0, 0x20004041, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv0\x00'})
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc)
connect$inet6(r6, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x2, &(0x7f0000000140)=@gcm_256={{0x303, 0x3a}, "c4d65ab71f5ef2fe", "9e8ecc7bb5352776725e104757e7dc25c6519a85efb17b5508000018bb00", "0900b43f"}, 0x38)
setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r6, 0x6, 0x15, &(0x7f0000000280)=0x8, 0x4)

75.483347ms ago: executing program 0 (id=92):
bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)={@map, 0xffffffffffffffff, 0x2b, 0x10}, 0x20)

0s ago: executing program 0 (id=93):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003000000000000000a000a00272d5d29212b0000140007"], 0x6c}}, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:22514' (ED25519) to the list of known hosts.
syzkaller login: [   49.152230][ T5802] cgroup: Unknown subsys name 'net'
[   49.249804][ T5802] cgroup: Unknown subsys name 'cpuset'
[   49.253483][ T5802] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.734364][ T5802] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   55.084869][   T55] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   55.088609][   T55] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   55.092297][   T55] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   55.096375][   T55] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   55.101086][   T55] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   55.152232][ T5219] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   55.157860][ T5219] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   55.161598][ T5219] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   55.165328][ T5219] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   55.169538][ T5219] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   55.203540][   T55] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   55.207323][   T55] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   55.210258][   T55] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   55.215391][   T55] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   55.218523][   T55] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   55.337358][ T5828] chnl_net:caif_netlink_parms(): no params data found
[   55.444922][ T5828] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.449477][ T5828] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.452738][ T5828] bridge_slave_0: entered allmulticast mode
[   55.457312][ T5828] bridge_slave_0: entered promiscuous mode
[   55.469206][ T5828] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.472359][ T5828] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.475704][ T5828] bridge_slave_1: entered allmulticast mode
[   55.479977][ T5828] bridge_slave_1: entered promiscuous mode
[   55.531222][ T5833] chnl_net:caif_netlink_parms(): no params data found
[   55.543139][ T5828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.557617][ T5828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.635956][ T5828] team0: Port device team_slave_0 added
[   55.639869][ T5836] chnl_net:caif_netlink_parms(): no params data found
[   55.660772][ T5828] team0: Port device team_slave_1 added
[   55.695123][ T5833] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.698035][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.700450][ T5833] bridge_slave_0: entered allmulticast mode
[   55.703465][ T5833] bridge_slave_0: entered promiscuous mode
[   55.714743][ T5833] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.717316][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.719824][ T5833] bridge_slave_1: entered allmulticast mode
[   55.723205][ T5833] bridge_slave_1: entered promiscuous mode
[   55.741010][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.743951][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.754787][ T5828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.785571][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.789181][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.798325][ T5828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.808435][ T5833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.821020][ T5833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.873581][ T5836] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.876055][ T5836] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.880348][ T5836] bridge_slave_0: entered allmulticast mode
[   55.883088][ T5836] bridge_slave_0: entered promiscuous mode
[   55.888334][ T5833] team0: Port device team_slave_0 added
[   55.892207][ T5833] team0: Port device team_slave_1 added
[   55.897646][ T5828] hsr_slave_0: entered promiscuous mode
[   55.900087][ T5828] hsr_slave_1: entered promiscuous mode
[   55.902623][ T5836] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.905284][ T5836] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.907968][ T5836] bridge_slave_1: entered allmulticast mode
[   55.910717][ T5836] bridge_slave_1: entered promiscuous mode
[   55.953594][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.955852][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.964409][ T5833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.977978][ T5836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.981314][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.983605][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.992224][ T5833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.011127][ T5836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   56.054207][ T5836] team0: Port device team_slave_0 added
[   56.072729][ T5836] team0: Port device team_slave_1 added
[   56.083832][ T5833] hsr_slave_0: entered promiscuous mode
[   56.086198][ T5833] hsr_slave_1: entered promiscuous mode
[   56.088984][ T5833] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   56.091836][ T5833] Cannot create hsr debugfs directory
[   56.144462][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_0
[   56.148693][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.160497][ T5836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   56.176996][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_1
[   56.179876][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   56.191060][ T5836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   56.258159][ T5828] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   56.285724][ T5828] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   56.318571][ T5836] hsr_slave_0: entered promiscuous mode
[   56.322282][ T5836] hsr_slave_1: entered promiscuous mode
[   56.325168][ T5836] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   56.328572][ T5836] Cannot create hsr debugfs directory
[   56.331402][ T5828] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   56.344906][ T5828] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   56.475272][ T5833] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   56.484114][ T5833] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   56.499106][ T5833] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   56.519025][ T5833] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   56.543376][ T5836] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   56.553277][ T5836] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   56.559550][ T5836] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   56.573128][ T5836] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   56.613783][ T5828] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.671684][ T5828] 8021q: adding VLAN 0 to HW filter on device team0
[   56.676577][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.696090][ T5836] 8021q: adding VLAN 0 to HW filter on device team0
[   56.710500][ T1938] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.713070][ T1938] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.717664][ T1938] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.720135][ T1938] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.732352][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.735419][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.742125][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.744565][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.794410][ T5833] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.840442][ T5833] 8021q: adding VLAN 0 to HW filter on device team0
[   56.858319][ T1087] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.861460][ T1087] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.889979][ T1938] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.892831][ T1938] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.998554][ T5828] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.020442][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.046080][ T5828] veth0_vlan: entered promiscuous mode
[   57.064290][ T5833] 8021q: adding VLAN 0 to HW filter on device batadv0
[   57.080449][ T5828] veth1_vlan: entered promiscuous mode
[   57.083977][ T5836] veth0_vlan: entered promiscuous mode
[   57.102665][ T5836] veth1_vlan: entered promiscuous mode
[   57.129261][ T5833] veth0_vlan: entered promiscuous mode
[   57.145908][ T5833] veth1_vlan: entered promiscuous mode
[   57.148798][   T55] Bluetooth: hci0: command tx timeout
[   57.162902][ T5828] veth0_macvtap: entered promiscuous mode
[   57.180232][ T5828] veth1_macvtap: entered promiscuous mode
[   57.186275][ T5836] veth0_macvtap: entered promiscuous mode
[   57.193788][ T5836] veth1_macvtap: entered promiscuous mode
[   57.208485][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.222072][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.226035][ T5833] veth0_macvtap: entered promiscuous mode
[   57.228138][   T55] Bluetooth: hci2: command tx timeout
[   57.228175][ T5219] Bluetooth: hci1: command tx timeout
[   57.230380][ T5833] veth1_macvtap: entered promiscuous mode
[   57.239531][ T5828] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.242920][ T5828] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.246623][ T5828] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.251628][ T5828] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.261646][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.270034][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.280898][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.290982][ T5836] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.294169][ T5836] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.298174][ T5836] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.301049][ T5836] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.318472][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.353574][ T5833] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.356428][ T5833] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.360754][ T5833] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.363541][ T5833] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.381973][ T1087] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.384916][ T1087] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.425625][   T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.428849][   T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.461546][ T1938] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.464257][ T1938] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.471532][   T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.474168][   T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.501298][   T53] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.507111][   T53] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.511548][ T5828] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   57.534218][   T65] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.538264][   T65] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.963658][ T5923] openvswitch: netlink: Flow actions attr not present in new flow.
[   58.083481][ T5935] syz.1.17 uses obsolete (PF_INET,SOCK_PACKET)
[   58.262035][ T5949] Zero length message leads to an empty skb
[   58.293086][ T5957] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.27'.
[   58.311117][ T5959] xt_cgroup: invalid path, errno=-2
[   58.367144][ T5965] netlink: 8 bytes leftover after parsing attributes in process `syz.0.32'.
[   58.431684][ T5974] bridge0: port 3(gretap0) entered blocking state
[   58.434003][ T5974] bridge0: port 3(gretap0) entered disabled state
[   58.436179][ T5974] gretap0: entered allmulticast mode
[   58.441687][ T5974] gretap0: entered promiscuous mode
[   58.443879][ T5975] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2
[   58.446777][ T5974] bridge0: port 3(gretap0) entered blocking state
[   58.449921][ T5974] bridge0: port 3(gretap0) entered forwarding state
[   58.460434][ T5974] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   58.594595][ T5989] mac80211_hwsim hwsim5 wlan0: entered promiscuous mode
[   58.768771][ T6011] netlink: 4 bytes leftover after parsing attributes in process `syz.0.52'.
[   58.939319][ T6019] nbd2: detected capacity change from 0 to 63
[   58.945827][ T6023] block nbd2: NBD_DISCONNECT
[   58.951553][ T6023] block nbd2: Disconnected due to user request.
[   58.955277][ T6023] block nbd2: shutting down sockets
[   58.968469][    C0] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   58.971625][    C0] Buffer I/O error on dev nbd2, logical block 0, async page read
[   58.974212][    C0] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   58.977277][    C0] Buffer I/O error on dev nbd2, logical block 1, async page read
[   58.979901][    C0] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   58.983198][    C0] Buffer I/O error on dev nbd2, logical block 2, async page read
[   58.985659][    C0] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   58.989175][    C0] Buffer I/O error on dev nbd2, logical block 3, async page read
[   58.994476][ T5832] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   59.002300][ T5832] Buffer I/O error on dev nbd2, logical block 0, async page read
[   59.009051][ T5832] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   59.015108][ T5832] Buffer I/O error on dev nbd2, logical block 1, async page read
[   59.019682][ T5832] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   59.023385][ T5832] Buffer I/O error on dev nbd2, logical block 2, async page read
[   59.027079][ T5832] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   59.030907][ T5832] Buffer I/O error on dev nbd2, logical block 3, async page read
[   59.034219][ T5832] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   59.041047][ T5832] Buffer I/O error on dev nbd2, logical block 0, async page read
[   59.044459][ T5832] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
[   59.057339][ T5832] Buffer I/O error on dev nbd2, logical block 1, async page read
[   59.063107][ T5832] ldm_validate_partition_table(): Disk read failed.
[   59.078375][ T5832] Dev nbd2: unable to read RDB block 0
[   59.083921][ T5832]  nbd2: unable to read partition table
[   59.102236][ T5832] ldm_validate_partition_table(): Disk read failed.
[   59.112279][ T5832] Dev nbd2: unable to read RDB block 0
[   59.122115][ T5832]  nbd2: unable to read partition table
[   59.227723][   T55] Bluetooth: hci0: command tx timeout
[   59.300184][ T6044] netlink: 'syz.1.68': attribute type 3 has an invalid length.
[   59.303731][ T6044] netlink: 8 bytes leftover after parsing attributes in process `syz.1.68'.
[   59.307423][   T55] Bluetooth: hci2: command tx timeout
[   59.307978][ T5219] Bluetooth: hci1: command tx timeout
[   59.363446][ T6051] netlink: 12 bytes leftover after parsing attributes in process `syz.2.70'.
[   60.201146][ T6121] netlink: 20 bytes leftover after parsing attributes in process `syz.0.93'.
[   60.253589][   T36] 
[   60.254676][   T36] ======================================================
[   60.257539][   T36] WARNING: possible circular locking dependency detected
[   60.260291][   T36] 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 Not tainted
[   60.264205][   T36] ------------------------------------------------------
[   60.267027][   T36] kworker/u10:1/36 is trying to acquire lock:
[   60.269417][   T36] ffff88802eb19358 (&disk->open_mutex){+.+.}-{4:4}, at: __del_gendisk+0x129/0x9e0
[   60.273104][   T36] 
[   60.273104][   T36] but task is already holding lock:
[   60.276083][   T36] ffff888011fa3988 (&set->update_nr_hwq_lock){++++}-{4:4}, at: del_gendisk+0xe0/0x160
[   60.279958][   T36] 
[   60.279958][   T36] which lock already depends on the new lock.
[   60.279958][   T36] 
[   60.284267][   T36] 
[   60.284267][   T36] the existing dependency chain (in reverse order) is:
[   60.287810][   T36] 
[   60.287810][   T36] -> #2 (&set->update_nr_hwq_lock){++++}-{4:4}:
[   60.291171][   T36]        lock_acquire+0x120/0x360
[   60.293225][   T36]        down_write+0x96/0x1f0
[   60.295145][   T36]        blk_mq_update_nr_hw_queues+0x3b/0x14c0
[   60.297607][   T36]        nbd_start_device+0x16c/0xac0
[   60.299804][   T36]        nbd_genl_connect+0x1250/0x1930
[   60.302039][   T36]        genl_family_rcv_msg_doit+0x215/0x300
[   60.304417][   T36]        genl_rcv_msg+0x60e/0x790
[   60.306509][   T36]        netlink_rcv_skb+0x208/0x470
[   60.308659][   T36]        genl_rcv+0x28/0x40
[   60.310500][   T36]        netlink_unicast+0x75b/0x8d0
[   60.312630][   T36]        netlink_sendmsg+0x805/0xb30
[   60.314782][   T36]        __sock_sendmsg+0x21c/0x270
[   60.316869][   T36]        ____sys_sendmsg+0x505/0x830
[   60.318981][   T36]        ___sys_sendmsg+0x21f/0x2a0
[   60.321086][   T36]        __x64_sys_sendmsg+0x19b/0x260
[   60.323171][   T36]        do_syscall_64+0xfa/0x3b0
[   60.325133][   T36]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   60.327706][   T36] 
[   60.327706][   T36] -> #1 (&nbd->config_lock){+.+.}-{4:4}:
[   60.330781][   T36]        lock_acquire+0x120/0x360
[   60.332826][   T36]        __mutex_lock+0x182/0xe80
[   60.334901][   T36]        refcount_dec_and_mutex_lock+0x30/0xa0
[   60.337366][   T36]        nbd_config_put+0x2c/0x790
[   60.339399][   T36]        nbd_release+0xfe/0x140
[   60.341371][   T36]        bdev_release+0x536/0x650
[   60.343441][   T36]        blkdev_release+0x15/0x20
[   60.345495][   T36]        __fput+0x44c/0xa70
[   60.347345][   T36]        fput_close_sync+0x119/0x200
[   60.349479][   T36]        __x64_sys_close+0x7f/0x110
[   60.351583][   T36]        do_syscall_64+0xfa/0x3b0
[   60.353581][   T36]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   60.356130][   T36] 
[   60.356130][   T36] -> #0 (&disk->open_mutex){+.+.}-{4:4}:
[   60.359268][   T36]        validate_chain+0xb9b/0x2140
[   60.361401][   T36]        __lock_acquire+0xab9/0xd20
[   60.363507][   T36]        lock_acquire+0x120/0x360
[   60.365560][   T36]        __mutex_lock+0x182/0xe80
[   60.367630][   T36]        __del_gendisk+0x129/0x9e0
[   60.369686][   T36]        del_gendisk+0xe8/0x160
[   60.371581][   T36]        nbd_dev_remove_work+0x47/0xe0
[   60.373749][   T36]        process_scheduled_works+0xae1/0x17b0
[   60.376173][   T36]        worker_thread+0x8a0/0xda0
[   60.378262][   T36]        kthread+0x711/0x8a0
[   60.380167][   T36]        ret_from_fork+0x3fc/0x770
[   60.382249][   T36]        ret_from_fork_asm+0x1a/0x30
[   60.384390][   T36] 
[   60.384390][   T36] other info that might help us debug this:
[   60.384390][   T36] 
[   60.388388][   T36] Chain exists of:
[   60.388388][   T36]   &disk->open_mutex --> &nbd->config_lock --> &set->update_nr_hwq_lock
[   60.388388][   T36] 
[   60.394029][   T36]  Possible unsafe locking scenario:
[   60.394029][   T36] 
[   60.396954][   T36]        CPU0                    CPU1
[   60.399072][   T36]        ----                    ----
[   60.401203][   T36]   rlock(&set->update_nr_hwq_lock);
[   60.403350][   T36]                                lock(&nbd->config_lock);
[   60.406223][   T36]                                lock(&set->update_nr_hwq_lock);
[   60.409233][   T36]   lock(&disk->open_mutex);
[   60.411097][   T36] 
[   60.411097][   T36]  *** DEADLOCK ***
[   60.411097][   T36] 
[   60.414327][   T36] 3 locks held by kworker/u10:1/36:
[   60.416400][   T36]  #0: ffff88801fa11148 ((wq_completion)nbd-del){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[   60.420590][   T36]  #1: ffffc900006afbc0 ((work_completion)(&nbd->remove_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[   60.424703][   T36]  #2: ffff888011fa3988 (&set->update_nr_hwq_lock){++++}-{4:4}, at: del_gendisk+0xe0/0x160
[   60.428025][   T36] 
[   60.428025][   T36] stack backtrace:
[   60.430029][   T36] CPU: 1 UID: 0 PID: 36 Comm: kworker/u10:1 Not tainted 6.16.0-rc3-syzkaller-00159-g223e2288f4b8-dirty #0 PREEMPT(full) 
[   60.430039][   T36] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   60.430045][   T36] Workqueue: nbd-del nbd_dev_remove_work
[   60.430056][   T36] Call Trace:
[   60.430060][   T36]  <TASK>
[   60.430063][   T36]  dump_stack_lvl+0x189/0x250
[   60.430074][   T36]  ? __pfx_dump_stack_lvl+0x10/0x10
[   60.430081][   T36]  ? __pfx__printk+0x10/0x10
[   60.430091][   T36]  ? print_lock_name+0xde/0x100
[   60.430100][   T36]  print_circular_bug+0x2ee/0x310
[   60.430110][   T36]  check_noncircular+0x134/0x160
[   60.430120][   T36]  validate_chain+0xb9b/0x2140
[   60.430134][   T36]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[   60.430148][   T36]  ? arch_stack_walk+0x11c/0x150
[   60.430163][   T36]  __lock_acquire+0xab9/0xd20
[   60.430171][   T36]  ? __del_gendisk+0x129/0x9e0
[   60.430178][   T36]  lock_acquire+0x120/0x360
[   60.430184][   T36]  ? __del_gendisk+0x129/0x9e0
[   60.430192][   T36]  ? check_path+0x21/0x40
[   60.430200][   T36]  __mutex_lock+0x182/0xe80
[   60.430208][   T36]  ? __del_gendisk+0x129/0x9e0
[   60.430216][   T36]  ? __del_gendisk+0x129/0x9e0
[   60.430223][   T36]  ? __pfx___mutex_lock+0x10/0x10
[   60.430230][   T36]  ? __pfx___might_resched+0x10/0x10
[   60.430239][   T36]  ? __lock_acquire+0xab9/0xd20
[   60.430245][   T36]  ? disk_del_events+0xb5/0x210
[   60.430253][   T36]  ? __del_gendisk+0xc1/0x9e0
[   60.430260][   T36]  __del_gendisk+0x129/0x9e0
[   60.430268][   T36]  ? del_gendisk+0xe0/0x160
[   60.430276][   T36]  ? __pfx___del_gendisk+0x10/0x10
[   60.430283][   T36]  ? down_read+0x1ad/0x2e0
[   60.430291][   T36]  del_gendisk+0xe8/0x160
[   60.430298][   T36]  nbd_dev_remove_work+0x47/0xe0
[   60.430305][   T36]  ? process_scheduled_works+0x9ef/0x17b0
[   60.430314][   T36]  process_scheduled_works+0xae1/0x17b0
[   60.430327][   T36]  ? __pfx_process_scheduled_works+0x10/0x10
[   60.430342][   T36]  worker_thread+0x8a0/0xda0
[   60.430357][   T36]  kthread+0x711/0x8a0
[   60.430373][   T36]  ? __pfx_worker_thread+0x10/0x10
[   60.430384][   T36]  ? __pfx_kthread+0x10/0x10
[   60.430394][   T36]  ? _raw_spin_unlock_irq+0x23/0x50
[   60.430403][   T36]  ? lockdep_hardirqs_on+0x9c/0x150
[   60.430409][   T36]  ? __pfx_kthread+0x10/0x10
[   60.430418][   T36]  ret_from_fork+0x3fc/0x770
[   60.430426][   T36]  ? __pfx_ret_from_fork+0x10/0x10
[   60.430433][   T36]  ? __switch_to_asm+0x39/0x70
[   60.430442][   T36]  ? __switch_to_asm+0x33/0x70
[   60.430450][   T36]  ? __pfx_kthread+0x10/0x10
[   60.430459][   T36]  ret_from_fork_asm+0x1a/0x30
[   60.430470][   T36]  </TASK>
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   60.685592][   T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   60.790233][   T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   60.882498][   T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   60.972441][   T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   61.022085][   T13] bridge_slave_1: left allmulticast mode
[   61.026186][   T13] bridge_slave_1: left promiscuous mode
[   61.028877][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[   61.032472][   T13] bridge_slave_0: left allmulticast mode
[   61.034346][   T13] bridge_slave_0: left promiscuous mode
[   61.036395][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[   61.132577][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   61.136499][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   61.140612][   T13] bond0 (unregistering): Released all slaves
[   61.330251][   T13] hsr_slave_0: left promiscuous mode
[   61.332893][   T13] hsr_slave_1: left promiscuous mode
[   61.335592][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   61.339069][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[   61.341682][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   61.344154][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[   61.349681][   T13] veth1_macvtap: left promiscuous mode
[   61.351550][   T13] veth0_macvtap: left promiscuous mode
[   61.353332][   T13] veth1_vlan: left promiscuous mode
[   61.355155][   T13] veth0_vlan: left promiscuous mode
[   61.453721][   T13] team0 (unregistering): Port device team_slave_1 removed
[   61.465757][   T13] team0 (unregistering): Port device team_slave_0 removed
[   61.752412][   T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   61.811400][   T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   61.878049][   T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   61.944388][   T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   62.008384][   T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   62.040862][   T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   62.071739][   T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   62.129565][   T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   62.169709][   T13] bridge_slave_1: left allmulticast mode
[   62.174729][   T13] bridge_slave_1: left promiscuous mode
[   62.176995][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[   62.180481][   T13] bridge_slave_0: left allmulticast mode
[   62.182327][   T13] bridge_slave_0: left promiscuous mode
[   62.184230][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[   62.188639][   T13] gretap0: left allmulticast mode
[   62.190296][   T13] gretap0: left promiscuous mode
[   62.191983][   T13] bridge0: port 3(gretap0) entered disabled state
[   62.195712][   T13] bridge_slave_1: left allmulticast mode
[   62.199231][   T13] bridge_slave_1: left promiscuous mode
[   62.201212][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[   62.204319][   T13] bridge_slave_0: left allmulticast mode
[   62.206168][   T13] bridge_slave_0: left promiscuous mode
[   62.208706][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[   62.310883][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   62.315680][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   62.320343][   T13] bond0 (unregistering): Released all slaves
[   62.413037][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   62.418192][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   62.422551][   T13] bond0 (unregistering): Released all slaves
[   62.718746][   T13] hsr_slave_0: left promiscuous mode
[   62.721493][   T13] hsr_slave_1: left promiscuous mode
[   62.724976][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   62.728728][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[   62.732348][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   62.735424][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[   62.743111][   T13] hsr_slave_0: left promiscuous mode
[   62.746475][   T13] hsr_slave_1: left promiscuous mode
[   62.750065][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   62.753191][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[   62.756550][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   62.759996][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[   62.768261][   T13] veth1_macvtap: left promiscuous mode
[   62.770633][   T13] veth0_macvtap: left promiscuous mode
[   62.772888][   T13] veth1_vlan: left promiscuous mode
[   62.775191][   T13] veth0_vlan: left promiscuous mode
[   62.778123][   T13] veth1_macvtap: left promiscuous mode
[   62.780402][   T13] veth0_macvtap: left promiscuous mode
[   62.782737][   T13] veth1_vlan: left promiscuous mode
[   62.785052][   T13] veth0_vlan: left promiscuous mode
[   62.952808][   T13] team0 (unregistering): Port device team_slave_1 removed
[   62.961261][   T13] team0 (unregistering): Port device team_slave_0 removed
[   63.046382][   T13] team0 (unregistering): Port device team_slave_1 removed
[   63.068095][   T13] team0 (unregistering): Port device team_slave_0 removed

VM DIAGNOSIS:
14:15:12  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000001 RBX=ffffc90003d9f240 RCX=b7d981a7fb439900 RDX=dffffc0000000000
RSI=ffffffff820e959f RDI=ffffc90003d9f188 RBP=ffffc90003d9f210 RSP=ffffc90003d9f178
R8 =ffffc90003d9f250 R9 =0000000000000008 R10=ffffc90003d9f1d8 R11=ffffffff81acf6a0
R12=ffff88802ed69cc0 R13=1ffff920007b3eb4 R14=ffffffff81acf6a0 R15=ffffc90003d9f188
RIP=ffffffff81729a55 RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007efe42976ba8 CR3=0000000028326000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffff0000 0000000000000000
XMM02=ffff000000000000 ffffffffffffffff XMM03=ffffffffffffffff ffffffffffffffff
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000032 RBX=0000000000000032 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900006aee10
R8 =ffff888108e20237 R9 =1ffff110211c4046 R10=dffffc0000000000 R11=ffffffff85475610
R12=dffffc0000000000 R13=ffffffff99af78f5 R14=ffffffff99dfc760 R15=0000000000000000
RIP=ffffffff8547568c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8881a3c1d000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007efe4297c270 CR3=00000000263da000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=ffffffffffffffff ffff00ff00000000 XMM05=000000000000026c 0000000000005f66
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffff0000 ffffffffffff0000 XMM09=6174735f64616f6c 66666f5f74665f66
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
