last executing test programs: 2.817007688s ago: executing program 4 (id=5): close(0xffffffffffffffff) 2.765900506s ago: executing program 2 (id=3): write(0xffffffffffffffff, &(0x7f0000000000), 0x0) 2.765856666s ago: executing program 0 (id=13): unlink(&(0x7f0000000000)) 2.765671216s ago: executing program 1 (id=14): socket$kcm(0x29, 0x2, 0x0) 2.765634146s ago: executing program 3 (id=4): ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000000)) 2.765598636s ago: executing program 0 (id=15): clone(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000)) exit(0x0) 2.765530946s ago: executing program 2 (id=16): socket(0x1e, 0x2, 0x0) 2.757625097s ago: executing program 1 (id=17): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cmdline', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/cmdline', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/cmdline', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/cmdline', 0x800, 0x0) 2.745110129s ago: executing program 0 (id=18): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun', 0x800, 0x0) 2.696600006s ago: executing program 2 (id=21): getpid() 2.211264441s ago: executing program 1 (id=20): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 2.182208675s ago: executing program 4 (id=22): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.992301125s ago: executing program 0 (id=23): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.889204641s ago: executing program 2 (id=24): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.351361233s ago: executing program 1 (id=25): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.223365792s ago: executing program 4 (id=26): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 775.646661ms ago: executing program 2 (id=30): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 707.262092ms ago: executing program 0 (id=27): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 659.688119ms ago: executing program 1 (id=29): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 236.130864ms ago: executing program 2 (id=32): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 103.904065ms ago: executing program 0 (id=33): mkdir(&(0x7f0000000000), 0x0) 35.240675ms ago: executing program 4 (id=31): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 0s ago: executing program 1 (id=34): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.237' (ED25519) to the list of known hosts. [ 47.079693][ T3545] cgroup: Unknown subsys name 'net' [ 47.179629][ T3545] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 48.462114][ T3545] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 49.581014][ T3587] chnl_net:caif_netlink_parms(): no params data found [ 49.643779][ T3603] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 49.653369][ T3603] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 49.661210][ T3603] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 49.674153][ T3603] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 49.683930][ T3603] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 49.692471][ T3603] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 49.904289][ T3587] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.923379][ T3587] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.931769][ T3587] device bridge_slave_0 entered promiscuous mode [ 50.028427][ T3587] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.062452][ T3587] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.093127][ T3587] device bridge_slave_1 entered promiscuous mode [ 50.178439][ T3587] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 50.222603][ T3587] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 50.350987][ T3587] team0: Port device team_slave_0 added [ 50.360672][ T3587] team0: Port device team_slave_1 added [ 50.479742][ T3587] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 50.508750][ T3587] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 50.564049][ T3587] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 50.580933][ T3587] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 50.613302][ T3587] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 50.649034][ T3587] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 50.801108][ T3587] device hsr_slave_0 entered promiscuous mode [ 50.817877][ T3587] device hsr_slave_1 entered promiscuous mode [ 51.295911][ T3624] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.353396][ T3624] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.405544][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 51.463163][ T3624] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.471118][ T3624] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.504743][ T3587] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 51.523340][ T3587] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 51.548010][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 51.559869][ T3587] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 51.571674][ T3587] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 51.735692][ T3587] 8021q: adding VLAN 0 to HW filter on device bond0 [ 51.750778][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 51.760749][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 51.774331][ T3587] 8021q: adding VLAN 0 to HW filter on device team0 [ 51.793410][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 51.803254][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 51.812306][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.819646][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.851667][ T3639] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 51.860061][ T3639] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 51.869471][ T3639] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 51.878375][ T3639] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.885700][ T3639] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.893579][ T3639] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 51.902719][ T3639] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 51.911318][ T3639] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 51.920937][ T3639] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 51.931051][ T3639] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 51.942340][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 51.951283][ T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 51.971490][ T3587] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 51.984296][ T3587] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 51.997496][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 52.008299][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 52.018209][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 52.027274][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 52.036005][ T3018] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 52.053648][ T9] [ 52.056209][ T9] ============================= [ 52.061082][ T9] WARNING: suspicious RCU usage [ 52.066175][ T9] 6.1.95-syzkaller #0 Not tainted [ 52.071571][ T9] ----------------------------- [ 52.076579][ T9] net/netfilter/ipset/ip_set_core.c:1202 suspicious rcu_dereference_protected() usage! [ 52.088217][ T9] [ 52.088217][ T9] other info that might help us debug this: [ 52.088217][ T9] [ 52.099506][ T9] [ 52.099506][ T9] rcu_scheduler_active = 2, debug_locks = 1 [ 52.107654][ T9] 3 locks held by kworker/u4:0/9: [ 52.112734][ T9] #0: ffff888012616938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 [ 52.123263][ T9] #1: ffffc900000e7d20 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 [ 52.133297][ T9] #2: ffffffff8e28d9d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xf1/0xb60 [ 52.142702][ T9] [ 52.142702][ T9] stack backtrace: [ 52.148632][ T9] CPU: 0 PID: 9 Comm: kworker/u4:0 Not tainted 6.1.95-syzkaller #0 [ 52.156544][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 52.166626][ T9] Workqueue: netns cleanup_net [ 52.171438][ T9] Call Trace: [ 52.174732][ T9] [ 52.177656][ T9] dump_stack_lvl+0x1e3/0x2cb [ 52.182345][ T9] ? nf_tcp_handle_invalid+0x642/0x642 [ 52.187802][ T9] ? panic+0x764/0x764 [ 52.191876][ T9] lockdep_rcu_suspicious+0x21c/0x330 [ 52.197338][ T9] _destroy_all_sets+0x22c/0x5e0 [ 52.202288][ T9] ip_set_net_exit+0x1c/0x50 [ 52.206895][ T9] cleanup_net+0x6ce/0xb60 [ 52.211489][ T9] ? ops_free_list+0x3b0/0x3b0 [ 52.216277][ T9] ? process_one_work+0x7a9/0x11d0 [ 52.221557][ T9] process_one_work+0x8a9/0x11d0 [ 52.226608][ T9] ? worker_detach_from_pool+0x260/0x260 [ 52.232273][ T9] ? _raw_spin_lock_irqsave+0x120/0x120 [ 52.237834][ T9] ? kthread_data+0x4e/0xc0 [ 52.242360][ T9] ? wq_worker_running+0x97/0x190 [ 52.247488][ T9] worker_thread+0xa47/0x1200 SYZFAIL: failed to recv rpc fd=3 want=4 sent=0 n=0 (errno 9: Bad file descriptor) [ 52.252188][ T9] kthrea