last executing test programs: 1.498636818s ago: executing program 5: open_tree(0xffffffffffffffff, &(0x7f0000000000), 0x0) 1.490589841s ago: executing program 4: openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/reclaim', 0x1, 0x0) 1.487862833s ago: executing program 3: syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$MSR(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$MSR(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$MSR(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$MSR(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$MSR(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$MSR(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$MSR(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$MSR(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$MSR(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$MSR(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$MSR(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$MSR(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$MSR(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$MSR(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$MSR(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$MSR(&(0x7f0000000500), 0x4, 0x800) 1.435121067s ago: executing program 3: openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/load', 0x2, 0x0) 1.432332299s ago: executing program 5: msgsnd(0x0, &(0x7f0000000000), 0x0, 0x0) 1.426830911s ago: executing program 0: munmap(0x0, 0x0) 1.407049409s ago: executing program 4: io_destroy(0x0) 1.380785139s ago: executing program 2: set_robust_list(&(0x7f0000000000), 0x0) 1.377804884s ago: executing program 5: listen(0xffffffffffffffff, 0x0) 1.369880387s ago: executing program 0: openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video2', 0x2, 0x0) 1.35593277s ago: executing program 4: getpgrp(0x0) 1.339802829s ago: executing program 2: chmod(&(0x7f0000000000), 0x0) 1.326587286s ago: executing program 0: sched_yield() 1.323699769s ago: executing program 3: openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qrtr-tun', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qrtr-tun', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qrtr-tun', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qrtr-tun', 0x800, 0x0) 1.309310668s ago: executing program 5: socket$can_bcm(0x1d, 0x2, 0x2) 1.295120031s ago: executing program 4: memfd_secret(0x0) 1.28185681s ago: executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/load', 0x2, 0x0) 1.25999364s ago: executing program 3: personality(0x0) 1.249335069s ago: executing program 0: rt_sigreturn() 1.239700258s ago: executing program 5: writev(0xffffffffffffffff, &(0x7f0000000000), 0x0) 1.224213294s ago: executing program 4: fsync(0xffffffffffffffff) 1.216477091s ago: executing program 2: tkill(0x0, 0x0) 1.193234703s ago: executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/damon/init_regions', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/damon/init_regions', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/damon/init_regions', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/damon/init_regions', 0x800, 0x0) 1.187990875s ago: executing program 0: futex(&(0x7f0000000000), 0x0, 0x0, &(0x7f0000000000), &(0x7f0000000000), 0x0) 1.173181314s ago: executing program 3: openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/failed_transaction_log', 0x0, 0x0) 1.159911364s ago: executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uhid', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uhid', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uhid', 0x800, 0x0) 1.14529475s ago: executing program 4: openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/md0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/md0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/md0', 0x800, 0x0) 1.129302653s ago: executing program 3: socket$nl_crypto(0x10, 0x3, 0x15) 1.117531359s ago: executing program 2: io_setup(0x0, &(0x7f0000000000)) 1.103335998s ago: executing program 0: fremovexattr(0xffffffffffffffff, &(0x7f0000000000)) 343.027849ms ago: executing program 1: syz_open_dev$usbfs(&(0x7f0000000040), 0x3, 0x0) syz_open_dev$usbfs(&(0x7f0000000080), 0x3, 0x1) syz_open_dev$usbfs(&(0x7f00000000c0), 0x3, 0x2) syz_open_dev$usbfs(&(0x7f0000000100), 0x3, 0x800) syz_open_dev$usbfs(&(0x7f0000000140), 0xd, 0x0) syz_open_dev$usbfs(&(0x7f0000000180), 0xd, 0x1) syz_open_dev$usbfs(&(0x7f00000001c0), 0xd, 0x2) syz_open_dev$usbfs(&(0x7f0000000200), 0xd, 0x800) syz_open_dev$usbfs(&(0x7f0000000240), 0x17, 0x0) syz_open_dev$usbfs(&(0x7f0000000280), 0x17, 0x1) syz_open_dev$usbfs(&(0x7f00000002c0), 0x17, 0x2) syz_open_dev$usbfs(&(0x7f0000000300), 0x17, 0x800) syz_open_dev$usbfs(&(0x7f0000000340), 0x21, 0x0) syz_open_dev$usbfs(&(0x7f0000000380), 0x21, 0x1) syz_open_dev$usbfs(&(0x7f00000003c0), 0x21, 0x2) syz_open_dev$usbfs(&(0x7f0000000400), 0x21, 0x800) syz_open_dev$usbfs(&(0x7f0000000440), 0x2b, 0x0) syz_open_dev$usbfs(&(0x7f0000000480), 0x2b, 0x1) syz_open_dev$usbfs(&(0x7f00000004c0), 0x2b, 0x2) syz_open_dev$usbfs(&(0x7f0000000500), 0x2b, 0x800) 270.447625ms ago: executing program 1: syz_open_dev$sndmidi(&(0x7f0000000040), 0x3, 0x0) syz_open_dev$sndmidi(&(0x7f0000000080), 0x3, 0x1) syz_open_dev$sndmidi(&(0x7f00000000c0), 0x3, 0x2) syz_open_dev$sndmidi(&(0x7f0000000100), 0x3, 0x800) syz_open_dev$sndmidi(&(0x7f0000000140), 0xd, 0x0) syz_open_dev$sndmidi(&(0x7f0000000180), 0xd, 0x1) syz_open_dev$sndmidi(&(0x7f00000001c0), 0xd, 0x2) syz_open_dev$sndmidi(&(0x7f0000000200), 0xd, 0x800) syz_open_dev$sndmidi(&(0x7f0000000240), 0x17, 0x0) syz_open_dev$sndmidi(&(0x7f0000000280), 0x17, 0x1) syz_open_dev$sndmidi(&(0x7f00000002c0), 0x17, 0x2) syz_open_dev$sndmidi(&(0x7f0000000300), 0x17, 0x800) syz_open_dev$sndmidi(&(0x7f0000000340), 0x21, 0x0) syz_open_dev$sndmidi(&(0x7f0000000380), 0x21, 0x1) syz_open_dev$sndmidi(&(0x7f00000003c0), 0x21, 0x2) syz_open_dev$sndmidi(&(0x7f0000000400), 0x21, 0x800) syz_open_dev$sndmidi(&(0x7f0000000440), 0x2b, 0x0) syz_open_dev$sndmidi(&(0x7f0000000480), 0x2b, 0x1) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2b, 0x2) syz_open_dev$sndmidi(&(0x7f0000000500), 0x2b, 0x800) 239.296965ms ago: executing program 1: syz_open_dev$sndpcmp(&(0x7f0000000040), 0x3, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x3, 0x1) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x3, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000100), 0x3, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000140), 0xd, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000180), 0xd, 0x1) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0xd, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000200), 0xd, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000240), 0x17, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000280), 0x17, 0x1) syz_open_dev$sndpcmp(&(0x7f00000002c0), 0x17, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000300), 0x17, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000340), 0x21, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000380), 0x21, 0x1) syz_open_dev$sndpcmp(&(0x7f00000003c0), 0x21, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000400), 0x21, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x2b, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000480), 0x2b, 0x1) syz_open_dev$sndpcmp(&(0x7f00000004c0), 0x2b, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000500), 0x2b, 0x800) 182.858695ms ago: executing program 1: syz_open_dev$usbfs(&(0x7f0000000040), 0x4, 0x0) syz_open_dev$usbfs(&(0x7f0000000080), 0x4, 0x1) syz_open_dev$usbfs(&(0x7f00000000c0), 0x4, 0x2) syz_open_dev$usbfs(&(0x7f0000000100), 0x4, 0x800) syz_open_dev$usbfs(&(0x7f0000000140), 0xe, 0x0) syz_open_dev$usbfs(&(0x7f0000000180), 0xe, 0x1) syz_open_dev$usbfs(&(0x7f00000001c0), 0xe, 0x2) syz_open_dev$usbfs(&(0x7f0000000200), 0xe, 0x800) syz_open_dev$usbfs(&(0x7f0000000240), 0x18, 0x0) syz_open_dev$usbfs(&(0x7f0000000280), 0x18, 0x1) syz_open_dev$usbfs(&(0x7f00000002c0), 0x18, 0x2) syz_open_dev$usbfs(&(0x7f0000000300), 0x18, 0x800) syz_open_dev$usbfs(&(0x7f0000000340), 0x22, 0x0) syz_open_dev$usbfs(&(0x7f0000000380), 0x22, 0x1) syz_open_dev$usbfs(&(0x7f00000003c0), 0x22, 0x2) syz_open_dev$usbfs(&(0x7f0000000400), 0x22, 0x800) syz_open_dev$usbfs(&(0x7f0000000440), 0x2c, 0x0) syz_open_dev$usbfs(&(0x7f0000000480), 0x2c, 0x1) syz_open_dev$usbfs(&(0x7f00000004c0), 0x2c, 0x2) syz_open_dev$usbfs(&(0x7f0000000500), 0x2c, 0x800) 84.4243ms ago: executing program 1: syz_open_dev$sndmidi(&(0x7f0000000040), 0x4, 0x0) syz_open_dev$sndmidi(&(0x7f0000000080), 0x4, 0x1) syz_open_dev$sndmidi(&(0x7f00000000c0), 0x4, 0x2) syz_open_dev$sndmidi(&(0x7f0000000100), 0x4, 0x800) syz_open_dev$sndmidi(&(0x7f0000000140), 0xe, 0x0) syz_open_dev$sndmidi(&(0x7f0000000180), 0xe, 0x1) syz_open_dev$sndmidi(&(0x7f00000001c0), 0xe, 0x2) syz_open_dev$sndmidi(&(0x7f0000000200), 0xe, 0x800) syz_open_dev$sndmidi(&(0x7f0000000240), 0x18, 0x0) syz_open_dev$sndmidi(&(0x7f0000000280), 0x18, 0x1) syz_open_dev$sndmidi(&(0x7f00000002c0), 0x18, 0x2) syz_open_dev$sndmidi(&(0x7f0000000300), 0x18, 0x800) syz_open_dev$sndmidi(&(0x7f0000000340), 0x22, 0x0) syz_open_dev$sndmidi(&(0x7f0000000380), 0x22, 0x1) syz_open_dev$sndmidi(&(0x7f00000003c0), 0x22, 0x2) syz_open_dev$sndmidi(&(0x7f0000000400), 0x22, 0x800) syz_open_dev$sndmidi(&(0x7f0000000440), 0x2c, 0x0) syz_open_dev$sndmidi(&(0x7f0000000480), 0x2c, 0x1) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2c, 0x2) syz_open_dev$sndmidi(&(0x7f0000000500), 0x2c, 0x800) 0s ago: executing program 1: syz_open_dev$sndpcmp(&(0x7f0000000040), 0x4, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x4, 0x1) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x4, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000100), 0x4, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000140), 0xe, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000180), 0xe, 0x1) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0xe, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000200), 0xe, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000240), 0x18, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000280), 0x18, 0x1) syz_open_dev$sndpcmp(&(0x7f00000002c0), 0x18, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000300), 0x18, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000340), 0x22, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000380), 0x22, 0x1) syz_open_dev$sndpcmp(&(0x7f00000003c0), 0x22, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000400), 0x22, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x2c, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000480), 0x2c, 0x1) syz_open_dev$sndpcmp(&(0x7f00000004c0), 0x2c, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000500), 0x2c, 0x800) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.210' (ED25519) to the list of known hosts. 2024/06/19 01:59:36 fuzzer started [ 101.856488][ T781] cfg80211: failed to load regulatory.db 2024/06/19 01:59:36 dialing manager at 10.128.0.169:30005 [ 102.779119][ T5091] cgroup: Unknown subsys name 'net' [ 103.070834][ T5091] cgroup: Unknown subsys name 'rlimit' 2024/06/19 01:59:39 starting 6 executor processes [ 104.927022][ T5107] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 108.227657][ T12] [ 108.230186][ T12] ============================= [ 108.235145][ T12] WARNING: suspicious RCU usage [ 108.240013][ T12] 6.10.0-rc4-syzkaller-00039-g46d1907d1caa #0 Not tainted [ 108.247244][ T12] ----------------------------- [ 108.252473][ T12] net/netfilter/ipset/ip_set_core.c:1200 suspicious rcu_dereference_protected() usage! [ 108.262212][ T12] [ 108.262212][ T12] other info that might help us debug this: [ 108.262212][ T12] [ 108.272534][ T12] [ 108.272534][ T12] rcu_scheduler_active = 2, debug_locks = 1 [ 108.280796][ T12] 3 locks held by kworker/u8:1/12: [ 108.286193][ T12] #0: ffff8880162d5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12bf/0x1b60 [ 108.296753][ T12] #1: ffffc90000117d80 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x957/0x1b60 [ 108.306926][ T12] #2: ffffffff8f741f90 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xbb/0xbf0 [ 108.316470][ T12] [ 108.316470][ T12] stack backtrace: [ 108.322376][ T12] CPU: 0 PID: 12 Comm: kworker/u8:1 Not tainted 6.10.0-rc4-syzkaller-00039-g46d1907d1caa #0 [ 108.332480][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 108.342568][ T12] Workqueue: netns cleanup_net [ 108.347396][ T12] Call Trace: [ 108.350785][ T12] [ 108.353739][ T12] dump_stack_lvl+0x16c/0x1f0 [ 108.358504][ T12] lockdep_rcu_suspicious+0x20b/0x3b0 [ 108.363942][ T12] _destroy_all_sets+0x261/0x6d0 [ 108.368946][ T12] ? __pfx_ip_set_net_exit+0x10/0x10 [ 108.374299][ T12] ip_set_net_exit+0x26/0x60 [ 108.378932][ T12] ops_exit_list+0xb3/0x180 [ 108.383493][ T12] cleanup_net+0x5b7/0xbf0 [ 108.387960][ T12] ? __pfx_cleanup_net+0x10/0x10 [ 108.392945][ T12] process_one_work+0x9fe/0x1b60 [ 108.397939][ T12] ? __pfx_lock_acquire+0x10/0x10 [ 108.402997][ T12] ? __pfx_process_one_work+0x10/0x10 [ 108.408408][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.414101][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.419786][ T12] ? assign_work+0x1a0/0x250 [ 108.424418][ T12] worker_thread+0x6c8/0xf70 [ 108.429070][ T12] ? __pfx_worker_thread+0x10/0x10 [ 108.434220][ T12] kthread+0x2c4/0x3a0 [ 108.438337][ T12] ? _raw_spin_unlock_irq+0x23/0x50 [ 108.443596][ T12] ? __pfx_kthread+0x10/0x10 [ 108.448237][ T12] ret_from_fork+0x48/0x80 [ 108.452701][ T12] ? __pfx_kthread+0x10/0x10 [ 108.457338][ T12] ret_from_fork_asm+0x1a/0x30 [ 108.462168][ T12] [ 108.547877][ T12] [ 108.550258][ T12] ============================= [ 108.555167][ T12] WARNING: suspicious RCU usage [ 108.560043][ T12] 6.10.0-rc4-syzkaller-00039-g46d1907d1caa #0 Not tainted [ 108.567921][ T12] ----------------------------- [ 108.572795][ T12] net/netfilter/ipset/ip_set_core.c:1211 suspicious rcu_dereference_protected() usage! [ 108.582612][ T12] [ 108.582612][ T12] other info that might help us debug this: [ 108.582612][ T12] [ 108.592902][ T12] [ 108.592902][ T12] rcu_scheduler_active = 2, debug_locks = 1 [ 108.601079][ T12] 3 locks held by kworker/u8:1/12: [ 108.606255][ T12] #0: ffff8880162d5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12bf/0x1b60 [ 108.616788][ T12] #1: ffffc90000117d80 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x957/0x1b60 [ 108.626862][ T12] #2: ffffffff8f741f90 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xbb/0xbf0 [ 108.636355][ T12] [ 108.636355][ T12] stack backtrace: [ 108.642265][ T12] CPU: 1 PID: 12 Comm: kworker/u8:1 Not tainted 6.10.0-rc4-syzkaller-00039-g46d1907d1caa #0 [ 108.652363][ T12] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 108.662446][ T12] Workqueue: netns cleanup_net [ 108.667254][ T12] Call Trace: [ 108.670549][ T12] [ 108.673503][ T12] dump_stack_lvl+0x16c/0x1f0 [ 108.678247][ T12] lockdep_rcu_suspicious+0x20b/0x3b0 [ 108.683672][ T12] _destroy_all_sets+0x4e6/0x6d0 [ 108.688696][ T12] ? __pfx_ip_set_net_exit+0x10/0x10 [ 108.694083][ T12] ip_set_net_exit+0x26/0x60 [ 108.698724][ T12] ops_exit_list+0xb3/0x180 [ 108.703298][ T12] cleanup_net+0x5b7/0xbf0 [ 108.707756][ T12] ? __pfx_cleanup_net+0x10/0x10 [ 108.712829][ T12] process_one_work+0x9fe/0x1b60 [ 108.717828][ T12] ? __pfx_lock_acquire+0x10/0x10 [ 108.722884][ T12] ? __pfx_process_one_work+0x10/0x10 [ 108.728337][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.734048][ T12] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.739729][ T12] ? assign_work+0x1a0/0x250 [ 108.744357][ T12] worker_thread+0x6c8/0xf70 2024/06/19 01:59:42 SYZFATAL: failed to recv *flatrpc.HostMessageRaw: EOF [ 108.749037][ T12] ? __pfx_worker_thread+0x10/0x10 [ 108.754184][ T12] kthread+0x2c4/0x3a0 [ 108.758298][ T12] ? _raw_spin_unlock_irq+0x23/0x50 [ 108.763544][ T12] ? __pfx_kthread+0x10/0x10 [ 108.768200][ T12] ret_from_fork+0x48/0x80 [ 108.772661][ T12] ? __pfx_kthread+0x10/0x10 [ 108.777297][ T12] ret_from_fork_asm+0x1a/0x30 [ 108.782128][ T12]