last executing test programs: 2.453223192s ago: executing program 1 (id=2): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cmdline', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/cmdline', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/cmdline', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/cmdline', 0x800, 0x0) 2.370002874s ago: executing program 2 (id=3): ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000000)) 2.282852638s ago: executing program 2 (id=7): recvmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0) 2.282048608s ago: executing program 2 (id=9): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun', 0x800, 0x0) 2.281806628s ago: executing program 4 (id=5): setsockopt(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000), 0x0) 2.278856689s ago: executing program 3 (id=11): socket$kcm(0x29, 0x2, 0x0) 2.262057091s ago: executing program 0 (id=12): socket(0x1e, 0x2, 0x0) 2.261104621s ago: executing program 4 (id=13): gettid() 2.210955578s ago: executing program 3 (id=14): clone(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000)) exit(0x0) 2.210802028s ago: executing program 2 (id=15): mkdir(&(0x7f0000000000), 0x0) 2.210748829s ago: executing program 4 (id=16): socket(0x1, 0x1, 0x0) 2.210620788s ago: executing program 0 (id=17): perf_event_open(&(0x7f0000000000), 0x0, 0x0, 0xffffffffffffffff, 0x0) 2.210553448s ago: executing program 0 (id=18): getpid() 2.210461838s ago: executing program 3 (id=19): unlink(&(0x7f0000000000)) 2.20019876s ago: executing program 2 (id=20): mkdirat(0xffffffffffffffff, &(0x7f0000000000), 0x0) 1.963514425s ago: executing program 1 (id=6): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.690217985s ago: executing program 2 (id=23): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.626820124s ago: executing program 3 (id=21): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.534915648s ago: executing program 0 (id=22): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.480086267s ago: executing program 1 (id=25): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.256912239s ago: executing program 4 (id=26): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.082935104s ago: executing program 1 (id=30): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 863.675839ms ago: executing program 3 (id=28): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 472.780188ms ago: executing program 0 (id=29): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 305.908483ms ago: executing program 4 (id=31): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 263.38411ms ago: executing program 3 (id=33): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 149.957487ms ago: executing program 1 (id=32): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 0s ago: executing program 0 (id=34): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp', 0x800, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.41' (ED25519) to the list of known hosts. syzkaller login: [ 47.494843][ T3535] cgroup: Unknown subsys name 'net' [ 47.630506][ T3535] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 48.911054][ T3535] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 49.769600][ T3585] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 49.778184][ T3585] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 49.788089][ T3585] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 49.796392][ T3585] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 49.804063][ T3585] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 49.812155][ T3585] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 50.775249][ T3605] chnl_net:caif_netlink_parms(): no params data found [ 50.813616][ T2466] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.830183][ T2466] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.989286][ T3536] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 51.035187][ T2466] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.043134][ T2466] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.082084][ T14] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 51.185158][ T3605] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.194661][ T3605] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.205708][ T3605] device bridge_slave_0 entered promiscuous mode [ 51.275326][ T3605] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.282515][ T3605] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.325108][ T3605] device bridge_slave_1 entered promiscuous mode [ 51.477745][ T3605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.515518][ T3605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.630895][ T3605] team0: Port device team_slave_0 added [ 51.639281][ T3605] team0: Port device team_slave_1 added [ 51.679255][ T3605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 51.686287][ T3605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.713198][ T3605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 51.726596][ T3605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 51.733730][ T3605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 51.759936][ T3605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 51.800145][ T3605] device hsr_slave_0 entered promiscuous mode [ 51.807186][ T3605] device hsr_slave_1 entered promiscuous mode [ 51.942606][ T3605] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 51.954619][ T3605] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 51.964579][ T3605] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 51.976041][ T3605] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 52.006711][ T33] [ 52.009358][ T33] ============================= [ 52.014400][ T33] WARNING: suspicious RCU usage [ 52.019380][ T33] 6.1.95-syzkaller #0 Not tainted [ 52.024679][ T33] ----------------------------- [ 52.029636][ T33] net/netfilter/ipset/ip_set_core.c:1202 suspicious rcu_dereference_protected() usage! [ 52.039469][ T33] [ 52.039469][ T33] other info that might help us debug this: [ 52.039469][ T33] [ 52.049859][ T33] SYZFAIL: failed to recv rpc fd=3 want=4 sent=0 n=0 (errno 9: Bad file descriptor) [ 52.049859][ T33] rcu_scheduler_active = 2, debug_locks = 1 [ 52.056178][ T3605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.058040][ T33] 3 locks held by kworker/u4:2/33: [ 52.069772][ T33] #0: ffff888012616938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 [ 52.080260][ T33] #1: ffffc90000aa7d20 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 [ 52.090284][ T33] #2: ffffffff8e28d9d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xf1/0xb60 [ 52.099708][ T33] [ 52.099708][ T33] stack backtrace: [ 52.105749][ T3