last executing test programs: 13.066912079s ago: executing program 2 (id=93): syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0xa8, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './dev\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x800) r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg_v2(r3, 0x0, 0x0) write$vhost_msg_v2(r3, &(0x7f0000000180)={0x2, 0x0, {0x0, 0x0, 0x0, 0x2, 0x3}}, 0x48) 11.18149802s ago: executing program 2 (id=95): mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./dev\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(0x0, 0x0, &(0x7f00000008c0)) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, 0xffffffffffffffff, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x400}) dup2(0xffffffffffffffff, 0xffffffffffffffff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000000)={0x34, 0x0, 0x905, 0x0, 0x0, {0x24}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x240, 0x310) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0214f9f4070009", 0xe) ioctl(r4, 0xc138fd02, &(0x7f0000000000)="0400000000000000") sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x0) r5 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r5, &(0x7f0000000040), 0x10) listen(r5, 0x0) r6 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r6, &(0x7f0000000080), 0x10) sendmmsg$inet6(r6, &(0x7f0000005480)=[{{0x0, 0x0, &(0x7f0000001c00)=[{&(0x7f0000000880)}], 0x1}}], 0x1, 0x24000082) 9.846965334s ago: executing program 2 (id=98): mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./dev\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(0x0, 0x0, &(0x7f00000008c0)) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000000)={0x34, 0x0, 0x905, 0x0, 0x0, {0x24}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x4) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x240, 0x310) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0214f9f4070009", 0xe) ioctl(r3, 0xc138fd02, &(0x7f0000000000)="0400000000000000") sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x0) r4 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r4, &(0x7f0000000040), 0x10) listen(r4, 0x0) r5 = socket(0x28, 0x5, 0x0) sendmmsg$inet6(r5, &(0x7f0000005480)=[{{0x0, 0x0, &(0x7f0000001c00)=[{&(0x7f0000000880)}], 0x1}}], 0x1, 0x24000082) 9.526399937s ago: executing program 0 (id=100): mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0/dev0/control\x00', 0x2, 0x0) close(r0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) write(r1, &(0x7f0000000440)='naa.600140512345', 0x10) symlinkat(&(0x7f00000004c0)='./config/target/core/rd_mcp_0/dev0\x00', 0xffffffffffffff9c, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/enable\x00', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) 9.458126483s ago: executing program 0 (id=101): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r0, &(0x7f0000000600)='loop', 0x4) symlinkat(&(0x7f0000000680)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/subsystems/testsubsys\x00') symlinkat(&(0x7f0000000440)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/subsystems/testnqn\x00') 9.316466405s ago: executing program 0 (id=102): mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./dev\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(0x0, 0x0, &(0x7f00000008c0)) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, 0xffffffffffffffff, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x400}) dup2(0xffffffffffffffff, 0xffffffffffffffff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x240, 0x310) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0214f9f4070009", 0xe) ioctl(r4, 0xc138fd02, &(0x7f0000000000)="0400000000000000") sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x0) r5 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r5, &(0x7f0000000040), 0x10) listen(r5, 0x0) r6 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r6, &(0x7f0000000080), 0x10) 8.521617176s ago: executing program 3 (id=104): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000000000002}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) symlink(0x0, 0x0) socket(0x1e, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r3 = socket(0x2b, 0x1, 0x1) listen(r3, 0x3) ioctl$sock_TIOCINQ(r3, 0x541b, 0x0) 7.353919153s ago: executing program 0 (id=105): signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getrlimit(0xd, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) ioctl$TIOCGSERIAL(0xffffffffffffffff, 0x541e, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_REAPURB(r3, 0x4004550c, 0x0) ptrace$pokeuser(0x6, 0x0, 0x358, 0xffff8881f5c0a000) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x44}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001180)={0x38, 0x0, 0x7, 0xfffffffc, 0x3, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x38}}, 0x0) 4.988461872s ago: executing program 2 (id=106): mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./dev\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(0x0, 0x0, &(0x7f00000008c0)) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, 0xffffffffffffffff, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x400}) dup2(0xffffffffffffffff, 0xffffffffffffffff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000000)={0x34, 0x0, 0x905, 0x0, 0x0, {0x24}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x240, 0x310) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0214f9f4070009", 0xe) ioctl(r4, 0xc138fd02, &(0x7f0000000000)="0400000000000000") sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x0) r5 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r5, &(0x7f0000000040), 0x10) listen(r5, 0x0) r6 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r6, &(0x7f0000000080), 0x10) sendmmsg$inet6(r6, &(0x7f0000005480)=[{{0x0, 0x0, &(0x7f0000001c00)=[{&(0x7f0000000880)}], 0x1}}], 0x1, 0x24000082) 4.363293375s ago: executing program 3 (id=109): mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0/dev0/control\x00', 0x2, 0x0) close(r0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) write(r1, &(0x7f0000000440)='naa.600140512345', 0x10) symlinkat(&(0x7f00000004c0)='./config/target/core/rd_mcp_0/dev0\x00', 0xffffffffffffff9c, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/enable\x00', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) 4.137742096s ago: executing program 3 (id=110): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.253648938s ago: executing program 1 (id=111): r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000e00)=@newtaction={0x68, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x54, 0x1, [@m_sample={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x9, 0x2, 0x10000000, 0xfffffffc, 0x3ff}}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x7}]}, {0x4}, {0xc}, {0xc, 0x4}}}]}]}, 0x68}}, 0x8000000) 3.136271345s ago: executing program 1 (id=112): r0 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) semop(0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$SNDRV_PCM_IOCTL_FORWARD(r0, 0x40084149, &(0x7f0000000080)=0xfd8) 2.921306833s ago: executing program 3 (id=113): mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./dev\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_submit(0x0, 0x0, &(0x7f00000008c0)) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, 0xffffffffffffffff, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x400}) dup2(0xffffffffffffffff, 0xffffffffffffffff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/mapper/control\x00', 0x240, 0x310) write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0214f9f4070009", 0xe) ioctl(r4, 0xc138fd02, &(0x7f0000000000)="0400000000000000") sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x0) r5 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r5, &(0x7f0000000040), 0x10) listen(r5, 0x0) r6 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r6, &(0x7f0000000080), 0x10) 2.6737074s ago: executing program 1 (id=114): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/custom1\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb3d68000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r4, 0x84, 0x20, &(0x7f00000002c0), &(0x7f0000000380)=0x4) setresuid(0x0, 0xee00, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000740)={0x104085280, 0x0, 0x0, 0x0, {0x22}, 0x0, 0x0, 0x0, 0x0}, 0x58) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000003c0)='./binderfs/binder1\x00', 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x4403, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r5, 0x80049367, &(0x7f0000000040)) r6 = fsopen(&(0x7f0000000000)='overlay\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) mmap(&(0x7f00009c5000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r7 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_MAKE_EQUIV(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x28, 0x3f7, 0x200, 0x70bd2b, 0x25dfdbfe, {0x7, 0x7, './file0', './file0'}, ["", "", "", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 2.229921491s ago: executing program 3 (id=115): inotify_init1(0x80800) epoll_create1(0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pselect6(0x40, &(0x7f0000000100)={0x0, 0x7, 0x0, 0x0, 0x0, 0xc}, &(0x7f0000000180)={0x1f, 0x0, 0x80000005, 0x0, 0xe5, 0x7, 0x8}, 0x0, 0x0, 0x0) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, 0x0) dup(0xffffffffffffffff) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000200), 0x20400, 0x0) r4 = socket(0x840000000002, 0x3, 0x100) openat$kvm(0xffffffffffffff9c, 0x0, 0x101201, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, 0x0, 0x4040) sched_setattr(0x0, &(0x7f00000002c0)={0x38, 0x0, 0x0, 0x0, 0x0, 0x8, 0x20000000000, 0xfffffffffffffffd, 0x10000000, 0x3}, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) mmap$dsp(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xc, 0x50, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) landlock_restrict_self(0xffffffffffffffff, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000000), 0x80080, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/asound/seq/clients\x00', 0x0, 0x0) read$FUSE(r5, &(0x7f0000000600)={0x2020}, 0x2020) mq_open(&(0x7f00000004c0)=' \x01\x9c\x147\xb3\xcf\xfc\xc3\xa2W)\xebs\x93\xa7\xc7!Q\x8f\xf6\xec\xa5fs\xf5\x9a\x98\xf52:\"\xf4\x12\xc0T+\xcd\x9fv|\x8d\xd5\xb2DvF\x8e\x93\xd8\xd6\xa0\xc56\xd2x\xe3c:\x00\x00\x00\x00\x00\x00\x00\x00\x97\x97\x9c \xdc\xaavt\x18\xcen\xe4\x03\x84;7\xfb\x84r\xf4\xe7\xc9\b\x987\xaa\x85\xfb\x05%\xa8\xe5b\x81\x8e}\xe1r\xf7s2\x82\xe57&b\x95\xcdq\xcc\xe6\x91X\xd6\xcc\xea$\xfd\xc4\n\x01&\x8d\xd2\x02\x83\x18(+\'4xq\xfebM\x84\x16+4\xc6Wf\xba\xb9\xaf\xac\xfe\x99\x95\x97[\x9bb\xd2\xfdr\x84&\x94\x7fcV\xa8m\\\x9bP\xfbFf\x0f \xd8R\xc9X+N\x9d\xbfx\xd0EZY\xea\\\xc1\x86{?jm\xec\x1b\x16\x83\xdeR~\x92\x8cg(@\xb3\xb2\x97\xdf\x1b\x9b\xcdtJw~\x99jd(\x034\xaa\x967\xd6OW# \xc3\xbf\xf2z\xf4\x8f\x91\xe3', 0x40, 0x80, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) 2.224789583s ago: executing program 0 (id=116): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) socket(0x400000000010, 0x3, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={r1}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xf, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000100000000000300000018110000", @ANYRES32=r2, @ANYBLOB], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0xf2a9a9ee94caf607, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0x0, 0x0, &(0x7f0000000200), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x6}, 0x50) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000500)=r3, 0x4) write(r1, &(0x7f0000000100)="060000000300010000", 0x9) write(r1, &(0x7f0000000300)="060000000300000000", 0x9) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x403, 0x10, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3ac}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x299}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 1.257743013s ago: executing program 1 (id=117): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0xffff, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000340)=[@ip_retopts={{0x1c, 0x0, 0x7, {[@timestamp_addr={0x44, 0xc, 0x7, 0x1, 0x7, [{@remote}]}]}}}], 0x20}, 0x200040c4) 850.237006ms ago: executing program 1 (id=118): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0/dev0/control\x00', 0x2, 0x0) close(r0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000002c0)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) write(r1, &(0x7f0000000440)='naa.600140512345', 0x10) symlinkat(&(0x7f00000004c0)='./config/target/core/rd_mcp_0/dev0\x00', 0xffffffffffffff9c, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/enable\x00', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) 365.652967ms ago: executing program 2 (id=119): landlock_restrict_self(0xffffffffffffffff, 0x8) landlock_restrict_self(0xffffffffffffffff, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) r0 = openat$userfaultfd(0xffffffffffffff9c, 0x0, 0x80001, 0x0) ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, 0x0) ioprio_set$pid(0x3, 0x0, 0x2007) syz_clone(0xc1200, 0x0, 0xfffffec8, 0x0, 0x0, 0x0) 253.820952ms ago: executing program 0 (id=120): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6_udp(0xa, 0x2, 0x0) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) r4 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r4, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) connect$inet(r4, &(0x7f0000000240)={0x2, 0x4e23, @private=0xa010100}, 0x10) listen(r4, 0xda8d) openat$sysfs(0xffffffffffffff9c, 0x0, 0x10a001, 0x97) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)={0x64, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x2}]}, 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x68, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2, 0x0, 0x6}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2=0xe0000001}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x4}]}, 0x68}}, 0x0) 251.779793ms ago: executing program 3 (id=121): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 183.523888ms ago: executing program 1 (id=122): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pages=6', 0xa) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) 0s ago: executing program 2 (id=123): r0 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$PPPIOCGL2TPSTATS(r0, 0x80047453, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() ioctl$UBLK_U_CMD_END_USER_RECOVERY(0xffffffffffffffff, 0xc0207511, &(0x7f0000000500)={0x0, 0xffff, 0x0, 0x0, r1}) prlimit64(r2, 0xb, &(0x7f0000000580)={0x4, 0x6}, &(0x7f00000005c0)) sched_setscheduler(r1, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) r5 = socket$can_bcm(0x1d, 0x2, 0x2) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r6) sendmsg$ETHTOOL_MSG_PAUSE_SET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x3c, r7, 0x2799f5eec7981083, 0x70bd26, 0x25dfdbfc, {}, [@ETHTOOL_A_PAUSE_RX={0x5}, @ETHTOOL_A_PAUSE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_PAUSE_AUTONEG={0x5, 0x2, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20040080}, 0x80) socket$nl_rdma(0x10, 0x3, 0x14) connect$can_bcm(r5, &(0x7f00000000c0), 0x10) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.23' (ED25519) to the list of known hosts. [ 73.662750][ T5768] cgroup: Unknown subsys name 'net' [ 73.792418][ T5768] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 75.202254][ T5768] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.745456][ T5789] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.750329][ T5791] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.753549][ T5789] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.769246][ T5791] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.777375][ T5791] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.785418][ T5791] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.792855][ T5791] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.801218][ T5791] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.807064][ T5792] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.808622][ T5791] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.825368][ T5789] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.825836][ T5791] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.833112][ T5792] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.841971][ T5791] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 76.854652][ T5789] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.854678][ T5791] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 76.861798][ T5792] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.869943][ T5791] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.885427][ T5090] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.895929][ T5090] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 76.906672][ T5783] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.914084][ T5783] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.923417][ T5783] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 76.937149][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 77.299745][ T5782] chnl_net:caif_netlink_parms(): no params data found [ 77.352044][ T5779] chnl_net:caif_netlink_parms(): no params data found [ 77.450738][ T5780] chnl_net:caif_netlink_parms(): no params data found [ 77.529147][ T5782] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.537021][ T5782] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.544318][ T5782] bridge_slave_0: entered allmulticast mode [ 77.552152][ T5782] bridge_slave_0: entered promiscuous mode [ 77.600615][ T5782] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.610007][ T5782] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.617343][ T5782] bridge_slave_1: entered allmulticast mode [ 77.627106][ T5782] bridge_slave_1: entered promiscuous mode [ 77.639479][ T5779] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.646735][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.654063][ T5779] bridge_slave_0: entered allmulticast mode [ 77.662762][ T5779] bridge_slave_0: entered promiscuous mode [ 77.675161][ T5779] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.682404][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.689722][ T5779] bridge_slave_1: entered allmulticast mode [ 77.696701][ T5779] bridge_slave_1: entered promiscuous mode [ 77.722715][ T5781] chnl_net:caif_netlink_parms(): no params data found [ 77.785090][ T5782] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.794479][ T5780] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.805011][ T5780] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.812211][ T5780] bridge_slave_0: entered allmulticast mode [ 77.821520][ T5780] bridge_slave_0: entered promiscuous mode [ 77.831430][ T5779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.856001][ T5782] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.876092][ T5780] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.883253][ T5780] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.890690][ T5780] bridge_slave_1: entered allmulticast mode [ 77.898031][ T5780] bridge_slave_1: entered promiscuous mode [ 77.907389][ T5779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.974207][ T5782] team0: Port device team_slave_0 added [ 78.012521][ T5779] team0: Port device team_slave_0 added [ 78.021377][ T5779] team0: Port device team_slave_1 added [ 78.030478][ T5782] team0: Port device team_slave_1 added [ 78.052904][ T5780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.064436][ T5781] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.071941][ T5781] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.080478][ T5781] bridge_slave_0: entered allmulticast mode [ 78.087684][ T5781] bridge_slave_0: entered promiscuous mode [ 78.104762][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.111991][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.138114][ T5782] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.151917][ T5780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.173947][ T5781] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.181533][ T5781] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.188849][ T5781] bridge_slave_1: entered allmulticast mode [ 78.196327][ T5781] bridge_slave_1: entered promiscuous mode [ 78.211715][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.218832][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.244832][ T5782] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.277202][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.284190][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.312625][ T5779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.353217][ T5780] team0: Port device team_slave_0 added [ 78.370642][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.380111][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.407132][ T5779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.423213][ T5782] hsr_slave_0: entered promiscuous mode [ 78.430330][ T5782] hsr_slave_1: entered promiscuous mode [ 78.438919][ T5780] team0: Port device team_slave_1 added [ 78.447757][ T5781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.470316][ T5781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.523827][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.533416][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.559833][ T5780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.599558][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.606655][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.633494][ T5780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.676444][ T5779] hsr_slave_0: entered promiscuous mode [ 78.683118][ T5779] hsr_slave_1: entered promiscuous mode [ 78.689804][ T5779] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.697683][ T5779] Cannot create hsr debugfs directory [ 78.706908][ T5781] team0: Port device team_slave_0 added [ 78.763058][ T5781] team0: Port device team_slave_1 added [ 78.786373][ T5780] hsr_slave_0: entered promiscuous mode [ 78.792978][ T5780] hsr_slave_1: entered promiscuous mode [ 78.799632][ T5780] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.807235][ T5780] Cannot create hsr debugfs directory [ 78.883092][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.890352][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.916476][ T5781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.945820][ T51] Bluetooth: hci0: command tx timeout [ 78.951974][ T5788] Bluetooth: hci3: command tx timeout [ 78.969902][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.977040][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.003382][ T5781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.025478][ T5788] Bluetooth: hci1: command tx timeout [ 79.025505][ T51] Bluetooth: hci2: command tx timeout [ 79.141822][ T5781] hsr_slave_0: entered promiscuous mode [ 79.148510][ T5781] hsr_slave_1: entered promiscuous mode [ 79.154653][ T5781] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 79.163301][ T5781] Cannot create hsr debugfs directory [ 79.280486][ T5782] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.309679][ T5782] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.320432][ T5782] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.359782][ T5782] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.443480][ T5779] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 79.452891][ T5779] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 79.463724][ T5779] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 79.487447][ T5779] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 79.561812][ T5780] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 79.572195][ T5780] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 79.599319][ T5780] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 79.608942][ T5780] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 79.687816][ T5781] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 79.702038][ T5781] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 79.711305][ T5781] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 79.733332][ T5781] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 79.835919][ T5779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.892954][ T5779] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.903995][ T5782] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.922333][ T2913] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.929769][ T2913] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.959408][ T2895] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.966578][ T2895] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.987320][ T5780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.022144][ T5782] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.045942][ T5781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.064077][ T5780] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.082162][ T1129] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.089410][ T1129] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.114236][ T1129] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.121424][ T1129] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.140473][ T1129] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.147695][ T1129] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.173458][ T1129] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.180671][ T1129] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.198263][ T5781] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.227075][ T1129] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.234247][ T1129] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.263399][ T1129] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.270708][ T1129] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.673275][ T5779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.800840][ T5779] veth0_vlan: entered promiscuous mode [ 80.846265][ T5780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.863590][ T5779] veth1_vlan: entered promiscuous mode [ 80.886779][ T5782] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.950130][ T5781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.981916][ T5780] veth0_vlan: entered promiscuous mode [ 81.008105][ T5780] veth1_vlan: entered promiscuous mode [ 81.026067][ T5788] Bluetooth: hci3: command tx timeout [ 81.026348][ T51] Bluetooth: hci0: command tx timeout [ 81.056500][ T5782] veth0_vlan: entered promiscuous mode [ 81.068294][ T5779] veth0_macvtap: entered promiscuous mode [ 81.082293][ T5782] veth1_vlan: entered promiscuous mode [ 81.099166][ T5779] veth1_macvtap: entered promiscuous mode [ 81.105480][ T51] Bluetooth: hci2: command tx timeout [ 81.106538][ T5788] Bluetooth: hci1: command tx timeout [ 81.142030][ T5780] veth0_macvtap: entered promiscuous mode [ 81.181811][ T5781] veth0_vlan: entered promiscuous mode [ 81.191183][ T5780] veth1_macvtap: entered promiscuous mode [ 81.212991][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.230305][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.246697][ T5779] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.255873][ T5779] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.264668][ T5779] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.279609][ T5779] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.308301][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.321559][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.334030][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.354401][ T5781] veth1_vlan: entered promiscuous mode [ 81.373501][ T5782] veth0_macvtap: entered promiscuous mode [ 81.383543][ T5782] veth1_macvtap: entered promiscuous mode [ 81.393386][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.405074][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.418305][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.432291][ T5780] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.441378][ T5780] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.450716][ T5780] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.459608][ T5780] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.540854][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.552088][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.564068][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.574850][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.593424][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.639075][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.647700][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.654531][ T5781] veth0_macvtap: entered promiscuous mode [ 81.675471][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.686251][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.697029][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.710057][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.722864][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.758489][ T5781] veth1_macvtap: entered promiscuous mode [ 81.773993][ T5782] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.785435][ T5782] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.794368][ T5782] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.803189][ T5782] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.835027][ T1135] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.842906][ T1135] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.892983][ T1077] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.914815][ T1077] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.952916][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.967865][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.977854][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.989138][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.000875][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.011395][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.028268][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.047936][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.060781][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.072162][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.084189][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.094311][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.106065][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.117653][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.170951][ T5781] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.189954][ T5781] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.205004][ T5781] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.217293][ T5781] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.296860][ T1077] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.304734][ T1077] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.316148][ T2913] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.336803][ T2913] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.432944][ T1077] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.454586][ T1077] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.803265][ T1135] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.961056][ T1135] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.117147][ T51] Bluetooth: hci3: command tx timeout [ 83.117147][ T5788] Bluetooth: hci0: command tx timeout [ 83.185240][ T51] Bluetooth: hci2: command tx timeout [ 83.185615][ T5788] Bluetooth: hci1: command tx timeout [ 83.384159][ T2913] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.398708][ T2913] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.975949][ T5788] Bluetooth: hci3: command tx timeout [ 85.981507][ T5788] Bluetooth: hci0: command tx timeout [ 85.988540][ T5788] Bluetooth: hci2: command tx timeout [ 85.995881][ T51] Bluetooth: hci1: command tx timeout [ 86.049554][ T5858] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 86.453588][ T5858] usb 1-1: Using ep0 maxpacket: 8 [ 86.481118][ T5858] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 86.517852][ T5858] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 86.573760][ T5858] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 86.608793][ T5858] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 86.635326][ T5858] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 86.657291][ T5858] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 86.673766][ T5858] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.685504][ T787] cfg80211: failed to load regulatory.db [ 87.705493][ T5858] usb 1-1: GET_CAPABILITIES returned 0 [ 87.711289][ T5858] usbtmc 1-1:16.0: can't read capabilities [ 88.444936][ C1] sched: RT throttling activated [ 88.655522][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 89.965601][ T5786] usb 1-1: USB disconnect, device number 2 [ 91.215499][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 94.185089][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 95.156162][ T5909] syz.2.19[5909]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 98.505367][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 98.728115][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 98.751582][ T9] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice= 1.00 [ 98.761440][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.784999][ T9] usb 4-1: Product: syz [ 98.789230][ T9] usb 4-1: Manufacturer: syz [ 98.809942][ T9] usb 4-1: SerialNumber: syz [ 99.045220][ T9] snd-usb-6fire 4-1:1.0: invalid firmware version in device: e5 00 00 00. please reconnect to power. if this failure still happens, check your firmware installation. [ 99.099018][ T9] snd-usb-6fire: probe of 4-1:1.0 failed with error -22 [ 99.289220][ T9] usb 4-1: USB disconnect, device number 2 [ 100.215305][ T42] usb 3-1: new full-speed USB device number 2 using dummy_hcd [ 100.580852][ T27] audit: type=1326 audit(2000000005.180:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5939 comm="syz.0.25" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff08ef9e159 code=0x7ffc0000 [ 100.607310][ T27] audit: type=1326 audit(2000000005.190:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5939 comm="syz.0.25" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=326 compat=0 ip=0x7ff08ef9e159 code=0x7ffc0000 [ 100.645058][ T27] audit: type=1326 audit(2000000005.190:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5939 comm="syz.0.25" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff08ef9e159 code=0x7ffc0000 [ 100.677267][ T42] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 100.704440][ T42] usb 3-1: config 0 has no interface number 0 [ 100.767779][ T42] usb 3-1: config 0 interface 1 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 100.857752][ T42] usb 3-1: config 0 interface 1 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 100.876382][ T27] audit: type=1326 audit(2000000005.190:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5939 comm="syz.0.25" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ff08ef9e159 code=0x7ffc0000 [ 100.973121][ T42] usb 3-1: config 0 interface 1 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 101.448543][ T42] usb 3-1: config 0 interface 1 has no altsetting 0 [ 101.450285][ T27] audit: type=1326 audit(2000000005.190:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5939 comm="syz.0.25" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff08ef9e159 code=0x7ffc0000 [ 101.462977][ T42] usb 3-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 101.735904][ T27] audit: type=1326 audit(2000000005.190:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5939 comm="syz.0.25" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7ff08ef5e98e code=0x7ffc0000 [ 101.769594][ T42] usb 3-1: New USB device strings: Mfr=93, Product=0, SerialNumber=0 [ 101.779526][ T42] usb 3-1: Manufacturer: syz [ 101.791397][ T42] usb 3-1: config 0 descriptor?? [ 101.799900][ T27] audit: type=1326 audit(2000000005.200:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5939 comm="syz.0.25" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7ff08ef5e98e code=0x7ffc0000 [ 102.252350][ T27] audit: type=1326 audit(2000000005.200:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5939 comm="syz.0.25" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7ff08ef5e98e code=0x7ffc0000 [ 102.665130][ T27] audit: type=1326 audit(2000000005.200:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5939 comm="syz.0.25" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff08ef9e159 code=0x7ffc0000 [ 102.667877][ T42] usbhid 3-1:0.1: can't add hid device: -71 [ 102.763199][ T42] usbhid: probe of 3-1:0.1 failed with error -71 [ 102.774320][ T42] usb 3-1: USB disconnect, device number 2 [ 102.790915][ T27] audit: type=1326 audit(2000000005.200:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5939 comm="syz.0.25" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7ff08ef9e159 code=0x7ffc0000 [ 104.015522][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 104.245107][ T5840] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 104.484685][ T5840] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 104.537365][ T5840] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 105.046483][ T5960] sctp: failed to load transform for md5: -2 [ 105.171181][ T5840] usb 2-1: config 0 interface 0 has no altsetting 0 [ 105.178008][ T5840] usb 2-1: New USB device found, idVendor=17ef, idProduct=60ee, bcdDevice= 0.00 [ 105.187340][ T5840] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.206535][ T5840] usb 2-1: config 0 descriptor?? [ 105.242690][ T5950] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 105.775608][ T5840] lenovo 0003:17EF:60EE.0001: ignoring exceeding usage max [ 105.833111][ T5840] lenovo 0003:17EF:60EE.0001: No inputs registered, leaving [ 105.871894][ T5840] lenovo 0003:17EF:60EE.0001: hidraw0: USB HID v0.11 Joystick [HID 17ef:60ee] on usb-dummy_hcd.1-1/input0 [ 105.916534][ T5840] usb 2-1: USB disconnect, device number 2 [ 106.142339][ T5973] fido_id[5973]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 107.147271][ T27] kauditd_printk_skb: 6 callbacks suppressed [ 107.147306][ T27] audit: type=1326 audit(2000000010.960:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5974 comm="syz.0.35" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff08ef9e159 code=0x7ffc0000 [ 107.314206][ T27] audit: type=1326 audit(2000000010.960:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5974 comm="syz.0.35" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ff08ef9e159 code=0x7ffc0000 [ 107.376515][ T27] audit: type=1326 audit(2000000010.970:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5974 comm="syz.0.35" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff08ef9e159 code=0x7ffc0000 [ 107.419431][ T27] audit: type=1326 audit(2000000010.970:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5974 comm="syz.0.35" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ff08ef9e159 code=0x7ffc0000 [ 108.366031][ T27] audit: type=1326 audit(2000000010.970:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5974 comm="syz.0.35" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff08ef9e159 code=0x7ffc0000 [ 108.414296][ T27] audit: type=1326 audit(2000000010.970:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5974 comm="syz.0.35" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7ff08ef5e98e code=0x7ffc0000 [ 108.505519][ T27] audit: type=1326 audit(2000000010.970:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5974 comm="syz.0.35" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7ff08ef5e98e code=0x7ffc0000 [ 108.550219][ T27] audit: type=1326 audit(2000000010.970:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5974 comm="syz.0.35" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7ff08ef5e98e code=0x7ffc0000 [ 108.595066][ T27] audit: type=1326 audit(2000000010.970:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5974 comm="syz.0.35" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff08ef9e159 code=0x7ffc0000 [ 108.660049][ T27] audit: type=1326 audit(2000000010.980:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5974 comm="syz.0.35" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7ff08ef9e159 code=0x7ffc0000 [ 108.775047][ T787] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 110.177001][ T787] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 110.206813][ T787] usb 4-1: config 0 has no interface number 0 [ 110.212986][ T787] usb 4-1: config 0 interface 1 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 110.255064][ T787] usb 4-1: config 0 interface 1 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 110.284499][ T787] usb 4-1: config 0 interface 1 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 110.325256][ T787] usb 4-1: config 0 interface 1 has no altsetting 0 [ 110.348915][ T787] usb 4-1: New USB device found, idVendor=145f, idProduct=0212, bcdDevice= 0.00 [ 110.362032][ T787] usb 4-1: New USB device strings: Mfr=93, Product=0, SerialNumber=0 [ 110.408804][ T787] usb 4-1: Manufacturer: syz [ 110.458887][ T787] usb 4-1: config 0 descriptor?? [ 110.945052][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 111.495039][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 111.552511][ T787] uclogic 0003:145F:0212.0002: pen parameters not found [ 111.575120][ T787] uclogic 0003:145F:0212.0002: interface is invalid, ignoring [ 111.613502][ T787] usb 4-1: USB disconnect, device number 3 [ 112.105116][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 114.665104][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 116.275402][ T969] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 116.472150][ T969] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 116.694717][ T969] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice= 1.00 [ 116.715011][ T969] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 116.723081][ T969] usb 2-1: Product: syz [ 116.727354][ T969] usb 2-1: Manufacturer: syz [ 116.732062][ T969] usb 2-1: SerialNumber: syz [ 116.820363][ T27] kauditd_printk_skb: 6 callbacks suppressed [ 116.820396][ T27] audit: type=1326 audit(2000000021.430:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6040 comm="syz.2.45" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f69e5f9e159 code=0x7ffc0000 [ 117.058720][ T27] audit: type=1326 audit(2000000021.430:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6040 comm="syz.2.45" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f69e5f9e159 code=0x7ffc0000 [ 117.349179][ T27] audit: type=1326 audit(2000000021.430:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6040 comm="syz.2.45" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f69e5f9e159 code=0x7ffc0000 [ 117.450242][ T27] audit: type=1326 audit(2000000021.430:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6040 comm="syz.2.45" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f69e5f9e159 code=0x7ffc0000 [ 117.475800][ T27] audit: type=1326 audit(2000000021.430:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6040 comm="syz.2.45" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f69e5f9e159 code=0x7ffc0000 [ 117.500413][ T27] audit: type=1326 audit(2000000021.440:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6040 comm="syz.2.45" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f69e5f5e98e code=0x7ffc0000 [ 117.544792][ T27] audit: type=1326 audit(2000000021.440:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6040 comm="syz.2.45" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f69e5f5e98e code=0x7ffc0000 [ 117.595266][ T27] audit: type=1326 audit(2000000021.440:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6040 comm="syz.2.45" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f69e5f5e98e code=0x7ffc0000 [ 117.624901][ T27] audit: type=1326 audit(2000000021.440:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6040 comm="syz.2.45" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f69e5f9e159 code=0x7ffc0000 [ 117.633455][ T969] snd-usb-6fire 2-1:1.0: invalid firmware version in device: e5 00 00 00. please reconnect to power. if this failure still happens, check your firmware installation. [ 117.683623][ T27] audit: type=1326 audit(2000000021.440:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6040 comm="syz.2.45" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f69e5f9e159 code=0x7ffc0000 [ 117.697046][ T969] snd-usb-6fire: probe of 2-1:1.0 failed with error -22 [ 118.011928][ T9] usb 2-1: USB disconnect, device number 3 [ 120.115662][ T6069] netlink: 8 bytes leftover after parsing attributes in process `syz.2.58'. [ 120.169777][ T6069] netlink: 12 bytes leftover after parsing attributes in process `syz.2.58'. [ 120.211749][ T6069] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 120.220965][ T6069] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 120.229785][ T6069] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 120.238910][ T6069] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 121.090425][ T6069] Zero length message leads to an empty skb [ 124.235323][ T5839] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 124.449978][ T5839] usb 3-1: Using ep0 maxpacket: 32 [ 124.464610][ T5839] usb 3-1: unable to get BOS descriptor or descriptor too short [ 124.510711][ T5839] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 124.557465][ T5839] usb 3-1: New USB device found, idVendor=0582, idProduct=008d, bcdDevice= 0.40 [ 124.594756][ T5839] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.180617][ T5839] usb 3-1: Product: syz [ 125.184855][ T5839] usb 3-1: Manufacturer: syz [ 125.205164][ T5839] usb 3-1: SerialNumber: syz [ 125.709437][ T5839] snd-ua101 3-1:1.1: sample format descriptor not found [ 125.726020][ T5839] snd-ua101 3-1:1.0: invalid num_altsetting [ 125.766576][ T5839] usb 3-1: USB disconnect, device number 3 [ 126.708992][ T6120] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 127.465168][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 133.045169][ T6160] 9pnet_fd: p9_fd_create_unix (6160): problem connecting socket: ./file0: -2 [ 133.146072][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.165247][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.403275][ T6158] sctp: failed to load transform for md5: -2 [ 135.145075][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 146.181624][ T6252] sctp: failed to load transform for md5: -2 [ 148.293984][ T6277] Bluetooth: MGMT ver 1.22 [ 150.348128][ T5788] Bluetooth: hci0: Opcode 0x0c3a failed: -110 [ 150.362303][ T6300] [ 150.364692][ T6300] ====================================================== [ 150.371741][ T6300] WARNING: possible circular locking dependency detected [ 150.378890][ T6300] syzkaller #0 Not tainted [ 150.383328][ T6300] ------------------------------------------------------ [ 150.390370][ T6300] syz.1.122/6300 is trying to acquire lock: [ 150.396287][ T6300] ffff8881488dc670 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: configfs_depend_item_unlocked+0x157/0x430 [ 150.407849][ T6300] [ 150.407849][ T6300] but task is already holding lock: [ 150.415265][ T6300] ffffffff8de55e88 (tpg_instances_lock){+.+.}-{3:3}, at: usbg_make_tpg+0xf9/0x550 [ 150.424545][ T6300] [ 150.424545][ T6300] which lock already depends on the new lock. [ 150.424545][ T6300] [ 150.435107][ T6300] [ 150.435107][ T6300] the existing dependency chain (in reverse order) is: [ 150.444146][ T6300] [ 150.444146][ T6300] -> #2 (tpg_instances_lock){+.+.}-{3:3}: [ 150.447360][ T6306] sctp: failed to load transform for md5: -2 [ 150.452066][ T6300] __mutex_lock+0x135/0xc80 [ 150.463166][ T6300] tcm_alloc+0x21/0x2d0 [ 150.467861][ T6300] usb_get_function+0x5d/0xb0 [ 150.473078][ T6300] config_usb_cfg_link+0x148/0x250 [ 150.478729][ T6300] configfs_symlink+0x5a5/0xfe0 [ 150.484149][ T6300] vfs_symlink+0x138/0x2b0 [ 150.489092][ T6300] do_symlinkat+0x1ba/0x400 [ 150.494121][ T6300] __x64_sys_symlinkat+0x99/0xb0 [ 150.499578][ T6300] do_syscall_64+0x55/0xb0 [ 150.504580][ T6300] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 150.511026][ T6300] [ 150.511026][ T6300] -> #1 (&gi->lock){+.+.}-{3:3}: [ 150.518151][ T6300] __mutex_lock+0x135/0xc80 [ 150.523200][ T6300] config_usb_cfg_link+0x59/0x250 [ 150.528779][ T6300] configfs_symlink+0x5a5/0xfe0 [ 150.534201][ T6300] vfs_symlink+0x138/0x2b0 [ 150.539136][ T6300] do_symlinkat+0x1ba/0x400 [ 150.544165][ T6300] __x64_sys_symlinkat+0x99/0xb0 [ 150.549627][ T6300] do_syscall_64+0x55/0xb0 [ 150.554566][ T6300] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 150.560983][ T6300] [ 150.560983][ T6300] -> #0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}: [ 150.569763][ T6300] __lock_acquire+0x37ef/0x7d80 [ 150.575166][ T6300] lock_acquire+0x19e/0x420 [ 150.580202][ T6300] down_write+0x97/0x200 [ 150.584975][ T6300] configfs_depend_item_unlocked+0x157/0x430 [ 150.591483][ T6300] usbg_make_tpg+0x1e1/0x550 [ 150.596610][ T6300] target_fabric_make_tpg+0xa4/0x6d0 [ 150.602549][ T6300] configfs_mkdir+0x515/0x9e0 [ 150.607764][ T6300] vfs_mkdir+0x2a5/0x470 [ 150.612533][ T6300] do_mkdirat+0x1dc/0x450 [ 150.617387][ T6300] __x64_sys_mkdirat+0x89/0xa0 [ 150.622674][ T6300] do_syscall_64+0x55/0xb0 [ 150.627703][ T6300] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 150.634136][ T6300] [ 150.634136][ T6300] other info that might help us debug this: [ 150.634136][ T6300] [ 150.644362][ T6300] Chain exists of: [ 150.644362][ T6300] &sb->s_type->i_mutex_key#20 --> &gi->lock --> tpg_instances_lock [ 150.644362][ T6300] [ 150.658280][ T6300] Possible unsafe locking scenario: [ 150.658280][ T6300] [ 150.665724][ T6300] CPU0 CPU1 [ 150.671271][ T6300] ---- ---- [ 150.676627][ T6300] lock(tpg_instances_lock); [ 150.681309][ T6300] lock(&gi->lock); [ 150.687719][ T6300] lock(tpg_instances_lock); [ 150.694911][ T6300] lock(&sb->s_type->i_mutex_key#20); [ 150.700418][ T6300] [ 150.700418][ T6300] *** DEADLOCK *** [ 150.700418][ T6300] [ 150.708747][ T6300] 4 locks held by syz.1.122/6300: [ 150.713798][ T6300] #0: ffff8881422f0418 (sb_writers#14){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 150.723499][ T6300] #1: ffff88805d3d15a0 (&sb->s_type->i_mutex_key#7/1){+.+.}-{3:3}, at: filename_create+0x20f/0x450 [ 150.734336][ T6300] #2: ffffffff8db2bdb0 (&subsys->su_mutex){+.+.}-{3:3}, at: configfs_mkdir+0x4b9/0x9e0 [ 150.744094][ T6300] #3: ffffffff8de55e88 (tpg_instances_lock){+.+.}-{3:3}, at: usbg_make_tpg+0xf9/0x550 [ 150.753774][ T6300] [ 150.753774][ T6300] stack backtrace: [ 150.759781][ T6300] CPU: 1 PID: 6300 Comm: syz.1.122 Not tainted syzkaller #0 [ 150.768122][ T6300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 150.778205][ T6300] Call Trace: [ 150.781490][ T6300] [ 150.784424][ T6300] dump_stack_lvl+0x18c/0x250 [ 150.789108][ T6300] ? load_image+0x420/0x420 [ 150.793613][ T6300] ? show_regs_print_info+0x20/0x20 [ 150.798833][ T6300] ? print_circular_bug+0x12b/0x1a0 [ 150.804041][ T6300] check_noncircular+0x2fc/0x400 [ 150.808994][ T6300] ? look_up_lock_class+0x75/0x140 [ 150.814107][ T6300] ? print_deadlock_bug+0x5d0/0x5d0 [ 150.819363][ T6300] ? lockdep_lock+0xf5/0x230 [ 150.823961][ T6300] ? __lock_acquire+0x357f/0x7d80 [ 150.828988][ T6300] ? _find_first_zero_bit+0xd6/0x100 [ 150.834368][ T6300] __lock_acquire+0x37ef/0x7d80 [ 150.839266][ T6300] ? is_bpf_text_address+0x28f/0x2a0 [ 150.844552][ T6300] ? verify_lock_unused+0x140/0x140 [ 150.849787][ T6300] lock_acquire+0x19e/0x420 [ 150.854294][ T6300] ? configfs_depend_item_unlocked+0x157/0x430 [ 150.861007][ T6300] ? trace_raw_output_contention_end+0xd0/0xd0 [ 150.867167][ T6300] ? __might_sleep+0xe0/0xe0 [ 150.871852][ T6300] ? rcu_is_watching+0x15/0xb0 [ 150.876626][ T6300] ? read_lock_is_recursive+0x20/0x20 [ 150.882173][ T6300] ? trace_contention_end+0x39/0xe0 [ 150.887377][ T6300] ? __mutex_lock+0x30d/0xc80 [ 150.892052][ T6300] ? do_syscall_64+0x55/0xb0 [ 150.896649][ T6300] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 150.902724][ T6300] down_write+0x97/0x200 [ 150.906965][ T6300] ? configfs_depend_item_unlocked+0x157/0x430 [ 150.913121][ T6300] ? down_read_killable+0x340/0x340 [ 150.918346][ T6300] configfs_depend_item_unlocked+0x157/0x430 [ 150.924344][ T6300] usbg_make_tpg+0x1e1/0x550 [ 150.929067][ T6300] ? snprintf+0xe9/0x140 [ 150.933316][ T6300] ? configfs_mkdir+0x4b9/0x9e0 [ 150.938168][ T6300] ? usbg_drop_tport+0x20/0x20 [ 150.942940][ T6300] ? vscnprintf+0x80/0x80 [ 150.947443][ T6300] target_fabric_make_tpg+0xa4/0x6d0 [ 150.952744][ T6300] ? target_fabric_release_wwn+0xb0/0xb0 [ 150.958640][ T6300] configfs_mkdir+0x515/0x9e0 [ 150.963346][ T6300] vfs_mkdir+0x2a5/0x470 [ 150.967770][ T6300] do_mkdirat+0x1dc/0x450 [ 150.972101][ T6300] ? vfs_mkdir+0x470/0x470 [ 150.976607][ T6300] __x64_sys_mkdirat+0x89/0xa0 [ 150.981664][ T6300] do_syscall_64+0x55/0xb0 [ 150.986101][ T6300] ? clear_bhb_loop+0x40/0x90 [ 150.990788][ T6300] ? clear_bhb_loop+0x40/0x90 [ 150.995471][ T6300] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 151.001400][ T6300] RIP: 0033:0x7fb6f119e159 [ 151.005914][ T6300] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 151.025701][ T6300] RSP: 002b:00007fb6f214f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 151.034141][ T6300] RAX: ffffffffffffffda RBX: 00007fb6f1425fa0 RCX: 00007fb6f119e159 [ 151.042132][ T6300] RDX: 00000000000001ff RSI: 0000200000000380 RDI: ffffffffffffff9c [ 151.050161][ T6300] RBP: 00007fb6f123506b R08: 0000000000000000 R09: 0000000000000000 [ 151.058175][ T6300] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 151.066162][ T6300] R13: 00007fb6f1426038 R14: 00007fb6f1425fa0 R15: 00007ffc4c644e78 [ 151.074269][ T6300] [ 151.155593][ T27] kauditd_printk_skb: 7 callbacks suppressed [ 151.155608][ T27] audit: type=1326 audit(2000000055.710:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6302 comm="syz.2.123" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f69e5f9e159 code=0x7ffc0000 [ 151.186355][ T5788] Bluetooth: hci0: command 0x0c3a tx timeout [ 151.232419][ T27] audit: type=1326 audit(2000000055.710:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6302 comm="syz.2.123" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f69e5f9e159 code=0x7ffc0000