last executing test programs: 1m1.702065932s ago: executing program 0 (id=405): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r3, @ANYBLOB="00000000000000002400128009000100626f6e64000000001400028008000000000000000800090001"], 0x44}}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) r5 = socket(0x11, 0x80a, 0x1) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r6, 0x40, 0x1040}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x4}]}}}]}, 0x3c}}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000380)={@multicast, @remote, @val={@void, {0x8100, 0x0, 0x0, 0x3}}, {@arp={0x806, @ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x8, @multicast, @dev={0xfe, 0x80, '\x00', 0xc}, @remote, @empty}}}}, 0x0) 48.59709251s ago: executing program 1 (id=406): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0xf0, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@local, @in6=@mcast1, 0x1, 0x4, 0x4e23, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in=@loopback, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0x83}, {0xfffffffffffffffc, 0x7fff, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x0, 0x2, 0x0, 0xfd, 0x20}}, 0xf0}, 0x1, 0x0, 0x0, 0xc801}, 0x10) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000007c0)=ANY=[@ANYBLOB="a0000000290001000000000004000000fc000000000000000000000000000001fc0200000000000000000000000000ff00000005000000020a000000ff000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="bf6b6e0000000000500000005080000000000000000000417d00000009c51400320400000476c7dab9887c5f"], 0xa0}}, 0x0) 47.038298095s ago: executing program 0 (id=407): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000100)=ANY=[@ANYBLOB="f0000000120021002dbd7000fcdbdf2561656769733132386c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000002c000000000000000000000800010004000000050001"], 0xf0}}, 0x0) 42.056185059s ago: executing program 1 (id=408): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x1}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x1001}, @flat=@binder={0x73622a85, 0x1001}, @flat=@handle={0x73682a85, 0x110b, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 37.192992373s ago: executing program 0 (id=409): madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x67) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32, @ANYBLOB="00000000000000002400128009000100626f6e64000000001400028008000000000000000800090001"], 0x44}}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) r4 = socket(0x11, 0x80a, 0x1) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x40, 0x1040}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x4}]}}}]}, 0x3c}}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000380)={@multicast, @remote, @val={@void, {0x8100, 0x0, 0x0, 0x3}}, {@arp={0x806, @ether_ipv6={0x1, 0x86dd, 0x6, 0x10, 0x8, @multicast, @dev={0xfe, 0x80, '\x00', 0xc}, @remote, @empty}}}}, 0x0) 31.791595729s ago: executing program 1 (id=410): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r4 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000240)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x7, 0xfff2}, {0xa, 0xffff}, {0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_skbmod={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0xd8, 0xd782, 0x2, 0x704, 0x4}, 0x10}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4008040}, 0x4000000) write$tun(r1, &(0x7f0000000300)={@void, @void, @arp=@ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x8, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x27}, @broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x36}, @private=0xa010101}}, 0x1c) 26.800070873s ago: executing program 0 (id=411): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x402, 0x0) write(r0, &(0x7f0000000500)='dum', 0x3) 13.455070611s ago: executing program 0 (id=412): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0xf0, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@local, @in6=@mcast1, 0x1, 0x4, 0x4e23, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0xee00}, {@in=@loopback, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0x83}, {0xfffffffffffffffc, 0x7fff, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x0, 0x2, 0x0, 0xfd, 0x20}}, 0xf0}, 0x1, 0x0, 0x0, 0xc801}, 0x10) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000007c0)=ANY=[@ANYBLOB="a0000000290001000000000004000000fc000000000000000000000000000001fc0200000000000000000000000000ff00000005000000020a000000ff000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="bf6b6e0000000000500000005080000000000000000000417d00000009c51400320400000476c7dab9887c5f"], 0xa0}}, 0x0) 13.370731182s ago: executing program 1 (id=413): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, 0x0) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000180)={0xd2, @time={0x300}}) 6.378750942s ago: executing program 1 (id=414): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x1}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x1001}, @flat=@binder={0x73622a85, 0x1001}, @flat=@handle={0x73682a85, 0x110b, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 4.751156297s ago: executing program 0 (id=415): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000240), 0x0) write(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r1, 0x0, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(0x0, 0xffffffffffffff9c, &(0x7f00000004c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0/virtual_scsi_port\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/enable\x00', 0x1, 0x0) write(r2, &(0x7f0000000540)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') 0s ago: executing program 1 (id=416): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x402, 0x0) write(r0, &(0x7f0000000500)='dum', 0x3) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:12186' (ED25519) to the list of known hosts. syzkaller login: [ 546.744208][ T3216] cgroup: Unknown subsys name 'net' [ 547.641652][ T3216] cgroup: Unknown subsys name 'cpuset' [ 547.770419][ T3216] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 622.947572][ T3216] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 791.807786][ T3223] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 792.058961][ T3223] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 795.760156][ T3225] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 795.958830][ T3225] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 814.458714][ T3223] hsr_slave_0: entered promiscuous mode [ 814.491307][ T3223] hsr_slave_1: entered promiscuous mode [ 817.504858][ T3225] hsr_slave_0: entered promiscuous mode [ 817.547216][ T3225] hsr_slave_1: entered promiscuous mode [ 817.572220][ T3225] debugfs: 'hsr0' already exists in 'hsr' [ 817.576066][ T3225] Cannot create hsr debugfs directory [ 827.228310][ T3223] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 827.515801][ T3223] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 827.637476][ T3223] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 827.780815][ T3223] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 827.848994][ T3223] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 827.966479][ T3223] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 828.010284][ T3223] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 828.238101][ T3223] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 832.749942][ T3225] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 832.884661][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 833.000992][ T3225] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 833.181233][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 833.460248][ T3225] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 833.830620][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 833.906444][ T3225] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 833.999449][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 846.111872][ T3223] 8021q: adding VLAN 0 to HW filter on device bond0 [ 850.668072][ T3225] 8021q: adding VLAN 0 to HW filter on device bond0 [ 920.747162][ T3223] veth0_vlan: entered promiscuous mode [ 921.408529][ T3223] veth1_vlan: entered promiscuous mode [ 924.338625][ T3223] veth0_macvtap: entered promiscuous mode [ 925.128086][ T3223] veth1_macvtap: entered promiscuous mode [ 928.150260][ T3225] veth0_vlan: entered promiscuous mode [ 930.789995][ T1345] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 931.071397][ T3635] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 931.188422][ T1372] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 931.485553][ T3635] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 931.757733][ T3225] veth1_vlan: entered promiscuous mode [ 938.276885][ T3225] veth0_macvtap: entered promiscuous mode [ 938.461938][ T3225] veth1_macvtap: entered promiscuous mode [ 939.962136][ T3223] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 940.690807][ T3635] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.489810][ T3635] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.646689][ T3397] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.655248][ T3397] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 955.655960][ T3842] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1'. [ 956.026694][ T3842] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1'. [ 969.828505][ T3855] process 'syz.1.5' launched '/dev/fd/5' with NULL argv: empty string added [ 1030.648162][ T3929] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17'. [ 1042.330303][ T3935] syzkaller1: entered promiscuous mode [ 1042.339548][ T3935] syzkaller1: entered allmulticast mode [ 1054.465369][ T3945] netlink: 12 bytes leftover after parsing attributes in process `syz.1.24'. [ 1078.079634][ T3966] comedi: valid board names for 8255 driver are: [ 1078.080186][ T3966] 8255 [ 1078.080473][ T3966] comedi: valid board names for vmk80xx driver are: [ 1078.080718][ T3966] vmk80xx [ 1078.080929][ T3966] comedi: valid board names for usbduxsigma driver are: [ 1078.081250][ T3966] usbduxsigma [ 1078.081448][ T3966] comedi: valid board names for usbduxfast driver are: [ 1078.081703][ T3966] usbduxfast [ 1078.081942][ T3966] comedi: valid board names for usbdux driver are: [ 1078.082241][ T3966] usbdux [ 1078.092237][ T3966] comedi: valid board names for ni6501 driver are: [ 1078.093977][ T3966] ni6501 [ 1078.094253][ T3966] comedi: valid board names for dt9812 driver are: [ 1078.094482][ T3966] dt9812 [ 1078.094679][ T3966] comedi: valid board names for ni_labpc_cs driver are: [ 1078.094933][ T3966] ni_labpc_cs [ 1078.095145][ T3966] comedi: valid board names for ni_daq_700 driver are: [ 1078.095369][ T3966] ni_daq_700 [ 1078.095548][ T3966] comedi: valid board names for labpc_pci driver are: [ 1078.095758][ T3966] labpc_pci [ 1078.095939][ T3966] comedi: valid board names for adl_pci9118 driver are: [ 1078.096200][ T3966] pci9118dg [ 1078.096429][ T3966] pci9118hg [ 1078.096635][ T3966] pci9118hr [ 1078.096810][ T3966] comedi: valid board names for 8255_pci driver are: [ 1078.097002][ T3966] 8255_pci [ 1078.097217][ T3966] comedi: valid board names for comedi_parport driver are: [ 1078.097416][ T3966] comedi_parport [ 1078.097587][ T3966] comedi: valid board names for comedi_test driver are: [ 1078.097788][ T3966] comedi_test [ 1078.097989][ T3966] comedi: valid board names for comedi_bond driver are: [ 1078.098190][ T3966] comedi_bond [ 1087.887276][ T3968] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1104.379045][ T3983] RDS: rds_bind could not find a transport for fe80::aa, load rds_tcp or rds_rdma? [ 1127.730336][ T4000] Zero length message leads to an empty skb [ 1188.890412][ T4053] capability: warning: `syz.0.67' uses 32-bit capabilities (legacy support in use) [ 1219.800722][ T4083] Could not find key with description: [syz ] [ 1219.801580][ T4083] process_request_key_err: No key [ 1219.802090][ T4083] Could not find valid key in user session keyring for sig specified in mount option: [syz ] [ 1219.826917][ T4083] One or more global auth toks could not properly register; rc = [-2] [ 1219.830369][ T4083] Error validating options; rc = [-2] [ 1236.436121][ T9] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 1236.899737][ T9] usb 1-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 1237.024644][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1237.041088][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 1237.042056][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1237.059459][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1237.517875][ T9] usb 1-1: config 0 descriptor?? [ 1237.807366][ T4089] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1241.850192][ T9] gt683r_led 0003:1770:FF00.0001: hidraw0: USB HID v0.00 Device [HID 1770:ff00] on usb-dummy_hcd.0-1/input0 [ 1243.247710][ T9] usb 1-1: USB disconnect, device number 2 [ 1247.071212][ T10] gt683r_led 0003:1770:FF00.0001: failed to send set report request: -19 [ 1271.654816][ T4139] FAULT_INJECTION: forcing a failure. [ 1271.654816][ T4139] name fail_futex, interval 1, probability 0, space 0, times 1 [ 1271.658777][ T4139] CPU: 0 UID: 0 PID: 4139 Comm: syz.0.87 Not tainted syzkaller #0 PREEMPT [ 1271.659360][ T4139] Hardware name: riscv-virtio,qemu (DT) [ 1271.659793][ T4139] Call Trace: [ 1271.660137][ T4139] [] dump_backtrace+0x2e/0x3c [ 1271.661984][ T4139] [] show_stack+0x30/0x3c [ 1271.662554][ T4139] [] dump_stack_lvl+0x114/0x1aa [ 1271.663113][ T4139] [] dump_stack+0x1c/0x24 [ 1271.663616][ T4139] [] should_fail_ex+0x5ac/0x5b6 [ 1271.664335][ T4139] [] should_fail+0xe/0x16 [ 1271.664939][ T4139] [] get_futex_key+0x532/0x17aa [ 1271.665667][ T4139] [] futex_wake+0xe8/0x6fc [ 1271.666320][ T4139] [] do_futex+0x204/0x338 [ 1271.666774][ T4139] [] mm_exit_exec_release+0x39c/0x5f6 [ 1271.667188][ T4139] [] do_exit+0x6f2/0x297c [ 1271.667647][ T4139] [] do_group_exit+0xca/0x258 [ 1271.668153][ T4139] [] get_signal+0x1f58/0x2224 [ 1271.668511][ T4139] [] arch_do_signal_or_restart+0xc70/0x1df6 [ 1271.668969][ T4139] [] exit_to_user_mode_loop+0x92/0xce8 [ 1271.669471][ T4139] [] do_trap_ecall_u+0x52c/0x658 [ 1271.669909][ T4139] [] handle_exception+0x168/0x174 [ 1279.155144][ T4144] fuse: Bad value for 'group_id' [ 1279.155610][ T4144] fuse: Bad value for 'group_id' [ 1291.590222][ T4153] 8021q: adding VLAN 0 to HW filter on device macsec0 [ 1301.395082][ T4160] FAULT_INJECTION: forcing a failure. [ 1301.395082][ T4160] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1301.406574][ T4160] CPU: 0 UID: 0 PID: 4160 Comm: syz.0.93 Not tainted syzkaller #0 PREEMPT [ 1301.407083][ T4160] Hardware name: riscv-virtio,qemu (DT) [ 1301.407244][ T4160] Call Trace: [ 1301.407389][ T4160] [] dump_backtrace+0x2e/0x3c [ 1301.407933][ T4160] [] show_stack+0x30/0x3c [ 1301.408276][ T4160] [] dump_stack_lvl+0x114/0x1aa [ 1301.408594][ T4160] [] dump_stack+0x1c/0x24 [ 1301.408894][ T4160] [] should_fail_ex+0x5ac/0x5b6 [ 1301.409360][ T4160] [] should_fail+0xe/0x16 [ 1301.409726][ T4160] [] get_futex_key+0x118c/0x17aa [ 1301.410153][ T4160] [] futex_wake+0xe8/0x6fc [ 1301.410575][ T4160] [] do_futex+0x204/0x338 [ 1301.410975][ T4160] [] mm_exit_exec_release+0x39c/0x5f6 [ 1301.411343][ T4160] [] do_exit+0x6f2/0x297c [ 1301.411767][ T4160] [] do_group_exit+0xca/0x258 [ 1301.412210][ T4160] [] get_signal+0x1f58/0x2224 [ 1301.412573][ T4160] [] arch_do_signal_or_restart+0xc70/0x1df6 [ 1301.412973][ T4160] [] exit_to_user_mode_loop+0x92/0xce8 [ 1301.413495][ T4160] [] do_trap_ecall_u+0x52c/0x658 [ 1301.413881][ T4160] [] handle_exception+0x168/0x174 [ 1316.821578][ T4174] fuse: Bad value for 'group_id' [ 1316.822319][ T4174] fuse: Bad value for 'group_id' [ 1333.121091][ T4186] FAULT_INJECTION: forcing a failure. [ 1333.121091][ T4186] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1333.121753][ T4186] CPU: 0 UID: 0 PID: 4186 Comm: syz.0.99 Not tainted syzkaller #0 PREEMPT [ 1333.122189][ T4186] Hardware name: riscv-virtio,qemu (DT) [ 1333.122343][ T4186] Call Trace: [ 1333.122489][ T4186] [] dump_backtrace+0x2e/0x3c [ 1333.122998][ T4186] [] show_stack+0x30/0x3c [ 1333.123447][ T4186] [] dump_stack_lvl+0x114/0x1aa [ 1333.123872][ T4186] [] dump_stack+0x1c/0x24 [ 1333.124250][ T4186] [] should_fail_ex+0x5ac/0x5b6 [ 1333.124666][ T4186] [] should_fail+0xe/0x16 [ 1333.125088][ T4186] [] get_futex_key+0x532/0x17aa [ 1333.125568][ T4186] [] futex_wake+0xe8/0x6fc [ 1333.126029][ T4186] [] do_futex+0x204/0x338 [ 1333.126570][ T4186] [] mm_exit_exec_release+0x39c/0x5f6 [ 1333.127016][ T4186] [] do_exit+0x6f2/0x297c [ 1333.127503][ T4186] [] do_group_exit+0xca/0x258 [ 1333.127965][ T4186] [] get_signal+0x1f58/0x2224 [ 1333.128310][ T4186] [] arch_do_signal_or_restart+0xc70/0x1df6 [ 1333.128721][ T4186] [] exit_to_user_mode_loop+0x92/0xce8 [ 1333.129264][ T4186] [] do_trap_ecall_u+0x52c/0x658 [ 1333.129658][ T4186] [] handle_exception+0x168/0x174 [ 1361.528646][ T3397] bond0: (slave bond_slave_0): interface is now down [ 1361.529733][ T3397] bond0: (slave bond_slave_1): interface is now down [ 1361.550775][ T3397] bond0: (slave bond_slave_0): interface is now down [ 1361.551249][ T3397] bond0: (slave bond_slave_1): interface is now down [ 1361.565219][ T3397] bond0: (slave bond_slave_0): interface is now down [ 1361.565722][ T3397] bond0: (slave bond_slave_1): interface is now down [ 1361.595642][ T3397] bond0: (slave bond_slave_0): interface is now down [ 1361.596080][ T3397] bond0: (slave bond_slave_1): interface is now down [ 1361.621705][ T3397] bond0: (slave bond_slave_0): interface is now down [ 1361.622165][ T3397] bond0: (slave bond_slave_1): interface is now down [ 1361.649770][ T3349] bond0: (slave bond_slave_0): interface is now down [ 1361.650276][ T3349] bond0: (slave bond_slave_1): interface is now down [ 1361.664996][ T3349] bond0: (slave bond_slave_0): interface is now down [ 1361.665953][ T3349] bond0: (slave bond_slave_1): interface is now down [ 1361.734927][ T3349] bond0: (slave bond_slave_0): interface is now down [ 1361.735497][ T3349] bond0: (slave bond_slave_1): interface is now down [ 1361.771877][ T3349] bond0: (slave bond_slave_0): interface is now down [ 1361.772406][ T3349] bond0: (slave bond_slave_1): interface is now down [ 1361.815915][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1361.816730][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1361.854893][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1361.855437][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1361.875296][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1361.875807][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1361.899750][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1361.900265][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1361.929735][ T4200] bond0: (slave bond_slave_0): interface is now down [ 1361.930240][ T4200] bond0: (slave bond_slave_1): interface is now down [ 1361.971621][ T4200] bond0: (slave bond_slave_0): interface is now down [ 1361.972098][ T4200] bond0: (slave bond_slave_1): interface is now down [ 1361.989088][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1361.989682][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1362.010245][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1362.010799][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1362.030895][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1362.031380][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1362.071295][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1362.071725][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1362.084695][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1362.085188][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1362.106953][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1362.107443][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1362.135108][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1362.135558][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1362.156276][ T4200] bond0: (slave bond_slave_0): interface is now down [ 1362.156743][ T4200] bond0: (slave bond_slave_1): interface is now down [ 1362.189768][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1362.190279][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1362.205034][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1362.205548][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1362.227203][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1362.227728][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1362.297427][ T4200] bond0: (slave bond_slave_0): interface is now down [ 1362.297898][ T4200] bond0: (slave bond_slave_1): interface is now down [ 1362.320476][ T4200] bond0: (slave bond_slave_0): interface is now down [ 1362.320955][ T4200] bond0: (slave bond_slave_1): interface is now down [ 1362.362200][ T4200] bond0: (slave bond_slave_0): interface is now down [ 1362.376728][ T4200] bond0: (slave bond_slave_1): interface is now down [ 1362.437728][ T4200] bond0: (slave bond_slave_0): interface is now down [ 1362.438206][ T4200] bond0: (slave bond_slave_1): interface is now down [ 1362.474415][ T3397] bond0: (slave bond_slave_0): interface is now down [ 1362.474881][ T3397] bond0: (slave bond_slave_1): interface is now down [ 1362.498343][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1362.498801][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1362.528187][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1362.528634][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1362.570336][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1362.571197][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1362.628133][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1362.628618][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1362.645198][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1362.645646][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1362.717336][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1362.760043][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1362.805037][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1362.805853][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1362.841279][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1362.852045][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1362.937155][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1362.954317][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1363.009268][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1363.017199][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1363.047209][ T3349] bond0: (slave bond_slave_0): interface is now down [ 1363.047673][ T3349] bond0: (slave bond_slave_1): interface is now down [ 1363.066053][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1363.066791][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1363.094757][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1363.107979][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1363.144888][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1363.218129][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1363.259075][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1363.259826][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1363.315433][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1363.325160][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1363.417210][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1363.417795][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1363.438240][ T4200] bond0: (slave bond_slave_0): interface is now down [ 1363.438688][ T4200] bond0: (slave bond_slave_1): interface is now down [ 1363.480145][ T3349] bond0: (slave bond_slave_0): interface is now down [ 1363.487747][ T3349] bond0: (slave bond_slave_1): interface is now down [ 1363.515961][ T1372] bond0: (slave bond_slave_0): interface is now down [ 1363.516659][ T1372] bond0: (slave bond_slave_1): interface is now down [ 1363.784395][ T1372] bond0: now running without any active interface! [ 1372.805538][ T4211] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.109'. [ 1376.088324][ T4217] FAULT_INJECTION: forcing a failure. [ 1376.088324][ T4217] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1376.088946][ T4217] CPU: 1 UID: 0 PID: 4217 Comm: syz.0.111 Not tainted syzkaller #0 PREEMPT [ 1376.089392][ T4217] Hardware name: riscv-virtio,qemu (DT) [ 1376.089553][ T4217] Call Trace: [ 1376.089692][ T4217] [] dump_backtrace+0x2e/0x3c [ 1376.090208][ T4217] [] show_stack+0x30/0x3c [ 1376.090598][ T4217] [] dump_stack_lvl+0x114/0x1aa [ 1376.090928][ T4217] [] dump_stack+0x1c/0x24 [ 1376.091276][ T4217] [] should_fail_ex+0x5ac/0x5b6 [ 1376.091832][ T4217] [] should_fail+0xe/0x16 [ 1376.092451][ T4217] [] get_futex_key+0x532/0x17aa [ 1376.092995][ T4217] [] futex_wake+0xe8/0x6fc [ 1376.093530][ T4217] [] do_futex+0x204/0x338 [ 1376.093969][ T4217] [] mm_exit_exec_release+0x39c/0x5f6 [ 1376.094355][ T4217] [] do_exit+0x6f2/0x297c [ 1376.094878][ T4217] [] do_group_exit+0xca/0x258 [ 1376.095435][ T4217] [] get_signal+0x1f58/0x2224 [ 1376.095792][ T4217] [] arch_do_signal_or_restart+0xc70/0x1df6 [ 1376.096218][ T4217] [] exit_to_user_mode_loop+0x92/0xce8 [ 1376.096696][ T4217] [] do_trap_ecall_u+0x52c/0x658 [ 1376.097378][ T4217] [] handle_exception+0x168/0x174 [ 1390.506246][ T4229] FAULT_INJECTION: forcing a failure. [ 1390.506246][ T4229] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1390.521706][ T4229] CPU: 1 UID: 0 PID: 4229 Comm: syz.0.117 Not tainted syzkaller #0 PREEMPT [ 1390.522275][ T4229] Hardware name: riscv-virtio,qemu (DT) [ 1390.522480][ T4229] Call Trace: [ 1390.522639][ T4229] [] dump_backtrace+0x2e/0x3c [ 1390.523208][ T4229] [] show_stack+0x30/0x3c [ 1390.523550][ T4229] [] dump_stack_lvl+0x114/0x1aa [ 1390.523960][ T4229] [] dump_stack+0x1c/0x24 [ 1390.524353][ T4229] [] should_fail_ex+0x5ac/0x5b6 [ 1390.524777][ T4229] [] should_fail+0xe/0x16 [ 1390.525272][ T4229] [] get_futex_key+0x532/0x17aa [ 1390.525750][ T4229] [] futex_wake+0xe8/0x6fc [ 1390.526260][ T4229] [] do_futex+0x204/0x338 [ 1390.526756][ T4229] [] mm_exit_exec_release+0x39c/0x5f6 [ 1390.527199][ T4229] [] do_exit+0x6f2/0x297c [ 1390.527656][ T4229] [] do_group_exit+0xca/0x258 [ 1390.528101][ T4229] [] get_signal+0x1f58/0x2224 [ 1390.528501][ T4229] [] arch_do_signal_or_restart+0xc70/0x1df6 [ 1390.528928][ T4229] [] exit_to_user_mode_loop+0x92/0xce8 [ 1390.529456][ T4229] [] do_trap_ecall_u+0x52c/0x658 [ 1390.529891][ T4229] [] handle_exception+0x168/0x174 [ 1398.649911][ T4234] fuse: Bad value for 'fd' [ 1422.154691][ T4242] netlink: 76 bytes leftover after parsing attributes in process `syz.0.122'. [ 1447.266972][ T4264] netlink: 76 bytes leftover after parsing attributes in process `syz.0.128'. [ 1451.111983][ T4268] FAULT_INJECTION: forcing a failure. [ 1451.111983][ T4268] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1451.130369][ T4268] CPU: 0 UID: 0 PID: 4268 Comm: syz.0.130 Not tainted syzkaller #0 PREEMPT [ 1451.131413][ T4268] Hardware name: riscv-virtio,qemu (DT) [ 1451.131686][ T4268] Call Trace: [ 1451.131943][ T4268] [] dump_backtrace+0x2e/0x3c [ 1451.132846][ T4268] [] show_stack+0x30/0x3c [ 1451.133450][ T4268] [] dump_stack_lvl+0x114/0x1aa [ 1451.134001][ T4268] [] dump_stack+0x1c/0x24 [ 1451.134625][ T4268] [] should_fail_ex+0x5ac/0x5b6 [ 1451.135315][ T4268] [] should_fail+0xe/0x16 [ 1451.135980][ T4268] [] get_futex_key+0x118c/0x17aa [ 1451.136758][ T4268] [] futex_wake+0xe8/0x6fc [ 1451.137589][ T4268] [] do_futex+0x204/0x338 [ 1451.138373][ T4268] [] mm_exit_exec_release+0x39c/0x5f6 [ 1451.139115][ T4268] [] do_exit+0x6f2/0x297c [ 1451.139926][ T4268] [] do_group_exit+0xca/0x258 [ 1451.140753][ T4268] [] get_signal+0x1f58/0x2224 [ 1451.141461][ T4268] [] arch_do_signal_or_restart+0xc70/0x1df6 [ 1451.142216][ T4268] [] exit_to_user_mode_loop+0x92/0xce8 [ 1451.143105][ T4268] [] do_trap_ecall_u+0x52c/0x658 [ 1451.143817][ T4268] [] handle_exception+0x168/0x174 [ 1474.121697][ T4278] netlink: 76 bytes leftover after parsing attributes in process `syz.1.134'. [ 1511.062242][ T4297] netlink: 76 bytes leftover after parsing attributes in process `syz.1.140'. [ 1542.657548][ T4311] netlink: 76 bytes leftover after parsing attributes in process `syz.1.145'. [ 1564.921968][ T4343] syz_tun: entered allmulticast mode [ 1587.846480][ T4355] netlink: 24 bytes leftover after parsing attributes in process `syz.0.150'. [ 1587.876985][ T4355] netlink: 28 bytes leftover after parsing attributes in process `syz.0.150'. [ 1587.900751][ T4355] netlink: 8 bytes leftover after parsing attributes in process `syz.0.150'. [ 1636.038662][ T4405] syz_tun: entered allmulticast mode [ 1656.789385][ T4413] binder: 4411:4413 ioctl c0306201 0 returned -14 [ 1659.584182][ T4415] netlink: 'syz.1.163': attribute type 10 has an invalid length. [ 1659.686325][ T4415] syz_tun: entered promiscuous mode [ 1660.797514][ T3397] bond0: (slave bond_slave_0): interface is now down [ 1660.827729][ T3397] bond0: (slave bond_slave_1): interface is now down [ 1660.851953][ T4263] bond0: (slave bond_slave_0): interface is now down [ 1660.872111][ T4263] bond0: (slave bond_slave_1): interface is now down [ 1660.911370][ T4214] bond0: (slave bond_slave_0): interface is now down [ 1660.911824][ T4214] bond0: (slave bond_slave_1): interface is now down [ 1660.945145][ T4214] bond0: (slave bond_slave_0): interface is now down [ 1660.945618][ T4214] bond0: (slave bond_slave_1): interface is now down [ 1660.976193][ T3397] bond0: (slave bond_slave_0): interface is now down [ 1660.976886][ T3397] bond0: (slave bond_slave_1): interface is now down [ 1661.050077][ T3397] bond0: (slave bond_slave_0): interface is now down [ 1661.050566][ T3397] bond0: (slave bond_slave_1): interface is now down [ 1661.075127][ T4263] bond0: (slave bond_slave_0): interface is now down [ 1661.075875][ T4263] bond0: (slave bond_slave_1): interface is now down [ 1661.144736][ T4263] bond0: (slave bond_slave_0): interface is now down [ 1661.159782][ T4263] bond0: (slave bond_slave_1): interface is now down [ 1661.211897][ T4263] bond0: (slave bond_slave_0): interface is now down [ 1661.260279][ T4263] bond0: (slave bond_slave_1): interface is now down [ 1661.280447][ T4263] bond0: (slave bond_slave_0): interface is now down [ 1661.285922][ T4263] bond0: (slave bond_slave_1): interface is now down [ 1661.398333][ T1446] bond0: (slave bond_slave_0): interface is now down [ 1661.400330][ T1446] bond0: (slave bond_slave_1): interface is now down [ 1661.417827][ T4214] bond0: (slave bond_slave_0): interface is now down [ 1661.418287][ T4214] bond0: (slave bond_slave_1): interface is now down [ 1661.490313][ T4263] bond0: (slave bond_slave_0): interface is now down [ 1661.502271][ T4263] bond0: (slave bond_slave_1): interface is now down [ 1661.781591][ T4263] bond0: now running without any active interface! [ 1679.890307][ T3839] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 1680.625531][ T3839] usb 1-1: Using ep0 maxpacket: 16 [ 1680.905439][ T3839] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1681.355560][ T3839] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1681.968619][ T3839] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1681.969151][ T3839] usb 1-1: Product: syz [ 1681.969446][ T3839] usb 1-1: Manufacturer: syz [ 1681.969723][ T3839] usb 1-1: SerialNumber: syz [ 1682.370237][ T3839] usb 1-1: config 0 descriptor?? [ 1697.644502][ T4350] usb 1-1: USB disconnect, device number 3 [ 1719.346682][ T4452] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.172'. [ 1753.100067][ T4467] netlink: 'syz.0.176': attribute type 10 has an invalid length. [ 1753.162079][ T4467] syz_tun: entered promiscuous mode [ 1766.716335][ T4470] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.177'. [ 1785.248775][ T4482] syzkaller0: entered promiscuous mode [ 1785.257855][ T4482] syzkaller0: entered allmulticast mode [ 1798.178737][ T4495] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.183'. [ 1806.392132][ T4501] syzkaller0: entered promiscuous mode [ 1806.410449][ T4501] syzkaller0: entered allmulticast mode [ 1924.859635][ T4554] syzkaller0: entered promiscuous mode [ 1924.865914][ T4554] syzkaller0: entered allmulticast mode [ 1954.453741][ T4574] random: crng reseeded on system resumption [ 2049.476939][ T4608] netlink: 12 bytes leftover after parsing attributes in process `syz.1.215'. [ 2124.780074][ T4649] syzkaller1: entered promiscuous mode [ 2124.781217][ T4649] syzkaller1: entered allmulticast mode [ 2165.794221][ T4674] syzkaller1: entered promiscuous mode [ 2165.815689][ T4674] syzkaller1: entered allmulticast mode [ 2281.947887][ T4755] binder: 4754:4755 ioctl 4018620d 0 returned -22 [ 2301.535916][ T4770] binder: 4768:4770 ioctl 4018620d 0 returned -22 [ 2332.962389][ T4784] binder: 4783:4784 ioctl 4018620d 0 returned -22 [ 2347.370751][ T4795] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.271'. [ 2363.217448][ T4805] binder: BINDER_SET_CONTEXT_MGR already set [ 2363.218461][ T4805] binder: 4804:4805 ioctl 4018620d 200000004a80 returned -16 [ 2365.647894][ T4807] netlink: 4768 bytes leftover after parsing attributes in process `syz.0.276'. [ 2383.488907][ T4820] netlink: 24 bytes leftover after parsing attributes in process `syz.0.280'. [ 2389.905877][ T4825] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.282'. [ 2390.204031][ T4824] binder: BINDER_SET_CONTEXT_MGR already set [ 2390.204606][ T4824] binder: 4822:4824 ioctl 4018620d 200000004a80 returned -16 [ 2406.359531][ T4842] netlink: 24 bytes leftover after parsing attributes in process `syz.1.285'. [ 2423.784343][ T4852] binder: BINDER_SET_CONTEXT_MGR already set [ 2423.785279][ T4852] binder: 4848:4852 ioctl 4018620d 200000004a80 returned -16 [ 2432.145043][ T4859] netlink: 24 bytes leftover after parsing attributes in process `syz.1.291'. [ 2454.936066][ T4871] binder: 4869:4871 ioctl c0306201 0 returned -14 [ 2547.191574][ T4920] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.315'. [ 2565.705215][ T4925] netlink: 12 bytes leftover after parsing attributes in process `syz.0.317'. [ 2585.561885][ T4935] netlink: 4768 bytes leftover after parsing attributes in process `syz.1.320'. [ 2746.069784][ T5033] netlink: 12 bytes leftover after parsing attributes in process `syz.1.347'. [ 2782.044715][ T5053] netlink: 'syz.1.356': attribute type 10 has an invalid length. [ 2828.214850][ T5072] netlink: 'syz.1.362': attribute type 10 has an invalid length. [ 2836.521504][ T5076] binder: 5075:5076 ioctl 4018620d 0 returned -22 [ 2844.357820][ T5084] netlink: 'syz.1.367': attribute type 10 has an invalid length. [ 2860.584370][ T5092] binder: 5091:5092 ioctl 4018620d 0 returned -22 [ 2881.830952][ T5103] netlink: 'syz.0.373': attribute type 10 has an invalid length. [ 2888.695240][ T5107] syzkaller0: entered promiscuous mode [ 2888.698392][ T5107] syzkaller0: entered allmulticast mode [ 2889.247567][ T5111] binder: 5108:5111 ioctl 4018620d 0 returned -22 [ 2914.961923][ T5129] netlink: 'syz.1.378': attribute type 10 has an invalid length. [ 2927.376838][ T5136] binder: 5133:5136 ioctl c0306201 0 returned -14 [ 2927.845378][ T5135] syzkaller0: entered promiscuous mode [ 2927.846275][ T5135] syzkaller0: entered allmulticast mode [ 2956.551944][ T5164] binder: 5163:5164 ioctl c0306201 0 returned -14 [ 2989.732057][ T5189] binder: 5188:5189 ioctl c0306201 0 returned -14 [ 3028.383728][ T4681] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 3028.391429][ C1] raw-gadget.0 gadget.1: ignoring, device is not running [ 3028.626625][ T4681] usb 2-1: device descriptor read/64, error -32 [ 3029.019924][ T4681] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 3029.412146][ T4681] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice= 1.00 [ 3029.474386][ T4681] usb 2-1: config 0 has no interfaces? [ 3030.447951][ T4681] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3030.453456][ T4681] usb 2-1: Product: syz [ 3030.453817][ T4681] usb 2-1: Manufacturer: syz [ 3030.454184][ T4681] usb 2-1: SerialNumber: syz [ 3030.702283][ T4681] usb 2-1: config 0 descriptor?? [ 3034.994336][ T4834] usb 2-1: USB disconnect, device number 3 [ 3085.675058][ T5250] netlink: 'syz.0.405': attribute type 10 has an invalid length. [ 3091.245613][ T5252] netlink: 12 bytes leftover after parsing attributes in process `syz.1.406'. [ 3095.905921][ T5254] netlink: 'syz.0.407': attribute type 1 has an invalid length. [ 3104.106211][ T5258] netlink: 'syz.0.409': attribute type 10 has an invalid length. [ 3129.776555][ T5275] netlink: 12 bytes leftover after parsing attributes in process `syz.0.412'. [ 3138.372331][ T5280] [ 3138.375047][ T5280] ====================================================== [ 3138.376693][ T5280] WARNING: possible circular locking dependency detected [ 3138.378655][ T5280] syzkaller #0 Not tainted [ 3138.380646][ T5280] ------------------------------------------------------ [ 3138.382825][ T5280] syz.0.415/5280 is trying to acquire lock: [ 3138.384399][ T5280] ffffffff89cf9bc0 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x2a/0x3fc [ 3138.387721][ T5280] [ 3138.387721][ T5280] but task is already holding lock: [ 3138.389212][ T5280] ffffaf8031d56390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x4a/0x31a [ 3138.391817][ T5280] [ 3138.391817][ T5280] which lock already depends on the new lock. [ 3138.391817][ T5280] [ 3138.393731][ T5280] [ 3138.393731][ T5280] the existing dependency chain (in reverse order) is: [ 3138.395378][ T5280] [ 3138.395378][ T5280] -> #2 (&gi->lock){+.+.}-{4:4}: [ 3138.397460][ T5280] lock_acquire+0x24e/0x502 [ 3138.398943][ T5280] __mutex_lock+0x164/0x192e [ 3138.400885][ T5280] mutex_lock_nested+0x14/0x1c [ 3138.403058][ T5280] config_usb_cfg_link+0x4a/0x31a [ 3138.404979][ T5280] configfs_symlink+0x5c4/0x11ba [ 3138.406940][ T5280] vfs_symlink+0x162/0x45e [ 3138.408658][ T5280] filename_symlinkat+0x264/0x4ca [ 3138.410696][ T5280] __riscv_sys_symlinkat+0x90/0xce [ 3138.412694][ T5280] syscall_handler+0x92/0x114 [ 3138.414614][ T5280] do_trap_ecall_u+0x4ca/0x658 [ 3138.416454][ T5280] handle_exception+0x168/0x174 [ 3138.418496][ T5280] [ 3138.418496][ T5280] -> #1 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 3138.422261][ T5280] lock_acquire+0x24e/0x502 [ 3138.424701][ T5280] down_write+0x9c/0x18e [ 3138.427280][ T5280] configfs_depend_item_unlocked+0xdc/0x5b0 [ 3138.430244][ T5280] usbg_make_tpg+0x26c/0x5d8 [ 3138.432817][ T5280] target_fabric_make_tpg+0x88/0x76c [ 3138.436381][ T5280] configfs_mkdir+0x478/0xbd4 [ 3138.439291][ T5280] vfs_mkdir+0x2f0/0x70e [ 3138.441936][ T5280] filename_mkdirat+0x414/0x54a [ 3138.444772][ T5280] __riscv_sys_mkdirat+0x84/0xbc [ 3138.447552][ T5280] syscall_handler+0x92/0x114 [ 3138.450103][ T5280] do_trap_ecall_u+0x4ca/0x658 [ 3138.452709][ T5280] handle_exception+0x168/0x174 [ 3138.455327][ T5280] [ 3138.455327][ T5280] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 3138.459402][ T5280] check_noncircular+0x136/0x14a [ 3138.462319][ T5280] __lock_acquire+0xee4/0x2614 [ 3138.465339][ T5280] lock_acquire+0x24e/0x502 [ 3138.468056][ T5280] __mutex_lock+0x164/0x192e [ 3138.471225][ T5280] mutex_lock_nested+0x14/0x1c [ 3138.478536][ T5280] tcm_alloc+0x2a/0x3fc [ 3138.480323][ T5280] usb_get_function+0x50/0xbc [ 3138.482395][ T5280] config_usb_cfg_link+0x1a4/0x31a [ 3138.484237][ T5280] configfs_symlink+0x5c4/0x11ba [ 3138.486493][ T5280] vfs_symlink+0x162/0x45e [ 3138.488437][ T5280] filename_symlinkat+0x264/0x4ca [ 3138.490694][ T5280] __riscv_sys_symlinkat+0x90/0xce [ 3138.492970][ T5280] syscall_handler+0x92/0x114 [ 3138.499740][ T5280] do_trap_ecall_u+0x4ca/0x658 [ 3138.501840][ T5280] handle_exception+0x168/0x174 [ 3138.503952][ T5280] [ 3138.503952][ T5280] other info that might help us debug this: [ 3138.503952][ T5280] [ 3138.507088][ T5280] Chain exists of: [ 3138.507088][ T5280] tpg_instances_lock --> &sb->s_type->i_mutex_key#24 --> &gi->lock [ 3138.507088][ T5280] [ 3138.511958][ T5280] Possible unsafe locking scenario: [ 3138.511958][ T5280] [ 3138.513823][ T5280] CPU0 CPU1 [ 3138.515133][ T5280] ---- ---- [ 3138.516416][ T5280] lock(&gi->lock); [ 3138.517789][ T5280] lock(&sb->s_type->i_mutex_key#24); [ 3138.520036][ T5280] lock(&gi->lock); [ 3138.521788][ T5280] lock(tpg_instances_lock); [ 3138.523452][ T5280] [ 3138.523452][ T5280] *** DEADLOCK *** [ 3138.523452][ T5280] [ 3138.526014][ T5280] locks held by syz.0.415/5280: 3, last CPU#1: [ 3138.528247][ T5280] #0: ffffaf8013f4c460 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x42/0x39e [ 3138.532662][ T5280] #1: ffffaf8021f1ac00 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x3b4/0x11ba [ 3138.537500][ T5280] #2: ffffaf8031d56390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x4a/0x31a [ 3138.541498][ T5280] [ 3138.541498][ T5280] stack backtrace: [ 3138.542914][ T5280] CPU: 1 UID: 0 PID: 5280 Comm: syz.0.415 Not tainted syzkaller #0 PREEMPT [ 3138.544916][ T5280] Hardware name: riscv-virtio,qemu (DT) [ 3138.546261][ T5280] Call Trace: [ 3138.547177][ T5280] [] dump_backtrace+0x2e/0x3c [ 3138.548959][ T5280] [] show_stack+0x30/0x3c [ 3138.550644][ T5280] [] dump_stack_lvl+0x114/0x1aa [ 3138.552182][ T5280] [] dump_stack+0x1c/0x24 [ 3138.553844][ T5280] [] print_circular_bug+0x250/0x29c [ 3138.555701][ T5280] [] check_noncircular+0x136/0x14a [ 3138.557465][ T5280] [] __lock_acquire+0xee4/0x2614 [ 3138.559272][ T5280] [] lock_acquire+0x24e/0x502 [ 3138.561021][ T5280] [] __mutex_lock+0x164/0x192e [ 3138.562996][ T5280] [] mutex_lock_nested+0x14/0x1c [ 3138.564795][ T5280] [] tcm_alloc+0x2a/0x3fc [ 3138.566480][ T5280] [] usb_get_function+0x50/0xbc [ 3138.568018][ T5280] [] config_usb_cfg_link+0x1a4/0x31a [ 3138.569637][ T5280] [] configfs_symlink+0x5c4/0x11ba [ 3138.571257][ T5280] [] vfs_symlink+0x162/0x45e [ 3138.572749][ T5280] [] filename_symlinkat+0x264/0x4ca [ 3138.574587][ T5280] [] __riscv_sys_symlinkat+0x90/0xce [ 3138.576164][ T5280] [] syscall_handler+0x92/0x114 [ 3138.577868][ T5280] [] do_trap_ecall_u+0x4ca/0x658 [ 3138.579466][ T5280] [] handle_exception+0x168/0x174