last executing test programs: 596.607667ms ago: executing program 3 (id=4): r0 = syz_usb_connect(0x0, 0x57, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cc1769190001010203010902450001010080320904000002ffffff0007058102400001070501024000010904000104ffffff0007058102400001070501024000010705820140000107050601400001"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xf, &(0x7f0000000100)="010000000000000004040000000000") nanosleep(&(0x7f0000000200)={0x1}, 0x0) 445.97399ms ago: executing program 2 (id=3): syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000406411220600000000000109022e0001010080000904000004ffffff0007050102000200070581020002000705840200020007050202000200"], 0x0) nanosleep(&(0x7f0000000100)={0x1}, 0x0) r0 = syz_open_dev$video(&(0x7f0000000200), 0x0, 0x0) ioctl$VIDIOC_QUERY_EXT_CTRL(r0, 0xc0e85667, &(0x7f0000000300)={0x80000000}) 239.82683ms ago: executing program 1 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/vkms/mydev\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/vkms/mydev/planes/plane0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/vkms/mydev/enabled\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1\x00', 0x2) 193.236225ms ago: executing program 0 (id=2): r0 = syz_usb_connect(0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c800000010102030109022e0001010080fa0904000004ffffff0007058103400001070501034000010705820140000107050601400001"], 0x0) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0xc0, 0x1, 0x8, "0200000000000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f0000000080)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)) syz_usb_control_io(r0, &(0x7f00000001c0)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)) nanosleep(&(0x7f0000000300)={0x3}, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000400), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc1105513, &(0x7f0000000500)={{0xc}, 0x0, [0x10, 0x10]}) 97.144403ms ago: executing program 1 (id=5): r0 = io_uring_setup(0x4, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_ZCRX_IFQ(r0, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x4, 0x0, &(0x7f0000000300)={&(0x7f0000001000), 0x1000, 0x0, 0x0, 0xffffffffffffffff}, &(0x7f0000000200)={&(0x7f0000002000), 0x1000, 0x1}}, 0x1) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x30000000) 0s ago: executing program 1 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f00000003c0)='0x1d6b\x00', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000440)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/strings\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/ramdisk_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/ramdisk_0/rd\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/ramdisk_0/rd/control\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='rd_pages=32768\x00', 0xe) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/ramdisk_0/rd/enable\x00', 0x2, 0x0) write(r3, &(0x7f00000002c0)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000740)='./config/target/core/ramdisk_0/rd\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0/port1\x00') r4 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/enable\x00', 0x2, 0x0) write(r4, &(0x7f0000000800)='1\x00', 0x1) symlinkat(&(0x7f0000000840)='./config/usb_gadget/g1/functions/tcm.0\x00', 0xffffffffffffff9c, &(0x7f0000000880)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r5, &(0x7f0000000900)='dummy_udc.0\x00', 0xb) nanosleep(&(0x7f0000000940)={0x1}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:30925' (ED25519) to the list of known hosts. [ 54.605734][ T42] audit: type=1400 audit(1785868059.800:138): avc: denied { name_bind } for pid=5729 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 54.647905][ T42] audit: type=1400 audit(1785868059.840:139): avc: denied { execute } for pid=5730 comm="sh" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 54.657211][ T42] audit: type=1400 audit(1785868059.840:140): avc: denied { execute_no_trans } for pid=5730 comm="sh" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 57.612090][ T42] audit: type=1400 audit(1785868062.800:141): avc: denied { mounton } for pid=5730 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 57.624037][ T42] audit: type=1400 audit(1785868062.810:142): avc: denied { mount } for pid=5730 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 57.628124][ T5730] cgroup: Unknown subsys name 'net' [ 57.789855][ T5730] cgroup: Unknown subsys name 'cpuset' [ 57.796825][ T5730] cgroup: Unknown subsys name 'rlimit' [ 57.954981][ T42] kauditd_printk_skb: 1 callbacks suppressed [ 57.955000][ T42] audit: type=1400 audit(1785868063.140:144): avc: denied { setattr } for pid=5730 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=850 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 57.968311][ T42] audit: type=1400 audit(1785868063.150:145): avc: denied { create } for pid=5730 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 57.977756][ T42] audit: type=1400 audit(1785868063.150:146): avc: denied { write } for pid=5730 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 57.987220][ T42] audit: type=1400 audit(1785868063.150:147): avc: denied { read } for pid=5730 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 57.996858][ T42] audit: type=1400 audit(1785868063.160:148): avc: denied { mounton } for pid=5730 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 58.008540][ T42] audit: type=1400 audit(1785868063.160:149): avc: denied { mount } for pid=5730 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 58.019111][ T42] audit: type=1400 audit(1785868063.170:150): avc: denied { read } for pid=5452 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 58.020199][ T5735] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 58.028573][ T42] audit: type=1400 audit(1785868063.180:151): avc: denied { read } for pid=5452 comm="dhcpcd" name="n31" dev="tmpfs" ino=1890 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 58.039909][ T42] audit: type=1400 audit(1785868063.180:152): avc: denied { open } for pid=5452 comm="dhcpcd" path="/run/udev/data/n31" dev="tmpfs" ino=1890 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 58.049268][ T42] audit: type=1400 audit(1785868063.180:153): avc: denied { getattr } for pid=5452 comm="dhcpcd" path="/run/udev/data/n31" dev="tmpfs" ino=1890 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 58.805648][ T5730] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 63.598310][ T42] kauditd_printk_skb: 4 callbacks suppressed [ 63.598327][ T42] audit: type=1400 audit(1785868068.790:158): avc: denied { execmem } for pid=5739 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 63.983189][ T42] audit: type=1400 audit(1785868069.170:159): avc: denied { create } for pid=5743 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 63.995492][ T42] audit: type=1400 audit(1785868069.170:160): avc: denied { read write } for pid=5743 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 64.005243][ T42] audit: type=1400 audit(1785868069.170:161): avc: denied { open } for pid=5743 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1292 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 64.013831][ T42] audit: type=1400 audit(1785868069.180:162): avc: denied { ioctl } for pid=5744 comm="syz-executor" path="socket:[5977]" dev="sockfs" ino=5977 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 64.035035][ T5752] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 64.036017][ T5757] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 64.038062][ T5758] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 64.040550][ T5758] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 64.041524][ T5752] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 64.042767][ T5757] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 64.043200][ T5757] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 64.043604][ T5757] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 64.046839][ T5758] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 64.047086][ T5758] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 64.047421][ T5757] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 64.049520][ T5757] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 64.049581][ T5757] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 64.052308][ T5752] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 64.052395][ T5099] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 64.053774][ T5760] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 64.058171][ T42] audit: type=1400 audit(1785868069.250:163): avc: denied { read } for pid=5743 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 64.063449][ T5099] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 64.067453][ T42] audit: type=1400 audit(1785868069.250:164): avc: denied { read } for pid=5749 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 64.067478][ T42] audit: type=1400 audit(1785868069.250:165): avc: denied { open } for pid=5743 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 64.067499][ T42] audit: type=1400 audit(1785868069.250:166): avc: denied { open } for pid=5749 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 64.070324][ T5758] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 64.071156][ T5099] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 64.071238][ T42] audit: type=1400 audit(1785868069.260:167): avc: denied { mounton } for pid=5749 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 64.076380][ T5758] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 64.893331][ T5743] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.897239][ T5743] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.900481][ T5743] bridge_slave_0: entered allmulticast mode [ 64.904995][ T5743] bridge_slave_0: entered promiscuous mode [ 64.913226][ T5743] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.916397][ T5743] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.919611][ T5743] bridge_slave_1: entered allmulticast mode [ 64.923912][ T5743] bridge_slave_1: entered promiscuous mode [ 64.928355][ T5749] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.931231][ T5749] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.934242][ T5749] bridge_slave_0: entered allmulticast mode [ 64.938715][ T5749] bridge_slave_0: entered promiscuous mode [ 64.943886][ T5749] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.946925][ T5749] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.950170][ T5749] bridge_slave_1: entered allmulticast mode [ 64.954050][ T5749] bridge_slave_1: entered promiscuous mode [ 65.049900][ T5749] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.055367][ T5749] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.070225][ T5743] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.080242][ T5754] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.082898][ T5754] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.085925][ T5754] bridge_slave_0: entered allmulticast mode [ 65.088935][ T5754] bridge_slave_0: entered promiscuous mode [ 65.094903][ T5743] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.107060][ T5749] team0: Port device team_slave_0 added [ 65.115471][ T5754] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.117955][ T5754] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.120642][ T5754] bridge_slave_1: entered allmulticast mode [ 65.124150][ T5754] bridge_slave_1: entered promiscuous mode [ 65.141544][ T5749] team0: Port device team_slave_1 added [ 65.168095][ T5743] team0: Port device team_slave_0 added [ 65.213576][ T5743] team0: Port device team_slave_1 added [ 65.218707][ T5754] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.223584][ T5749] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.226721][ T5749] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 65.237121][ T5749] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.266257][ T5754] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.270562][ T5749] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.273443][ T5749] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 65.283267][ T5749] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.359138][ T5743] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.361463][ T5743] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 65.369968][ T5743] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.384266][ T5754] team0: Port device team_slave_0 added [ 65.387367][ T5744] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.390357][ T5744] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.393385][ T5744] bridge_slave_0: entered allmulticast mode [ 65.396929][ T5744] bridge_slave_0: entered promiscuous mode [ 65.401330][ T5744] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.404207][ T5744] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.407756][ T5744] bridge_slave_1: entered allmulticast mode [ 65.411939][ T5744] bridge_slave_1: entered promiscuous mode [ 65.423332][ T5743] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.426663][ T5743] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 65.438211][ T5743] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.445547][ T5754] team0: Port device team_slave_1 added [ 65.498670][ T5744] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.514355][ T5754] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.517153][ T5754] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 65.526227][ T5754] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.532715][ T5744] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.553848][ T5749] hsr_slave_0: entered promiscuous mode [ 65.557695][ T5749] hsr_slave_1: entered promiscuous mode [ 65.561685][ T5754] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.564848][ T5754] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 65.575627][ T5754] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.628508][ T5744] team0: Port device team_slave_0 added [ 65.638513][ T5743] hsr_slave_0: entered promiscuous mode [ 65.641769][ T5743] hsr_slave_1: entered promiscuous mode [ 65.644750][ T5743] debugfs: 'hsr0' already exists in 'hsr' [ 65.647474][ T5743] Cannot create hsr debugfs directory [ 65.653327][ T5744] team0: Port device team_slave_1 added [ 65.735546][ T5754] hsr_slave_0: entered promiscuous mode [ 65.737833][ T5754] hsr_slave_1: entered promiscuous mode [ 65.739897][ T5754] debugfs: 'hsr0' already exists in 'hsr' [ 65.742317][ T5754] Cannot create hsr debugfs directory [ 65.754576][ T5744] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.756934][ T5744] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 65.767243][ T5744] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.780030][ T5744] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.782069][ T5744] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 65.795233][ T5744] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.910524][ T5744] hsr_slave_0: entered promiscuous mode [ 65.914021][ T5744] hsr_slave_1: entered promiscuous mode [ 65.916566][ T5744] debugfs: 'hsr0' already exists in 'hsr' [ 65.918533][ T5744] Cannot create hsr debugfs directory [ 66.105839][ T64] Bluetooth: hci1: command tx timeout [ 66.105841][ T5099] Bluetooth: hci3: command tx timeout [ 66.105843][ T5758] Bluetooth: hci2: command tx timeout [ 66.185834][ T5758] Bluetooth: hci0: command tx timeout [ 66.213894][ T5749] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 66.222774][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 66.240438][ T5749] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 66.248715][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 66.252581][ T5749] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 66.260321][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 66.270767][ T5749] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 66.276919][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 66.346129][ T5743] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 66.354078][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 66.358997][ T5743] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 66.365006][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 66.368870][ T5743] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 66.375098][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 66.379474][ T5743] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 66.385095][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 66.453022][ T5754] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 66.460577][ T5754] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 66.465088][ T5754] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 66.470839][ T5754] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 66.474626][ T5754] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 66.482164][ T5754] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 66.489323][ T5754] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 66.497047][ T5754] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 66.595860][ T5744] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 66.603340][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 66.607442][ T5744] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 66.613715][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 66.618105][ T5744] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 66.624856][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 66.629366][ T5744] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 66.635717][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 66.648084][ T5749] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.724101][ T5743] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.731366][ T5749] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.749982][ T1170] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.753866][ T1170] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.770062][ T1170] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.773141][ T1170] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.805767][ T5743] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.831204][ T1170] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.834317][ T1170] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.862330][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.865704][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.894004][ T5754] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.933624][ T5744] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.938957][ T5754] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.958162][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.961285][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.969786][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.972142][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.997511][ T5744] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.018435][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.021820][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.029296][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.032105][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.270979][ T5749] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.327420][ T5749] veth0_vlan: entered promiscuous mode [ 67.341809][ T5749] veth1_vlan: entered promiscuous mode [ 67.354116][ T5743] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.397142][ T5749] veth0_macvtap: entered promiscuous mode [ 67.413592][ T5743] veth0_vlan: entered promiscuous mode [ 67.423404][ T5749] veth1_macvtap: entered promiscuous mode [ 67.445003][ T5754] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.462178][ T5749] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.472055][ T5743] veth1_vlan: entered promiscuous mode [ 67.480343][ T5749] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.505756][ T5744] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 67.545888][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.571064][ T5754] veth0_vlan: entered promiscuous mode [ 67.586710][ T5743] veth0_macvtap: entered promiscuous mode [ 67.595677][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.605760][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.612486][ T5743] veth1_macvtap: entered promiscuous mode [ 67.624116][ T651] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.628453][ T651] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.631021][ T5754] veth1_vlan: entered promiscuous mode [ 67.673217][ T5743] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.677047][ T1170] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.681534][ T5743] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.685707][ T1170] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.708639][ T5744] veth0_vlan: entered promiscuous mode [ 67.741068][ T5744] veth1_vlan: entered promiscuous mode [ 67.744462][ T5749] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 67.746607][ T5754] veth0_macvtap: entered promiscuous mode [ 67.782060][ T5754] veth1_macvtap: entered promiscuous mode [ 67.813402][ T1166] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.820397][ T1166] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.851978][ T5754] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.857092][ T1166] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.860094][ T1166] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.867053][ T5744] veth0_macvtap: entered promiscuous mode [ 67.876051][ T5744] veth1_macvtap: entered promiscuous mode [ 67.883418][ T5754] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.909060][ T5744] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.931653][ T5744] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.935784][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.966184][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.970921][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 67.975380][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.003738][ T651] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.007730][ T651] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.046494][ T5795] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.050286][ T5795] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.068735][ T651] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.072194][ T651] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.092565][ T173] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.097206][ T173] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.115312][ T5856] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 68.126136][ T5795] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.131416][ T651] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.134485][ T651] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.166719][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.170285][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.186713][ T5758] Bluetooth: hci3: command tx timeout [ 68.187690][ T5795] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.190486][ T5099] Bluetooth: hci1: command tx timeout [ 68.192937][ T64] Bluetooth: hci2: command tx timeout [ 68.235456][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.243321][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.246974][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.262354][ T5908] (NULL device *): [drm] The number of CRTCs must be between 1 and 31 [ 68.265519][ T5099] Bluetooth: hci0: command tx timeout [ 68.276298][ T5856] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 68.286050][ T5856] usb 8-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 68.290081][ T5856] usb 8-1: config 1 interface 0 altsetting 1 bulk endpoint 0x81 has invalid maxpacket 64 [ 68.293634][ T5833] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 68.296763][ T5856] usb 8-1: config 1 interface 0 altsetting 1 bulk endpoint 0x1 has invalid maxpacket 64 [ 68.302706][ T5856] usb 8-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00 [ 68.307506][ T5856] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.311441][ T5856] usb 8-1: Product: syz [ 68.313162][ T5856] usb 8-1: Manufacturer: syz [ 68.314924][ T5856] usb 8-1: SerialNumber: syz [ 68.327540][ T5901] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 68.330380][ T5901] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 68.404123][ T5913] [ 68.405141][ T5913] ====================================================== [ 68.407937][ T5913] WARNING: possible circular locking dependency detected [ 68.410780][ T5913] syzkaller #0 Not tainted [ 68.412738][ T5913] ------------------------------------------------------ [ 68.415554][ T5913] syz.1.6/5913 is trying to acquire lock: [ 68.417876][ T5913] ffffffff90253240 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x20/0x440 [ 68.421540][ T5913] [ 68.421540][ T5913] but task is already holding lock: [ 68.424558][ T5913] ffff888039964390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 68.428257][ T5913] [ 68.428257][ T5913] which lock already depends on the new lock. [ 68.428257][ T5913] [ 68.432255][ T5913] [ 68.432255][ T5913] the existing dependency chain (in reverse order) is: [ 68.435820][ T5913] [ 68.435820][ T5913] -> #3 (&gi->lock){+.+.}-{4:4}: [ 68.437586][ T5833] usb 7-1: New USB device found, idVendor=1164, idProduct=0622, bcdDevice= 0.00 [ 68.438700][ T5913] lock_acquire+0x1b9/0x370 [ 68.438732][ T5913] __mutex_lock+0x1a4/0x1bd0 [ 68.438756][ T5913] config_usb_cfg_link+0x57/0x3a0 [ 68.442373][ T5833] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 68.444337][ T5913] configfs_symlink+0x540/0x11f0 [ 68.452711][ T5833] pvrusb2: Hardware description: Gotview USB 2.0 DVD 2 [ 68.454149][ T5913] vfs_symlink+0x178/0x4d0 [ 68.454185][ T5913] filename_symlinkat+0x2a6/0x560 [ 68.461316][ T5913] __x64_sys_symlinkat+0x9c/0xe0 [ 68.463461][ T5913] do_syscall_64+0x115/0x870 [ 68.465587][ T5913] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.468236][ T5913] [ 68.468236][ T5913] -> #2 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 68.471681][ T5913] lock_acquire+0x1b9/0x370 [ 68.473761][ T5913] down_write+0x8b/0x1f0 [ 68.475704][ T5913] configfs_depend_item_unlocked+0xf3/0x6a0 [ 68.478308][ T5913] usbg_make_tpg+0x261/0x620 [ 68.480365][ T5913] target_fabric_make_tpg+0xab/0x8c0 [ 68.482521][ T5913] configfs_mkdir+0x51e/0xb70 [ 68.484565][ T5913] vfs_mkdir+0x361/0x850 [ 68.486574][ T5913] filename_mkdirat+0x48b/0x5e0 [ 68.488932][ T5913] __x64_sys_mkdirat+0x89/0xc0 [ 68.491128][ T5913] do_syscall_64+0x115/0x870 [ 68.493157][ T5913] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.495805][ T5913] [ 68.495805][ T5913] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 68.498923][ T5913] lock_acquire+0x1b9/0x370 [ 68.500982][ T5913] __mutex_lock+0x1a4/0x1bd0 [ 68.503041][ T5913] usbg_make_tpg+0x1a4/0x620 [ 68.505243][ T5913] target_fabric_make_tpg+0xab/0x8c0 [ 68.507759][ T5913] configfs_mkdir+0x51e/0xb70 [ 68.509791][ T5913] vfs_mkdir+0x361/0x850 [ 68.511583][ T5913] filename_mkdirat+0x48b/0x5e0 [ 68.513610][ T5913] __x64_sys_mkdirat+0x89/0xc0 [ 68.515278][ T848] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 68.515569][ T5913] do_syscall_64+0x115/0x870 [ 68.520486][ T5913] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.522881][ T5913] [ 68.522881][ T5913] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 68.525782][ T5913] check_prev_add+0xeb/0xe60 [ 68.527841][ T5913] __lock_acquire+0x136c/0x1a40 [ 68.530069][ T5913] lock_acquire+0x1b9/0x370 [ 68.532145][ T5913] __mutex_lock+0x1a4/0x1bd0 [ 68.534389][ T5913] tcm_alloc+0x20/0x440 [ 68.536370][ T5913] usb_get_function+0x5e/0xd0 [ 68.537506][ T5901] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 68.538601][ T5913] config_usb_cfg_link+0x1ed/0x3a0 [ 68.541410][ T5901] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 68.543244][ T5913] configfs_symlink+0x540/0x11f0 [ 68.547253][ C3] usb 8-1: received EP1 urb->status = -71 [ 68.548006][ T5913] vfs_symlink+0x178/0x4d0 [ 68.550459][ T5856] usb 8-1: unable to init card! (ret=-71) [ 68.552497][ T5913] filename_symlinkat+0x2a6/0x560 [ 68.555235][ T5856] snd-usb-caiaq 8-1:1.0: probe with driver snd-usb-caiaq failed with error -71 [ 68.557092][ T5913] __x64_sys_symlinkat+0x9c/0xe0 [ 68.557118][ T5913] do_syscall_64+0x115/0x870 [ 68.557139][ T5913] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.567420][ T5913] [ 68.567420][ T5913] other info that might help us debug this: [ 68.567420][ T5913] [ 68.571510][ T5913] Chain exists of: [ 68.571510][ T5913] tpg_instances_lock --> &sb->s_type->i_mutex_key#24 --> &gi->lock [ 68.571510][ T5913] [ 68.576938][ T5913] Possible unsafe locking scenario: [ 68.576938][ T5913] [ 68.580259][ T5913] CPU0 CPU1 [ 68.582455][ T5913] ---- ---- [ 68.584580][ T5913] lock(&gi->lock); [ 68.586203][ T5913] lock(&sb->s_type->i_mutex_key#24); [ 68.589359][ T5913] lock(&gi->lock); [ 68.591897][ T5913] lock(tpg_instances_lock); [ 68.593803][ T5913] [ 68.593803][ T5913] *** DEADLOCK *** [ 68.593803][ T5913] [ 68.596877][ T5913] 3 locks held by syz.1.6/5913: [ 68.598793][ T5913] #0: ffff88802333a450 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 68.602336][ T5913] #1: ffff8880576c0ac0 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x3c0/0x11f0 [ 68.606252][ T5913] #2: ffff888039964390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 68.609379][ T5913] [ 68.609379][ T5913] stack backtrace: [ 68.611362][ T5913] CPU: 2 UID: 0 PID: 5913 Comm: syz.1.6 Not tainted syzkaller #0 PREEMPT(full) [ 68.611377][ T5913] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 68.611391][ T5913] Call Trace: [ 68.611397][ T5913] [ 68.611403][ T5913] dump_stack_lvl+0x100/0x190 [ 68.611419][ T5913] print_circular_bug.cold+0x178/0x1c7 [ 68.611436][ T5913] check_noncircular+0x146/0x160 [ 68.611450][ T5913] check_prev_add+0xeb/0xe60 [ 68.611463][ T5913] __lock_acquire+0x136c/0x1a40 [ 68.611479][ T5913] lock_acquire+0x1b9/0x370 [ 68.611491][ T5913] ? tcm_alloc+0x20/0x440 [ 68.611504][ T5913] ? __pfx___might_resched+0x10/0x10 [ 68.611518][ T5913] __mutex_lock+0x1a4/0x1bd0 [ 68.611532][ T5913] ? tcm_alloc+0x20/0x440 [ 68.611544][ T5913] ? tcm_alloc+0x20/0x440 [ 68.611556][ T5913] ? __mutex_lock+0x26d/0x1bd0 [ 68.611569][ T5913] ? config_usb_cfg_link+0x57/0x3a0 [ 68.611583][ T5913] ? __pfx___mutex_lock+0x10/0x10 [ 68.611598][ T5913] ? __pfx_selinux_inode_permission+0x10/0x10 [ 68.611613][ T5913] ? tcm_alloc+0x20/0x440 [ 68.611625][ T5913] tcm_alloc+0x20/0x440 [ 68.611638][ T5913] usb_get_function+0x5e/0xd0 [ 68.611653][ T5913] config_usb_cfg_link+0x1ed/0x3a0 [ 68.611667][ T5913] ? mntput_no_expire+0xe7/0x220 [ 68.611678][ T5913] configfs_symlink+0x540/0x11f0 [ 68.611695][ T5913] ? __pfx_configfs_symlink+0x10/0x10 [ 68.611713][ T5913] vfs_symlink+0x178/0x4d0 [ 68.611729][ T5913] filename_symlinkat+0x2a6/0x560 [ 68.611743][ T5913] ? __pfx_filename_symlinkat+0x10/0x10 [ 68.611756][ T5913] ? strncpy_from_user+0x19d/0x2d0 [ 68.611771][ T5913] ? do_getname+0x191/0x390 [ 68.611784][ T5913] __x64_sys_symlinkat+0x9c/0xe0 [ 68.611797][ T5913] do_syscall_64+0x115/0x870 [ 68.611809][ T5913] ? clear_bhb_loop+0x40/0x90 [ 68.611821][ T5913] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 68.611832][ T5913] RIP: 0033:0x7f7ec459e019 [ 68.611842][ T5913] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 68.611853][ T5913] RSP: 002b:00007f7ec5415028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 68.611873][ T5913] RAX: ffffffffffffffda RBX: 00007f7ec4825fa0 RCX: 00007f7ec459e019 [ 68.611880][ T5913] RDX: 0000200000000880 RSI: ffffffffffffff9c RDI: 0000200000000840 [ 68.611886][ T5913] RBP: 00007f7ec463500c R08: 0000000000000000 R09: 0000000000000000 [ 68.611892][ T5913] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 68.611898][ T5913] R13: 00007f7ec4826038 R14: 00007f7ec4825fa0 R15: 00007ffdea271638 [ 68.611907][ T5913] [ 68.688609][ T848] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice= 1.00 [ 68.693376][ T42] kauditd_printk_skb: 57 callbacks suppressed [ 68.693394][ T42] audit: type=1800 audit(1785868073.880:225): pid=5914 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.1.6" name="UDC" dev="configfs" ino=7666 res=0 errno=0 [ 68.698741][ T848] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 68.706424][ T42] audit: type=1400 audit(1785868073.900:226): avc: denied { read } for pid=5902 comm="syz.2.3" name="video0" dev="devtmpfs" ino=956 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 68.708399][ T848] usb 5-1: Product: syz [ 68.715927][ T42] audit: type=1400 audit(1785868073.900:227): avc: denied { open } for pid=5902 comm="syz.2.3" path="/dev/video0" dev="devtmpfs" ino=956 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 68.719200][ T848] usb 5-1: Manufacturer: syz [ 68.727590][ T42] audit: type=1400 audit(1785868073.900:228): avc: denied { ioctl } for pid=5902 comm="syz.2.3" path="/dev/video0" dev="devtmpfs" ino=956 ioctlcmd=0x5667 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 68.729368][ T848] usb 5-1: SerialNumber: syz [ 68.958980][ T848] snd-usb-6fire 5-1:1.0: unknown device firmware state received from device: [ 68.962786][ T848] 02 00 00 00 00 00 00 00 [ 68.964761][ T848] snd-usb-6fire 5-1:1.0: probe with driver snd-usb-6fire failed with error -5 [ 69.654241][ T2524] pvrusb2: Failed to submit write-control URB status=-2 [ 69.655805][ T5833] usb 7-1: USB disconnect, device number 2 [ 69.657173][ T2524] pvrusb2: Device being rendered inoperable [ 69.661480][ T2524] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 69.665411][ T2524] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 69.751912][ T29] usb 8-1: USB disconnect, device number 2 [ 70.265274][ T5758] Bluetooth: hci1: command tx timeout [ 70.265592][ T5099] Bluetooth: hci3: command tx timeout [ 70.275384][ T5099] Bluetooth: hci2: command tx timeout [ 70.345373][ T5099] Bluetooth: hci0: command tx timeout [ 71.290358][ T5856] usb 5-1: USB disconnect, device number 2 [ 71.626629][ T1443] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.629444][ T1443] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.345335][ T5099] Bluetooth: hci2: command tx timeout [ 72.345487][ T5758] Bluetooth: hci1: command tx timeout [ 72.345620][ T64] Bluetooth: hci3: command tx timeout [ 72.426253][ T5758] Bluetooth: hci0: command tx timeout