last executing test programs: 1.318929006s ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/rdma_rxe\x00', 0x2, 0x0) r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write(r0, &(0x7f0000000200)='transport=rdma,nqn=nqn.2014-08.org.nvmexpress.discovery,traddr=127.0.0.1\x00', 0x48) 1.036830593s ago: executing program 1 (id=5): r0 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000280), 0xed8, 0x280) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r1, 0xc0984124, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:/export\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000001c0)='addr\x00', &(0x7f0000000200)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000002c0)='vers\x00', &(0x7f0000000300)='4\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x24044080, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) ptrace$setsig(0x4203, r2, 0x61a, &(0x7f0000000240)={0x2, 0x0, 0x9}) 0s ago: executing program 1 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target/core/rd_mcp_0/rd1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/core/rd_mcp_0/rd1/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='rd_pages=32768\x00', 0xe) r1 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/core/rd_mcp_0/rd1/enable\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r2, &(0x7f0000000500)='0x1d6b\x00', 0x6) r3 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r3, &(0x7f0000000580)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0\x00', 0x1ff) symlink(&(0x7f0000000840)='./config/target/core/rd_mcp_0/rd1\x00', &(0x7f0000000880)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0/rd1\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) write(r4, &(0x7f0000000940)='naa.6001405123456789\x00', 0x14) r5 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/enable\x00', 0x2, 0x0) write(r5, &(0x7f00000009c0)='1\x00', 0x1) symlink(&(0x7f0000000a00)='./config/usb_gadget/g1/functions/tcm.0\x00', &(0x7f0000000a40)='./config/usb_gadget/g1/configs/c.1/tcm.0\x00') r6 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r6, &(0x7f0000000ac0)='dummy_udc.0\x00', 0xb) nanosleep(&(0x7f0000000000)={0x1}, 0x0) r7 = syz_open_dev$sg(&(0x7f0000000b00), 0x0, 0x0) ioctl$SG_IO(r7, 0x2285, &(0x7f0000000100)={0x53, 0xfffffffe, 0xa, 0x0, @buffer={0x0, 0x1c, &(0x7f0000000200)=""/28}, &(0x7f0000000300)="5f000000000000001c00", &(0x7f0000000400), 0x0, 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.103' (ED25519) to the list of known hosts. [ 72.892207][ T5758] cgroup: Unknown subsys name 'net' [ 73.020776][ T5758] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.391993][ T5758] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.175097][ T5772] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.183222][ T5772] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.194657][ T5772] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.205252][ T5772] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.212872][ T5772] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 76.220400][ T5772] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.253204][ T5776] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.299653][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.308497][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.316082][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.323624][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.323670][ T5778] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.331501][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.338921][ T5778] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.345492][ T51] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 76.352373][ T5778] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 76.359023][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.365984][ T5778] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.435764][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.444810][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.452338][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.460742][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.468407][ T51] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 76.475790][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.759599][ T5770] chnl_net:caif_netlink_parms(): no params data found [ 76.862624][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 76.872142][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 76.882104][ T5779] chnl_net:caif_netlink_parms(): no params data found [ 76.951619][ T5770] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.959450][ T5770] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.967096][ T5770] bridge_slave_0: entered allmulticast mode [ 76.973785][ T5770] bridge_slave_0: entered promiscuous mode [ 77.006364][ T5770] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.013839][ T5770] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.021253][ T5770] bridge_slave_1: entered allmulticast mode [ 77.027963][ T5770] bridge_slave_1: entered promiscuous mode [ 77.101721][ T5770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.140504][ T5770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.149901][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.159385][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.166685][ T5773] bridge_slave_0: entered allmulticast mode [ 77.173255][ T5773] bridge_slave_0: entered promiscuous mode [ 77.182308][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.189598][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.196948][ T5773] bridge_slave_1: entered allmulticast mode [ 77.204166][ T5773] bridge_slave_1: entered promiscuous mode [ 77.255282][ T5779] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.262401][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.269951][ T5779] bridge_slave_0: entered allmulticast mode [ 77.276714][ T5779] bridge_slave_0: entered promiscuous mode [ 77.284486][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.291561][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.298870][ T5774] bridge_slave_0: entered allmulticast mode [ 77.306794][ T5774] bridge_slave_0: entered promiscuous mode [ 77.314275][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.321427][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.328663][ T5774] bridge_slave_1: entered allmulticast mode [ 77.335344][ T5774] bridge_slave_1: entered promiscuous mode [ 77.345237][ T5770] team0: Port device team_slave_0 added [ 77.358680][ T5779] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.365889][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.373051][ T5779] bridge_slave_1: entered allmulticast mode [ 77.379912][ T5779] bridge_slave_1: entered promiscuous mode [ 77.399262][ T5770] team0: Port device team_slave_1 added [ 77.407411][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.448445][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.469318][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.482432][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.520001][ T5779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.532727][ T5779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.542510][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.549893][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.576227][ T5770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.610953][ T5773] team0: Port device team_slave_0 added [ 77.628358][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.636160][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.662457][ T5770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.676967][ T5774] team0: Port device team_slave_0 added [ 77.690214][ T5773] team0: Port device team_slave_1 added [ 77.709018][ T5779] team0: Port device team_slave_0 added [ 77.722687][ T5774] team0: Port device team_slave_1 added [ 77.739566][ T5779] team0: Port device team_slave_1 added [ 77.793415][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.800502][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.827965][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.859731][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.866916][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.893118][ T5779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.905313][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.912276][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.943023][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.956404][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.963367][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.989608][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.001654][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.009087][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.035200][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.055988][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.062954][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.090927][ T5779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.118899][ T5770] hsr_slave_0: entered promiscuous mode [ 78.125801][ T5770] hsr_slave_1: entered promiscuous mode [ 78.165449][ T5773] hsr_slave_0: entered promiscuous mode [ 78.171569][ T5773] hsr_slave_1: entered promiscuous mode [ 78.177813][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.185954][ T5773] Cannot create hsr debugfs directory [ 78.281488][ T5774] hsr_slave_0: entered promiscuous mode [ 78.288330][ T5774] hsr_slave_1: entered promiscuous mode [ 78.294527][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.302499][ T5774] Cannot create hsr debugfs directory [ 78.315167][ T51] Bluetooth: hci0: command tx timeout [ 78.360815][ T5779] hsr_slave_0: entered promiscuous mode [ 78.367520][ T5779] hsr_slave_1: entered promiscuous mode [ 78.373493][ T5779] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.381285][ T5779] Cannot create hsr debugfs directory [ 78.394428][ T51] Bluetooth: hci1: command tx timeout [ 78.394490][ T5778] Bluetooth: hci2: command tx timeout [ 78.554610][ T5778] Bluetooth: hci3: command tx timeout [ 78.684268][ T5770] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 78.696715][ T5770] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 78.731313][ T5770] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 78.749708][ T5770] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 78.788164][ T5773] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 78.819552][ T5773] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 78.841897][ T5773] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 78.851163][ T5773] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 78.874678][ T5774] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.891364][ T5774] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.901812][ T5774] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.912958][ T5774] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.023942][ T5779] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 79.042747][ T5779] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 79.065938][ T5779] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 79.075519][ T5779] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 79.159136][ T5770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.208821][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.248283][ T5770] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.261197][ T2924] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.268529][ T2924] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.283106][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.303816][ T2924] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.310980][ T2924] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.337591][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.367192][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.374272][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.388104][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.410393][ T5779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.451717][ T2924] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.458867][ T2924] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.470586][ T2924] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.477711][ T2924] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.533063][ T5779] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.552917][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.560184][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.673621][ T2924] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.680812][ T2924] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.692292][ T2924] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.699476][ T2924] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.747106][ T5773] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 79.769951][ T5779] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 79.790416][ T5770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.946077][ T5770] veth0_vlan: entered promiscuous mode [ 80.006288][ T5770] veth1_vlan: entered promiscuous mode [ 80.091750][ T5770] veth0_macvtap: entered promiscuous mode [ 80.119326][ T5770] veth1_macvtap: entered promiscuous mode [ 80.186933][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.213010][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.241485][ T5770] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.252277][ T5770] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.269216][ T5770] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.278862][ T5770] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.317778][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.359755][ T5779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.394683][ T5778] Bluetooth: hci0: command tx timeout [ 80.407529][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.475108][ T5778] Bluetooth: hci1: command tx timeout [ 80.475335][ T51] Bluetooth: hci2: command tx timeout [ 80.482547][ T2924] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.501645][ T2924] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.540092][ T5773] veth0_vlan: entered promiscuous mode [ 80.569090][ T2949] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.583156][ T5774] veth0_vlan: entered promiscuous mode [ 80.589033][ T2949] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.598964][ T5779] veth0_vlan: entered promiscuous mode [ 80.620390][ T5773] veth1_vlan: entered promiscuous mode [ 80.631608][ T5779] veth1_vlan: entered promiscuous mode [ 80.637626][ T51] Bluetooth: hci3: command tx timeout [ 80.667567][ T5774] veth1_vlan: entered promiscuous mode [ 80.791005][ T5773] veth0_macvtap: entered promiscuous mode [ 80.802386][ T5773] veth1_macvtap: entered promiscuous mode [ 80.812914][ T5774] veth0_macvtap: entered promiscuous mode [ 80.838652][ T5779] veth0_macvtap: entered promiscuous mode [ 80.849162][ T5774] veth1_macvtap: entered promiscuous mode [ 80.871226][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.878963][ T5834] nvme nvme0: rdma_resolve_addr failed (-19). [ 80.885529][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.903973][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.943860][ T5779] veth1_macvtap: entered promiscuous mode [ 80.971404][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.984448][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.996903][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.008617][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.022628][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.077259][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.089822][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.101384][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.134915][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.155886][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.175558][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.191210][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.208751][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.219674][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.236674][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.249539][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.263020][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.274582][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.285539][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.297659][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.308256][ T5773] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.317235][ T5773] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.327408][ T5773] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.336996][ T5773] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.480707][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.637212][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.719216][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.823548][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.916172][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.939330][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.967427][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.021622][ T5779] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.058177][ T5779] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.067461][ T5779] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.084057][ T5779] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.104772][ T5774] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.124918][ T27] audit: type=1800 audit(1785876999.726:2): pid=5842 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.6" name="enable" dev="configfs" ino=6122 res=0 errno=0 [ 82.133716][ T5842] se_device not configured yet, cannot port link [ 82.151606][ T5774] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.169798][ T5774] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.179669][ T5842] [ 82.182009][ T5842] ====================================================== [ 82.184363][ T27] audit: type=1800 audit(1785876999.726:3): pid=5842 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.6" name="idVendor" dev="configfs" ino=6129 res=0 errno=0 [ 82.189007][ T5842] WARNING: possible circular locking dependency detected [ 82.189027][ T5842] syzkaller #0 Not tainted [ 82.220205][ T5842] ------------------------------------------------------ [ 82.224844][ T27] audit: type=1800 audit(1785876999.736:4): pid=5842 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.6" name="idProduct" dev="configfs" ino=6130 res=0 errno=0 [ 82.227202][ T5842] syz.1.6/5842 is trying to acquire lock: [ 82.252769][ T5842] ffffffff8de58f08 (tpg_instances_lock){+.+.}-{3:3}, at: tcm_alloc+0x21/0x1e0 [ 82.261678][ T5842] [ 82.261678][ T5842] but task is already holding lock: [ 82.269043][ T5842] ffff888021df8398 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x59/0x250 [ 82.274338][ T27] audit: type=1800 audit(1785876999.776:5): pid=5842 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.6" name="nexus" dev="configfs" ino=7175 res=0 errno=0 [ 82.278014][ T5842] [ 82.278014][ T5842] which lock already depends on the new lock. [ 82.278014][ T5842] [ 82.278021][ T5842] [ 82.278021][ T5842] the existing dependency chain (in reverse order) is: [ 82.316929][ T5842] [ 82.316929][ T5842] -> #3 (&gi->lock){+.+.}-{3:3}: [ 82.324059][ T5842] __mutex_lock+0x135/0xc80 [ 82.324338][ T27] audit: type=1800 audit(1785876999.776:6): pid=5842 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.6" name="enable" dev="configfs" ino=7176 res=0 errno=0 [ 82.329085][ T5842] config_usb_cfg_link+0x59/0x250 [ 82.354222][ T5842] configfs_symlink+0x5a5/0xfe0 [ 82.359598][ T5842] vfs_symlink+0x138/0x2b0 [ 82.364538][ T5842] do_symlinkat+0x1ba/0x400 [ 82.369570][ T5842] __x64_sys_symlink+0x7e/0x90 [ 82.374866][ T5842] do_syscall_64+0x55/0xb0 [ 82.377733][ T5774] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.379793][ T5842] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 82.394863][ T5842] [ 82.394863][ T5842] -> #2 (&sb->s_type->i_mutex_key#20){++++}-{3:3}: [ 82.403555][ T5842] down_write+0x97/0x200 [ 82.408303][ T5842] configfs_depend_item_unlocked+0x157/0x430 [ 82.414784][ T5842] usbg_make_tpg+0x1f7/0x580 [ 82.419880][ T5842] target_fabric_make_tpg+0xa4/0x6d0 [ 82.425676][ T5842] configfs_mkdir+0x515/0x9e0 [ 82.430872][ T5842] vfs_mkdir+0x2a5/0x470 [ 82.435613][ T5842] do_mkdirat+0x1dc/0x450 [ 82.440439][ T5842] __x64_sys_mkdirat+0x89/0xa0 [ 82.445702][ T5842] do_syscall_64+0x55/0xb0 [ 82.450615][ T5842] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 82.457005][ T5842] [ 82.457005][ T5842] -> #1 (&opts->dep_lock){+.+.}-{3:3}: [ 82.464634][ T5842] __mutex_lock+0x135/0xc80 [ 82.469645][ T5842] usbg_make_tpg+0x148/0x580 [ 82.474760][ T5842] target_fabric_make_tpg+0xa4/0x6d0 [ 82.480577][ T5842] configfs_mkdir+0x515/0x9e0 [ 82.485758][ T5842] vfs_mkdir+0x2a5/0x470 [ 82.490500][ T5842] do_mkdirat+0x1dc/0x450 [ 82.495337][ T5842] __x64_sys_mkdirat+0x89/0xa0 [ 82.500612][ T5842] do_syscall_64+0x55/0xb0 [ 82.505533][ T5842] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 82.511930][ T5842] [ 82.511930][ T5842] -> #0 (tpg_instances_lock){+.+.}-{3:3}: [ 82.519813][ T5842] __lock_acquire+0x37ef/0x7d80 [ 82.525182][ T5842] lock_acquire+0x19e/0x420 [ 82.530234][ T5842] __mutex_lock+0x135/0xc80 [ 82.535255][ T5842] tcm_alloc+0x21/0x1e0 [ 82.539913][ T5842] usb_get_function+0x5d/0xb0 [ 82.545089][ T5842] config_usb_cfg_link+0x148/0x250 [ 82.550705][ T5842] configfs_symlink+0x5a5/0xfe0 [ 82.556057][ T5842] vfs_symlink+0x138/0x2b0 [ 82.560971][ T5842] do_symlinkat+0x1ba/0x400 [ 82.565971][ T5842] __x64_sys_symlink+0x7e/0x90 [ 82.571230][ T5842] do_syscall_64+0x55/0xb0 [ 82.573490][ T51] Bluetooth: hci0: command tx timeout [ 82.576142][ T5842] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 82.576162][ T5842] [ 82.576162][ T5842] other info that might help us debug this: [ 82.576162][ T5842] [ 82.576168][ T5842] Chain exists of: [ 82.576168][ T5842] tpg_instances_lock --> &sb->s_type->i_mutex_key#20 --> &gi->lock [ 82.576168][ T5842] [ 82.576202][ T5842] Possible unsafe locking scenario: [ 82.576202][ T5842] [ 82.576206][ T5842] CPU0 CPU1 [ 82.576210][ T5842] ---- ---- [ 82.576215][ T5842] lock(&gi->lock); [ 82.576226][ T5842] lock(&sb->s_type->i_mutex_key#20); [ 82.576243][ T5842] lock(&gi->lock); [ 82.576256][ T5842] lock(tpg_instances_lock); [ 82.576267][ T5842] [ 82.576267][ T5842] *** DEADLOCK *** [ 82.576267][ T5842] [ 82.576271][ T5842] 3 locks held by syz.1.6/5842: [ 82.576281][ T5842] #0: ffff888018f1c418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 82.576333][ T5842] #1: ffff88805e0dcb80 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: configfs_symlink+0x47a/0xfe0 [ 82.576382][ T5842] #2: ffff888021df8398 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x59/0x250 [ 82.576426][ T5842] [ 82.576426][ T5842] stack backtrace: [ 82.576448][ T5842] CPU: 0 PID: 5842 Comm: syz.1.6 Not tainted syzkaller #0 [ 82.576463][ T5842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 82.576480][ T5842] Call Trace: [ 82.576487][ T5842] [ 82.576495][ T5842] dump_stack_lvl+0x18c/0x250 [ 82.576513][ T5842] ? load_image+0x420/0x420 [ 82.576535][ T5842] ? show_regs_print_info+0x20/0x20 [ 82.576557][ T5842] ? print_circular_bug+0x12b/0x1a0 [ 82.576580][ T5842] check_noncircular+0x2fc/0x400 [ 82.576601][ T5842] ? print_deadlock_bug+0x5d0/0x5d0 [ 82.576620][ T5842] ? lockdep_lock+0xf5/0x230 [ 82.576640][ T5842] ? _find_first_zero_bit+0xd6/0x100 [ 82.582178][ T5778] Bluetooth: hci1: command tx timeout [ 82.588381][ T5842] __lock_acquire+0x37ef/0x7d80 [ 82.588414][ T5842] ? verify_lock_unused+0x140/0x140 [ 82.779323][ T5842] ? __lock_acquire+0x1336/0x7d80 [ 82.784340][ T5842] ? verify_lock_unused+0x140/0x140 [ 82.789525][ T5842] lock_acquire+0x19e/0x420 [ 82.794007][ T5842] ? tcm_alloc+0x21/0x1e0 [ 82.798320][ T5842] ? __might_sleep+0xe0/0xe0 [ 82.802891][ T5842] ? read_lock_is_recursive+0x20/0x20 [ 82.808243][ T5842] ? __mutex_trylock_common+0x160/0x270 [ 82.813767][ T5842] __mutex_lock+0x135/0xc80 [ 82.818251][ T5842] ? tcm_alloc+0x21/0x1e0 [ 82.822563][ T5842] ? trace_contention_end+0x39/0xe0 [ 82.827752][ T5842] ? __mutex_lock+0x30d/0xc80 [ 82.832416][ T5842] ? tcm_alloc+0x21/0x1e0 [ 82.836726][ T5842] ? mutex_lock_nested+0x20/0x20 [ 82.841665][ T5842] ? read_lock_is_recursive+0x20/0x20 [ 82.847018][ T5842] ? config_usb_cfg_link+0x59/0x250 [ 82.852212][ T5842] ? mutex_lock_nested+0x20/0x20 [ 82.857129][ T5842] ? configfs_symlink+0x469/0xfe0 [ 82.862135][ T5842] tcm_alloc+0x21/0x1e0 [ 82.866287][ T5842] usb_get_function+0x5d/0xb0 [ 82.870954][ T5842] config_usb_cfg_link+0x148/0x250 [ 82.876068][ T5842] configfs_symlink+0x5a5/0xfe0 [ 82.880937][ T5842] ? from_kgid+0x153/0x6a0 [ 82.885339][ T5842] ? generic_permission+0x1ed/0x590 [ 82.890522][ T5842] ? detach_groups+0x370/0x370 [ 82.895270][ T5842] ? inode_permission+0xf3/0x480 [ 82.900192][ T5842] ? bpf_lsm_inode_symlink+0x9/0x10 [ 82.905371][ T5842] ? security_inode_symlink+0xb6/0x100 [ 82.910817][ T5842] vfs_symlink+0x138/0x2b0 [ 82.915215][ T5842] do_symlinkat+0x1ba/0x400 [ 82.919699][ T5842] ? vfs_symlink+0x2b0/0x2b0 [ 82.924266][ T5842] ? getname_flags+0x20a/0x500 [ 82.929024][ T5842] __x64_sys_symlink+0x7e/0x90 [ 82.933767][ T5842] do_syscall_64+0x55/0xb0 [ 82.938166][ T5842] ? clear_bhb_loop+0x40/0x90 [ 82.942823][ T5842] ? clear_bhb_loop+0x40/0x90 [ 82.947478][ T5842] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 82.953347][ T5842] RIP: 0033:0x7f234b59e019 [ 82.957771][ T5842] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 82.977373][ T5842] RSP: 002b:00007f234c3e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 82.985791][ T5842] RAX: ffffffffffffffda RBX: 00007f234b825fa0 RCX: 00007f234b59e019 [ 82.993745][ T5842] RDX: 0000000000000000 RSI: 0000200000000a40 RDI: 0000200000000a00 [ 83.001695][ T5842] RBP: 00007f234b63500c R08: 0000000000000000 R09: 0000000000000000 [ 83.009647][ T5842] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.017597][ T5842] R13: 00007f234b826038 R14: 00007f234b825fa0 R15: 00007ffc3239ef78 [ 83.025569][ T5842] [ 83.029682][ T51] Bluetooth: hci2: command tx timeout [ 83.035734][ T5778] Bluetooth: hci3: command tx timeout [ 83.043852][ T27] audit: type=1800 audit(1785877000.636:7): pid=5843 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.6" name="UDC" dev="configfs" ino=7177 res=0 errno=0 [ 83.099145][ T5773] ieee80211 phy5: Selected rate control algorithm 'minstrel_ht' [ 83.145590][ T5774] ieee80211 phy6: Selected rate control algorithm 'minstrel_ht' [ 83.161562][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.170674][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.180565][ T167] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.180940][ T5779] ieee80211 phy7: Selected rate control algorithm 'minstrel_ht' [ 83.198804][ T167] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.227768][ T5773] ieee80211 phy8: Selected rate control algorithm 'minstrel_ht' [ 83.243462][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.268541][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.281884][ T5774] ieee80211 phy9: Selected rate control algorithm 'minstrel_ht' [ 83.303464][ T2949] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.312707][ T5831] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 83.322433][ T2979] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.322987][ T5779] ieee80211 phy10: Selected rate control algorithm 'minstrel_ht' [ 83.338800][ T2949] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.340452][ T2979] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.443412][ T2924] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.452172][ T2924] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.497525][ T5831] usb 1-1: Dual-Role OTG device on HNP port [ 83.503844][ T5831] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0104, bcdDevice= 6.06 [ 83.513840][ T5831] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.524886][ T175] Using the BOT protocol [ 83.532265][ T175] Using the UAS protocol [ 83.539361][ T5831] scsi host1: uas [ 84.634834][ T51] Bluetooth: hci0: command tx timeout [ 84.635090][ T5778] Bluetooth: hci1: command tx timeout [ 85.114661][ T5778] Bluetooth: hci3: command tx timeout [ 85.114828][ T51] Bluetooth: hci2: command tx timeout [ 86.797023][ T791] cfg80211: failed to load regulatory.db