last executing test programs: 6.143668817s ago: executing program 0 (id=155): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() fsopen(0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000180)={0x2, 0x898, 0xfffffffe, 0xe}, 0x10) setns(0xc9, 0x0) r3 = socket(0x2a, 0x2, 0x9) bind$inet(r3, &(0x7f0000000180)={0x2a, 0x4e26, @empty=0x1000000}, 0x10) 2.31461181s ago: executing program 0 (id=159): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x8, 0xa, &(0x7f00000001c0)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006400000000000000180000000000000000000000000000009500000000000000950000000000000011da8583930b4b7a31e21395a6fa7f6dbd8d9b4ab5706d716943a4a7c6f5921d1ef6d6433794d69b00d60b22bd08e9b8c150af4801111c"], &(0x7f00000000c0)='syzkaller\x00', 0x4, 0xea, &(0x7f0000000340)=""/234}, 0x80) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000000)=[{}], 0x8, 0x10, &(0x7f0000002e00), &(0x7f0000000400), 0x8, 0x23, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000600)={r0, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8, 0x0, 0x0}}, 0x10) 2.214291181s ago: executing program 0 (id=162): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x3, 0xd, &(0x7f0000000280)=@raw=[@btf_id={0x18, 0x5, 0x3, 0x0, 0x2}, @initr0={0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x6}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @generic={0x3, 0x6, 0x0, 0x401, 0x7f}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x21, '\x00', 0x0, @fallback=0x28, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c0000000a000000000000000000000b02000000000000000300000d000000000300000003000000000000000300000004000000030000000000000000000005000000000000005f"], &(0x7f0000000b80)=""/4090, 0x5e, 0xffa, 0x1}, 0x28) 2.132650582s ago: executing program 0 (id=164): bpf$ENABLE_STATS(0x20, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000000c0)=r3, 0x4) sendmsg$inet(r1, &(0x7f0000001a00)={0x0, 0x0, 0x0}, 0x80) 1.971129393s ago: executing program 0 (id=166): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0x97, &(0x7f00000001c0)=""/151}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) 1.823275835s ago: executing program 0 (id=168): fsopen(0x0, 0x0) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000180)=0x6f) syz_usb_connect$cdc_ncm(0x4, 0x6e, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$dsp(r0, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) 1.639841546s ago: executing program 1 (id=169): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1000}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x1000000, &(0x7f0000000440)='B'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f00000001c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0xf0de, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x440}], 0x0, 0x0, 0x0}) 933.501243ms ago: executing program 1 (id=170): r0 = socket(0x2a, 0x2, 0x9) bind$inet(r0, &(0x7f0000000180)={0x2a, 0x4e26, @empty=0x1000000}, 0x10) 669.654085ms ago: executing program 1 (id=171): r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @private2}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 560.047806ms ago: executing program 1 (id=172): syz_usb_connect(0x0, 0x3f, 0x0, 0x0) write$eventfd(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x2) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)={0x5c, 0x9, 0x6, 0x801, 0x0, 0x0, {0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private0}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0xe1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x88}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e1f}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) getpid() connect$l2tp6(0xffffffffffffffff, 0x0, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, r2) sendmsg$NL802154_CMD_SET_PAN_ID(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400a00}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x8000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 283.848918ms ago: executing program 1 (id=173): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/hid.usb0/no_out_endpoint\x00', 0x2, 0x0) write(r0, 0x0, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/hid.usb0/subclass\x00', 0x2, 0x0) write(r1, &(0x7f0000000280)='1\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/hid.usb0/protocol\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='1\n', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/hid.usb0/report_length\x00', 0x2, 0x0) write(r3, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/hid.usb0/report_desc\x00', 0x2, 0x0) write(r4, &(0x7f0000000400)="05010906a101050719e029e71500250175019508810295017508810195057501050819012905910295017503910195067508150025650507190029658100c0", 0x3f) close(r4) symlinkat(&(0x7f0000000440)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/hid.usb0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)='dummy_udc.0\n', 0xc) close(r5) nanosleep(&(0x7f0000000540)={0x0, 0x2faf080}, 0x0) r6 = syz_open_dev$hidraw(&(0x7f0000000580), 0x0, 0x2) write$hidraw(r6, &(0x7f00000005c0)='1234567', 0x7) 0s ago: executing program 1 (id=174): socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = epoll_create1(0x80000) r5 = fcntl$dupfd(r3, 0x0, r3) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f0000000080)={0x20000000}) r6 = gettid() kcmp$KCMP_EPOLL_TFD(r6, r6, 0x7, r5, &(0x7f0000000840)={r4, r5, 0x8}) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:28648' (ED25519) to the list of known hosts. syzkaller login: [ 74.821202][ T3367] cgroup: Unknown subsys name 'net' [ 75.017498][ T3367] cgroup: Unknown subsys name 'cpuset' [ 75.030245][ T3367] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 75.435508][ T3367] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 84.475193][ T3375] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.528384][ T3375] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.577379][ T3374] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.628330][ T3374] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.117525][ T3375] hsr_slave_0: entered promiscuous mode [ 85.122166][ T3375] hsr_slave_1: entered promiscuous mode [ 85.254329][ T3374] hsr_slave_0: entered promiscuous mode [ 85.257958][ T3374] hsr_slave_1: entered promiscuous mode [ 85.259710][ T3374] debugfs: 'hsr0' already exists in 'hsr' [ 85.261192][ T3374] Cannot create hsr debugfs directory [ 85.829055][ T3375] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 85.856320][ T3375] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 85.868532][ T3375] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 85.883613][ T3375] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 85.889407][ T3375] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 85.901956][ T3375] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 85.926010][ T3375] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 85.937755][ T3375] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.063846][ T3374] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 86.080295][ T3374] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.082785][ T3374] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 86.099175][ T3374] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.121085][ T3374] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 86.138438][ T3374] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.166232][ T3374] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 86.183210][ T3374] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.939357][ T3375] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.057400][ T3374] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.791833][ T3375] veth0_vlan: entered promiscuous mode [ 89.878703][ T3375] veth1_vlan: entered promiscuous mode [ 89.888843][ T3374] veth0_vlan: entered promiscuous mode [ 89.935840][ T3374] veth1_vlan: entered promiscuous mode [ 90.021783][ T3375] veth0_macvtap: entered promiscuous mode [ 90.048091][ T3375] veth1_macvtap: entered promiscuous mode [ 90.132586][ T3374] veth0_macvtap: entered promiscuous mode [ 90.193096][ T3374] veth1_macvtap: entered promiscuous mode [ 90.421633][ T2218] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.422287][ T2218] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.558473][ T51] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.560099][ T51] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.599585][ T195] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.600027][ T195] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.600324][ T195] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.600463][ T195] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.798621][ T3375] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 91.242649][ T3525] bonding: bond1 is being created... [ 91.441601][ T3529] FAULT_INJECTION: forcing a failure. [ 91.441601][ T3529] name failslab, interval 1, probability 0, space 0, times 1 [ 91.443529][ T3529] CPU: 0 UID: 0 PID: 3529 Comm: syz.1.3 Tainted: G W syzkaller #0 PREEMPT [ 91.443823][ T3529] Tainted: [W]=WARN [ 91.443862][ T3529] Hardware name: linux,dummy-virt (DT) [ 91.444118][ T3529] Call trace: [ 91.444418][ T3529] show_stack+0x18/0x24 (C) [ 91.445199][ T3529] dump_stack_lvl+0x60/0x80 [ 91.445249][ T3529] dump_stack+0x18/0x24 [ 91.445287][ T3529] should_fail_ex+0x1e0/0x238 [ 91.445337][ T3529] should_failslab+0x54/0x80 [ 91.445376][ T3529] kmem_cache_alloc_node_noprof+0x5c/0x448 [ 91.445419][ T3529] __alloc_skb+0x74/0x2e0 [ 91.445468][ T3529] virtual_ncidev_write+0x3c/0x140 [ 91.445517][ T3529] vfs_write+0xd4/0x36c [ 91.445589][ T3529] ksys_write+0x70/0x108 [ 91.445630][ T3529] __arm64_sys_write+0x18/0x24 [ 91.445670][ T3529] invoke_syscall+0x54/0x10c [ 91.445730][ T3529] el0_svc_common.constprop.0+0x40/0xe0 [ 91.445771][ T3529] do_el0_svc+0x1c/0x34 [ 91.445809][ T3529] el0_svc+0x38/0x1fc [ 91.445862][ T3529] el0t_64_sync_handler+0xa0/0xe4 [ 91.445917][ T3529] el0t_64_sync+0x1a4/0x1a8 [ 93.910678][ T3538] FAULT_INJECTION: forcing a failure. [ 93.910678][ T3538] name failslab, interval 1, probability 0, space 0, times 0 [ 93.910982][ T3538] CPU: 1 UID: 0 PID: 3538 Comm: syz.0.5 Tainted: G W syzkaller #0 PREEMPT [ 93.911051][ T3538] Tainted: [W]=WARN [ 93.911071][ T3538] Hardware name: linux,dummy-virt (DT) [ 93.911116][ T3538] Call trace: [ 93.911144][ T3538] show_stack+0x18/0x24 (C) [ 93.911207][ T3538] dump_stack_lvl+0x60/0x80 [ 93.911247][ T3538] dump_stack+0x18/0x24 [ 93.911292][ T3538] should_fail_ex+0x1e0/0x238 [ 93.911333][ T3538] should_failslab+0x54/0x80 [ 93.911400][ T3538] kmem_cache_alloc_lru_noprof+0x58/0x458 [ 93.911486][ T3538] __d_alloc+0x3c/0x280 [ 93.911532][ T3538] d_alloc_parallel+0x78/0x50c [ 93.911581][ T3538] lookup_open+0x244/0x748 [ 93.911622][ T3538] path_openat+0x55c/0x960 [ 93.911659][ T3538] do_file_open+0xb0/0x168 [ 93.911711][ T3538] do_sys_openat2+0x84/0x104 [ 93.911775][ T3538] __arm64_sys_openat+0x64/0xc0 [ 93.911859][ T3538] invoke_syscall+0x54/0x10c [ 93.911915][ T3538] el0_svc_common.constprop.0+0x40/0xe0 [ 93.911953][ T3538] do_el0_svc+0x1c/0x34 [ 93.911989][ T3538] el0_svc+0x38/0x1fc [ 93.912077][ T3538] el0t_64_sync_handler+0xa0/0xe4 [ 93.912130][ T3538] el0t_64_sync+0x1a4/0x1a8 [ 94.414164][ T3542] loop3: detected capacity change from 0 to 1 [ 97.783695][ T3575] null_blk: nullb1: using native zone append [ 97.882316][ T3575] null_blk: disk nullb1 created [ 97.903451][ T3575] nvmet: adding nsid 1 to subsystem testsubsys [ 98.097420][ T2218] nvmet: Created nvm controller 1 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:984981ae-c9e3-4adc-a7fa-019b4d970fd4. [ 98.132405][ T3575] nvme nvme0: creating 2 I/O queues. [ 98.147084][ T3575] nvme nvme0: new ctrl: "testsubsys" [ 98.901748][ T3585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 98.918872][ T3585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 98.940098][ T3585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 98.948329][ T3585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.167578][ T3585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 99.169123][ T3585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.247287][ T3592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 99.248244][ T3592] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.302380][ T3594] xt_hashlimit: size too large, truncated to 1048576 [ 100.467079][ T3603] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 100.468459][ T3603] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 101.100925][ T3607] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 101.192899][ T51] nvmet: Created nvm controller 2 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:984981ae-c9e3-4adc-a7fa-019b4d970fd4. [ 101.204201][ T3607] nvme nvme1: creating 2 I/O queues. [ 101.209791][ T3607] nvme nvme1: new ctrl: "testsubsys" [ 103.137460][ T3622] netlink: 'syz.0.32': attribute type 3 has an invalid length. [ 106.335582][ C0] vcan0: j1939_tp_rxtimer: 0x00000000c6794ce2: rx timeout, send abort [ 106.338371][ C0] vcan0: j1939_xtp_rx_abort_one: 0x00000000c6794ce2: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 107.093999][ T3645] binder: 3644:3645 ioctl 4018620d 0 returned -22 [ 111.502631][ T3664] netlink: 28 bytes leftover after parsing attributes in process `syz.1.48'. [ 111.504357][ T3664] netlink: 28 bytes leftover after parsing attributes in process `syz.1.48'. [ 111.506931][ T3664] netlink: 8 bytes leftover after parsing attributes in process `syz.1.48'. [ 111.867093][ T803] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 112.035788][ T803] usb 1-1: Using ep0 maxpacket: 32 [ 112.042271][ T803] usb 1-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 112.053837][ T803] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 112.054245][ T803] usb 1-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 112.059482][ T803] usb 1-1: too many endpoints for config 1 interface 1 altsetting 239: 255, using maximum allowed: 30 [ 112.060117][ T803] usb 1-1: config 1 interface 1 altsetting 239 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 112.060696][ T803] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 112.061071][ T803] usb 1-1: config 1 interface 1 has no altsetting 0 [ 112.095866][ T803] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.096217][ T803] usb 1-1: Product: syz [ 112.098876][ T803] usb 1-1: Manufacturer: syz [ 112.099226][ T803] usb 1-1: SerialNumber: syz [ 112.387375][ T803] usb 1-1: selecting invalid altsetting 0 [ 112.390272][ T803] usb 1-1: 1:1: cannot get freq (v2/v3): err -71 [ 112.395874][ T803] usb 1-1: 1:1: cannot set freq 44100 (v2/v3): err -71 [ 112.627021][ T803] usb 1-1: USB disconnect, device number 2 [ 112.879154][ T3684] udevd[3684]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 115.995901][ T803] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 116.177949][ T803] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 116.185492][ T803] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.197179][ T803] usb 1-1: config 0 descriptor?? [ 117.391133][ T3705] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.392940][ T3705] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 126.453108][ T803] usb 1-1: USB disconnect, device number 3 [ 126.808777][ T3752] FAULT_INJECTION: forcing a failure. [ 126.808777][ T3752] name failslab, interval 1, probability 0, space 0, times 0 [ 126.809062][ T3752] CPU: 0 UID: 0 PID: 3752 Comm: syz.0.75 Tainted: G W syzkaller #0 PREEMPT [ 126.809133][ T3752] Tainted: [W]=WARN [ 126.809153][ T3752] Hardware name: linux,dummy-virt (DT) [ 126.809176][ T3752] Call trace: [ 126.809194][ T3752] show_stack+0x18/0x24 (C) [ 126.809269][ T3752] dump_stack_lvl+0x60/0x80 [ 126.809359][ T3752] dump_stack+0x18/0x24 [ 126.809401][ T3752] should_fail_ex+0x1e0/0x238 [ 126.809472][ T3752] should_failslab+0x54/0x80 [ 126.809524][ T3752] kmem_cache_alloc_noprof+0x54/0x458 [ 126.809578][ T3752] do_getname_kernel+0x4c/0x12c [ 126.809623][ T3752] kern_path+0x20/0x60 [ 126.809684][ T3752] lookup_bdev+0x44/0xf0 [ 126.809738][ T3752] get_tree_bdev_flags+0x48/0x1f0 [ 126.809796][ T3752] get_tree_bdev+0x14/0x20 [ 126.809847][ T3752] fuse_get_tree+0x184/0x1a4 [ 126.809900][ T3752] vfs_get_tree+0x28/0x100 [ 126.809954][ T3752] fc_mount+0x18/0xa0 [ 126.810026][ T3752] path_mount+0x3e8/0xabc [ 126.810072][ T3752] __arm64_sys_mount+0x1b0/0x204 [ 126.810125][ T3752] invoke_syscall+0x54/0x10c [ 126.810166][ T3752] el0_svc_common.constprop.0+0x40/0xe0 [ 126.810223][ T3752] do_el0_svc+0x1c/0x34 [ 126.810263][ T3752] el0_svc+0x38/0x1fc [ 126.810329][ T3752] el0t_64_sync_handler+0xa0/0xe4 [ 126.810395][ T3752] el0t_64_sync+0x1a4/0x1a8 [ 126.819208][ T3752] ./file0: Can't lookup blockdev [ 126.892393][ T3754] netlink: 16 bytes leftover after parsing attributes in process `syz.0.76'. [ 130.525614][ T803] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 130.679019][ T803] usb 1-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 130.687836][ T803] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 134.709599][ T3792] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 134.711164][ T3792] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.673114][ T3802] xt_CT: You must specify a L4 protocol and not use inversions on it [ 140.874216][ T3806] ip_tables: iptables: counters copy to user failed while replacing table [ 141.217684][ T28] audit: type=1326 audit(141.120:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3807 comm="syz.1.94" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 141.222106][ T28] audit: type=1326 audit(141.130:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3807 comm="syz.1.94" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 141.224563][ T28] audit: type=1326 audit(141.130:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3807 comm="syz.1.94" exe="/syz-executor" sig=0 arch=c00000b7 syscall=71 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 141.225388][ T28] audit: type=1326 audit(141.130:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3807 comm="syz.1.94" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 141.225603][ T28] audit: type=1326 audit(141.140:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3807 comm="syz.1.94" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 141.424185][ T3812] : renamed from bond0 [ 144.110882][ T3816] Zero length message leads to an empty skb [ 144.713601][ T3817] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x48000 [ 144.716951][ T3817] flags: 0x1ffc00000002000(reserved|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) [ 144.724063][ T3817] raw: 01ffc00000002000 ffffc1ffc0200008 ffffc1ffc0200008 0000000000000000 [ 144.731068][ T3817] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 144.736212][ T3817] page dumped because: unmovable page [ 145.269136][ T11] usb 1-1: USB disconnect, device number 4 [ 147.483725][ T3828] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.488996][ T3828] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 152.265673][ T3846] loop0: detected capacity change from 0 to 262144 [ 152.469651][ T3846] loop1: detected capacity change from 0 to 262144 [ 153.473171][ T3846] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 154.254044][ T3857] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 154.266334][ T3857] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 157.229874][ T3884] netlink: 60 bytes leftover after parsing attributes in process `syz.1.118'. [ 159.022600][ T3889] netlink: 284 bytes leftover after parsing attributes in process `syz.0.122'. [ 166.242111][ T3920] FAULT_INJECTION: forcing a failure. [ 166.242111][ T3920] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 166.242515][ T3920] CPU: 1 UID: 0 PID: 3920 Comm: syz.1.133 Tainted: G W syzkaller #0 PREEMPT [ 166.242629][ T3920] Tainted: [W]=WARN [ 166.242664][ T3920] Hardware name: linux,dummy-virt (DT) [ 166.242703][ T3920] Call trace: [ 166.242823][ T3920] show_stack+0x18/0x24 (C) [ 166.243018][ T3920] dump_stack_lvl+0x60/0x80 [ 166.243154][ T3920] dump_stack+0x18/0x24 [ 166.243291][ T3920] should_fail_ex+0x1e0/0x238 [ 166.243435][ T3920] should_fail+0x14/0x40 [ 166.243563][ T3920] should_fail_usercopy+0x1c/0x40 [ 166.243706][ T3920] preserve_sve_context+0x148/0x2b0 [ 166.243841][ T3920] setup_rt_frame+0x828/0x1120 [ 166.244025][ T3920] arch_do_signal_or_restart+0x220/0x3dc [ 166.244129][ T3920] exit_to_user_mode_loop+0x114/0x19c [ 166.244299][ T3920] el0_da+0xe8/0xf0 [ 166.244414][ T3920] el0t_64_sync_handler+0xd0/0xe4 [ 166.244537][ T3920] el0t_64_sync+0x1a4/0x1a8 [ 166.809827][ T3927] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 167.153513][ T3927] md/raid:md0: not clean -- starting background reconstruction [ 167.213240][ T3927] md/raid:md0: not enough operational devices (2/2 failed) [ 167.332479][ T3927] md/raid:md0: failed to run raid set. [ 167.332945][ T3927] md: pers->run() failed ... [ 168.598978][ T3445] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 168.759584][ T3445] usb 1-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 168.771245][ T3445] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 168.771620][ T3445] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 168.793691][ T3445] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 168.794016][ T3445] usb 1-1: Product: syz [ 168.794269][ T3445] usb 1-1: Manufacturer: syz [ 168.794334][ T3445] usb 1-1: SerialNumber: syz [ 168.827265][ T3445] ums-sddr09 1-1:1.0: USB Mass Storage device detected [ 168.836732][ T3445] ums-sddr09 1-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 168.836732][ T3445] Please send a copy of this message to and [ 169.486052][ T3445] ums-sddr09 1-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 169.512033][ T3445] usb 1-1: USB disconnect, device number 5 [ 174.410611][ T3960] xt_CT: You must specify a L4 protocol and not use inversions on it [ 178.084322][ T3969] ======================================================= [ 178.084322][ T3969] WARNING: The mand mount option has been deprecated and [ 178.084322][ T3969] and is ignored by this kernel. Remove the mand [ 178.084322][ T3969] option from the mount to silence this warning. [ 178.084322][ T3969] ======================================================= [ 182.007298][ T28] audit: type=1326 audit(181.850:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3985 comm="syz.1.151" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 182.008176][ T28] audit: type=1326 audit(181.850:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3985 comm="syz.1.151" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 182.008382][ T28] audit: type=1326 audit(181.860:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3985 comm="syz.1.151" exe="/syz-executor" sig=0 arch=c00000b7 syscall=293 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 182.008545][ T28] audit: type=1326 audit(181.860:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3985 comm="syz.1.151" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 182.008699][ T28] audit: type=1326 audit(181.860:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3985 comm="syz.1.151" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 182.008887][ T28] audit: type=1326 audit(181.860:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3985 comm="syz.1.151" exe="/syz-executor" sig=0 arch=c00000b7 syscall=204 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 182.009044][ T28] audit: type=1326 audit(181.860:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3985 comm="syz.1.151" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 182.009188][ T28] audit: type=1326 audit(181.860:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3985 comm="syz.1.151" exe="/syz-executor" sig=0 arch=c00000b7 syscall=115 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 182.009391][ T28] audit: type=1326 audit(181.860:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3985 comm="syz.1.151" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 182.009555][ T28] audit: type=1326 audit(181.860:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3985 comm="syz.1.151" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbaf79368 code=0x7ffc0000 [ 182.106260][ T3988] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 182.110347][ T3988] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 189.279440][ T4008] smc: net device vlan1 applied user defined pnetid SYZ2 [ 189.852367][ T4029] FAULT_INJECTION: forcing a failure. [ 189.852367][ T4029] name failslab, interval 1, probability 0, space 0, times 0 [ 189.854502][ T4029] CPU: 1 UID: 0 PID: 4029 Comm: syz.1.167 Tainted: G W syzkaller #0 PREEMPT [ 189.854650][ T4029] Tainted: [W]=WARN [ 189.854744][ T4029] Hardware name: linux,dummy-virt (DT) [ 189.854799][ T4029] Call trace: [ 189.854840][ T4029] show_stack+0x18/0x24 (C) [ 189.854959][ T4029] dump_stack_lvl+0x60/0x80 [ 189.855043][ T4029] dump_stack+0x18/0x24 [ 189.855119][ T4029] should_fail_ex+0x1e0/0x238 [ 189.855202][ T4029] should_failslab+0x54/0x80 [ 189.855288][ T4029] kmem_cache_alloc_lru_noprof+0x58/0x458 [ 189.855374][ T4029] debugfs_alloc_inode+0x20/0x2c [ 189.855458][ T4029] alloc_inode+0x28/0xdc [ 189.855536][ T4029] new_inode+0x14/0x88 [ 189.855611][ T4029] __debugfs_create_file+0x60/0x198 [ 189.855688][ T4029] debugfs_create_file_full+0x1c/0x28 [ 189.855768][ T4029] ref_tracker_dir_debugfs+0xe0/0x160 [ 189.855854][ T4029] preinit_net+0xdc/0x160 [ 189.855943][ T4029] copy_net_ns+0xa0/0x354 [ 189.856026][ T4029] create_new_namespaces+0x114/0x370 [ 189.856115][ T4029] unshare_nsproxy_namespaces+0x70/0xbc [ 189.856201][ T4029] ksys_unshare+0x1cc/0x3b8 [ 189.856287][ T4029] __arm64_sys_unshare+0x14/0x24 [ 189.856366][ T4029] invoke_syscall+0x54/0x10c [ 189.856442][ T4029] el0_svc_common.constprop.0+0x40/0xe0 [ 189.856518][ T4029] do_el0_svc+0x1c/0x34 [ 189.856591][ T4029] el0_svc+0x38/0x1fc [ 189.856675][ T4029] el0t_64_sync_handler+0xa0/0xe4 [ 189.856755][ T4029] el0t_64_sync+0x1a4/0x1a8 [ 189.864151][ T4029] debugfs: out of free dentries, can not create file 'net_notrefcnt@000000007a774948' [ 190.207691][ T4033] binder: 4032:4033 tried to acquire reference to desc 0, got 1 instead [ 190.214603][ T4033] binder: 4032:4033 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 190.221882][ T4033] binder: 4033 RLIMIT_NICE not set [ 190.738314][ T4033] binder: 4033 RLIMIT_NICE not set [ 190.740605][ T4033] binder: send failed reply for transaction 6 to 4032:4035 [ 190.756612][ T4033] binder: 4032:4033 ioctl c0306201 20000280 returned -14 [ 190.768895][ T3521] binder: undelivered TRANSACTION_COMPLETE [ 190.769416][ T3521] binder: undelivered TRANSACTION_ERROR: 29201 [ 191.936116][ T11] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 192.821060][ T11] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.02 [ 193.182103][ T11] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 193.243640][ T11] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 193.311210][ T11] usb 1-1: Dual-Role OTG device on HNP port [ 194.224526][ T11] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 194.232188][ C0] ------------[ cut here ]------------ [ 194.232315][ C0] usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0 [ 194.233367][ C0] WARNING: drivers/usb/gadget/udc/core.c:124 at usb_ep_enable+0xa0/0xdc, CPU#0: kworker/0:1/11 [ 194.241036][ C0] Modules linked in: [ 194.242620][ C0] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Tainted: G W syzkaller #0 PREEMPT [ 194.243227][ C0] Tainted: [W]=WARN [ 194.243366][ C0] Hardware name: linux,dummy-virt (DT) [ 194.243829][ C0] Workqueue: usb_hub_wq hub_event [ 194.244392][ C0] pstate: 604020c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 194.244661][ C0] pc : usb_ep_enable+0xa0/0xdc [ 194.244990][ C0] lr : usb_ep_enable+0xa0/0xdc [ 194.245138][ C0] sp : ffff800082f7bc70 [ 194.245315][ C0] x29: ffff800082f7bc70 x28: 0000000000007fff x27: 0000000000000000 [ 194.245768][ C0] x26: f2f00000036f9180 x25: f5f00000085bfcb8 x24: f9f000000e5a3e90 [ 194.246031][ C0] x23: f4f0000005bec0a8 x22: f1f00000087a0c78 x21: 0000000000000000 [ 194.246251][ C0] x20: f4f0000005becbc8 x19: f4f0000005bec0a8 x18: 00000000ffffffff [ 194.246501][ C0] x17: fff07ffffcd05000 x16: ffff800082f78000 x15: ffff800082e76919 [ 194.246801][ C0] x14: 00000000ffffffea x13: ffff800082f7b8c8 x12: 00000000000affa8 [ 194.247091][ C0] x11: ffff800082c09338 x10: 000000000002ffe8 x9 : ffff800082cb9338 [ 194.247404][ C0] x8 : ffff800082ce9320 x7 : 0000000000000001 x6 : ffffffffffffdfff [ 194.247743][ C0] x5 : fff000007f8b6188 x4 : 0000000000000000 x3 : fff07ffffcd05000 [ 194.248034][ C0] x2 : 0000000000000000 x1 : 0000000000000000 x0 : f9f000000356a200 [ 194.248448][ C0] Call trace: [ 194.248973][ C0] usb_ep_enable+0xa0/0xdc (P) [ 194.249411][ C0] hidg_set_alt+0x64/0x2b8 [ 194.249666][ C0] composite_setup+0xa04/0x1a70 [ 194.249927][ C0] configfs_composite_setup+0x80/0xac [ 194.250182][ C0] dummy_timer+0xb68/0xf90 [ 194.250330][ C0] __hrtimer_run_queues+0x100/0x170 [ 194.250492][ C0] hrtimer_run_softirq+0x6c/0xac [ 194.250628][ C0] handle_softirqs+0x100/0x248 [ 194.250775][ C0] __do_softirq+0x14/0x20 [ 194.250920][ C0] ____do_softirq+0x10/0x20 [ 194.251064][ C0] call_on_irq_stack+0x30/0x48 [ 194.251176][ C0] do_softirq_own_stack+0x1c/0x40 [ 194.251337][ C0] __irq_exit_rcu+0xe8/0x120 [ 194.251572][ C0] irq_exit_rcu+0x10/0x20 [ 194.251756][ C0] el1_interrupt+0x40/0x60 [ 194.251950][ C0] el1h_64_irq_handler+0x18/0x24 [ 194.252128][ C0] el1h_64_irq+0x6c/0x70 [ 194.252362][ C0] _raw_spin_unlock_irq+0x8/0x50 (P) [ 194.252530][ C0] schedule+0xc8/0xd4 [ 194.252689][ C0] schedule_timeout+0x8c/0x110 [ 194.252904][ C0] wait_for_completion_timeout+0x78/0x16c [ 194.253085][ C0] usb_start_wait_urb+0x124/0x168 [ 194.253256][ C0] usb_control_msg+0xc8/0x144 [ 194.253387][ C0] usb_set_configuration+0x4cc/0x8b4 [ 194.253530][ C0] usb_generic_driver_probe+0x54/0x94 [ 194.253670][ C0] usb_probe_device+0x3c/0x138 [ 194.253838][ C0] really_probe+0xbc/0x2bc [ 194.253973][ C0] __driver_probe_device+0x11c/0x184 [ 194.254103][ C0] driver_probe_device+0x3c/0x114 [ 194.254234][ C0] __device_attach_driver+0xb8/0x11c [ 194.254367][ C0] bus_for_each_drv+0x88/0xe8 [ 194.254492][ C0] __device_attach+0xa0/0x190 [ 194.254608][ C0] device_initial_probe+0x50/0x54 [ 194.254847][ C0] bus_probe_device+0x38/0xac [ 194.255010][ C0] device_add+0x5fc/0x800 [ 194.255159][ C0] usb_new_device.part.0+0x3a8/0x600 [ 194.255351][ C0] hub_event+0xee8/0x1638 [ 194.255490][ C0] process_one_work+0x1ac/0x320 [ 194.255646][ C0] worker_thread+0x184/0x2f4 [ 194.255814][ C0] kthread+0x118/0x130 [ 194.255935][ C0] ret_from_fork+0x10/0x20 [ 194.256252][ C0] ---[ end trace 0000000000000000 ]--- [ 194.257064][ C0] configfs-gadget.g1 gadget.0: Enable IN endpoint FAILED! [ 194.265089][ T11] usb 1-1: can't set config #1, error -32 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 194.738700][ T51] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.893688][ T51] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.957916][ T51] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.050489][ T51] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.648269][ T51] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 195.679128][ T51] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 195.711090][ T51] bond0 (unregistering): Released all slaves [ 195.811277][ T51] hsr_slave_0: left promiscuous mode [ 195.821000][ T51] hsr_slave_1: left promiscuous mode [ 195.847656][ T51] veth1_macvtap: left promiscuous mode [ 195.849616][ T51] veth0_macvtap: left promiscuous mode [ 195.850349][ T51] veth1_vlan: left promiscuous mode [ 195.850866][ T51] veth0_vlan: left promiscuous mode [ 196.839747][ T51] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 196.936307][ T51] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.020193][ T3221] 8021q: adding VLAN 0 to HW filter on device eth1 [ 197.049705][ T51] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.155626][ T51] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 197.933146][ T51]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 197.976700][ T51]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 198.012265][ T51]  (unregistering): Released all slaves [ 198.030202][ T51] bond1 (unregistering): Released all slaves [ 198.144382][ T51] hsr_slave_0: left promiscuous mode [ 198.154413][ T51] hsr_slave_1: left promiscuous mode [ 198.177601][ T51] veth1_macvtap: left promiscuous mode [ 198.178131][ T51] veth0_macvtap: left promiscuous mode [ 198.180463][ T51] veth1_vlan: left promiscuous mode [ 198.181039][ T51] veth0_vlan: left promiscuous mode [ 198.490763][ T51] smc: removing net device vlan1 with user defined pnetid SYZ2 [ 198.944504][ T3221] 8021q: adding VLAN 0 to HW filter on device eth2 [ 199.812520][ T3221] 8021q: adding VLAN 0 to HW filter on device eth3 [ 200.383900][ T3221] 8021q: adding VLAN 0 to HW filter on device eth4 [ 200.886077][ T3221] 8021q: adding VLAN 0 to HW filter on device eth5 [ 201.460872][ T3221] 8021q: adding VLAN 0 to HW filter on device eth6 [ 202.017242][ T3221] 8021q: adding VLAN 0 to HW filter on device eth7 [ 202.651803][ T3221] 8021q: adding VLAN 0 to HW filter on device eth8