last executing test programs: 2.858387819s ago: executing program 4 (id=5): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendto(r0, &(0x7f0000000000)="2c0000002f0005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c0000002f0005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000300005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000300005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000310005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000310005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000320005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000320005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000330005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000330005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000340005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000340005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000350005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000350005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000360005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000360005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000370005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000370005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000380005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) sendto(r0, &(0x7f0000000000)="2c000000380005000100000000000000010100000c00010011111111111111110c0003002222222222222222", 0x2c, 0x0, 0x0, 0x0) 2.299895402s ago: executing program 1 (id=8): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x405, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x48}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWCHAIN={0x5c, 0x3, 0xa, 0x405, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xa}, @NFTA_HOOK_DEV={0x14, 0x3, 'netdevsim0\x00'}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x84}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0xb8, 0x6, 0xa, 0xc05, 0x0, 0x0, {0x5}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x8c, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_BASE={0x8}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0xe}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x1}]}}}, {0x2c, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x20, 0x2, 0x0, 0x1, [@NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_CMP_OP={0x8}, @NFTA_CMP_DATA={0xc, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}}}, {0x30, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8}, @NFTA_IMMEDIATE_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x1}]}]}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0xe0}}, 0x0) 2.031803711s ago: executing program 1 (id=9): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0x130, 0x1c8, 0xffffffff, 0xffffffff, 0x98, 0x130, 0x1c8, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @empty, 0x0, 0x0, 'lo\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0xf, 0x7, 0x5b4}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2c0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) listen(r1, 0x5) r2 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r2, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) 1.995635078s ago: executing program 4 (id=10): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bridge0/bridge/multicast_igmp_version\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='3\n\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/net/bridge_slave_0/brport/multicast_fast_leave\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='1\n\x00', 0x2) close(r1) r2 = socket(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'veth0_to_bridge\x00', 0x0}) close(r2) r4 = socket$packet(0x11, 0x3, 0x300) bind$packet(r4, &(0x7f0000000240)={0x11, 0x300, r3, 0x1, 0x0, 0x6, @random="020000000001"}, 0x14) write(r4, &(0x7f0000000300)="01005e000016020000000001080046000030000040000102d4af0a000002e0000016940400002200d8f90000000101000001ef0101010a000001", 0x3e) nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0) write(r4, &(0x7f0000000500)="01005e000016020000000001080046000030000040000102d4af0a000002e0000016940400002200d3f90000000106000001ef0101010a000001", 0x3e) close(r4) 1.824142547s ago: executing program 1 (id=11): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000100)=0x2, 0x4) setsockopt(r0, 0x84, 0x7d, &(0x7f0000000140)="0000000001000000", 0x8) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x5) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, 0x0, 0x0) setsockopt(r1, 0x84, 0x7d, &(0x7f0000000200)="0000000001000000", 0x8) setsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000240)=@assoc_value={0x0, 0x200}, 0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000280)={0x0, 0x1}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r1, &(0x7f0000000300)='\x00'/4096, 0x1000, 0x0, 0x0, 0x0) 1.763134803s ago: executing program 0 (id=1): syz_80211_inject_frame(&(0x7f0000000080)=@device_b, &(0x7f0000000000)=ANY=[@ANYBLOB="80000000ffffffffffff02000000000002000000000000000000000000000000640001000006020202020202010882848b960c12182403010147120100105302010055030101000006020202020202"], 0x4d) 1.609788614s ago: executing program 2 (id=3): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x6f00, @loopback}, 0x10) listen(r0, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000300)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)='tcp 2049\n\x00', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000700)='4\n\x00', 0x2) 1.515589008s ago: executing program 1 (id=12): nanosleep(&(0x7f0000000340)={0x0, 0x1000000}, 0x0) 1.265411206s ago: executing program 4 (id=13): mkdir(&(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='tcp 2049\n\x00', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1\n\x00', 0x2) close(r1) 1.114093065s ago: executing program 1 (id=14): mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000840)='./config\x00', &(0x7f0000000880)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./img\x00', 0x42, 0x1ff) ftruncate(r0, 0x1000000) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x2, 0x0) write(r1, &(0x7f0000000980)='1\n\x00', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f00000009c0)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x2, 0x0) write(r2, &(0x7f0000000a40)='./img\n\x00', 0x6) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x2, 0x0) write(r3, &(0x7f0000000ac0)='1\n\x00', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/nvmet/subsystems/testsubsys/namespaces/1/resv_enable\x00', 0x2, 0x0) write(r4, &(0x7f0000000b40)='1\n\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000b80)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x2, 0x0) write(r5, &(0x7f0000000bc0)='1\n\x00', 0x2) close(r5) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/nvmet/ports/1\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000c40)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r6, &(0x7f0000000c80)='loop\n\x00', 0x5) close(r6) symlinkat(&(0x7f0000000cc0)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000d00)='./config/nvmet/ports/1/subsystems/testsubsys\x00') r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000d40), 0x2, 0x0) write(r7, &(0x7f0000000d80)='transport=loop,nqn=testsubsys\x00', 0x1e) close(r7) nanosleep(&(0x7f0000000dc0)={0x0, 0xee6b280}, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e00)='/proc/diskstats\x00', 0x0, 0x0) read(r8, &(0x7f0000000e40)=""/2000, 0x7d0) close(r8) 1.019666688s ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) read(r0, &(0x7f0000000100)=""/64, 0x40) close(r0) 685.606427ms ago: executing program 0 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'dummy0\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000780)={'bond_slave_0\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000007c0)={'bond_slave_1\x00'}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r1, &(0x7f0000000480)='-bond_slave_0\n\x00', 0xe) write(r1, &(0x7f00000004c0), 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/class/net/bond0/bonding/mode\x00', 0x2, 0x0) write(r2, &(0x7f0000000580), 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r3, &(0x7f0000000600)='+dummy0\n\x00', 0x8) 599.990565ms ago: executing program 5 (id=6): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newqdisc={0x30, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x5c, 0x2c, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff3, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x2c, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1, 0x2}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_META={0x18, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1019}, {0x1019}}}]}}]}]}]}}]}, 0x5c}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000400)={'lo\x00', 0x41}) sendto$inet(r1, &(0x7f0000000200)="01020304", 0x4, 0x0, &(0x7f0000000300)={0x2, 0x1234, @loopback}, 0x10) 270.691734ms ago: executing program 5 (id=16): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pages=64\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='naa.6001405c935d7912\n', 0x16) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000480)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0/virtual_scsi_port\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='1\n', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000680)='dummy_udc.0\n', 0xc) close(r4) nanosleep(&(0x7f00000006c0)={0x0, 0x5f5e100}, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000700), 0x1, 0x2) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) r6 = syz_open_dev$sg(&(0x7f0000000700), 0x0, 0x2) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) 249.93086ms ago: executing program 1 (id=17): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='nfsd\x00', &(0x7f0000000180)='./nfsd\x00', &(0x7f0000000200)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='tcp 2049\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/kernel/sunrpc/xprt-switches/switch-0/xprt-0-tcp/dstaddr\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='127.0.0.1\n', 0xa) close(r1) r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r2, &(0x7f0000000400)='127.0.0.1\n', 0xa) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/kernel/sunrpc/xprt-switches/switch-1/xprt-0-tcp/dstaddr\x00', 0x2, 0x0) write(r3, &(0x7f0000000400)='127.0.0.1\n', 0xa) close(r3) 0s ago: executing program 0 (id=18): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./img\x00', 0x42, 0x1ff) ftruncate(r0, 0x1000000) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='1\n\x00', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='./img\n\x00', 0x6) close(r2) write(0xffffffffffffffff, &(0x7f0000000300)='1\n\x00', 0x2) close(0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/subsystems/testsubsys/namespaces/1/resv_enable\x00', 0x2, 0x0) write(r3, &(0x7f0000000380)='1\n\x00', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x2, 0x0) write(r4, &(0x7f0000000400)='1\n', 0x2) close(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/ports/1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r5, &(0x7f00000004c0)='loop\n\x00', 0x5) r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) close(r6) mknodat(0xffffffffffffff9c, &(0x7f0000000640)='./nvmedev\x00', 0x81b0, 0x10300) r7 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./nvmedev\x00', 0x2, 0x0) ioctl(r7, 0xc01070ce, &(0x7f00000006c0)="000000001000"/16) kernel console output (not intermixed with test programs): no interfaces have a carrier [ 60.764775][ T5272] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.788012][ T5272] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.48' (ED25519) to the list of known hosts. syzkaller login: [ 86.214266][ T188] cfg80211: failed to load regulatory.db [ 89.803668][ T5597] cgroup: Unknown subsys name 'net' [ 89.895025][ T5597] cgroup: Unknown subsys name 'cpuset' [ 89.899402][ T5597] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 91.592556][ T5597] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 94.289435][ T5618] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 94.309377][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 94.321178][ T5627] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 94.327518][ T5630] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 94.328239][ T5630] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 94.330380][ T5630] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 94.332972][ T5630] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 94.333916][ T5630] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 94.335707][ T5630] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 94.337153][ T5630] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 94.338370][ T5632] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 94.338790][ T5632] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 94.340064][ T5632] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 94.341873][ T5632] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 94.342757][ T5632] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 94.343831][ T5632] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 94.345947][ T5632] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 94.346718][ T5632] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 94.359675][ T52] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 94.375494][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 94.378824][ T5632] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 94.386578][ T4926] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 94.386863][ T4926] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 94.392506][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 94.394618][ T5632] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 94.395952][ T5632] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 94.404648][ T4926] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 94.405414][ T5632] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 94.429046][ T5627] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 94.444945][ T5627] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 96.452375][ T5629] Bluetooth: hci1: command tx timeout [ 96.452574][ T5624] Bluetooth: hci0: command tx timeout [ 96.452655][ T5629] Bluetooth: hci3: command tx timeout [ 96.452662][ T5624] Bluetooth: hci2: command tx timeout [ 96.453193][ T5627] Bluetooth: hci4: command tx timeout [ 96.530620][ T5627] Bluetooth: hci5: command tx timeout [ 97.135047][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.136122][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.136665][ T5616] bridge_slave_0: entered allmulticast mode [ 97.139002][ T5616] bridge_slave_0: entered promiscuous mode [ 97.200139][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.200308][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.200710][ T5616] bridge_slave_1: entered allmulticast mode [ 97.202565][ T5616] bridge_slave_1: entered promiscuous mode [ 97.309587][ T5621] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.309757][ T5621] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.309879][ T5621] bridge_slave_0: entered allmulticast mode [ 97.315323][ T5621] bridge_slave_0: entered promiscuous mode [ 97.320232][ T5620] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.320348][ T5620] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.321136][ T5620] bridge_slave_0: entered allmulticast mode [ 97.325250][ T5620] bridge_slave_0: entered promiscuous mode [ 97.352293][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.356944][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.392541][ T5621] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.392704][ T5621] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.392828][ T5621] bridge_slave_1: entered allmulticast mode [ 97.394524][ T5621] bridge_slave_1: entered promiscuous mode [ 97.396494][ T5620] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.396611][ T5620] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.396765][ T5620] bridge_slave_1: entered allmulticast mode [ 97.399229][ T5620] bridge_slave_1: entered promiscuous mode [ 97.581344][ T5616] team0: Port device team_slave_0 added [ 97.581523][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.582431][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.582761][ T5617] bridge_slave_0: entered allmulticast mode [ 97.584399][ T5617] bridge_slave_0: entered promiscuous mode [ 97.618750][ T5621] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.623473][ T5620] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.656718][ T5616] team0: Port device team_slave_1 added [ 97.656917][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.657030][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.657151][ T5617] bridge_slave_1: entered allmulticast mode [ 97.659025][ T5617] bridge_slave_1: entered promiscuous mode [ 97.695940][ T5621] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.698521][ T5620] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.698901][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.699025][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.699146][ T5614] bridge_slave_0: entered allmulticast mode [ 97.702029][ T5614] bridge_slave_0: entered promiscuous mode [ 97.738163][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.738340][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.738786][ T5615] bridge_slave_0: entered allmulticast mode [ 97.742882][ T5615] bridge_slave_0: entered promiscuous mode [ 97.791839][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.791930][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.792047][ T5614] bridge_slave_1: entered allmulticast mode [ 97.793891][ T5614] bridge_slave_1: entered promiscuous mode [ 97.861844][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.861966][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.862117][ T5615] bridge_slave_1: entered allmulticast mode [ 97.864441][ T5615] bridge_slave_1: entered promiscuous mode [ 97.886261][ T5621] team0: Port device team_slave_0 added [ 97.912772][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.913889][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 97.913909][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.913950][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 97.918512][ T5617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.943215][ T5621] team0: Port device team_slave_1 added [ 97.985994][ T5620] team0: Port device team_slave_0 added [ 97.992020][ T5620] team0: Port device team_slave_1 added [ 97.996059][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.996897][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 97.996918][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 97.996962][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.003591][ T5617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.024944][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 98.102370][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 98.116815][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.116841][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.116909][ T5621] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.142809][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.142836][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.142880][ T5620] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.168675][ T5614] team0: Port device team_slave_0 added [ 98.174123][ T5617] team0: Port device team_slave_0 added [ 98.192792][ T5621] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.192817][ T5621] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.192861][ T5621] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.196094][ T5620] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.196115][ T5620] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.196159][ T5620] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.203127][ T5614] team0: Port device team_slave_1 added [ 98.206761][ T5617] team0: Port device team_slave_1 added [ 98.211056][ T5615] team0: Port device team_slave_0 added [ 98.342000][ T5615] team0: Port device team_slave_1 added [ 98.412295][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.412323][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.412363][ T5617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.455231][ T5616] hsr_slave_0: entered promiscuous mode [ 98.456652][ T5616] hsr_slave_1: entered promiscuous mode [ 98.467344][ T5621] hsr_slave_0: entered promiscuous mode [ 98.468595][ T5621] hsr_slave_1: entered promiscuous mode [ 98.469478][ T5621] debugfs: 'hsr0' already exists in 'hsr' [ 98.469577][ T5621] Cannot create hsr debugfs directory [ 98.472290][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.472312][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.472356][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.475062][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.475083][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.475127][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.476513][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.476533][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.476577][ T5617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.479202][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.479222][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.479266][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.484467][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.484488][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.484532][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.533831][ T5627] Bluetooth: hci4: command tx timeout [ 98.533876][ T5627] Bluetooth: hci2: command tx timeout [ 98.533910][ T5627] Bluetooth: hci0: command tx timeout [ 98.533926][ T5632] Bluetooth: hci3: command tx timeout [ 98.533959][ T5632] Bluetooth: hci1: command tx timeout [ 98.593276][ T5620] hsr_slave_0: entered promiscuous mode [ 98.595531][ T5620] hsr_slave_1: entered promiscuous mode [ 98.596496][ T5620] debugfs: 'hsr0' already exists in 'hsr' [ 98.596527][ T5620] Cannot create hsr debugfs directory [ 98.610146][ T5627] Bluetooth: hci5: command tx timeout [ 98.811323][ T5614] hsr_slave_0: entered promiscuous mode [ 98.812205][ T5614] hsr_slave_1: entered promiscuous mode [ 98.812854][ T5614] debugfs: 'hsr0' already exists in 'hsr' [ 98.812883][ T5614] Cannot create hsr debugfs directory [ 99.077752][ T5617] hsr_slave_0: entered promiscuous mode [ 99.078690][ T5617] hsr_slave_1: entered promiscuous mode [ 99.079350][ T5617] debugfs: 'hsr0' already exists in 'hsr' [ 99.079378][ T5617] Cannot create hsr debugfs directory [ 99.087122][ T5615] hsr_slave_0: entered promiscuous mode [ 99.088326][ T5615] hsr_slave_1: entered promiscuous mode [ 99.089206][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 99.089233][ T5615] Cannot create hsr debugfs directory [ 99.753042][ T5621] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 99.766481][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 99.767933][ T5621] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 99.773168][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 99.774251][ T5621] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 99.785658][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 99.788689][ T5621] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 99.799338][ T5621] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 99.898547][ T5616] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 99.913069][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 99.914191][ T5616] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 99.919581][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 99.933372][ T5616] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 99.938740][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 99.939744][ T5616] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 99.951951][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 100.064034][ T5614] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 100.071568][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 100.072713][ T5614] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 100.083365][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 100.103441][ T5614] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 100.108036][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 100.109451][ T5614] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 100.115022][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 100.177936][ T5621] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.268815][ T5615] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 100.278288][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 100.279281][ T5615] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 100.285567][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 100.312248][ T5621] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.317249][ T5615] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 100.323916][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 100.337112][ T5615] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 100.347871][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 100.356359][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.356531][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.419333][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.419434][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.523685][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.543185][ T5617] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 100.547164][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 100.548246][ T5617] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 100.556933][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 100.581915][ T5617] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 100.585444][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 100.588397][ T5617] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 100.603611][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 100.612378][ T5627] Bluetooth: hci3: command tx timeout [ 100.612423][ T5627] Bluetooth: hci2: command tx timeout [ 100.612456][ T5627] Bluetooth: hci4: command tx timeout [ 100.613828][ T5627] Bluetooth: hci0: command tx timeout [ 100.613865][ T5627] Bluetooth: hci1: command tx timeout [ 100.693939][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 100.700198][ T5627] Bluetooth: hci5: command tx timeout [ 100.748053][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 100.790208][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.790334][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.793039][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.793282][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.875091][ T5620] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 100.883479][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 100.884546][ T5620] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 100.906889][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 100.908089][ T5620] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 100.915938][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 100.930608][ T5620] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 100.936494][ T5620] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 101.000469][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.042199][ T1345] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.042341][ T1345] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.098238][ T1345] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.098347][ T1345] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.111842][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.156734][ T5616] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 101.193113][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.283936][ T168] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.284063][ T168] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.366661][ T168] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.366791][ T168] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.619177][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.684489][ T5620] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.785654][ T5617] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.795262][ T5620] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.859589][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.859744][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.876055][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.876187][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.919455][ T5621] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.954444][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.954572][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.966941][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.967065][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.691506][ T5627] Bluetooth: hci1: command tx timeout [ 102.691552][ T5627] Bluetooth: hci4: command tx timeout [ 102.691586][ T5627] Bluetooth: hci2: command tx timeout [ 102.691619][ T5627] Bluetooth: hci3: command tx timeout [ 102.691652][ T5627] Bluetooth: hci0: command tx timeout [ 102.777767][ T5624] Bluetooth: hci5: command tx timeout [ 102.939518][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.262653][ T5616] veth0_vlan: entered promiscuous mode [ 103.283625][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.348352][ T5621] veth0_vlan: entered promiscuous mode [ 103.373116][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.375471][ T5616] veth1_vlan: entered promiscuous mode [ 103.422849][ T5621] veth1_vlan: entered promiscuous mode [ 103.596975][ T5621] veth0_macvtap: entered promiscuous mode [ 103.626033][ T5616] veth0_macvtap: entered promiscuous mode [ 103.654518][ T5621] veth1_macvtap: entered promiscuous mode [ 103.678263][ T5616] veth1_macvtap: entered promiscuous mode [ 103.713034][ T5614] veth0_vlan: entered promiscuous mode [ 103.787909][ T5615] veth0_vlan: entered promiscuous mode [ 103.805381][ T5614] veth1_vlan: entered promiscuous mode [ 103.817049][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 103.821177][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 103.853053][ T5621] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 103.862644][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 103.875367][ T5615] veth1_vlan: entered promiscuous mode [ 103.941428][ T50] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.941593][ T50] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.941659][ T50] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.941731][ T50] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.002531][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 104.133542][ T168] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.133667][ T168] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.157597][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.172457][ T5614] veth0_macvtap: entered promiscuous mode [ 104.204452][ T5620] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 104.252728][ T5615] veth0_macvtap: entered promiscuous mode [ 104.267771][ T5614] veth1_macvtap: entered promiscuous mode [ 104.270201][ T168] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.308817][ T5615] veth1_macvtap: entered promiscuous mode [ 104.395496][ T168] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.395528][ T168] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.472897][ T1345] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.472931][ T1345] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.477621][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 104.493529][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 104.526717][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.564067][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.588889][ T1345] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.588921][ T1345] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.608130][ T168] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.636372][ T5620] veth0_vlan: entered promiscuous mode [ 104.643788][ T33] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.716879][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.716913][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.749341][ T5621] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 104.783579][ T5620] veth1_vlan: entered promiscuous mode [ 104.872554][ T168] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.872631][ T168] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.872696][ T168] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.872767][ T168] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.872830][ T168] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.872897][ T168] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.978579][ T5617] veth0_vlan: entered promiscuous mode [ 105.072318][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.072350][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.072972][ T5617] veth1_vlan: entered promiscuous mode [ 105.152543][ T5620] veth0_macvtap: entered promiscuous mode [ 105.233251][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.233282][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.265843][ T5620] veth1_macvtap: entered promiscuous mode [ 105.322114][ T5847] netlink: 'syz.4.5': attribute type 11 has an invalid length. [ 105.323809][ T5848] netlink: 'syz.4.5': attribute type 11 has an invalid length. [ 105.363755][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.363784][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.474226][ T5851] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5'. [ 105.494098][ T5851] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5'. [ 105.496781][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 105.500784][ T5847] netlink: 'syz.4.5': attribute type 1 has an invalid length. [ 105.500808][ T5847] netlink: 'syz.4.5': attribute type 3 has an invalid length. [ 105.509753][ T5847] netlink: 'syz.4.5': attribute type 1 has an invalid length. [ 105.509781][ T5847] netlink: 'syz.4.5': attribute type 3 has an invalid length. [ 105.529131][ T5847] netlink: 'syz.4.5': attribute type 3 has an invalid length. [ 105.539601][ T5847] netlink: 'syz.4.5': attribute type 3 has an invalid length. [ 105.542174][ T5847] netlink: 'syz.4.5': attribute type 1 has an invalid length. [ 105.546462][ T5847] netlink: 'syz.4.5': attribute type 1 has an invalid length. [ 105.558701][ T5617] veth0_macvtap: entered promiscuous mode [ 105.570945][ T5847] netlink: 'syz.4.5': attribute type 1 has an invalid length. [ 105.570973][ T5847] netlink: 'syz.4.5': attribute type 3 has an invalid length. [ 105.585057][ T5620] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 105.591815][ T5846] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 105.611032][ T168] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.611061][ T168] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.638971][ T5617] veth1_macvtap: entered promiscuous mode [ 105.753154][ T5858] ip_tables: iptables: counters copy to user failed while replacing table [ 105.773170][ T168] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.773251][ T168] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.773311][ T168] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.773371][ T168] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 105.946378][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.037284][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.267570][ T5866] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 106.298047][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.298077][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.300241][ T59] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.300320][ T59] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.300381][ T59] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.300443][ T59] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 106.426121][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.426171][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.646034][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.646066][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.832216][ T5880] nvmet: adding nsid 1 to subsystem testsubsys [ 106.878318][ T1345] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.878353][ T1345] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.944904][ T5873] svc: failed to register lockdv1 RPC service (errno 111). [ 106.945219][ T5873] lockd_up: makesock failed, error=-111 [ 107.107401][ T1345] nvmet: Created nvm controller 1 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:8f15e37d-a15b-4d30-aaa9-56f2f8572065. [ 107.213368][ T5880] nvme nvme0: creating 2 I/O queues. [ 107.245158][ T5880] nvme nvme0: new ctrl: "testsubsys" [ 107.476241][ T5890] bond0: (slave bond_slave_0): Releasing backup interface [ 107.479396][ T5873] svc: failed to register nfsdv3 RPC service (errno 512). [ 107.501948][ T5873] svc: failed to register nfsaclv3 RPC service (errno 512). [ 107.501981][ T5873] failed to unregister tcp with rpcbind [ 107.502887][ T5873] svc: failed to register nfsdv3 RPC service (errno 97). [ 107.502996][ T5873] svc: failed to register nfsaclv3 RPC service (errno 97). [ 107.503021][ T5873] failed to unregister tcp with rpcbind [ 107.630271][ T5892] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 107.717973][ T5894] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 107.774629][ T5894] [ 107.777008][ T5894] ====================================================== [ 107.784033][ T5894] WARNING: possible circular locking dependency detected [ 107.791058][ T5894] syzkaller #0 Not tainted [ 107.795480][ T5894] ------------------------------------------------------ [ 107.802503][ T5894] syz.5.16/5894 is trying to acquire lock: [ 107.808318][ T5894] ffffffff90483240 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x20/0x440 [ 107.817312][ T5894] [ 107.817312][ T5894] but task is already holding lock: [ 107.824686][ T5894] ffff888052fc0390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 107.833740][ T5894] [ 107.833740][ T5894] which lock already depends on the new lock. [ 107.833740][ T5894] [ 107.844237][ T5894] [ 107.844237][ T5894] the existing dependency chain (in reverse order) is: [ 107.853258][ T5894] [ 107.853258][ T5894] -> #2 (&gi->lock){+.+.}-{4:4}: [ 107.860418][ T5894] lock_acquire+0x1d1/0x380 [ 107.865463][ T5894] __mutex_lock+0x1a4/0x1bd0 [ 107.870597][ T5894] config_usb_cfg_link+0x57/0x3a0 [ 107.876175][ T5894] configfs_symlink+0x695/0x1340 [ 107.881713][ T5894] vfs_symlink+0x178/0x4d0 [ 107.886675][ T5894] filename_symlinkat+0x2a6/0x560 [ 107.892238][ T5894] __x64_sys_symlinkat+0x9c/0xe0 [ 107.897718][ T5894] do_syscall_64+0x123/0x790 [ 107.902851][ T5894] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.909278][ T5894] [ 107.909278][ T5894] -> #1 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 107.918178][ T5894] lock_acquire+0x1d1/0x380 [ 107.923223][ T5894] down_write+0x8b/0x1f0 [ 107.928009][ T5894] configfs_depend_item_unlocked+0xf3/0x6a0 [ 107.934458][ T5894] usbg_make_tpg+0x251/0x610 [ 107.939602][ T5894] target_fabric_make_tpg+0xab/0x8c0 [ 107.945424][ T5894] configfs_mkdir+0x525/0xd40 [ 107.950658][ T5894] vfs_mkdir+0x364/0x850 [ 107.955455][ T5894] filename_mkdirat+0x48b/0x5e0 [ 107.960841][ T5894] __x64_sys_mkdirat+0x89/0xc0 [ 107.966177][ T5894] do_syscall_64+0x123/0x790 [ 107.971349][ T5894] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.977789][ T5894] [ 107.977789][ T5894] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 107.985724][ T5894] check_prev_add+0xeb/0xe60 [ 107.990859][ T5894] __lock_acquire+0x1528/0x1f40 [ 107.996247][ T5894] lock_acquire+0x1d1/0x380 [ 108.001320][ T5894] __mutex_lock+0x1a4/0x1bd0 [ 108.006444][ T5894] tcm_alloc+0x20/0x440 [ 108.011152][ T5894] usb_get_function+0x5e/0xd0 [ 108.016372][ T5894] config_usb_cfg_link+0x1ed/0x3a0 [ 108.022016][ T5894] configfs_symlink+0x695/0x1340 [ 108.027509][ T5894] vfs_symlink+0x178/0x4d0 [ 108.032479][ T5894] filename_symlinkat+0x2a6/0x560 [ 108.038069][ T5894] __x64_sys_symlinkat+0x9c/0xe0 [ 108.043542][ T5894] do_syscall_64+0x123/0x790 [ 108.048668][ T5894] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.055141][ T5894] [ 108.055141][ T5894] other info that might help us debug this: [ 108.055141][ T5894] [ 108.065425][ T5894] Chain exists of: [ 108.065425][ T5894] tpg_instances_lock --> &sb->s_type->i_mutex_key#24 --> &gi->lock [ 108.065425][ T5894] [ 108.079312][ T5894] Possible unsafe locking scenario: [ 108.079312][ T5894] [ 108.086764][ T5894] CPU0 CPU1 [ 108.092131][ T5894] ---- ---- [ 108.097512][ T5894] lock(&gi->lock); [ 108.101421][ T5894] lock(&sb->s_type->i_mutex_key#24); [ 108.109426][ T5894] lock(&gi->lock); [ 108.115847][ T5894] lock(tpg_instances_lock); [ 108.120537][ T5894] [ 108.120537][ T5894] *** DEADLOCK *** [ 108.120537][ T5894] [ 108.128675][ T5894] locks held by syz.5.16/5894: 3, last CPU#1: [ 108.134753][ T5894] #0: ffff88801e33e460 (sb_writers#12){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 108.144332][ T5894] #1: ffff88805399fa40 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 108.155302][ T5894] #2: ffff888052fc0390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 108.164763][ T5894] [ 108.164763][ T5894] stack backtrace: [ 108.170661][ T5894] CPU: 1 UID: 0 PID: 5894 Comm: syz.5.16 Not tainted syzkaller #0 PREEMPT(full) [ 108.179788][ T5894] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 108.189853][ T5894] Call Trace: [ 108.193137][ T5894] [ 108.196070][ T5894] dump_stack_lvl+0x100/0x190 [ 108.200776][ T5894] print_circular_bug.cold+0x178/0x1be [ 108.206361][ T5894] check_noncircular+0x146/0x160 [ 108.211342][ T5894] check_prev_add+0xeb/0xe60 [ 108.215947][ T5894] __lock_acquire+0x1528/0x1f40 [ 108.220823][ T5894] lock_acquire+0x1d1/0x380 [ 108.225339][ T5894] ? tcm_alloc+0x20/0x440 [ 108.229703][ T5894] ? __pfx___might_resched+0x10/0x10 [ 108.235050][ T5894] ? config_usb_cfg_link+0x57/0x3a0 [ 108.240269][ T5894] __mutex_lock+0x1a4/0x1bd0 [ 108.244876][ T5894] ? tcm_alloc+0x20/0x440 [ 108.249243][ T5894] ? tcm_alloc+0x20/0x440 [ 108.253610][ T5894] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.259263][ T5894] ? __mutex_lock+0x26c/0x1bd0 [ 108.264045][ T5894] ? config_usb_cfg_link+0x57/0x3a0 [ 108.269260][ T5894] ? __pfx___mutex_lock+0x10/0x10 [ 108.274296][ T5894] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.279951][ T5894] ? __lock_acquire+0x5c0/0x1f40 [ 108.284923][ T5894] ? tcm_alloc+0x20/0x440 [ 108.289372][ T5894] tcm_alloc+0x20/0x440 [ 108.293586][ T5894] usb_get_function+0x5e/0xd0 [ 108.298370][ T5894] config_usb_cfg_link+0x1ed/0x3a0 [ 108.303501][ T5894] ? mntput_no_expire+0xe7/0x220 [ 108.308505][ T5894] configfs_symlink+0x695/0x1340 [ 108.313508][ T5894] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.319159][ T5894] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.324822][ T5894] ? security_inode_permission+0xbf/0x250 [ 108.330579][ T5894] ? __pfx_configfs_symlink+0x10/0x10 [ 108.335987][ T5894] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.341763][ T5894] vfs_symlink+0x178/0x4d0 [ 108.346204][ T5894] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.351866][ T5894] filename_symlinkat+0x2a6/0x560 [ 108.356911][ T5894] ? __pfx_filename_symlinkat+0x10/0x10 [ 108.362505][ T5894] ? strncpy_from_user+0x19d/0x2d0 [ 108.367649][ T5894] ? srso_alias_return_thunk+0x5/0xfbef5 [ 108.373304][ T5894] ? do_getname+0x191/0x390 [ 108.377832][ T5894] __x64_sys_symlinkat+0x9c/0xe0 [ 108.382790][ T5894] do_syscall_64+0x123/0x790 [ 108.387395][ T5894] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.393299][ T5894] RIP: 0033:0x7fc3c419e159 [ 108.397720][ T5894] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 108.417372][ T5894] RSP: 002b:00007fc3c50ba028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 108.425823][ T5894] RAX: ffffffffffffffda RBX: 00007fc3c4425fa0 RCX: 00007fc3c419e159 [ 108.433822][ T5894] RDX: 0000200000000600 RSI: ffffffffffffff9c RDI: 00002000000005c0 [ 108.441815][ T5894] RBP: 00007fc3c423506b R08: 0000000000000000 R09: 0000000000000000 [ 108.449829][ T5894] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 108.457817][ T5894] R13: 00007fc3c4426038 R14: 00007fc3c4425fa0 R15: 00007ffebf667cf8 [ 108.465821][ T5894] [ 108.519390][ T5900] nvmet: the ns:1 is already enabled. [ 108.526572][ T5900] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 108.850586][ T1213] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 109.010673][ T1213] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.03 [ 109.011214][ T1213] usb 1-1: Dual-Role OTG device on HNP port [ 109.011524][ T1213] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.014028][ T5752] Using the BOT protocol [ 109.017741][ T5752] Using the UAS protocol [ 109.037681][ T1213] scsi host1: uas [ 109.047798][ T12] scsi 1:0:0:0: Direct-Access LIO-ORG RAMDISK-MCP 4.0 PQ: 0 ANSI: 6 [ 109.075232][ T12] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 109.078516][ T61] sd 1:0:0:0: [sdb] 512 512-byte logical blocks: (262 kB/256 KiB) [ 109.079714][ T61] sd 1:0:0:0: [sdb] Write Protect is off [ 109.079761][ T61] sd 1:0:0:0: [sdb] Mode Sense: 43 00 00 08 [ 109.082226][ T61] sd 1:0:0:0: [sdb] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA [ 109.176130][ T61] sd 1:0:0:0: [sdb] Attached SCSI disk [ 110.672096][ T5874] svc: failed to register nfsdv3 RPC service (errno 512). [ 110.672236][ T5874] svc: failed to register nfsaclv3 RPC service (errno 512). [ 110.672259][ T5874] failed to unregister tcp with rpcbind [ 110.672384][ T5874] svc: failed to register nfsdv3 RPC service (errno 97). [ 110.672408][ T5874] svc: failed to register nfsaclv3 RPC service (errno 97). [ 110.672429][ T5874] failed to unregister tcp with rpcbind [ 110.778142][ T5616] svc: failed to register nfsdv3 RPC service (errno 111). [ 110.778916][ T5616] svc: failed to register nfsaclv3 RPC service (errno 111). [ 110.778941][ T5616] failed to unregister tcp with rpcbind [ 110.779066][ T5616] svc: failed to register nfsdv3 RPC service (errno 97). [ 110.779090][ T5616] svc: failed to register nfsaclv3 RPC service (errno 97). [ 110.779111][ T5616] failed to unregister tcp with rpcbind