last executing test programs: 1.001651986s ago: executing program 1 (id=2): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000480)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x200}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) nanosleep(&(0x7f0000000300)={0x2}, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x11, 0x2) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000200)=@usbdevfs_connect) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/net/usb0/cdc_ncm/min_tx_pkt\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='10\n\x00', 0x3) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/net/wwan0/cdc_ncm/min_tx_pkt\x00', 0x2, 0x0) write(r3, &(0x7f0000000300)='10\n\x00', 0x3) 403.031574ms ago: executing program 2 (id=3): r0 = syz_usb_connect(0x0, 0x3d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b1130000000000001090227000101008032090400000300000000070501020002000705810200020007058202000200"], 0x0) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\x00\x00') syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00') syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00') syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00') syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00') syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00') syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00') syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00') syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00') syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00') nanosleep(&(0x7f0000000200)={0x2}, 0x0) 22.441349ms ago: executing program 0 (id=1): r0 = syz_usb_connect(0x0, 0x3d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x9710, 0x7720, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2e, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x5, 0xff, 0x0, 0x0, 0x0, [], [{{0x9, 0x5, 0x81, 0x3, 0x8, 0x1}}, {{0x9, 0x5, 0x82, 0x2, 0x40}}, {{0x9, 0x5, 0x2, 0x2, 0x40}}, {{0x9, 0x5, 0x83, 0x2, 0x40}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}]}}]}}]}}, 0x0) nanosleep(&(0x7f0000000300)={0x2}, 0x0) syz_usb_disconnect(r0) 0s ago: executing program 3 (id=4): unshare(0x20000200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x777) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x777) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x777) openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0/ifname\x00', 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.45' (ED25519) to the list of known hosts. [ 70.801773][ T5602] cgroup: Unknown subsys name 'net' [ 70.911560][ T5602] cgroup: Unknown subsys name 'cpuset' [ 70.921174][ T5602] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 71.691124][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.691240][ T1311] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.580932][ T5602] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.058532][ T5622] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.059500][ T5622] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.060457][ T5622] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.082312][ T5628] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.083008][ T5628] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.100170][ T5624] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.107714][ T5624] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.115705][ T5624] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.116930][ T5628] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.118075][ T5628] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.119076][ T5628] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.120374][ T5628] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.121292][ T5628] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.121599][ T5628] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.124031][ T5628] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.124321][ T5628] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.150613][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.173607][ T5624] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.185271][ T5628] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.186660][ T5628] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 77.775106][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.775978][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.776113][ T5616] bridge_slave_0: entered allmulticast mode [ 77.778500][ T5616] bridge_slave_0: entered promiscuous mode [ 77.783979][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.784083][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.784206][ T5616] bridge_slave_1: entered allmulticast mode [ 77.786153][ T5616] bridge_slave_1: entered promiscuous mode [ 77.895448][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.895583][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.895705][ T5615] bridge_slave_0: entered allmulticast mode [ 77.897557][ T5615] bridge_slave_0: entered promiscuous mode [ 77.901115][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.901221][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.901337][ T5615] bridge_slave_1: entered allmulticast mode [ 77.903336][ T5615] bridge_slave_1: entered promiscuous mode [ 77.968943][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.969091][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.969213][ T5613] bridge_slave_0: entered allmulticast mode [ 77.972158][ T5613] bridge_slave_0: entered promiscuous mode [ 77.976091][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.976195][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.977058][ T5613] bridge_slave_1: entered allmulticast mode [ 77.979361][ T5613] bridge_slave_1: entered promiscuous mode [ 77.985685][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.990518][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.990711][ T5614] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.990822][ T5614] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.990944][ T5614] bridge_slave_0: entered allmulticast mode [ 77.993011][ T5614] bridge_slave_0: entered promiscuous mode [ 77.996680][ T5614] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.996877][ T5614] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.996999][ T5614] bridge_slave_1: entered allmulticast mode [ 77.999686][ T5614] bridge_slave_1: entered promiscuous mode [ 78.023258][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.088389][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.147908][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.151742][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.169062][ T5628] Bluetooth: hci1: command tx timeout [ 78.169341][ T4932] Bluetooth: hci2: command tx timeout [ 78.170657][ T5616] team0: Port device team_slave_0 added [ 78.173896][ T5616] team0: Port device team_slave_1 added [ 78.178971][ T5614] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.182560][ T5615] team0: Port device team_slave_0 added [ 78.216071][ T5614] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.219499][ T5615] team0: Port device team_slave_1 added [ 78.222410][ T5613] team0: Port device team_slave_0 added [ 78.247930][ T5628] Bluetooth: hci0: command tx timeout [ 78.247937][ T4932] Bluetooth: hci3: command tx timeout [ 78.264378][ T5613] team0: Port device team_slave_1 added [ 78.277024][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.277124][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.277159][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.298802][ T5614] team0: Port device team_slave_0 added [ 78.334811][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.334866][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.335868][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.339290][ T5614] team0: Port device team_slave_1 added [ 78.340230][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.340242][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.340264][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.342591][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.342603][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.342633][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.494944][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.495032][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.495057][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.526154][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.526173][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.526196][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.557618][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.557647][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.557678][ T5614] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.633026][ T5614] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.633389][ T5614] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.633416][ T5614] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.642645][ T5616] hsr_slave_0: entered promiscuous mode [ 78.643784][ T5616] hsr_slave_1: entered promiscuous mode [ 78.656000][ T5615] hsr_slave_0: entered promiscuous mode [ 78.657088][ T5615] hsr_slave_1: entered promiscuous mode [ 78.658334][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 78.658410][ T5615] Cannot create hsr debugfs directory [ 78.769787][ T5613] hsr_slave_0: entered promiscuous mode [ 78.770913][ T5613] hsr_slave_1: entered promiscuous mode [ 78.771804][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 78.771823][ T5613] Cannot create hsr debugfs directory [ 78.801179][ T5614] hsr_slave_0: entered promiscuous mode [ 78.802263][ T5614] hsr_slave_1: entered promiscuous mode [ 78.802950][ T5614] debugfs: 'hsr0' already exists in 'hsr' [ 78.802969][ T5614] Cannot create hsr debugfs directory [ 79.235136][ T5615] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 79.250900][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.252867][ T5615] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 79.263300][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.266255][ T5615] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 79.281543][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.282782][ T5615] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 79.293795][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 79.374691][ T5613] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 79.384642][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.385797][ T5613] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 79.396895][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.416085][ T5613] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 79.427197][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.428479][ T5613] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 79.439502][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 79.549818][ T5614] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 79.561137][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.572121][ T5614] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 79.582906][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.583804][ T5614] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 79.595878][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.612082][ T5614] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 79.621729][ T5614] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 79.654723][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.720563][ T5616] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.730934][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 79.731842][ T5616] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.742959][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 79.756935][ T5616] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.766715][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 79.778879][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.779271][ T5616] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.795098][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 79.836709][ T3376] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.836849][ T3376] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.862635][ T1135] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.862757][ T1135] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.970306][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.991978][ T5614] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.026560][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.063022][ T1152] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.063152][ T1152] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.104735][ T5614] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.106809][ T989] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.106932][ T989] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.152474][ T1135] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.152615][ T1135] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.154942][ T1135] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.155041][ T1135] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.254845][ T5628] Bluetooth: hci2: command tx timeout [ 80.254873][ T4932] Bluetooth: hci1: command tx timeout [ 80.280910][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 80.328191][ T5628] Bluetooth: hci0: command tx timeout [ 80.329319][ T4932] Bluetooth: hci3: command tx timeout [ 80.376962][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 80.428005][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.428143][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.458332][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.458479][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.058074][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.221255][ T5615] veth0_vlan: entered promiscuous mode [ 81.264643][ T5615] veth1_vlan: entered promiscuous mode [ 81.443694][ T5615] veth0_macvtap: entered promiscuous mode [ 81.476292][ T5615] veth1_macvtap: entered promiscuous mode [ 81.494691][ T5614] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.521587][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.550638][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.578801][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.600630][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.673290][ T5614] veth0_vlan: entered promiscuous mode [ 81.704929][ T1131] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.730369][ T59] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.730451][ T59] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.765042][ T5614] veth1_vlan: entered promiscuous mode [ 81.819499][ T5613] veth0_vlan: entered promiscuous mode [ 81.820154][ T5616] veth0_vlan: entered promiscuous mode [ 81.833161][ T1131] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.833183][ T1131] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.883421][ T5616] veth1_vlan: entered promiscuous mode [ 81.888546][ T5613] veth1_vlan: entered promiscuous mode [ 81.913918][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.914639][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.947230][ T5614] veth0_macvtap: entered promiscuous mode [ 81.958649][ T989] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.981658][ T5614] veth1_macvtap: entered promiscuous mode [ 82.067130][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.086113][ T5615] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 82.113682][ T5613] veth0_macvtap: entered promiscuous mode [ 82.124484][ T5616] veth0_macvtap: entered promiscuous mode [ 82.135122][ T5614] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.172717][ T5616] veth1_macvtap: entered promiscuous mode [ 82.187109][ T5613] veth1_macvtap: entered promiscuous mode [ 82.283269][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.284277][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.284317][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.284350][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.295035][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.329047][ T5628] Bluetooth: hci1: command tx timeout [ 82.337783][ T5628] Bluetooth: hci2: command tx timeout [ 82.359513][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.401115][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.409018][ T5628] Bluetooth: hci3: command tx timeout [ 82.418952][ T5628] Bluetooth: hci0: command tx timeout [ 82.432161][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.548184][ T989] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.548259][ T989] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.548314][ T989] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.548355][ T989] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.548394][ T989] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.548435][ T989] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.578923][ T59] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.580686][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.580703][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.656507][ T1135] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.656561][ T1135] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.690045][ T1220] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 82.834746][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.834808][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.854606][ T1220] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 82.870666][ T1220] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 82.891275][ T1220] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.891321][ T1220] usb 2-1: Product: syz [ 82.891356][ T1220] usb 2-1: Manufacturer: syz [ 82.891375][ T1220] usb 2-1: SerialNumber: syz [ 82.942607][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.942999][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.014452][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.022548][ T1131] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.030151][ T1131] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.030172][ T1131] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.030516][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.189149][ T5619] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 83.318893][ T5776] ================================================================== ** replaying previous printk message ** [ 83.318893][ T5776] ================================================================== [ 83.318916][ T5776] BUG: KASAN: slab-out-of-bounds in gether_get_ifname+0xee/0x110 [ 83.318946][ T5776] Read of size 1 at addr ffff88802b8df042 by task syz.3.4/5776 [ 83.318965][ T5776] [ 83.318976][ T5776] CPU: 0 UID: 0 PID: 5776 Comm: syz.3.4 Not tainted syzkaller #0 PREEMPT(full) [ 83.319000][ T5776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 83.319013][ T5776] Call Trace: [ 83.319021][ T5776] [ 83.319031][ T5776] dump_stack_lvl+0xe8/0x150 [ 83.319057][ T5776] print_address_description+0x55/0x1e0 [ 83.319102][ T5776] ? gether_get_ifname+0xee/0x110 [ 83.319120][ T5776] print_report+0x58/0x70 [ 83.319145][ T5776] kasan_report+0x117/0x150 [ 83.319172][ T5776] ? gether_get_ifname+0xee/0x110 [ 83.319195][ T5776] gether_get_ifname+0xee/0x110 [ 83.319215][ T5776] f_phonet_ifname_show+0x48/0x60 [ 83.319242][ T5776] ? __pfx_f_phonet_ifname_show+0x10/0x10 [ 83.319278][ T5776] configfs_read_iter+0x2b7/0x620 [ 83.319303][ T5776] __kernel_read+0x4ca/0x960 [ 83.319336][ T5776] ? __pfx___kernel_read+0x10/0x10 [ 83.319374][ T5776] ? rcu_is_watching+0x16/0xb0 [ 83.319395][ T5776] integrity_kernel_read+0x89/0xd0 [ 83.319422][ T5776] ? __pfx_integrity_kernel_read+0x10/0x10 [ 83.319448][ T5776] ? __kmalloc_cache_noprof+0x14d/0x600 [ 83.319469][ T5776] ? ima_calc_file_hash+0x40f/0x890 [ 83.319490][ T5776] ? ima_calc_file_hash+0x40f/0x890 [ 83.319514][ T5776] ima_calc_file_hash+0x451/0x890 [ 83.319539][ T5776] ? __pfx_ima_calc_file_hash+0x10/0x10 [ 83.319578][ T5776] ? generic_fillattr+0x575/0x840 [ 83.319606][ T5776] ima_collect_measurement+0x51b/0xa00 [ 83.319633][ T5776] ? __pfx_ima_collect_measurement+0x10/0x10 [ 83.319660][ T5776] ? trace_contention_end+0x3d/0x140 [ 83.319696][ T5776] ? __pfx_ima_get_hash_algo+0x10/0x10 [ 83.319729][ T5776] process_measurement+0x1272/0x1c10 [ 83.319758][ T5776] ? __pfx_process_measurement+0x10/0x10 [ 83.319794][ T5776] ? __pfx___up_read+0x10/0x10 [ 83.319822][ T5776] ima_file_check+0xe1/0x130 [ 83.319843][ T5776] ? __pfx_ima_file_check+0x10/0x10 [ 83.319868][ T5776] security_file_post_open+0xb3/0x260 [ 83.319895][ T5776] path_openat+0x1485/0x1d60 [ 83.319925][ T5776] do_file_open+0x23e/0x4a0 [ 83.319947][ T5776] ? __pfx_do_file_open+0x10/0x10 [ 83.319977][ T5776] ? _raw_spin_unlock+0x28/0x50 [ 83.320000][ T5776] ? alloc_fd+0x651/0x6c0 [ 83.320030][ T5776] do_sys_openat2+0x115/0x200 [ 83.320056][ T5776] ? __se_sys_futex+0x3a8/0x450 [ 83.320077][ T5776] ? __pfx_do_sys_openat2+0x10/0x10 [ 83.320114][ T5776] ? __pfx___se_sys_futex+0x10/0x10 [ 83.320135][ T5776] ? __se_sys_mkdirat+0xc9/0x150 [ 83.320157][ T5776] ? kmem_cache_free+0x182/0x650 [ 83.320180][ T5776] __x64_sys_openat+0x138/0x170 [ 83.320208][ T5776] do_syscall_64+0x166/0x520 [ 83.320234][ T5776] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.320255][ T5776] ? clear_bhb_loop+0x70/0xc0 [ 83.320279][ T5776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.320299][ T5776] RIP: 0033:0x7f8ca419e0d9 [ 83.320319][ T5776] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.320337][ T5776] RSP: 002b:00007f8ca50eb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 83.320361][ T5776] RAX: ffffffffffffffda RBX: 00007f8ca4425fa0 RCX: 00007f8ca419e0d9 [ 83.320376][ T5776] RDX: 0000000000000000 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 83.320391][ T5776] RBP: 00007f8ca4235024 R08: 0000000000000000 R09: 0000000000000000 [ 83.320404][ T5776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.320416][ T5776] R13: 00007f8ca4426038 R14: 00007f8ca4425fa0 R15: 00007ffe8c681928 [ 83.320438][ T5776] [ 83.320446][ T5776] [ 83.320452][ T5776] Allocated by task 5776: [ 83.320461][ T5776] kasan_save_track+0x3e/0x80 [ 83.320483][ T5776] __kasan_kmalloc+0x93/0xb0 [ 83.320502][ T5776] __kvmalloc_node_noprof+0x50f/0x820 [ 83.320523][ T5776] alloc_netdev_mqs+0xa9/0x12b0 [ 83.320545][ T5776] phonet_alloc_inst+0xa4/0x180 [ 83.320568][ T5776] usb_get_function_instance+0xe3/0x2f0 [ 83.320591][ T5776] function_make+0x127/0x360 [ 83.320611][ T5776] configfs_mkdir+0x4f6/0x9e0 [ 83.320624][ T5776] vfs_mkdir+0x40c/0x620 [ 83.320635][ T5776] filename_mkdirat+0x285/0x510 [ 83.320646][ T5776] __se_sys_mkdirat+0x35/0x150 [ 83.320661][ T5776] do_syscall_64+0x166/0x520 [ 83.320682][ T5776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.320699][ T5776] [ 83.320705][ T5776] The buggy address belongs to the object at ffff88802b8de000 [ 83.320705][ T5776] which belongs to the cache kmalloc-cg-4k of size 4096 [ 83.320721][ T5776] The buggy address is located 314 bytes to the right of [ 83.320721][ T5776] allocated 3848-byte region [ffff88802b8de000, ffff88802b8def08) [ 83.320740][ T5776] [ 83.320745][ T5776] The buggy address belongs to the physical page: [ 83.320755][ T5776] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802b8d8000 pfn:0x2b8d8 [ 83.320772][ T5776] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 83.320781][ T5776] memcg:ffff8880758043c1 [ 83.320786][ T5776] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 83.320799][ T5776] page_type: f5(slab) [ 83.320810][ T5776] raw: 00fff00000000240 ffff88813ff1b500 ffff88813ff1a7c8 ffffea0000ad0410 [ 83.320821][ T5776] raw: ffff88802b8d8000 0000000200040003 00000000f5000000 ffff8880758043c1 [ 83.320838][ T5776] head: 00fff00000000240 ffff88813ff1b500 ffff88813ff1a7c8 ffffea0000ad0410 [ 83.320856][ T5776] head: ffff88802b8d8000 0000000200040003 00000000f5000000 ffff8880758043c1 [ 83.320873][ T5776] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 83.320889][ T5776] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 83.320898][ T5776] page dumped because: kasan: bad access detected [ 83.320907][ T5776] page_owner tracks the page as allocated [ 83.320914][ T5776] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4991, tgid 4991 (udevd), ts 33142070950 [ 83.320938][ T5776] post_alloc_hook+0x1f9/0x250 [ 83.320955][ T5776] get_page_from_freelist+0x2209/0x2280 [ 83.320967][ T5776] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 83.320980][ T5776] allocate_slab+0x7d/0x620 [ 83.321003][ T5776] refill_objects+0x2d5/0x350 [ 83.321026][ T5776] __pcs_replace_empty_main+0x2c8/0x6c0 [ 83.321049][ T5776] __kvmalloc_node_noprof+0x63c/0x820 [ 83.321068][ T5776] seq_read_iter+0x1ea/0xca0 [ 83.321093][ T5776] vfs_read+0x595/0xa80 [ 83.321109][ T5776] ksys_read+0x150/0x270 [ 83.321124][ T5776] do_syscall_64+0x166/0x520 [ 83.321138][ T5776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.321156][ T5776] page last free pid 4986 tgid 4986 ts 33125065751 stack trace: [ 83.321170][ T5776] __free_frozen_pages+0xc93/0xd90 [ 83.321187][ T5776] __slab_free+0x274/0x2c0 [ 83.321204][ T5776] qlist_free_all+0x99/0x100 [ 83.321222][ T5776] kasan_quarantine_reduce+0x148/0x160 [ 83.321240][ T5776] __kasan_slab_alloc+0x22/0x80 [ 83.321254][ T5776] __kmalloc_cache_noprof+0x29f/0x600 [ 83.321264][ T5776] kernfs_fop_open+0x3ac/0xce0 [ 83.321278][ T5776] do_dentry_open+0x816/0x1380 [ 83.321292][ T5776] vfs_open+0x3b/0x340 [ 83.321310][ T5776] path_openat+0x1443/0x1d60 [ 83.321328][ T5776] do_file_open+0x23e/0x4a0 [ 83.321345][ T5776] do_sys_openat2+0x115/0x200 [ 83.321366][ T5776] __x64_sys_openat+0x138/0x170 [ 83.321388][ T5776] do_syscall_64+0x166/0x520 [ 83.321405][ T5776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.321416][ T5776] [ 83.321419][ T5776] Memory state around the buggy address: [ 83.321425][ T5776] ffff88802b8def00: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 83.321433][ T5776] ffff88802b8def80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 83.321441][ T5776] >ffff88802b8df000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 83.321447][ T5776] ^ [ 83.321455][ T5776] ffff88802b8df080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 83.321467][ T5776] ffff88802b8df100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 83.321476][ T5776] ================================================================== [ 83.328669][ T5776] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 84.144910][ T5776] CPU: 0 UID: 0 PID: 5776 Comm: syz.3.4 Not tainted syzkaller #0 PREEMPT(full) [ 84.154039][ T5776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 84.164625][ T5776] Call Trace: [ 84.168123][ T5776] [ 84.171244][ T5776] vpanic+0x56d/0xa60 [ 84.175250][ T5776] ? __pfx_vpanic+0x10/0x10 [ 84.179777][ T5776] ? __pfx___schedule+0x10/0x10 [ 84.184757][ T5776] panic+0xc5/0xd0 [ 84.188499][ T5776] ? __pfx_panic+0x10/0x10 [ 84.192932][ T5776] ? preempt_schedule_common+0x7f/0xd0 [ 84.198510][ T5776] ? gether_get_ifname+0xee/0x110 [ 84.203561][ T5776] check_panic_on_warn+0x89/0xb0 [ 84.208519][ T5776] ? gether_get_ifname+0xee/0x110 [ 84.213557][ T5776] end_report+0x73/0x170 [ 84.217832][ T5776] ? gether_get_ifname+0xee/0x110 [ 84.222869][ T5776] kasan_report+0x128/0x150 [ 84.227399][ T5776] ? gether_get_ifname+0xee/0x110 [ 84.232470][ T5776] gether_get_ifname+0xee/0x110 [ 84.237440][ T5776] f_phonet_ifname_show+0x48/0x60 [ 84.242491][ T5776] ? __pfx_f_phonet_ifname_show+0x10/0x10 [ 84.248236][ T5776] configfs_read_iter+0x2b7/0x620 [ 84.253300][ T5776] __kernel_read+0x4ca/0x960 [ 84.257992][ T5776] ? __pfx___kernel_read+0x10/0x10 [ 84.263473][ T5776] ? rcu_is_watching+0x16/0xb0 [ 84.268253][ T5776] integrity_kernel_read+0x89/0xd0 [ 84.273474][ T5776] ? __pfx_integrity_kernel_read+0x10/0x10 [ 84.279381][ T5776] ? __kmalloc_cache_noprof+0x14d/0x600 [ 84.284934][ T5776] ? ima_calc_file_hash+0x40f/0x890 [ 84.290137][ T5776] ? ima_calc_file_hash+0x40f/0x890 [ 84.295427][ T5776] ima_calc_file_hash+0x451/0x890 [ 84.300813][ T5776] ? __pfx_ima_calc_file_hash+0x10/0x10 [ 84.306466][ T5776] ? generic_fillattr+0x575/0x840 [ 84.311515][ T5776] ima_collect_measurement+0x51b/0xa00 [ 84.317263][ T5776] ? __pfx_ima_collect_measurement+0x10/0x10 [ 84.323280][ T5776] ? trace_contention_end+0x3d/0x140 [ 84.328870][ T5776] ? __pfx_ima_get_hash_algo+0x10/0x10 [ 84.334554][ T5776] process_measurement+0x1272/0x1c10 [ 84.339868][ T5776] ? __pfx_process_measurement+0x10/0x10 [ 84.345520][ T5776] ? __pfx___up_read+0x10/0x10 [ 84.350310][ T5776] ima_file_check+0xe1/0x130 [ 84.355002][ T5776] ? __pfx_ima_file_check+0x10/0x10 [ 84.360386][ T5776] security_file_post_open+0xb3/0x260 [ 84.365788][ T5776] path_openat+0x1485/0x1d60 [ 84.370487][ T5776] do_file_open+0x23e/0x4a0 [ 84.375005][ T5776] ? __pfx_do_file_open+0x10/0x10 [ 84.380223][ T5776] ? _raw_spin_unlock+0x28/0x50 [ 84.385079][ T5776] ? alloc_fd+0x651/0x6c0 [ 84.389430][ T5776] do_sys_openat2+0x115/0x200 [ 84.394478][ T5776] ? __se_sys_futex+0x3a8/0x450 [ 84.399345][ T5776] ? __pfx_do_sys_openat2+0x10/0x10 [ 84.404632][ T5776] ? __pfx___se_sys_futex+0x10/0x10 [ 84.409839][ T5776] ? __se_sys_mkdirat+0xc9/0x150 [ 84.414787][ T5776] ? kmem_cache_free+0x182/0x650 [ 84.419830][ T5776] __x64_sys_openat+0x138/0x170 [ 84.424701][ T5776] do_syscall_64+0x166/0x520 [ 84.429306][ T5776] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.435382][ T5776] ? clear_bhb_loop+0x70/0xc0 [ 84.440327][ T5776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.446399][ T5776] RIP: 0033:0x7f8ca419e0d9 [ 84.451001][ T5776] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 84.470992][ T5776] RSP: 002b:00007f8ca50eb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 84.479431][ T5776] RAX: ffffffffffffffda RBX: 00007f8ca4425fa0 RCX: 00007f8ca419e0d9 [ 84.487411][ T5776] RDX: 0000000000000000 RSI: 0000200000000180 RDI: ffffffffffffff9c [ 84.495395][ T5776] RBP: 00007f8ca4235024 R08: 0000000000000000 R09: 0000000000000000 [ 84.503377][ T5776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 84.511469][ T5776] R13: 00007f8ca4426038 R14: 00007f8ca4425fa0 R15: 00007ffe8c681928 [ 84.519460][ T5776] [ 84.522877][ T5776] Kernel Offset: disabled [ 84.527312][ T5776] Rebooting in 86400 seconds..