last executing test programs: 58.920104741s ago: executing program 0 (id=1): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='file1\x00', 0x42, 0x1ff) syslog(0x3, &(0x7f0000000100)=""/65536, 0x10000) write(r0, &(0x7f0000000100)='\x00'/65536, 0x10000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='file1\x00', 0x0, 0x0) read(r1, &(0x7f0000000100)=""/65536, 0x10000) 49.735979821s ago: executing program 1 (id=2): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff00000007050102000200070581020002000705020200020007058202000200"], 0x0) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="900100"/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000200)) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000400)) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000500)="840100"/64) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000600)) nanosleep(&(0x7f0000000c00)={0x0, 0x5f5e100}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000d00)=@filename='none\x00', &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/bus/usb/drivers/cxacru/5-1:1.0/adsl_state\x00', 0x0, 0x0) read(r1, &(0x7f0000001100)=""/64, 0x40) 38.905842248s ago: executing program 0 (id=3): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x97, 0xff, 0x82, 0x8, 0x2058, 0x1005, 0xc19b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x8f, 0x0, 0x0, 0xbf, 0x57, 0x5a}}]}}]}}, 0x0) r0 = syz_usb_connect(0x3, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401107020900010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) syz_usb_ep_write(r0, 0x8d, 0x4, &(0x7f0000000110)="11111111") nanosleep(&(0x7f0000000330)={0x0, 0x1dcd6500}, 0x0) syz_usb_ep_write(r0, 0x8e, 0x20, &(0x7f0000000220)='\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"') nanosleep(&(0x7f0000000340)={0x0, 0x1dcd6500}, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x85) lseek(r1, 0x20000000, 0x0) write$char_usb(r1, &(0x7f0000000440)='33333333', 0x8) syz_usb_disconnect(r0) 23.951223693s ago: executing program 1 (id=4): r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="50000000100005060100000000000000000000000000000001000000010000000c00030076786c616e300000240012000a00010076786c616e00000014000200080001002a0000000600050012b50000", 0x50) r1 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r1, &(0x7f0000000100)="0800000000002a0011223344", 0xc, 0x0, &(0x7f0000000200)={0x2, 0x12b5, @dev={0xac, 0x14, 0x14, 0x1}}, 0x10) syz_emit_ethernet(0x3a, &(0x7f0000000300)=ANY=[@ANYBLOB="ffffffffffff00000000000008004500002c000000004011fa94ac141402ac141401303912b5001800000800000000002a001122334455667788"], 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000400)=ANY=[@ANYBLOB="ffffffffffff000000000000080045000040000000004001fa91ac141402ac1414010303b1d40000000045000024000000004011fa9dac141401ac141402303912b5001000000800000000002a0000"], 0x0) 22.229387159s ago: executing program 0 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_chmask\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_mute_present\x00', 0x1, 0x0) write(r0, &(0x7f0000000b00)='0\n', 0x2) 8.845899303s ago: executing program 1 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0\n\x00', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000a00000000040000020000000200000000000000010000000000000000000000000000000000000000000000000000000201000000000100") ioctl(r1, 0x40140921, &(0x7f0000000400)="0000000001000000000000000000000006000000") ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006000000") ioctl(r1, 0x40140921, &(0x7f0000000440)="020000000100000002000000ffffffff00000000") r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r2, &(0x7f0000000600)='3\n\x00', 0x2) close(r2) pwrite64(r1, &(0x7f0000001000), 0x1000, 0x0) 8.22093052s ago: executing program 0 (id=7): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/profiling', 0x1, 0x0) write(r0, &(0x7f0000000080)='808', 0x3) 233.804612ms ago: executing program 1 (id=8): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./tracing\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/instances/inst1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000100)='./tracing/instances/inst1/trace\x00', 0x0, 0x0) 0s ago: executing program 0 (id=9): r0 = syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff00000007050102000200070581020002000705020200020007058202000200"], 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000200)) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000100)="90000a00"/64) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000400)) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000300)="9101000000112233445500"/64) (async) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000600)) syz_usb_ep_write(r0, 0x81, 0x40, &(0x7f0000000500)="840100"/64) (async) nanosleep(&(0x7f0000000c00)={0x0, 0x11e1a300}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000d00)=@filename='none\x00', &(0x7f0000000e00)='./sys\x00', &(0x7f0000000f00)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/cxacru/adsl_state\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001100)='./sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/adsl_state\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001200)='./sys/class/atm/cxacru0/device/cxacru/adsl_state\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001300)='./sys/class/atm/cxacru0/cxacru/adsl_state\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001400)='./sys/class/atm/cxacru0/adsl_state\x00', 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:18764' (ED25519) to the list of known hosts. syzkaller login: [ 574.000505][ T3216] cgroup: Unknown subsys name 'net' [ 575.160821][ T3216] cgroup: Unknown subsys name 'cpuset' [ 575.413329][ T3216] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 656.510297][ T3216] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 822.863408][ T3225] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 823.122303][ T3225] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 826.471644][ T3223] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 826.611409][ T3223] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 837.449485][ T3225] hsr_slave_0: entered promiscuous mode [ 837.562847][ T3225] hsr_slave_1: entered promiscuous mode [ 841.630536][ T3223] hsr_slave_0: entered promiscuous mode [ 841.657858][ T3223] hsr_slave_1: entered promiscuous mode [ 841.681311][ T3223] debugfs: 'hsr0' already exists in 'hsr' [ 841.684727][ T3223] Cannot create hsr debugfs directory [ 849.974662][ T3225] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 850.213707][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 850.301832][ T3225] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 850.494408][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 850.554231][ T3225] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 850.704488][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 851.154194][ T3225] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 851.314607][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 855.220566][ T3223] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 855.641533][ T3223] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 855.798295][ T3223] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 856.762403][ T3223] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 856.921476][ T3223] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 857.332495][ T3223] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 857.530924][ T3223] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 858.575087][ T3223] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 880.378030][ T3225] 8021q: adding VLAN 0 to HW filter on device bond0 [ 884.161906][ T3223] 8021q: adding VLAN 0 to HW filter on device bond0 [ 943.570309][ T3225] veth0_vlan: entered promiscuous mode [ 945.289426][ T3225] veth1_vlan: entered promiscuous mode [ 949.406764][ T3225] veth0_macvtap: entered promiscuous mode [ 950.202261][ T3225] veth1_macvtap: entered promiscuous mode [ 954.537172][ T3265] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 954.611912][ T3237] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 955.184888][ T3223] veth0_vlan: entered promiscuous mode [ 955.256705][ T3226] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 955.374424][ T3265] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 956.561037][ T3223] veth1_vlan: entered promiscuous mode [ 963.191430][ T3223] veth0_macvtap: entered promiscuous mode [ 964.458025][ T3225] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 964.512692][ T3223] veth1_macvtap: entered promiscuous mode [ 968.712320][ T3265] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 968.902873][ T53] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 969.142086][ T3265] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 969.151652][ T3265] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 992.154124][ T29] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 998.131820][ T3844] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 999.061563][ T29] usb 2-1: device descriptor read/all, error -110 [ 999.279934][ T3844] usb 1-1: Using ep0 maxpacket: 8 [ 999.337931][ T29] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1002.909612][ T3844] usb 1-1: device descriptor read/all, error -71 [ 1007.178639][ T3867] netlink: 'syz.1.4': attribute type 5 has an invalid length. [ 1011.531941][ T3508] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1011.547293][ T3508] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1011.578373][ T3268] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1011.596654][ T3237] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1023.034839][ T3877] kernel profiling enabled (shift: 63) [ 1023.060106][ T3877] profiling shift: 63 too large [ 1028.549578][ T29] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 1029.129189][ T29] usb 1-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 1029.140833][ T29] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1034.009401][ T3882] ------------[ cut here ]------------ [ 1034.013833][ T3882] failed to allocate ring buffer on CPU 1 [ 1034.034436][ C1] WARNING: [] kernel/trace/ring_buffer.c:7976 at trace_rb_cpu_prepare+0x422/0x53c, CPU#1: syz.1.8/3882 [ 1034.037222][ C1] Modules linked in: [ 1034.038484][ C1] CPU: 1 UID: 0 PID: 3882 Comm: syz.1.8 Not tainted syzkaller #0 PREEMPT [ 1034.039253][ C1] Hardware name: riscv-virtio,qemu (DT) [ 1034.039821][ C1] epc : trace_rb_cpu_prepare+0x422/0x53c [ 1034.040578][ C1] ra : trace_rb_cpu_prepare+0x422/0x53c [ 1034.041248][ C1] epc : ffffffff8056521e ra : ffffffff8056521e sp : ffff8f800b0f7590 [ 1034.041636][ C1] gp : ffffffff8a4a7c60 tp : ffffaf8031458000 t0 : 0000000000000000 [ 1034.042060][ C1] t1 : ffffffff8007bc8e t2 : ffffffff86a06bd0 s0 : ffff8f800b0f7610 [ 1034.042483][ C1] s1 : 0000000000000001 a0 : ffffaf8031458008 a1 : ffffffff86e06ce0 [ 1034.042830][ C1] a2 : 0000000000080000 a3 : ffffffff80150b94 a4 : 0000000000000000 [ 1034.043216][ C1] a5 : 0000000000000000 a6 : 0000000000000003 a7 : 0000000041b58ab3 [ 1034.043584][ C1] s2 : ffffaf801cde7408 s3 : ffffaf801c1be4b8 s4 : 0000000000000001 [ 1034.043949][ C1] s5 : ffffaf801c1be410 s6 : ffffaf801cde7408 s7 : 0000000000000008 [ 1034.044286][ C1] s8 : 0000000000000001 s9 : ffffaf801c1be4a8 s10: ffffffffffffffff [ 1034.044623][ C1] s11: 0000000000000001 t3 : ffffffff8809bec8 t4 : fffff5ef0e58a569 [ 1034.044961][ C1] t5 : fffff5ef0e58a56a t6 : 0000000000000002 ssp : 0000000000000000 [ 1034.045290][ C1] status: 0000000200000120 badaddr: ffffffff8056521e cause: 0000000000000003 [ 1034.045756][ C1] [] trace_rb_cpu_prepare+0x422/0x53c [ 1034.046707][ C1] [] cpuhp_invoke_callback+0x1c0/0x808 [ 1034.047311][ C1] [] cpuhp_issue_call+0x1a0/0x8b8 [ 1034.047876][ C1] [] __cpuhp_state_add_instance_cpuslocked+0x200/0x462 [ 1034.048557][ C1] [] __cpuhp_state_add_instance+0x30/0x302 [ 1034.049244][ C1] [] alloc_buffer+0xbb2/0x1602 [ 1034.049806][ C1] [] __ring_buffer_alloc+0x2c/0x3a [ 1034.050418][ C1] [] allocate_trace_buffer+0x57c/0x876 [ 1034.051031][ C1] [] trace_array_create_systems+0x432/0x9d0 [ 1034.051680][ C1] [] instance_mkdir+0xc0/0x138 [ 1034.052355][ C1] [] tracefs_syscall_mkdir+0x104/0x172 [ 1034.052996][ C1] [] vfs_mkdir+0x2ea/0x708 [ 1034.053510][ C1] [] filename_mkdirat+0x414/0x54a [ 1034.054125][ C1] [] __riscv_sys_mkdirat+0x84/0xbc [ 1034.054762][ C1] [] syscall_handler+0x92/0x114 [ 1034.055434][ C1] [] do_trap_ecall_u+0x3e4/0x636 [ 1034.056052][ C1] [] handle_exception+0x168/0x174 [ 1034.057899][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1034.058838][ C1] CPU: 1 UID: 0 PID: 3882 Comm: syz.1.8 Not tainted syzkaller #0 PREEMPT [ 1034.059425][ C1] Hardware name: riscv-virtio,qemu (DT) [ 1034.059688][ C1] Call Trace: [ 1034.059901][ C1] [] dump_backtrace+0x2e/0x3c [ 1034.060646][ C1] [] show_stack+0x30/0x3c [ 1034.061155][ C1] [] dump_stack_lvl+0x114/0x1aa [ 1034.061884][ C1] [] dump_stack+0x1c/0x24 [ 1034.062683][ C1] [] vpanic+0x32e/0x75a [ 1034.063226][ C1] [] panic+0xa0/0xa2 [ 1034.063768][ C1] [] check_panic_on_warn+0xc0/0xe4 [ 1034.064369][ C1] [] __warn+0x218/0x61a [ 1034.064932][ C1] [] __report_bug+0x166/0x302 [ 1034.065648][ C1] [] report_bug+0xd8/0x28c [ 1034.066411][ C1] [] handle_break+0x13a/0x30c [ 1034.067071][ C1] [] do_trap_break+0x22e/0x458 [ 1034.067632][ C1] [] handle_exception+0x168/0x174 [ 1034.068172][ C1] [] trace_rb_cpu_prepare+0x422/0x53c [ 1034.068839][ C1] [] cpuhp_invoke_callback+0x1c0/0x808 [ 1034.069472][ C1] [] cpuhp_issue_call+0x1a0/0x8b8 [ 1034.070108][ C1] [] __cpuhp_state_add_instance_cpuslocked+0x200/0x462 [ 1034.070887][ C1] [] __cpuhp_state_add_instance+0x30/0x302 [ 1034.071598][ C1] [] alloc_buffer+0xbb2/0x1602 [ 1034.072236][ C1] [] __ring_buffer_alloc+0x2c/0x3a [ 1034.072883][ C1] [] allocate_trace_buffer+0x57c/0x876 [ 1034.073561][ C1] [] trace_array_create_systems+0x432/0x9d0 [ 1034.074317][ C1] [] instance_mkdir+0xc0/0x138 [ 1034.074975][ C1] [] tracefs_syscall_mkdir+0x104/0x172 [ 1034.075608][ C1] [] vfs_mkdir+0x2ea/0x708 [ 1034.076116][ C1] [] filename_mkdirat+0x414/0x54a [ 1034.076709][ C1] [] __riscv_sys_mkdirat+0x84/0xbc [ 1034.077282][ C1] [] syscall_handler+0x92/0x114 [ 1034.077868][ C1] [] do_trap_ecall_u+0x3e4/0x636 [ 1034.078397][ C1] [] handle_exception+0x168/0x174 [ 1034.079381][ C1] SMP: stopping secondary CPUs