last executing test programs:
3.298133993s ago: executing program 3 (id=4):
r0 = syz_usb_connect(0x0, 0x3d, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x9710, 0x7720, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2e, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x5, 0xff, 0x0, 0x0, 0x0, [], [{{0x9, 0x5, 0x81, 0x3, 0x8, 0x1}}, {{0x9, 0x5, 0x82, 0x2, 0x40}}, {{0x9, 0x5, 0x2, 0x2, 0x40}}, {{0x9, 0x5, 0x83, 0x2, 0x40}}, {{0x9, 0x5, 0x3, 0x2, 0x40}}]}}]}}]}}, 0x0)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
syz_usb_disconnect(r0)
2.898702265s ago: executing program 1 (id=2):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/devices/0000:00:01.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='0000:00:01.0\x00', 0xd)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pci/drivers/cirrus-qemu/new_id\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/bus/pci/drivers_probe\x00', 0x1, 0x0)
write(r1, &(0x7f0000000b00)='0000:00:01.0\x00', 0xd)
2.738103826s ago: executing program 2 (id=3):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./my_configfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./my_configfs\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./my_configfs/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000001c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r0, &(0x7f0000000280)='dummy_udc.0\x00', 0xb)
2.686528788s ago: executing program 1 (id=5):
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0)
write(r0, &(0x7f0000000000)='1\x00', 0x1)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/rescan\x00', 0x1, 0x0)
write(r1, &(0x7f0000000000)='1\x00', 0x1)
2.490027351s ago: executing program 2 (id=6):
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040b4040221000101020301090212000101008032090400000000000000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
2.425213585s ago: executing program 1 (id=7):
mmap(&(0x7f0000000000/0x100000)=nil, 0x100000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x100000})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
close(r1)
close(r0)
2.234252452s ago: executing program 1 (id=8):
r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000480)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}, {{0x9, 0x5, 0x81, 0x3, 0x200}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}}}}}}]}}, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x11, 0x2)
ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000200)=@usbdevfs_connect)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/net/usb0/cdc_ncm/min_tx_pkt\x00', 0x2, 0x0)
write(r2, &(0x7f0000000300)='10\n\x00', 0x3)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/net/wwan0/cdc_ncm/min_tx_pkt\x00', 0x2, 0x0)
write(r3, &(0x7f0000000300)='10\n\x00', 0x3)
676.136175ms ago: executing program 0 (id=11):
r0 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='vers\x00', &(0x7f0000000200)='4.0\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000300)='addr\x00', &(0x7f0000000400)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000500)='source\x00', &(0x7f0000000600)='127.0.0.1:/\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000700)='clientaddr\x00', &(0x7f0000000800)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt\x00', 0x1ff)
move_mount(r1, &(0x7f0000000a00)='\x00', 0xffffffffffffff9c, &(0x7f0000000900)='./mnt\x00', 0x4)
openat(0xffffffffffffff9c, &(0x7f0000000b00)='./mnt/file0\x00', 0x0, 0x0)
630.25854ms ago: executing program 0 (id=12):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r0, 0xc138fd03, &(0x7f0000000000)="04000000320000000000000038010000380100000000000000000000000000000000000063616368655f7465737400")
559.147245ms ago: executing program 0 (id=13):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed)
mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/devices/0000:00:01.0/driver/unbind\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='0000:00:01.0\x00', 0xd)
openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pci/drivers/cirrus-qemu/new_id\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/bus/pci/drivers_probe\x00', 0x1, 0x0)
write(r1, &(0x7f0000000b00)='0000:00:01.0\x00', 0xd)
496.276276ms ago: executing program 0 (id=14):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f0000000200)={0x0, &(0x7f0000000000)=[@wrmsr={0x65, 0x20, {0x186, 0x40003c}}, @wrmsr={0x65, 0x20, {0x38f, 0x1}}, @uexit={0x0, 0x18}], 0x58})
ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000100)={0x2, 0x0, [{0x1, 0x0, 0x0, 0x0, 0xa01}, {0xa, 0x0, 0x0, 0x0, 0x7300402}]})
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000300)={0x2, 0x0, [{0x186, 0x0, 0x40003c}, {0x38f, 0x0, 0x1}]})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
268.080699ms ago: executing program 0 (id=15):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000100)={[], 0x0, 0x202})
ioctl$KVM_SET_MSRS(r2, 0x4140aecd, &(0x7f0000000200)={0x2, 0x0, [{0x1b, 0x0, 0xfee00c00}, {0x80f, 0x0, 0x1ff}]})
ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000300)={0xfee00000, 0x0, 0x30})
ioctl$KVM_RUN(r2, 0xae80, 0x0)
247.084835ms ago: executing program 2 (id=16):
mkdir(&(0x7f0000000100)='./my_sysfs\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./my_sysfs\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./my_sysfs/bus/pci/drivers/cdns3-pci-usbss\x00', 0x10000, 0x0)
168.289873ms ago: executing program 2 (id=17):
mkdir(&(0x7f0000000000)='./dir0\x00', 0x1ff)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./dir0\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000200)=""/2048, 0x800)
mkdir(&(0x7f0000000300)='./dir1\x00', 0x1ff)
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./dir1\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000000500)=""/2048, 0x800)
88.194224ms ago: executing program 0 (id=18):
r0 = syz_usb_connect(0x0, 0x3d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040480b1130000000000001090227000101008032090400000300000000070501020002000705810200020007058202000200"], 0x0)
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\x00\x00')
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00')
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00')
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00')
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00')
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00')
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00')
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00')
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00')
syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f0000000100)='\b\x00')
nanosleep(&(0x7f0000000200)={0x2}, 0x0)
55.31732ms ago: executing program 2 (id=19):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x1ff)
symlinkat(&(0x7f00000001c0)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1/phonet.usb0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='\n', 0x1)
close(r1)
rmdir(&(0x7f0000000380)='./config/usb_gadget/g1/functions/phonet.usb0\x00')
0s ago: executing program 2 (id=20):
unshare(0x20000200)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x777)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x777)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x777)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0/ifname\x00', 0x0, 0x0)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.222' (ED25519) to the list of known hosts.
[ 72.374030][ T5601] cgroup: Unknown subsys name 'net'
[ 72.483551][ T5601] cgroup: Unknown subsys name 'cpuset'
[ 72.493557][ T5601] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 74.135248][ T5601] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 77.530923][ T5612] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 77.539232][ T5612] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 77.546992][ T5612] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 77.555302][ T5612] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 77.563157][ T5612] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 77.679670][ T5612] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 77.695479][ T52] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 77.703526][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 77.705052][ T5621] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 77.729943][ T5623] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 77.738074][ T5623] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 77.738481][ T5623] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 77.754026][ T5623] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 77.754329][ T5621] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 77.762179][ T5623] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 77.826414][ T5612] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 77.837415][ T5612] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 77.847080][ T5612] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 77.850948][ T5612] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 77.851576][ T5612] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 78.877648][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state
[ 78.877984][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state
[ 78.878111][ T5610] bridge_slave_0: entered allmulticast mode
[ 78.880817][ T5610] bridge_slave_0: entered promiscuous mode
[ 78.901068][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state
[ 78.901173][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state
[ 78.901291][ T5610] bridge_slave_1: entered allmulticast mode
[ 78.903332][ T5610] bridge_slave_1: entered promiscuous mode
[ 78.983284][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 79.005444][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 79.055643][ T5610] team0: Port device team_slave_0 added
[ 79.078728][ T5610] team0: Port device team_slave_1 added
[ 79.150926][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 79.150972][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 79.152133][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 79.179436][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 79.179453][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 79.179476][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 79.404748][ T5610] hsr_slave_0: entered promiscuous mode
[ 79.405788][ T5610] hsr_slave_1: entered promiscuous mode
[ 79.441061][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state
[ 79.441251][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state
[ 79.441376][ T5617] bridge_slave_0: entered allmulticast mode
[ 79.443444][ T5617] bridge_slave_0: entered promiscuous mode
[ 79.479862][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state
[ 79.480042][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state
[ 79.480165][ T5617] bridge_slave_1: entered allmulticast mode
[ 79.482009][ T5617] bridge_slave_1: entered promiscuous mode
[ 79.568482][ T5617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 79.583645][ T5619] bridge0: port 1(bridge_slave_0) entered blocking state
[ 79.583840][ T5619] bridge0: port 1(bridge_slave_0) entered disabled state
[ 79.583963][ T5619] bridge_slave_0: entered allmulticast mode
[ 79.586106][ T5619] bridge_slave_0: entered promiscuous mode
[ 79.592166][ T5617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 79.639597][ T5619] bridge0: port 2(bridge_slave_1) entered blocking state
[ 79.639728][ T5619] bridge0: port 2(bridge_slave_1) entered disabled state
[ 79.639859][ T5619] bridge_slave_1: entered allmulticast mode
[ 79.642151][ T5619] bridge_slave_1: entered promiscuous mode
[ 79.651002][ T5612] Bluetooth: hci0: command tx timeout
[ 79.699495][ T5617] team0: Port device team_slave_0 added
[ 79.703034][ T5617] team0: Port device team_slave_1 added
[ 79.764997][ T5619] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 79.765216][ T5626] bridge0: port 1(bridge_slave_0) entered blocking state
[ 79.766342][ T5626] bridge0: port 1(bridge_slave_0) entered disabled state
[ 79.766461][ T5626] bridge_slave_0: entered allmulticast mode
[ 79.768230][ T5626] bridge_slave_0: entered promiscuous mode
[ 79.772201][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 79.772214][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 79.772236][ T5617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 79.773575][ T5626] bridge0: port 2(bridge_slave_1) entered blocking state
[ 79.773674][ T5626] bridge0: port 2(bridge_slave_1) entered disabled state
[ 79.774110][ T5626] bridge_slave_1: entered allmulticast mode
[ 79.776513][ T5626] bridge_slave_1: entered promiscuous mode
[ 79.793913][ T5619] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 79.794811][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 79.794823][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 79.794846][ T5617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 79.834865][ T5623] Bluetooth: hci1: command tx timeout
[ 79.835200][ T5612] Bluetooth: hci2: command tx timeout
[ 79.899457][ T5626] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 79.914009][ T5612] Bluetooth: hci3: command tx timeout
[ 79.953330][ T5619] team0: Port device team_slave_0 added
[ 79.956253][ T5619] team0: Port device team_slave_1 added
[ 79.971483][ T5626] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 80.018418][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 80.021052][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 80.021080][ T5619] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 80.024638][ T5626] team0: Port device team_slave_0 added
[ 80.033469][ T5617] hsr_slave_0: entered promiscuous mode
[ 80.034780][ T5617] hsr_slave_1: entered promiscuous mode
[ 80.035821][ T5617] debugfs: 'hsr0' already exists in 'hsr'
[ 80.035886][ T5617] Cannot create hsr debugfs directory
[ 80.060532][ T5619] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 80.060550][ T5619] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 80.060572][ T5619] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 80.078811][ T5626] team0: Port device team_slave_1 added
[ 80.159476][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 80.159518][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 80.159542][ T5626] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 80.191980][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 80.191998][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 80.192020][ T5626] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 80.265318][ T5619] hsr_slave_0: entered promiscuous mode
[ 80.266303][ T5619] hsr_slave_1: entered promiscuous mode
[ 80.267024][ T5619] debugfs: 'hsr0' already exists in 'hsr'
[ 80.267043][ T5619] Cannot create hsr debugfs directory
[ 80.353252][ T5610] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 80.365790][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 80.383405][ T5626] hsr_slave_0: entered promiscuous mode
[ 80.384506][ T5626] hsr_slave_1: entered promiscuous mode
[ 80.385183][ T5626] debugfs: 'hsr0' already exists in 'hsr'
[ 80.385201][ T5626] Cannot create hsr debugfs directory
[ 80.409757][ T5610] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 80.422341][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 80.428051][ T5610] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 80.442484][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 80.467738][ T5610] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 80.476879][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 80.747135][ T5617] netdevsim netdevsim3 netdevsim0: renamed from eth0
[ 80.759726][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 80.769304][ T5617] netdevsim netdevsim3 netdevsim1: renamed from eth1
[ 80.779109][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 80.788199][ T5617] netdevsim netdevsim3 netdevsim2: renamed from eth2
[ 80.798866][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 80.814104][ T5617] netdevsim netdevsim3 netdevsim3: renamed from eth3
[ 80.823658][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 80.881411][ T5619] netdevsim netdevsim1 netdevsim0: renamed from eth0
[ 80.894605][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 80.905843][ T5619] netdevsim netdevsim1 netdevsim1: renamed from eth1
[ 80.915667][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 80.923918][ T5619] netdevsim netdevsim1 netdevsim2: renamed from eth2
[ 80.928296][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 80.936834][ T5619] netdevsim netdevsim1 netdevsim3: renamed from eth3
[ 80.945315][ T5619] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 80.969969][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0
[ 81.046421][ T5626] netdevsim netdevsim2 netdevsim0: renamed from eth0
[ 81.056447][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[ 81.066788][ T5610] 8021q: adding VLAN 0 to HW filter on device team0
[ 81.074308][ T5626] netdevsim netdevsim2 netdevsim1: renamed from eth1
[ 81.083665][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[ 81.097942][ T5626] netdevsim netdevsim2 netdevsim2: renamed from eth2
[ 81.107088][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[ 81.118195][ T35] bridge0: port 1(bridge_slave_0) entered blocking state
[ 81.118372][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 81.133670][ T5626] netdevsim netdevsim2 netdevsim3: renamed from eth3
[ 81.146231][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[ 81.159996][ T35] bridge0: port 2(bridge_slave_1) entered blocking state
[ 81.160112][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 81.229198][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0
[ 81.278146][ T5617] 8021q: adding VLAN 0 to HW filter on device team0
[ 81.299789][ T5619] 8021q: adding VLAN 0 to HW filter on device bond0
[ 81.309118][ T83] bridge0: port 1(bridge_slave_0) entered blocking state
[ 81.309222][ T83] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 81.340164][ T1014] bridge0: port 2(bridge_slave_1) entered blocking state
[ 81.340548][ T1014] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 81.392026][ T5619] 8021q: adding VLAN 0 to HW filter on device team0
[ 81.445900][ T83] bridge0: port 1(bridge_slave_0) entered blocking state
[ 81.446040][ T83] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 81.495993][ T1014] bridge0: port 2(bridge_slave_1) entered blocking state
[ 81.496217][ T1014] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 81.655311][ T5626] 8021q: adding VLAN 0 to HW filter on device bond0
[ 81.730557][ T5612] Bluetooth: hci0: command tx timeout
[ 81.752618][ T5626] 8021q: adding VLAN 0 to HW filter on device team0
[ 81.804100][ T70] bridge0: port 1(bridge_slave_0) entered blocking state
[ 81.804234][ T70] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 81.834273][ T35] bridge0: port 2(bridge_slave_1) entered blocking state
[ 81.834463][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 81.900320][ T5612] Bluetooth: hci2: command tx timeout
[ 81.900370][ T5612] Bluetooth: hci1: command tx timeout
[ 81.970518][ T5623] Bluetooth: hci3: command tx timeout
[ 82.517090][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 82.682990][ T5610] veth0_vlan: entered promiscuous mode
[ 82.751245][ T5610] veth1_vlan: entered promiscuous mode
[ 82.795997][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 82.914346][ T5610] veth0_macvtap: entered promiscuous mode
[ 82.947321][ T5610] veth1_macvtap: entered promiscuous mode
[ 82.989793][ T5617] veth0_vlan: entered promiscuous mode
[ 83.012085][ T5619] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 83.037331][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 83.057007][ T5617] veth1_vlan: entered promiscuous mode
[ 83.071441][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 83.138041][ T5626] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 83.156096][ T5617] veth0_macvtap: entered promiscuous mode
[ 83.173220][ T1014] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.173384][ T1014] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.190748][ T1014] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.190793][ T1014] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.234594][ T5617] veth1_macvtap: entered promiscuous mode
[ 83.274593][ T5619] veth0_vlan: entered promiscuous mode
[ 83.282817][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 83.291088][ T70] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 83.291109][ T70] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 83.295189][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 83.356461][ T5619] veth1_vlan: entered promiscuous mode
[ 83.379355][ T1014] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 83.379396][ T1014] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 83.480091][ T5626] veth0_vlan: entered promiscuous mode
[ 83.512734][ T5610] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 83.553141][ T5626] veth1_vlan: entered promiscuous mode
[ 83.556721][ T1014] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 83.556740][ T1014] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 83.573672][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.573982][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.574024][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.574058][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.579199][ T5619] veth0_macvtap: entered promiscuous mode
[ 83.608565][ T5619] veth1_macvtap: entered promiscuous mode
[ 83.712381][ T83] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 83.718544][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 83.720995][ T83] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 83.725936][ T5619] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 83.793855][ T5626] veth0_macvtap: entered promiscuous mode
[ 83.811201][ T5623] Bluetooth: hci0: command tx timeout
[ 83.839591][ T5626] veth1_macvtap: entered promiscuous mode
[ 83.846056][ T1014] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.846123][ T1014] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.846175][ T1014] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.846210][ T1014] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.865846][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 83.872279][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 83.902430][ T70] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.970975][ T5623] Bluetooth: hci1: command tx timeout
[ 83.971369][ T5623] Bluetooth: hci2: command tx timeout
[ 83.981415][ T1014] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.981587][ T1014] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 83.981760][ T1014] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 84.011017][ T5611] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 84.036382][ T4863] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 84.044590][ T4863] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 84.050915][ T5612] Bluetooth: hci3: command tx timeout
[ 84.100099][ T1014] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 84.111992][ T1014] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 84.169616][ T4863] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 84.169662][ T4863] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 84.187410][ T5611] usb 1-1: New USB device found, idVendor=1199, idProduct=0fff, bcdDevice= 0.00
[ 84.205619][ T5611] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 84.205659][ T5611] usb 1-1: Product: syz
[ 84.205971][ T5611] usb 1-1: Manufacturer: syz
[ 84.205993][ T5611] usb 1-1: SerialNumber: syz
[ 84.215590][ T31] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[ 84.257558][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 84.257606][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 84.291385][ T5611] usb-storage 1-1:1.0: USB Mass Storage device detected
[ 84.361226][ T31] usb 4-1: New USB device found, idVendor=9710, idProduct=7720, bcdDevice= 0.00
[ 84.372149][ T31] usb 4-1: config index 0 descriptor too short (expected 46, got 43)
[ 84.372193][ T31] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config
[ 84.372274][ T31] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64
[ 84.372304][ T31] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5
[ 84.425985][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 84.426062][ T31] usb 4-1: Product: syz
[ 84.426096][ T31] usb 4-1: Manufacturer: syz
[ 84.426115][ T31] usb 4-1: SerialNumber: syz
[ 84.470418][ T5766] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22
[ 84.503538][ T31] mos7720 4-1:1.0: required endpoints missing
[ 84.567519][ T5772] UDC core: g1: couldn't find an available UDC or it's busy
[ 84.654522][ T5774] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint
[ 84.749640][ T5761] usb 4-1: USB disconnect, device number 2
[ 84.788739][ T5780] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
[ 84.964148][ T31] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[ 85.122143][ T31] usb 3-1: New USB device found, idVendor=04b4, idProduct=2102, bcdDevice= 1.00
[ 85.136761][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 85.145584][ T31] usb 3-1: Product: syz
[ 85.145652][ T31] usb 3-1: Manufacturer: syz
[ 85.145674][ T31] usb 3-1: SerialNumber: syz
[ 85.161692][ T31] dvb-usb: found a 'DVBWorld DVB-S 2102 USB2.0' in cold state, will try to load a firmware
[ 85.171321][ T31] usb 3-1: Direct firmware load for dvb-usb-dw2102.fw failed with error -2
[ 85.171346][ T31] usb 3-1: Falling back to sysfs fallback for: dvb-usb-dw2102.fw
[ 85.200569][ T5708] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[ 85.352448][ T5708] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[ 85.354215][ T5708] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[ 85.356356][ T5708] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 85.356377][ T5708] usb 2-1: Product: syz
[ 85.356390][ T5708] usb 2-1: Manufacturer: syz
[ 85.356403][ T5708] usb 2-1: SerialNumber: syz
[ 85.793142][ T5611] usb-storage 1-1:1.0: probe with driver usb-storage failed with error -5
[ 85.798902][ T5611] usb 1-1: USB disconnect, device number 2
[ 85.892011][ T5612] Bluetooth: hci0: command tx timeout
[ 86.050515][ T5623] Bluetooth: hci1: command tx timeout
[ 86.055948][ T5612] Bluetooth: hci2: command tx timeout
[ 86.130754][ T5612] Bluetooth: hci3: command tx timeout
[ 86.375327][ T5708] cdc_ncm 2-1:1.0: MAC-Address: 42:42:42:42:42:42
[ 86.384407][ T5708] cdc_ncm 2-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048
[ 86.393533][ T5708] cdc_ncm 2-1:1.0: setting rx_max = 2048
[ 86.572146][ T5793] device-mapper: ioctl: name not supplied when creating device
[ 86.759142][ T5798] kvm [5797]: vcpu0, guest rIP: 0x55d80 Unhandled WRMSR(0x186) = 0x40003c
[ 86.774544][ T1012] cfg80211: failed to load regulatory.db
[ 87.213576][ T5812] =========================================================
** replaying previous printk message **
[ 87.213576][ T5812] ==================================================================
[ 87.213596][ T5812] BUG: KASAN: slab-out-of-bounds in gether_get_ifname+0xee/0x110
[ 87.213627][ T5812] Read of size 1 at addr ffff88802d043042 by task syz.2.20/5812
[ 87.213644][ T5812]
[ 87.213654][ T5812] CPU: 1 UID: 0 PID: 5812 Comm: syz.2.20 Not tainted syzkaller #0 PREEMPT(full)
[ 87.213677][ T5812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 87.213690][ T5812] Call Trace:
[ 87.213698][ T5812]
[ 87.213708][ T5812] dump_stack_lvl+0xe8/0x150
[ 87.213734][ T5812] print_address_description+0x55/0x1e0
[ 87.213776][ T5812] ? gether_get_ifname+0xee/0x110
[ 87.213795][ T5812] print_report+0x58/0x70
[ 87.213820][ T5812] kasan_report+0x117/0x150
[ 87.213849][ T5812] ? gether_get_ifname+0xee/0x110
[ 87.213872][ T5812] gether_get_ifname+0xee/0x110
[ 87.213893][ T5812] f_phonet_ifname_show+0x48/0x60
[ 87.213920][ T5812] ? __pfx_f_phonet_ifname_show+0x10/0x10
[ 87.213946][ T5812] configfs_read_iter+0x2b7/0x620
[ 87.213971][ T5812] __kernel_read+0x4ca/0x960
[ 87.214004][ T5812] ? __pfx___kernel_read+0x10/0x10
[ 87.214042][ T5812] ? rcu_is_watching+0x16/0xb0
[ 87.214064][ T5812] integrity_kernel_read+0x89/0xd0
[ 87.214091][ T5812] ? __pfx_integrity_kernel_read+0x10/0x10
[ 87.214119][ T5812] ? __kmalloc_cache_noprof+0x14d/0x600
[ 87.214140][ T5812] ? ima_calc_file_hash+0x40f/0x890
[ 87.214161][ T5812] ? ima_calc_file_hash+0x40f/0x890
[ 87.214186][ T5812] ima_calc_file_hash+0x451/0x890
[ 87.214209][ T5812] ? __pfx_ima_calc_file_hash+0x10/0x10
[ 87.214246][ T5812] ? generic_fillattr+0x575/0x840
[ 87.214275][ T5812] ima_collect_measurement+0x51b/0xa00
[ 87.214303][ T5812] ? __pfx_ima_collect_measurement+0x10/0x10
[ 87.214330][ T5812] ? trace_contention_end+0x3d/0x140
[ 87.214363][ T5812] ? __pfx_ima_get_hash_algo+0x10/0x10
[ 87.214396][ T5812] process_measurement+0x1272/0x1c10
[ 87.214425][ T5812] ? __pfx_process_measurement+0x10/0x10
[ 87.214466][ T5812] ? __pfx___up_read+0x10/0x10
[ 87.214493][ T5812] ima_file_check+0xe1/0x130
[ 87.214514][ T5812] ? __pfx_ima_file_check+0x10/0x10
[ 87.214538][ T5812] security_file_post_open+0xb3/0x260
[ 87.214564][ T5812] path_openat+0x1485/0x1d60
[ 87.214593][ T5812] do_file_open+0x23e/0x4a0
[ 87.214615][ T5812] ? __pfx_do_file_open+0x10/0x10
[ 87.214642][ T5812] ? _raw_spin_unlock+0x28/0x50
[ 87.214664][ T5812] ? alloc_fd+0x651/0x6c0
[ 87.214694][ T5812] do_sys_openat2+0x115/0x200
[ 87.214719][ T5812] ? __se_sys_futex+0x3a8/0x450
[ 87.214741][ T5812] ? __pfx_do_sys_openat2+0x10/0x10
[ 87.214776][ T5812] ? rcu_is_watching+0x16/0xb0
[ 87.214797][ T5812] __x64_sys_openat+0x138/0x170
[ 87.214826][ T5812] do_syscall_64+0x166/0x520
[ 87.214851][ T5812] ? trace_irq_disable+0x3b/0x140
[ 87.214880][ T5812] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.214901][ T5812] ? clear_bhb_loop+0x70/0xc0
[ 87.214924][ T5812] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.214944][ T5812] RIP: 0033:0x7f39e8f9e0d9
[ 87.214964][ T5812] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.214982][ T5812] RSP: 002b:00007f39e9e93028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 87.215007][ T5812] RAX: ffffffffffffffda RBX: 00007f39e9225fa0 RCX: 00007f39e8f9e0d9
[ 87.215023][ T5812] RDX: 0000000000000000 RSI: 0000200000000180 RDI: ffffffffffffff9c
[ 87.215038][ T5812] RBP: 00007f39e9035024 R08: 0000000000000000 R09: 0000000000000000
[ 87.215051][ T5812] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.215064][ T5812] R13: 00007f39e9226038 R14: 00007f39e9225fa0 R15: 00007ffd54dbbc28
[ 87.215085][ T5812]
[ 87.215093][ T5812]
[ 87.215098][ T5812] Allocated by task 5786:
[ 87.215109][ T5812] kasan_save_track+0x3e/0x80
[ 87.215130][ T5812] __kasan_kmalloc+0x93/0xb0
[ 87.215152][ T5812] __kvmalloc_node_noprof+0x50f/0x820
[ 87.215174][ T5812] alloc_netdev_mqs+0xa9/0x12b0
[ 87.215215][ T5812] phonet_alloc_inst+0xa4/0x180
[ 87.215239][ T5812] usb_get_function_instance+0xe3/0x2f0
[ 87.215264][ T5812] function_make+0x127/0x360
[ 87.215290][ T5812] configfs_mkdir+0x4f6/0x9e0
[ 87.215312][ T5812] vfs_mkdir+0x40c/0x620
[ 87.215331][ T5812] filename_mkdirat+0x285/0x510
[ 87.215350][ T5812] __se_sys_mkdirat+0x35/0x150
[ 87.215370][ T5812] do_syscall_64+0x166/0x520
[ 87.215394][ T5812] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.215413][ T5812]
[ 87.215418][ T5812] The buggy address belongs to the object at ffff88802d042000
[ 87.215418][ T5812] which belongs to the cache kmalloc-cg-4k of size 4096
[ 87.215434][ T5812] The buggy address is located 314 bytes to the right of
[ 87.215434][ T5812] allocated 3848-byte region [ffff88802d042000, ffff88802d042f08)
[ 87.215456][ T5812]
[ 87.215461][ T5812] The buggy address belongs to the physical page:
[ 87.215470][ T5812] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d040
[ 87.215488][ T5812] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 87.215504][ T5812] memcg:ffff888078f25401
[ 87.215513][ T5812] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 87.215532][ T5812] page_type: f5(slab)
[ 87.215551][ T5812] raw: 00fff00000000040 ffff88813ff1b500 dead000000000100 dead000000000122
[ 87.215569][ T5812] raw: 0000000000000000 0000000200040004 00000000f5000000 ffff888078f25401
[ 87.215588][ T5812] head: 00fff00000000040 ffff88813ff1b500 dead000000000100 dead000000000122
[ 87.215606][ T5812] head: 0000000000000000 0000000200040004 00000000f5000000 ffff888078f25401
[ 87.215625][ T5812] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 87.215641][ T5812] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 87.215651][ T5812] page dumped because: kasan: bad access detected
[ 87.215660][ T5812] page_owner tracks the page as allocated
[ 87.215668][ T5812] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4983, tgid 4983 (udevd), ts 31980017255
[ 87.215700][ T5812] post_alloc_hook+0x1f9/0x250
[ 87.215730][ T5812] get_page_from_freelist+0x2209/0x2280
[ 87.215760][ T5812] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 87.215781][ T5812] allocate_slab+0x7d/0x620
[ 87.215804][ T5812] refill_objects+0x2d5/0x350
[ 87.215829][ T5812] __pcs_replace_empty_main+0x2c8/0x6c0
[ 87.215853][ T5812] __kvmalloc_node_noprof+0x63c/0x820
[ 87.215873][ T5812] seq_read_iter+0x1ea/0xca0
[ 87.215894][ T5812] vfs_read+0x595/0xa80
[ 87.215921][ T5812] ksys_read+0x150/0x270
[ 87.215946][ T5812] do_syscall_64+0x166/0x520
[ 87.215970][ T5812] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.215989][ T5812] page last free pid 4987 tgid 4987 ts 31967522434 stack trace:
[ 87.216004][ T5812] __free_frozen_pages+0xc93/0xd90
[ 87.216021][ T5812] __slab_free+0x274/0x2c0
[ 87.216040][ T5812] qlist_free_all+0x99/0x100
[ 87.216059][ T5812] kasan_quarantine_reduce+0x148/0x160
[ 87.216078][ T5812] __kasan_slab_alloc+0x22/0x80
[ 87.216099][ T5812] kmem_cache_alloc_lru_noprof+0x2a3/0x5f0
[ 87.216129][ T5812] __d_alloc+0x37/0x6f0
[ 87.216144][ T5812] d_alloc+0x4b/0x190
[ 87.216159][ T5812] lookup_one_qstr_excl+0xd8/0x360
[ 87.216187][ T5812] filename_unlinkat+0x2ba/0x610
[ 87.216207][ T5812] __se_sys_unlink+0x2e/0x140
[ 87.216227][ T5812] do_syscall_64+0x166/0x520
[ 87.216251][ T5812] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.216269][ T5812]
[ 87.216274][ T5812] Memory state around the buggy address:
[ 87.216285][ T5812] ffff88802d042f00: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 87.216298][ T5812] ffff88802d042f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 87.216312][ T5812] >ffff88802d043000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 87.216321][ T5812] ^
[ 87.216332][ T5812] ffff88802d043080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 87.216345][ T5812] ffff88802d043100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 87.216354][ T5812] ==================================================================
[ 87.222927][ T5812] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 88.012289][ T5812] CPU: 1 UID: 0 PID: 5812 Comm: syz.2.20 Not tainted syzkaller #0 PREEMPT(full)
[ 88.021409][ T5812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 88.031471][ T5812] Call Trace:
[ 88.034754][ T5812]
[ 88.037691][ T5812] vpanic+0x56d/0xa60
[ 88.041698][ T5812] ? __pfx_vpanic+0x10/0x10
[ 88.046218][ T5812] ? __pfx___schedule+0x10/0x10
[ 88.051083][ T5812] panic+0xc5/0xd0
[ 88.054836][ T5812] ? __pfx_panic+0x10/0x10
[ 88.059270][ T5812] ? preempt_schedule_common+0x7f/0xd0
[ 88.064743][ T5812] ? gether_get_ifname+0xee/0x110
[ 88.069773][ T5812] check_panic_on_warn+0x89/0xb0
[ 88.074725][ T5812] ? gether_get_ifname+0xee/0x110
[ 88.079755][ T5812] end_report+0x73/0x170
[ 88.084006][ T5812] ? gether_get_ifname+0xee/0x110
[ 88.089030][ T5812] kasan_report+0x128/0x150
[ 88.093542][ T5812] ? gether_get_ifname+0xee/0x110
[ 88.098573][ T5812] gether_get_ifname+0xee/0x110
[ 88.103427][ T5812] f_phonet_ifname_show+0x48/0x60
[ 88.108463][ T5812] ? __pfx_f_phonet_ifname_show+0x10/0x10
[ 88.114204][ T5812] configfs_read_iter+0x2b7/0x620
[ 88.119237][ T5812] __kernel_read+0x4ca/0x960
[ 88.123841][ T5812] ? __pfx___kernel_read+0x10/0x10
[ 88.128970][ T5812] ? rcu_is_watching+0x16/0xb0
[ 88.133744][ T5812] integrity_kernel_read+0x89/0xd0
[ 88.138870][ T5812] ? __pfx_integrity_kernel_read+0x10/0x10
[ 88.144691][ T5812] ? __kmalloc_cache_noprof+0x14d/0x600
[ 88.150244][ T5812] ? ima_calc_file_hash+0x40f/0x890
[ 88.155456][ T5812] ? ima_calc_file_hash+0x40f/0x890
[ 88.160662][ T5812] ima_calc_file_hash+0x451/0x890
[ 88.165697][ T5812] ? __pfx_ima_calc_file_hash+0x10/0x10
[ 88.171263][ T5812] ? generic_fillattr+0x575/0x840
[ 88.176299][ T5812] ima_collect_measurement+0x51b/0xa00
[ 88.181767][ T5812] ? __pfx_ima_collect_measurement+0x10/0x10
[ 88.187757][ T5812] ? trace_contention_end+0x3d/0x140
[ 88.193058][ T5812] ? __pfx_ima_get_hash_algo+0x10/0x10
[ 88.198531][ T5812] process_measurement+0x1272/0x1c10
[ 88.203831][ T5812] ? __pfx_process_measurement+0x10/0x10
[ 88.209485][ T5812] ? __pfx___up_read+0x10/0x10
[ 88.214269][ T5812] ima_file_check+0xe1/0x130
[ 88.218876][ T5812] ? __pfx_ima_file_check+0x10/0x10
[ 88.224085][ T5812] security_file_post_open+0xb3/0x260
[ 88.229479][ T5812] path_openat+0x1485/0x1d60
[ 88.234080][ T5812] do_file_open+0x23e/0x4a0
[ 88.238595][ T5812] ? __pfx_do_file_open+0x10/0x10
[ 88.243633][ T5812] ? _raw_spin_unlock+0x28/0x50
[ 88.248492][ T5812] ? alloc_fd+0x651/0x6c0
[ 88.252836][ T5812] do_sys_openat2+0x115/0x200
[ 88.257520][ T5812] ? __se_sys_futex+0x3a8/0x450
[ 88.262377][ T5812] ? __pfx_do_sys_openat2+0x10/0x10
[ 88.267585][ T5812] ? rcu_is_watching+0x16/0xb0
[ 88.272352][ T5812] __x64_sys_openat+0x138/0x170
[ 88.277217][ T5812] do_syscall_64+0x166/0x520
[ 88.281816][ T5812] ? trace_irq_disable+0x3b/0x140
[ 88.286850][ T5812] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.292924][ T5812] ? clear_bhb_loop+0x70/0xc0
[ 88.297613][ T5812] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.303511][ T5812] RIP: 0033:0x7f39e8f9e0d9
[ 88.307938][ T5812] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 88.327552][ T5812] RSP: 002b:00007f39e9e93028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 88.335978][ T5812] RAX: ffffffffffffffda RBX: 00007f39e9225fa0 RCX: 00007f39e8f9e0d9
[ 88.343958][ T5812] RDX: 0000000000000000 RSI: 0000200000000180 RDI: ffffffffffffff9c
[ 88.351933][ T5812] RBP: 00007f39e9035024 R08: 0000000000000000 R09: 0000000000000000
[ 88.359905][ T5812] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 88.367878][ T5812] R13: 00007f39e9226038 R14: 00007f39e9225fa0 R15: 00007ffd54dbbc28
[ 88.375864][ T5812]
[ 88.379149][ T5812] Kernel Offset: disabled
[ 88.383470][ T5812] Rebooting in 86400 seconds..