last executing test programs: 3.084301453s ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/cluster\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/cluster/o2cb\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/cluster/o2cb/node\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/o2cb/node/node0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/cluster/o2cb/node/node0/num\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='0\n\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/cluster/o2cb/node/node0/ipv4_address\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='127.0.0.1\n\x00', 0xa) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/cluster/o2cb/node/node0/ipv4_port\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='7777\n\x00', 0x5) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/cluster/o2cb/node/node0/local\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='1\n\x00', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/cluster/o2cb/heartbeat\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/cluster/o2cb/heartbeat/region\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./dlm\x00', 0x1ff) mount(0x0, &(0x7f0000000480)='./dlm\x00', &(0x7f00000004c0)='ocfs2_dlmfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./dlm/mydomain\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./dlm/mydomain/mylock\x00', 0x42, 0x1ff) write(r4, &(0x7f0000000580)='testlvbdata\x00', 0x7) close(r4) 3.01500227s ago: executing program 2 (id=6): r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x3f0, 0x6c17, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x3, 0x0, "", {{}, [{}]}}}]}}]}}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000400)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)={0x20, 0x0, 0x1}}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x15, 0x101301) ioctl$USBDEVFS_RESET(r1, 0x5514) 2.875355705s ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000240)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='dummy_udc.0\n\x00', 0xc) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/usb/devices/5-1/bConfigurationValue\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1\n\x00', 0x2) write(r1, &(0x7f0000000500)='0\n\x00', 0x2) 2.848022275s ago: executing program 3 (id=4): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TIOCSRS485(r0, 0x542f, &(0x7f0000000200)={0x1}) write(r0, &(0x7f0000000300)="12345678", 0x8) ioctl$TCXONC(r0, 0x540a, 0x2) ioctl$TCXONC(r0, 0x540a, 0x3) 2.744752078s ago: executing program 3 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='0x1d6b\x00', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='1234567890\x00', 0xb) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x2, 0x0) write(r3, &(0x7f0000000340)='Linux Foundation\x00', 0x11) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x2, 0x0) write(r4, &(0x7f00000003c0)='Test Gadget\x00', 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x2, 0x0) write(r5, &(0x7f0000000500)='Conf 1\x00', 0x7) r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1\x00', 0x0, 0x0) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', r6, &(0x7f00000005c0)='midi.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.2\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs/c.2/strings/0x409\x00', 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/configs/c.2/strings/0x409/configuration\x00', 0x2, 0x0) write(r7, &(0x7f00000006c0)='Conf 2\x00', 0x7) r8 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.2\x00', 0x0, 0x0) symlinkat(&(0x7f0000000580)='./config/usb_gadget/g1/functions/midi.usb0\x00', r8, &(0x7f0000000740)='midi.usb0\x00') write(0xffffffffffffffff, &(0x7f00000008c0)='2\x00', 0x2) write(0xffffffffffffffff, &(0x7f0000000900)='0\x00', 0x2) write(0xffffffffffffffff, &(0x7f00000009a0)='0\x00', 0x2) 2.734684633s ago: executing program 3 (id=8): syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f20c50620001000000010902200001010080320904000002080650000705010200020007058202000200"], 0x0) nanosleep(&(0x7f0000000100)={0x1}, 0x0) 2.715871647s ago: executing program 4 (id=9): r0 = syz_usb_connect(0x2, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040582005109bc10000000109021900010100000009040000010000000007050202400000"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) syz_usb_ep_read(r0, 0x2, 0x1000, &(0x7f0000000000)) (async) 2.120776281s ago: executing program 4 (id=10): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000e0)='./dev/mapper\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) ftruncate(r0, 0x1000000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x1ff) ftruncate(r1, 0x1000000) r2 = syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x2) ioctl$LOOP_SET_FD(r2, 0x4c00, r0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev/loop1\x00', 0x61ff, 0x701) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev/loop1\x00', 0x2, 0x0) ioctl$LOOP_SET_FD(r3, 0x4c00, r1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r4, 0xc138fd03, &(0x7f0000000200)="04000000000000000000000040010000380100000000000000000000000000000000000000000000000000000000000077633000") ioctl(r4, 0xc138fd09, &(0x7f0000000400)="040000000000000000000000000200003801000001000000000000000000000000000000000000000000000000000000776330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000777269746563616368650000000000007320373a3020373a3120343039360000") ioctl(r4, 0xc138fd06, &(0x7f0000000800)="04000000000000000000000040010000380100000000000000000000000000000000000000000000000000000000000077633000") mknodat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/wc0\x00', 0x61ff, 0x701) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/wc0\x00', 0x2, 0x0) ioctl(r5, 0x1277, &(0x7f00000001c0)="00000000000000000000010000000000") 2.111795688s ago: executing program 4 (id=11): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010002000000402505a1a4000001020301090212000101008032090400000000000000"], 0x0) nanosleep(&(0x7f0000000200)={0x0, 0x1312d00}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='add 1-1\x00', 0x8) r1 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/bus/usb/drivers/usbip-host/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='1-1\x00', 0x4) 1.99842808s ago: executing program 0 (id=12): syz_usb_connect(0x1, 0x20, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040da0b38010000010200010902200001010080320904000002080650000705010200020007058202000200"], 0x0) nanosleep(&(0x7f0000000300)={0x2}, 0x0) 1.777000288s ago: executing program 1 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='vmwgfx\x00', 0x7) 1.776508698s ago: executing program 1 (id=14): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='1', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/pci/devices/0000:00:02.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='1', 0x1) 1.768947184s ago: executing program 1 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000050)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nullb/nullb1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nullb/nullb1/zone_size\x00', 0x1, 0x0) write(r1, &(0x7f0000000700)='4\x00', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/nullb/nullb1/zone_nr_conv\x00', 0x1, 0x0) write(r2, &(0x7f0000000900)='2\x00', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nullb/nullb1/power\x00', 0x1, 0x0) write(r3, &(0x7f0000000b00)='1\x00', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./dev_mnt\x00', 0x1ff) mount(&(0x7f0000000c50)=@filename='none\x00', &(0x7f0000000d00)='./dev_mnt\x00', &(0x7f0000000e00)='devtmpfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./dev_mnt/mapper/control\x00', 0x2, 0x0) ioctl(r4, 0xc138fd03, &(0x7f0000000080)="040000000000000000000000380100003801000000000000000000000000000000000000000000000000000000000000646d3000") ioctl(r4, 0xc138fd09, &(0x7f0000000140)="0400000000000000000000006c0000003800000001000000000000000000000000000000000000000000000000000000646d300000000000000000000000000000000000008000000000000000000000340000007a6f6e6564000000000000000000002f6465762f6e756c6c623100") ioctl(r4, 0xc138fd06, &(0x7f00000001c0)="040000000000000000000000340000003400000000000000000000000000000000000000000000000000000000000000646d3000") 1.6397417s ago: executing program 1 (id=16): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./img0\x00', 0x42, 0x1ff) ftruncate(r0, 0x100000) write(r0, &(0x7f0000000000), 0x10000) r1 = syz_open_dev$loop(&(0x7f0000000100), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r2, &(0x7f0000000500)='/dev/loop0,65536\x00', 0x11) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt\x00', 0x1ff) mount(&(0x7f0000000700)=@filename='mtd1\x00', &(0x7f0000000600)='./mnt\x00', &(0x7f0000000800)='jffs2\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt/file0\x00', 0x42, 0x1ff) write(r3, &(0x7f0000000a00)="00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40) write(r3, &(0x7f0000000a00)="00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", 0x40) fsync(r3) unlinkat(0xffffffffffffff9c, &(0x7f0000000900)='./mnt/file0\x00', 0x0) sync() nanosleep(&(0x7f0000000b00)={0x0, 0x1dcd6500}, 0x0) 1.552954002s ago: executing program 4 (id=17): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x1c, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) 1.488944805s ago: executing program 4 (id=18): syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000404f1004000001010203010902200001010080fa0904000002ff000000070581020002000705020200020000000000"], 0x0) nanosleep(&(0x7f0000000100)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./dev\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/ttyUSB0\x00', 0x2, 0x0) 1.476754296s ago: executing program 2 (id=19): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040470535220000010203010902200001010080fa0904000002ffffff000705820200020007050202000200"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 1.187012531s ago: executing program 3 (id=20): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ed) mount(&(0x7f0000000140)=@filename='sysfs\x00', &(0x7f0000000180)='./sys\x00', &(0x7f00000001c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/module/dvb_as102/parameters/fw_upload\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='0\x00', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vidtv/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='vidtv.0\x00', 0x7) syz_usb_connect(0x3, 0x2b, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000200000040a61b01000000010203010902190001010080320904000001ff00000007058102000200"], 0x0) nanosleep(&(0x7f0000000500)={0x1}, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FE_READ_STATUS(r2, 0x80046f45, &(0x7f0000000700)) 978.492325ms ago: executing program 1 (id=21): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='stusb1600 0x48\x00', 0xf) 977.641574ms ago: executing program 1 (id=22): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000000406d0499c20000000000010902220001010080320904000001030000000921000100012237000705810308000a"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) nanosleep(&(0x7f0000000300)={0x2}, 0x0) 912.738375ms ago: executing program 2 (id=23): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380)) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480)) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28) nanosleep(&(0x7f0000000540)={0x0, 0x2faf080}, &(0x7f0000000580)) syz_80211_inject_frame(&(0x7f00000005c0)=@device_b, &(0x7f0000000600)=@data_frame={@msdu=@type01={{}, {}, @device_b, @from_mac}, @random="aaaa03000000890d020c05"}, 0x23) 264.109191ms ago: executing program 2 (id=24): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x5e1, 0x408, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0xff, 0x0, 0x0, 0x0, [], [{{0x9, 0x5, 0x82, 0x1, 0x200, 0x1}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 0s ago: executing program 4 (id=25): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='0000:00:02.0', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:02.0/resource0\x00', 0x2, 0x0) pwrite64(r1, &(0x7f0000000240)="20000001", 0x4, 0x0) pwrite64(r1, &(0x7f0000000280)="01010101", 0x4, 0x4) pwrite64(r1, &(0x7f00000002c0)='\x00\x00\x00\x00', 0x4, 0x20) pwrite64(r1, &(0x7f0000000300)="01000000", 0x4, 0x24) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='xhci_hcd', 0x8) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/bus/pci/drivers/xhci_hcd/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)='0000:00:02.0', 0xc) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/bus/pci/drivers/xhci_hcd/unbind\x00', 0x1, 0x0) write(r4, &(0x7f0000000480)='0000:00:02.0', 0xc) close(r4) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.15' (ED25519) to the list of known hosts. [ 28.539653][ T4700] cgroup: Unknown subsys name 'net' [ 28.690787][ T4700] cgroup: Unknown subsys name 'cpuset' [ 28.692869][ T4700] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 28.908658][ T4700] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 30.387568][ T4716] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 30.387844][ T4716] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 30.390030][ T4716] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 30.390214][ T4716] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 30.391768][ T4716] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 30.391820][ T4716] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 30.407863][ T4725] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 30.409596][ T4725] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 30.409744][ T4725] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 30.409976][ T4725] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 30.413924][ T4725] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 30.414152][ T4725] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 30.414561][ T4725] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 30.414944][ T4725] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 30.415412][ T4725] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 30.415656][ T4725] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 30.416454][ T4725] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 30.417244][ T4725] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 30.417678][ T4725] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 30.419061][ T4716] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 30.421256][ T4716] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 30.423216][ T4727] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 30.431720][ T4716] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 30.432322][ T4727] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 30.438685][ T4727] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 30.755873][ T4711] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.756152][ T4711] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.756225][ T4711] bridge_slave_0: entered allmulticast mode [ 30.756690][ T4711] bridge_slave_0: entered promiscuous mode [ 30.773555][ T4711] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.773626][ T4711] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.773685][ T4711] bridge_slave_1: entered allmulticast mode [ 30.774127][ T4711] bridge_slave_1: entered promiscuous mode [ 30.777918][ T4720] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.777947][ T4720] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.777998][ T4720] bridge_slave_0: entered allmulticast mode [ 30.778897][ T4720] bridge_slave_0: entered promiscuous mode [ 30.779885][ T4720] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.779906][ T4720] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.780000][ T4720] bridge_slave_1: entered allmulticast mode [ 30.780512][ T4720] bridge_slave_1: entered promiscuous mode [ 30.788524][ T4720] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.806100][ T4720] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.807297][ T4711] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.809793][ T4711] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.817895][ T4710] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.818541][ T4710] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.818614][ T4710] bridge_slave_0: entered allmulticast mode [ 30.819051][ T4710] bridge_slave_0: entered promiscuous mode [ 30.833557][ T4710] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.835012][ T4710] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.836441][ T4710] bridge_slave_1: entered allmulticast mode [ 30.838014][ T4710] bridge_slave_1: entered promiscuous mode [ 30.852458][ T4711] team0: Port device team_slave_0 added [ 30.853347][ T4711] team0: Port device team_slave_1 added [ 30.862491][ T4720] team0: Port device team_slave_0 added [ 30.868996][ T4710] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.876229][ T4720] team0: Port device team_slave_1 added [ 30.879632][ T4711] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.879654][ T4711] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.879679][ T4711] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.880465][ T4711] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.880474][ T4711] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.880490][ T4711] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.889827][ T4710] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.903519][ T4720] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.903554][ T4720] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.903810][ T4720] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.904425][ T4720] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.904431][ T4720] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.904444][ T4720] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.914511][ T4710] team0: Port device team_slave_0 added [ 30.915290][ T4710] team0: Port device team_slave_1 added [ 30.921921][ T4710] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.921931][ T4710] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.921946][ T4710] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.922441][ T4710] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.922448][ T4710] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.922463][ T4710] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.939629][ T4710] hsr_slave_0: entered promiscuous mode [ 30.940008][ T4710] hsr_slave_1: entered promiscuous mode [ 30.962901][ T4711] hsr_slave_0: entered promiscuous mode [ 30.964582][ T4711] hsr_slave_1: entered promiscuous mode [ 30.965889][ T4711] debugfs: 'hsr0' already exists in 'hsr' [ 30.966963][ T4711] Cannot create hsr debugfs directory [ 30.982580][ T4720] hsr_slave_0: entered promiscuous mode [ 30.984048][ T4720] hsr_slave_1: entered promiscuous mode [ 30.985284][ T4720] debugfs: 'hsr0' already exists in 'hsr' [ 30.986386][ T4720] Cannot create hsr debugfs directory [ 30.995289][ T4714] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.996732][ T4714] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.999157][ T4714] bridge_slave_0: entered allmulticast mode [ 31.000775][ T4714] bridge_slave_0: entered promiscuous mode [ 31.013617][ T4714] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.013692][ T4714] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.013792][ T4714] bridge_slave_1: entered allmulticast mode [ 31.014242][ T4714] bridge_slave_1: entered promiscuous mode [ 31.031938][ T4714] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 31.043655][ T4714] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 31.067682][ T4719] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.067770][ T4719] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.067948][ T4719] bridge_slave_0: entered allmulticast mode [ 31.068440][ T4719] bridge_slave_0: entered promiscuous mode [ 31.073134][ T4714] team0: Port device team_slave_0 added [ 31.073941][ T4714] team0: Port device team_slave_1 added [ 31.080289][ T4719] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.080373][ T4719] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.080440][ T4719] bridge_slave_1: entered allmulticast mode [ 31.080856][ T4719] bridge_slave_1: entered promiscuous mode [ 31.097466][ T4714] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 31.097497][ T4714] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 31.097512][ T4714] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 31.098084][ T4714] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 31.098092][ T4714] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 31.098108][ T4714] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 31.107725][ T4714] hsr_slave_0: entered promiscuous mode [ 31.108018][ T4714] hsr_slave_1: entered promiscuous mode [ 31.108987][ T4714] debugfs: 'hsr0' already exists in 'hsr' [ 31.108999][ T4714] Cannot create hsr debugfs directory [ 31.126263][ T4719] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 31.135068][ T4719] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 31.155284][ T4719] team0: Port device team_slave_0 added [ 31.159024][ T4710] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 31.162317][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.162686][ T4710] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 31.164887][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.167357][ T4719] team0: Port device team_slave_1 added [ 31.174187][ T4710] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 31.177366][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.177733][ T4710] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 31.179939][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.186042][ T4719] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 31.186075][ T4719] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 31.186092][ T4719] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 31.195177][ T4719] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 31.195201][ T4719] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 31.195215][ T4719] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 31.231948][ T4719] hsr_slave_0: entered promiscuous mode [ 31.233450][ T4719] hsr_slave_1: entered promiscuous mode [ 31.234746][ T4719] debugfs: 'hsr0' already exists in 'hsr' [ 31.235883][ T4719] Cannot create hsr debugfs directory [ 31.240236][ T4710] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.240290][ T4710] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.240425][ T4710] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.240456][ T4710] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.252199][ T4711] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 31.254495][ T4711] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.254857][ T4711] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 31.256647][ T4711] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.257440][ T4711] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 31.259405][ T4711] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.265667][ T4711] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 31.267812][ T4711] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.314629][ T4711] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.314674][ T4711] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.314764][ T4711] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.314797][ T4711] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.316325][ T4720] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 31.319464][ T4720] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.319788][ T4720] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 31.321218][ T4720] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.322244][ T4720] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 31.323992][ T4720] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.324314][ T4720] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 31.326118][ T4720] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.343631][ T4720] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.343684][ T4720] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.343753][ T4720] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.343780][ T4720] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.356584][ T4710] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.368981][ T15] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.369842][ T15] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.371023][ T15] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.372295][ T15] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.374961][ T15] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.376690][ T15] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.383845][ T4714] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 31.386191][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.387960][ T4714] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 31.390714][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.392325][ T4714] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 31.394430][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.396671][ T4714] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 31.398951][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.414573][ T4711] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.417814][ T4710] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.422235][ T4719] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 31.424537][ T4719] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.427180][ T4719] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 31.429608][ T4719] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.429912][ T4719] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 31.431762][ T4719] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.433971][ T4719] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 31.436006][ T4719] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.442018][ T1199] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.442080][ T1199] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.442486][ T1199] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.442507][ T1199] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.448907][ T4711] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.459571][ T4720] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.464738][ T4720] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.469636][ T3386] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.469675][ T3386] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.470876][ T3386] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.470900][ T3386] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.476697][ T15] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.476744][ T15] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.484909][ T4710] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.492918][ T15] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.492963][ T15] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.563241][ T4719] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.572076][ T4719] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.585239][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.585285][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.585656][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.585675][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.604695][ T4714] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.611129][ T4714] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.661009][ T3386] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.661065][ T3386] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.661467][ T3386] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.661485][ T3386] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.666368][ T4714] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.668831][ T4714] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.683974][ T4710] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.706566][ T4710] veth0_vlan: entered promiscuous mode [ 31.716393][ T4710] veth1_vlan: entered promiscuous mode [ 31.741779][ T4710] veth0_macvtap: entered promiscuous mode [ 31.747621][ T4710] veth1_macvtap: entered promiscuous mode [ 31.756422][ T4710] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.757486][ T4710] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.806325][ T4711] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.832232][ T4720] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.842061][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.842097][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.872055][ T4720] veth0_vlan: entered promiscuous mode [ 31.886272][ T4711] veth0_vlan: entered promiscuous mode [ 31.887618][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.887655][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.891173][ T4720] veth1_vlan: entered promiscuous mode [ 31.894906][ T4719] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.896687][ T4711] veth1_vlan: entered promiscuous mode [ 31.900591][ T40] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.900838][ T40] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.900936][ T40] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.901025][ T40] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.915473][ T4720] veth0_macvtap: entered promiscuous mode [ 31.928606][ T4711] veth0_macvtap: entered promiscuous mode [ 31.931501][ T4720] veth1_macvtap: entered promiscuous mode [ 31.933885][ T4714] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.936855][ T4711] veth1_macvtap: entered promiscuous mode [ 31.945762][ T4720] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.959889][ T4720] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.963354][ T4711] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.964407][ T4711] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.967030][ T4710] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.982829][ T4714] veth0_vlan: entered promiscuous mode [ 31.984808][ T4714] veth1_vlan: entered promiscuous mode [ 32.027824][ T4714] veth0_macvtap: entered promiscuous mode [ 32.042249][ T4719] veth0_vlan: entered promiscuous mode [ 32.052586][ T4714] veth1_macvtap: entered promiscuous mode [ 32.059362][ T512] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.061371][ T512] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.061399][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.061411][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.076966][ T4719] veth1_vlan: entered promiscuous mode [ 32.083156][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.083189][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.086103][ T4894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.087867][ T4894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.095282][ T4714] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.104164][ T3386] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.104198][ T3386] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.107149][ T4714] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.109368][ T512] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.109438][ T512] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.110081][ T512] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.123348][ T4719] veth0_macvtap: entered promiscuous mode [ 32.133516][ T3286] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.133545][ T3286] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.136534][ T4719] veth1_macvtap: entered promiscuous mode [ 32.155015][ T512] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.155039][ T512] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.157827][ T4719] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.158424][ T3386] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.161364][ T4719] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.170121][ T512] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.170573][ T512] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.173942][ T512] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.178422][ T512] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.178461][ T512] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.178485][ T512] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.178505][ T512] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.202602][ T3386] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.202638][ T3386] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.219725][ T512] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.219839][ T512] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.225291][ T4897] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.234012][ T3386] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.234047][ T3386] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.237963][ T4897] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.253157][ T4899] configfs-gadget.g1 gadget.0: HOST MAC da:e6:ca:2f:78:cf [ 32.254805][ T4899] configfs-gadget.g1 gadget.0: MAC f2:17:d6:69:13:6f [ 32.273202][ T512] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.273235][ T512] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.288394][ T1199] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.376734][ T4917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.376928][ T4917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.399041][ T4921] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.399669][ T4921] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.429885][ T4717] Bluetooth: hci1: command tx timeout [ 32.488354][ T4874] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 32.508319][ T4717] Bluetooth: hci3: command tx timeout [ 32.508579][ T4718] Bluetooth: hci0: command tx timeout [ 32.508702][ T4718] Bluetooth: hci2: command tx timeout [ 32.508751][ T4718] Bluetooth: hci4: command tx timeout [ 32.639003][ T4874] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0104, bcdDevice= 7.02 [ 32.639726][ T4874] usb 1-1: Dual-Role OTG device on HNP port [ 32.639909][ T4874] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 32.651991][ T4874] cdc_ether 1-1:1.0 usb1: register 'cdc_ether' at usb-dummy_hcd.0-1, CDC Ethernet Device, da:e6:ca:2f:78:cf [ 32.940146][ T4975] loop0: detected capacity change from 0 to 32768 [ 32.942780][ T4975] loop1: detected capacity change from 0 to 32768 [ 32.947452][ T4975] device-mapper: table: 248:0: zero-length target [ 32.947479][ T4975] device-mapper: ioctl: error adding target to table [ 32.992798][ T4978] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.993077][ T4978] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.095244][ T4980] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.095526][ T4980] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.332882][ T4987] null_blk: nullb1: using native zone append [ 33.382651][ T4990] device-mapper: ioctl: Invalid data size in the ioctl structure: 108 [ 33.382804][ T4990] device-mapper: ioctl: Invalid data size in the ioctl structure: 52 [ 33.430126][ T4987] null_blk: disk nullb1 created [ 33.452702][ T4993] loop0: detected capacity change from 0 to 2048 [ 33.480075][ T4993] ftl_cs: FTL header not found. [ 33.490782][ T4993] block2mtd: mtd1: [/dev/loop0] erase_size = 64KiB [65536] [ 33.563165][ T5002] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.565184][ T5002] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.612910][ T5004] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.613108][ T5004] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.918747][ T5008] vidtv vidtv.0: Successfully removed vidtv [ 33.923474][ T5008] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.926127][ T5008] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.088412][ T5011] stusb160x 0-0048: Failed to allocate register map:-22 [ 34.090568][ T5011] stusb160x 0-0048: probe with driver stusb160x failed with error -22 [ 34.092342][ T5011] i2c i2c-0: new_device: Instantiated device stusb1600 at 0x48 [ 34.118044][ T5013] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.121494][ T5013] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 34.156260][ T5016] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 34.207363][ T5016] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 34.258453][ T5016] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 34.309538][ T5016] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 34.508206][ T4717] Bluetooth: hci1: command tx timeout [ 34.588329][ T4717] Bluetooth: hci3: command tx timeout [ 34.588393][ T4727] Bluetooth: hci4: command tx timeout [ 34.588411][ T4718] Bluetooth: hci0: command tx timeout [ 34.588467][ T4717] Bluetooth: hci2: command tx timeout [ 34.827452][ T5018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 34.829808][ T5018] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.132845][ T5020] EXT4-fs (nvme0n1p2): shut down requested (2) [ 35.132937][ T5020] Aborting journal on device nvme0n1p2-8. Jan 1 00:00:35 syzkaller kern.alert kernel: [ 35.132845][ T5020] EXT4-fs (nvme0n1p2): shut down requested (2) [ 35.277851][ T5021] xhci_hcd 0000:00:02.0: xHCI Host Controller [ 35.279924] ** replaying previous printk message ** [ 35.279924][ T5021] xhci_hcd 0000:00:02.0: new USB bus registered, assigned bus number 34 [ 35.280070][ T5021] Unable to handle kernel paging request at virtual address ffff8000986740ff [ 35.280086][ T5021] KASAN: probably user-memory-access in range [0x00000004c33a07f8-0x00000004c33a07ff] [ 35.280096][ T5021] Mem abort info: [ 35.280101][ T5021] ESR = 0x0000000096000021 [ 35.280106][ T5021] EC = 0x25: DABT (current EL), IL = 32 bits [ 35.280112][ T5021] SET = 0, FnV = 0 [ 35.280117][ T5021] EA = 0, S1PTW = 0 [ 35.280121][ T5021] FSC = 0x21: alignment fault [ 35.280126][ T5021] Data abort info: [ 35.280129][ T5021] ISV = 0, ISS = 0x00000021, ISS2 = 0x00000000 [ 35.280134][ T5021] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 35.280139][ T5021] GCS = 0, Overlay = 0, DirtyBit = 0 [ 35.280145][ T5021] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000021b049000 [ 35.280151][ T5021] [ffff8000986740ff] pgd=0000000000000000, p4d=1000000221341003, pud=1000000221342003, pmd=100000010c44b403, pte=0068010000000713 [ 35.280211][ T5021] Internal error: Oops: 0000000096000021 [#1] SMP [ 35.298262][ T5021] Modules linked in: [ 35.298973][ T5021] CPU: 1 UID: 0 PID: 5021 Comm: syz.4.25 Not tainted syzkaller #0 PREEMPT [ 35.300504][ T5021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 35.302212][ T5021] pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 35.303520][ T5021] pc : xhci_halt+0x64/0x1ec [ 35.304293][ T5021] lr : xhci_halt+0x40/0x1ec [ 35.305079][ T5021] sp : ffff8000988073c0 [ 35.305774][ T5021] x29: ffff8000988073c0 x28: ffff0000d2bd8000 x27: dfff800000000000 [ 35.307147][ T5021] x26: ffff0000d2bd8418 x25: 0000000000000f01 x24: ffff0000d2bd86e8 [ 35.308572][ T5021] x23: ffff0000c2b100d0 x22: ffff0000d2bd8418 x21: dfff800000000000 [ 35.309940][ T5021] x20: 1fffe0001a57b083 x19: ffff0000d2bd8400 x18: 00000000ffffffff [ 35.311356][ T5021] x17: ffff80008a7d6000 x16: 0000000000000006 x15: ffff80008a35fda0 [ 35.312771][ T5021] x14: ffff80008a5d5e28 x13: 0000000000000004 x12: 0000000000000000 [ 35.314149][ T5021] x11: ffff8000988072e0 x10: 00000000fffffbf2 x9 : 9609c837fa093800 [ 35.315514][ T5021] x8 : ffff8000986740ff x7 : 0000000000000000 x6 : 0000000000000000 [ 35.316883][ T5021] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000833104ec [ 35.318311][ T5021] x2 : 0000000000000002 x1 : ffff0000c47f57c0 x0 : 0000000000000001 [ 35.319704][ T5021] Call trace: [ 35.320257][ T5021] xhci_halt+0x64/0x1ec (P) [ 35.321079][ T5021] xhci_gen_setup+0x5d8/0x111c [ 35.321899][ T5021] xhci_pci_setup+0x110/0x44c [ 35.322734][ T5021] usb_add_hcd+0x5c4/0xdec [ 35.323498][ T5021] usb_hcd_pci_probe+0x63c/0xaa4 [ 35.324373][ T5021] xhci_pci_common_probe+0x90/0x760 [ 35.325336][ T5021] xhci_pci_probe+0x44/0xdc [ 35.326153][ T5021] local_pci_probe+0xc8/0x158 [ 35.326948][ T5021] pci_device_probe+0x460/0x8d4 [ 35.327858][ T5021] really_probe+0x29c/0x800 [ 35.328708][ T5021] __driver_probe_device+0x1e0/0x350 [ 35.329683][ T5021] device_driver_attach+0x58/0xac [ 35.330582][ T5021] bind_store+0xf4/0x14c [ 35.331320][ T5021] drv_attr_store+0x80/0xa4 [ 35.332118][ T5021] sysfs_kf_write+0xe0/0x108 [ 35.332930][ T5021] kernfs_fop_write_iter+0x260/0x3b8 [ 35.333856][ T5021] vfs_write+0x51c/0xa0c [ 35.334615][ T5021] ksys_write+0x12c/0x228 [ 35.335401][ T5021] __arm64_sys_write+0x84/0x98 [ 35.336244][ T5021] invoke_syscall+0x98/0x244 [ 35.337075][ T5021] el0_svc_common+0xec/0x23c [ 35.337916][ T5021] do_el0_svc+0x4c/0x5c [ 35.338685][ T5021] el0_svc+0x64/0x260 [ 35.339375][ T5021] el0t_64_sync_handler+0x44/0x104 [ 35.340292][ T5021] el0t_64_sync+0x198/0x19c [ 35.341130][ T5021] Code: 9762248f f94002c8 128081aa d503201f (b9400108) [ 35.342302][ T5021] ---[ end trace 0000000000000000 ]--- [ 35.586100][ T5021] Kernel panic - not syncing: Oops: Fatal exception [ 35.587262][ T5021] SMP: stopping secondary CPUs [ 35.588102][ T5021] Kernel Offset: disabled [ 35.588844][ T5021] CPU features: 0x14000000,003c0008,27020a02,a84ff6a7 [ 35.590045][ T5021] Memory Limit: none [ 35.831358][ T5021] Rebooting in 86400 seconds..