last executing test programs: 817.834753ms ago: executing program 2 (id=3): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(r1, 0x4068aea3, &(0x7f0000000100)={0x8a}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CAP_X86_DISABLE_EXITS(r1, 0x4068aea3, &(0x7f0000000200)={0x8f, 0x2}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, &(0x7f0000000400)="0f324801c00f300f324805001000004889c248c1e820b9000100000f30b932080000b800000400ba000000000f30b9400800000f324805000001004889c248c1e820b93a0800000f30f4", 0x3d}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 760.280571ms ago: executing program 1 (id=2): syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040f71d00250000000000010902190001010080320904000001ff00000007058102000200"], 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$swradio(&(0x7f0000000200), 0x0, 0x2) r1 = syz_open_dev$swradio(&(0x7f0000000280), 0x1, 0x2) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000300)={0x2, 0xb, 0x1}) ioctl$VIDIOC_QUERYBUF(r0, 0xc0445609, &(0x7f0000000400)=@mmap={0x0, 0xb, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0}) ioctl$VIDIOC_QBUF(r0, 0xc050560f, &(0x7f0000000500)=@mmap={0x0, 0xb, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0}) ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000600)=0xb) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000380)={0x2, 0xb, 0x1}) ioctl$VIDIOC_QUERYBUF(r1, 0xc0445609, &(0x7f0000000480)=@mmap={0x0, 0xb, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0}) ioctl$VIDIOC_QBUF(r1, 0xc050560f, &(0x7f0000000580)=@mmap={0x0, 0xb, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0}) ioctl$VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000680)=0xb) 362.506498ms ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='0x1d6b\x00', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='1234567890\x00', 0xa) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r3, &(0x7f0000000340)='Foo\x00', 0x3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) write(r4, &(0x7f00000003c0)='Bar\x00', 0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./config/target/core/rd_mcp_0/ramdisk_0\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/target/core/rd_mcp_0/ramdisk_0/control\x00', 0x1, 0x0) write(r5, &(0x7f00000005c0)='rd_pages=32768\x00', 0xe) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/core/rd_mcp_0/ramdisk_0/enable\x00', 0x1, 0x0) write(r6, &(0x7f0000000640)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.1234567890123456\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f00000007c0)='./config/target/core/rd_mcp_0/ramdisk_0\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0/virtual_scsi_port\x00') r7 = openat(0xffffffffffffff9c, &(0x7f0000000840)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/nexus\x00', 0x1, 0x0) write(r7, &(0x7f0000000880)='naa.1234567890123456\x00', 0x12) r8 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/enable\x00', 0x1, 0x0) write(r8, &(0x7f0000000900)='1\x00', 0x1) symlinkat(&(0x7f0000000940)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000980)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') 311.160068ms ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='none\x00', &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000140)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/direction\x00', 0x1, 0x0) write(r0, &(0x7f00000002c0)='1\x00', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/num_groups\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)='2\x00', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/midi1_num_groups\x00', 0x1, 0x0) write(r2, &(0x7f0000000440)='2\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/direction\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='2\x00', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/first_group\x00', 0x1, 0x0) write(r4, &(0x7f0000000600)='2\x00', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/num_groups\x00', 0x1, 0x0) write(r5, &(0x7f00000006c0)='3\x00', 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/midi1_first_group\x00', 0x1, 0x0) write(r6, &(0x7f0000000780)='2\x00', 0x1) r7 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.1/midi1_num_groups\x00', 0x1, 0x0) write(r7, &(0x7f0000000840)='3\x00', 0x1) symlinkat(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000008c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r8 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r8, &(0x7f0000000940)='dummy_udc.0\x00', 0xb) write(r8, &(0x7f0000000980)='\n\x00', 0x1) write(r8, &(0x7f00000009c0)='dummy_udc.0\x00', 0xb) write(r8, &(0x7f0000000a00)='\n\x00', 0x1) write(r8, &(0x7f0000000a40)='dummy_udc.0\x00', 0xb) write(r8, &(0x7f0000000a80)='\n\x00', 0x1) write(r8, &(0x7f0000000ac0)='dummy_udc.0\x00', 0xb) write(r8, &(0x7f0000000b00)='\n\x00', 0x1) write(r8, &(0x7f0000000b40)='dummy_udc.0\x00', 0xb) write(r8, &(0x7f0000000b80)='\n\x00', 0x1) write(r8, &(0x7f0000000bc0)='dummy_udc.0\x00', 0xb) write(r8, &(0x7f0000000c00)='\n\x00', 0x1) write(r8, &(0x7f0000000c40)='dummy_udc.0\x00', 0xb) write(r8, &(0x7f0000000c80)='\n\x00', 0x1) write(r8, &(0x7f0000000cc0)='dummy_udc.0\x00', 0xb) 0s ago: executing program 2 (id=5): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000002000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f00000004c0)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0}) ioctl(r0, 0x3b8e, &(0x7f0000000000)="10") ioctl$IOMMU_HWPT_ALLOC$NONE(r0, 0x3b89, &(0x7f0000000540)={0x28, 0x1, r2, r1, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl(r0, 0x3b89, &(0x7f0000001000)="300000000400000003000000060000000000000000000000adde000008") kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.221' (ED25519) to the list of known hosts. [ 78.992293][ T5600] cgroup: Unknown subsys name 'net' [ 79.127543][ T5600] cgroup: Unknown subsys name 'cpuset' [ 79.135497][ T5600] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 80.792310][ T5600] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 84.432356][ T5612] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 84.452166][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 84.470291][ T5617] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 84.480890][ T5620] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 84.490845][ T5620] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 84.491836][ T5624] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 84.492812][ T5625] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 84.494786][ T5625] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 84.495956][ T5625] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 84.498147][ T5625] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 84.504752][ T5625] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 84.508545][ T5625] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 84.511576][ T5625] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 84.511669][ T5620] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 84.520381][ T5620] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 84.521127][ T5625] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 84.523757][ T5625] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 84.524986][ T5625] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 84.527657][ T5625] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 84.532537][ T5625] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 86.105126][ T5609] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.112514][ T5609] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.112767][ T5609] bridge_slave_0: entered allmulticast mode [ 86.117855][ T5609] bridge_slave_0: entered promiscuous mode [ 86.169641][ T5609] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.170186][ T5609] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.170593][ T5609] bridge_slave_1: entered allmulticast mode [ 86.176232][ T5609] bridge_slave_1: entered promiscuous mode [ 86.265073][ T5609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.274833][ T5609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.324547][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.324941][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.325332][ T5615] bridge_slave_0: entered allmulticast mode [ 86.331608][ T5615] bridge_slave_0: entered promiscuous mode [ 86.382147][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.382575][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.382959][ T5615] bridge_slave_1: entered allmulticast mode [ 86.390118][ T5615] bridge_slave_1: entered promiscuous mode [ 86.419658][ T5609] team0: Port device team_slave_0 added [ 86.446482][ T5616] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.446832][ T5616] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.447194][ T5616] bridge_slave_0: entered allmulticast mode [ 86.452585][ T5616] bridge_slave_0: entered promiscuous mode [ 86.474419][ T5609] team0: Port device team_slave_1 added [ 86.489279][ T5611] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.489398][ T5611] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.489530][ T5611] bridge_slave_0: entered allmulticast mode [ 86.492602][ T5611] bridge_slave_0: entered promiscuous mode [ 86.524917][ T5616] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.527189][ T5616] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.528543][ T5616] bridge_slave_1: entered allmulticast mode [ 86.534401][ T5616] bridge_slave_1: entered promiscuous mode [ 86.559035][ T5611] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.559170][ T5611] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.560059][ T5611] bridge_slave_1: entered allmulticast mode [ 86.566824][ T5611] bridge_slave_1: entered promiscuous mode [ 86.597170][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.616128][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.616708][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.616777][ T5609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.650271][ T4930] Bluetooth: hci1: command tx timeout [ 86.650283][ T5617] Bluetooth: hci3: command tx timeout [ 86.650562][ T5625] Bluetooth: hci2: command tx timeout [ 86.662564][ T5625] Bluetooth: hci0: command tx timeout [ 86.679773][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.704400][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.705010][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.705095][ T5609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.722160][ T5611] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.765631][ T5616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.784340][ T5611] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.813902][ T5616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.859979][ T5615] team0: Port device team_slave_0 added [ 86.871867][ T5615] team0: Port device team_slave_1 added [ 86.947151][ T5616] team0: Port device team_slave_0 added [ 86.956654][ T5611] team0: Port device team_slave_0 added [ 86.999552][ T5616] team0: Port device team_slave_1 added [ 87.007725][ T5611] team0: Port device team_slave_1 added [ 87.038504][ T5609] hsr_slave_0: entered promiscuous mode [ 87.046640][ T5609] hsr_slave_1: entered promiscuous mode [ 87.054902][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.062669][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.088921][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.136077][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.143432][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.169469][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.197935][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.206152][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.232384][ T5611] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.268105][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.268157][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.268185][ T5616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.280847][ T5611] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.280972][ T5611] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.281047][ T5611] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.319388][ T5616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.319441][ T5616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.319516][ T5616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.457621][ T5615] hsr_slave_0: entered promiscuous mode [ 87.460576][ T5615] hsr_slave_1: entered promiscuous mode [ 87.462974][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 87.463590][ T5615] Cannot create hsr debugfs directory [ 87.543186][ T5611] hsr_slave_0: entered promiscuous mode [ 87.550512][ T5611] hsr_slave_1: entered promiscuous mode [ 87.554623][ T5611] debugfs: 'hsr0' already exists in 'hsr' [ 87.554695][ T5611] Cannot create hsr debugfs directory [ 87.611137][ T5616] hsr_slave_0: entered promiscuous mode [ 87.615321][ T5616] hsr_slave_1: entered promiscuous mode [ 87.616991][ T5616] debugfs: 'hsr0' already exists in 'hsr' [ 87.617012][ T5616] Cannot create hsr debugfs directory [ 87.991834][ T5609] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 88.007477][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.031562][ T5609] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 88.041726][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.061562][ T5609] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 88.071536][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.098874][ T5609] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 88.109204][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.173452][ T5615] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 88.186471][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.194764][ T5615] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 88.207618][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.220633][ T5615] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 88.231352][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.251078][ T5615] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 88.262887][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.328359][ T5611] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 88.347658][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.361153][ T5611] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 88.373406][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.388300][ T5611] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 88.399253][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.417118][ T5611] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 88.426800][ T5611] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.532738][ T5616] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.544506][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.547015][ T5616] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 88.561399][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.577804][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.586141][ T5616] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.597132][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.599577][ T5616] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.609308][ T5616] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.660552][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.706442][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.706810][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.714837][ T5625] Bluetooth: hci1: command tx timeout [ 88.714873][ T5625] Bluetooth: hci0: command tx timeout [ 88.714898][ T5617] Bluetooth: hci2: command tx timeout [ 88.714997][ T5625] Bluetooth: hci3: command tx timeout [ 88.774513][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.774773][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.805908][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.877837][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.905457][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.905796][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.931763][ T5611] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.952640][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.952854][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.006598][ T5611] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.040776][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.040907][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.077278][ T5616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.086345][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.086654][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.202752][ T5616] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.250874][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.251003][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.317120][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.317260][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.169592][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.322022][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.361946][ T5609] veth0_vlan: entered promiscuous mode [ 90.373765][ T5611] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.402025][ T5609] veth1_vlan: entered promiscuous mode [ 90.522246][ T5615] veth0_vlan: entered promiscuous mode [ 90.537122][ T5611] veth0_vlan: entered promiscuous mode [ 90.551041][ T5616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.569584][ T5609] veth0_macvtap: entered promiscuous mode [ 90.577527][ T5615] veth1_vlan: entered promiscuous mode [ 90.591621][ T5611] veth1_vlan: entered promiscuous mode [ 90.609214][ T5609] veth1_macvtap: entered promiscuous mode [ 90.689402][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.695304][ T5615] veth0_macvtap: entered promiscuous mode [ 90.718605][ T5611] veth0_macvtap: entered promiscuous mode [ 90.727813][ T5615] veth1_macvtap: entered promiscuous mode [ 90.735981][ T5616] veth0_vlan: entered promiscuous mode [ 90.749045][ T5611] veth1_macvtap: entered promiscuous mode [ 90.761322][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.793284][ T4930] Bluetooth: hci3: command tx timeout [ 90.793338][ T4930] Bluetooth: hci1: command tx timeout [ 90.793495][ T4930] Bluetooth: hci2: command tx timeout [ 90.793553][ T4930] Bluetooth: hci0: command tx timeout [ 90.822695][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.832548][ T5616] veth1_vlan: entered promiscuous mode [ 90.846722][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.855421][ T35] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.876100][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.909737][ T5611] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.002572][ T5616] veth0_macvtap: entered promiscuous mode [ 91.050205][ T5616] veth1_macvtap: entered promiscuous mode [ 91.070720][ T1106] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.070768][ T1106] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.151535][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.165649][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.175722][ T35] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.175828][ T35] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.221037][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.235112][ T59] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.248538][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.261717][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.284026][ T5616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.325940][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.325990][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.326717][ T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.397266][ T1106] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.397352][ T1106] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.413715][ T35] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.444350][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.447019][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.448016][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.448866][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.451357][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.452250][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.512899][ T5609] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 91.648699][ T1106] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.648739][ T1106] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.668624][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.764282][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.774062][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.775619][ T5766] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 91.809919][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.809965][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.907562][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.907612][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.938022][ T190] cfg80211: failed to load regulatory.db [ 91.944236][ T1106] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.136123][ T5709] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 92.313682][ T5709] usb 2-1: New USB device found, idVendor=1df7, idProduct=2500, bcdDevice= 0.00 [ 92.335127][ T5709] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.560601][ T5785] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 92.599282][ T5777] Oops: general protection fault, probably for non-canonical address 0xdffffc00000000e6: 0000 [#1] SMP KASAN PTI [ 92.611258][ T5777] KASAN: null-ptr-deref in range [0x0000000000000730-0x0000000000000737] [ 92.619737][ T5777] CPU: 1 UID: 0 PID: 5777 Comm: syz.0.1 Not tainted syzkaller #0 PREEMPT(full) [ 92.628835][ T5777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.638931][ T5777] RIP: 0010:f_midi2_free_ep+0x52/0x2f0 [ 92.644642][ T5777] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 e3 51 53 fa 41 bc 30 07 00 00 4d 03 26 4c 89 e0 48 c1 e8 03 48 89 44 24 30 <0f> b6 04 28 84 c0 0f 85 5d 02 00 00 41 8b 1c 24 31 ff 89 de e8 65 [ 92.664299][ T5777] RSP: 0018:ffffc90004de7970 EFLAGS: 00010202 [ 92.670436][ T5777] RAX: 00000000000000e6 RBX: ffff888065b90000 RCX: 0000000000080000 [ 92.678450][ T5777] RDX: ffffc9000e879000 RSI: 000000000000e448 RDI: 000000000000e449 [ 92.686473][ T5777] RBP: dffffc0000000000 R08: ffffffff909ac37f R09: 1ffffffff213586f [ 92.694485][ T5777] R10: dffffc0000000000 R11: fffffbfff2135870 R12: 0000000000000730 [ 92.702502][ T5777] R13: dffffc0000000000 R14: ffff888065b90128 R15: dffffc0000000000 [ 92.710582][ T5777] FS: 00007f15234306c0(0000) GS:ffff8881249ab000(0000) knlGS:0000000000000000 [ 92.719564][ T5777] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 92.726202][ T5777] CR2: 0000200000001000 CR3: 000000007a518000 CR4: 00000000003526f0 [ 92.734223][ T5777] Call Trace: [ 92.737558][ T5777] [ 92.740566][ T5777] f_midi2_unbind+0x9b/0x340 [ 92.745244][ T5777] purge_configs_funcs+0x248/0x3d0 [ 92.750409][ T5777] configfs_composite_unbind+0xa4/0x1c0 [ 92.756009][ T5777] gadget_unbind_driver+0x1cb/0x410 [ 92.761275][ T5777] ? __pfx_gadget_unbind_driver+0x10/0x10 [ 92.767079][ T5777] device_release_driver_internal+0x48b/0x880 [ 92.773211][ T5777] driver_detach+0x1f3/0x2d0 [ 92.777959][ T5777] bus_remove_driver+0x226/0x320 [ 92.782990][ T5777] usb_gadget_unregister_driver+0x4e/0x70 [ 92.788798][ T5777] gadget_dev_desc_UDC_store+0x17a/0x2f0 [ 92.794507][ T5777] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 92.800759][ T5777] configfs_write_iter+0x337/0x430 [ 92.805932][ T5777] vfs_write+0x612/0xba0 [ 92.810241][ T5777] ? __pfx_vfs_write+0x10/0x10 [ 92.815067][ T5777] ? __fget_files+0x2a/0x420 [ 92.819721][ T5777] ksys_write+0x150/0x270 [ 92.824160][ T5777] ? __pfx_ksys_write+0x10/0x10 [ 92.829080][ T5777] ? __pfx_kcov_ioctl+0x10/0x10 [ 92.834034][ T5777] do_syscall_64+0x166/0x520 [ 92.838672][ T5777] ? trace_irq_disable+0x3b/0x140 [ 92.843740][ T5777] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.849956][ T5777] ? clear_bhb_loop+0x70/0xc0 [ 92.854687][ T5777] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.860624][ T5777] RIP: 0033:0x7f152259e0d9 [ 92.865100][ T5777] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.884831][ T5777] RSP: 002b:00007f1523430028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 92.891072][ T5625] Bluetooth: hci0: command tx timeout [ 92.891188][ T5625] Bluetooth: hci2: command tx timeout [ 92.891293][ T5625] Bluetooth: hci1: command tx timeout [ 92.891358][ T5625] Bluetooth: hci3: command tx timeout [ 92.914816][ T5777] RAX: ffffffffffffffda RBX: 00007f1522826090 RCX: 00007f152259e0d9 [ 92.922821][ T5777] RDX: 0000000000000001 RSI: 0000200000000980 RDI: 000000000000000b [ 92.930827][ T5777] RBP: 00007f1522635024 R08: 0000000000000000 R09: 0000000000000000 [ 92.938833][ T5777] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.946855][ T5777] R13: 00007f1522826128 R14: 00007f1522826090 R15: 00007ffe9a6b72c8 [ 92.954873][ T5777] [ 92.957929][ T5777] Modules linked in: [ 92.964170][ T5777] ---[ end trace 0000000000000000 ]--- [ 92.979766][ T5709] msi2500 2-1:1.0: Registered as swradio24 [ 92.979800][ T5709] msi2500 2-1:1.0: SDR API is still slightly experimental and functionality changes may follow [ 92.987842][ T5777] RIP: 0010:f_midi2_free_ep+0x52/0x2f0 [ 92.987890][ T5777] Code: 4c 89 f0 48 c1 e8 03 80 3c 28 00 74 08 4c 89 f7 e8 e3 51 53 fa 41 bc 30 07 00 00 4d 03 26 4c 89 e0 48 c1 e8 03 48 89 44 24 30 <0f> b6 04 28 84 c0 0f 85 5d 02 00 00 41 8b 1c 24 31 ff 89 de e8 65 [ 92.987909][ T5777] RSP: 0018:ffffc90004de7970 EFLAGS: 00010202 [ 92.987930][ T5777] RAX: 00000000000000e6 RBX: ffff888065b90000 RCX: 0000000000080000 [ 92.987946][ T5777] RDX: ffffc9000e879000 RSI: 000000000000e448 RDI: 000000000000e449 [ 92.987991][ T5777] RBP: dffffc0000000000 R08: ffffffff909ac37f R09: 1ffffffff213586f [ 92.988009][ T5777] R10: dffffc0000000000 R11: fffffbfff2135870 R12: 0000000000000730 [ 92.988025][ T5777] R13: dffffc0000000000 R14: ffff888065b90128 R15: dffffc0000000000 [ 92.988041][ T5777] FS: 00007f15234306c0(0000) GS:ffff8881249ab000(0000) knlGS:0000000000000000 [ 92.988087][ T5777] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 92.988102][ T5777] CR2: 0000564870391850 CR3: 000000007a518000 CR4: 00000000003526f0 [ 92.988125][ T5777] Kernel panic - not syncing: Fatal exception [ 93.099370][ T5777] Kernel Offset: disabled [ 93.103718][ T5777] Rebooting in 86400 seconds..