last executing test programs:
1.26596803s ago: executing program 2 (id=3):
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f00005a4000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x840)
io_uring_setup(0x4fee, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7})
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2)
523.053006ms ago: executing program 1 (id=2):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='rd_pages=64\n', 0xc)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='naa.6001405c935d7912\n', 0x16)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff)
symlinkat(&(0x7f0000000480)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0/virtual_scsi_port\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/enable\x00', 0x1, 0x0)
write(r3, &(0x7f0000000540)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00')
write(0xffffffffffffffff, &(0x7f0000000680)='dummy_udc.0\n', 0xc)
close(0xffffffffffffffff)
ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0})
r4 = syz_open_dev$sg(&(0x7f0000000700), 0x0, 0x2)
ioctl$SG_IO(r4, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0xd, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f00"/13, 0x0, 0x3e8, 0x0, 0x0, 0x0})
85.535856ms ago: executing program 0 (id=1):
mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb)
mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0)
mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0)
mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0)
mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0)
mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0)
0s ago: executing program 3 (id=4):
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='3', 0x4e)
lsetxattr$trusted_overlay_opaque(0x0, 0x0, 0x0, 0x0, 0x2)
mount_setattr(0xffffffffffffffff, 0x0, 0x9800, &(0x7f0000000040)={0x100002, 0xf4}, 0x20)
pipe(0x0)
pipe(0x0)
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.121' (ED25519) to the list of known hosts.
syzkaller login: [ 79.752379][ T5759] cgroup: Unknown subsys name 'net'
[ 79.892278][ T5759] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 81.600474][ T5759] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 83.410667][ T5777] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 83.446589][ T5783] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 83.456281][ T5782] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 83.465046][ T5783] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 83.473213][ T5783] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 83.478110][ T5782] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 83.483355][ T5783] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 83.498453][ T5783] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 83.506106][ T5790] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 83.515111][ T5783] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 83.523598][ T5783] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 83.532364][ T5783] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 83.534355][ T5782] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[ 83.542205][ T5783] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[ 83.553988][ T5783] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 83.584544][ T5777] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 83.588118][ T5788] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 83.598282][ T5781] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[ 83.604613][ T5788] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 83.607890][ T5781] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[ 83.621166][ T5788] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 83.623256][ T5781] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[ 83.630824][ T5788] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[ 83.654205][ T5788] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 84.171000][ T5772] chnl_net:caif_netlink_parms(): no params data found
[ 84.184951][ T5775] chnl_net:caif_netlink_parms(): no params data found
[ 84.198035][ T5774] chnl_net:caif_netlink_parms(): no params data found
[ 84.318453][ T5773] chnl_net:caif_netlink_parms(): no params data found
[ 84.448653][ T5772] bridge0: port 1(bridge_slave_0) entered blocking state
[ 84.456668][ T5772] bridge0: port 1(bridge_slave_0) entered disabled state
[ 84.464689][ T5772] bridge_slave_0: entered allmulticast mode
[ 84.471808][ T5772] bridge_slave_0: entered promiscuous mode
[ 84.491577][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state
[ 84.501037][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state
[ 84.508350][ T5774] bridge_slave_0: entered allmulticast mode
[ 84.517148][ T5774] bridge_slave_0: entered promiscuous mode
[ 84.525856][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state
[ 84.533002][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state
[ 84.540285][ T5774] bridge_slave_1: entered allmulticast mode
[ 84.547785][ T5774] bridge_slave_1: entered promiscuous mode
[ 84.568445][ T5772] bridge0: port 2(bridge_slave_1) entered blocking state
[ 84.575777][ T5772] bridge0: port 2(bridge_slave_1) entered disabled state
[ 84.583004][ T5772] bridge_slave_1: entered allmulticast mode
[ 84.590800][ T5772] bridge_slave_1: entered promiscuous mode
[ 84.644648][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 84.666783][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state
[ 84.676947][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state
[ 84.684490][ T5775] bridge_slave_0: entered allmulticast mode
[ 84.691532][ T5775] bridge_slave_0: entered promiscuous mode
[ 84.701108][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state
[ 84.708401][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state
[ 84.716065][ T5775] bridge_slave_1: entered allmulticast mode
[ 84.723539][ T5775] bridge_slave_1: entered promiscuous mode
[ 84.744320][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 84.767630][ T5772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 84.806969][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state
[ 84.814408][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state
[ 84.821659][ T5773] bridge_slave_0: entered allmulticast mode
[ 84.829117][ T5773] bridge_slave_0: entered promiscuous mode
[ 84.838332][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state
[ 84.845604][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state
[ 84.852995][ T5773] bridge_slave_1: entered allmulticast mode
[ 84.860751][ T5773] bridge_slave_1: entered promiscuous mode
[ 84.870430][ T5772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 84.892345][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 84.905673][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 84.962516][ T5774] team0: Port device team_slave_0 added
[ 84.971845][ T5774] team0: Port device team_slave_1 added
[ 84.993970][ T5772] team0: Port device team_slave_0 added
[ 85.027526][ T5775] team0: Port device team_slave_0 added
[ 85.036560][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 85.049449][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 85.061047][ T5772] team0: Port device team_slave_1 added
[ 85.090479][ T5775] team0: Port device team_slave_1 added
[ 85.140519][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 85.147783][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 85.174176][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 85.188118][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 85.195359][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 85.221383][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 85.256038][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 85.263049][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 85.289744][ T5772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 85.308841][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 85.315969][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 85.345856][ T5772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 85.358679][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 85.365799][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 85.391844][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 85.406925][ T5773] team0: Port device team_slave_0 added
[ 85.413643][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 85.420726][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 85.447283][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 85.490397][ T5773] team0: Port device team_slave_1 added
[ 85.511579][ T5774] hsr_slave_0: entered promiscuous mode
[ 85.518713][ T5774] hsr_slave_1: entered promiscuous mode
[ 85.552145][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 85.559267][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 85.585833][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 85.628811][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 85.636205][ T5084] Bluetooth: hci3: command tx timeout
[ 85.636263][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 85.668065][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 85.714042][ T5084] Bluetooth: hci0: command tx timeout
[ 85.719812][ T5084] Bluetooth: hci2: command tx timeout
[ 85.725956][ T5788] Bluetooth: hci1: command tx timeout
[ 85.735495][ T5772] hsr_slave_0: entered promiscuous mode
[ 85.743902][ T5772] hsr_slave_1: entered promiscuous mode
[ 85.750143][ T5772] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 85.758247][ T5772] Cannot create hsr debugfs directory
[ 85.781536][ T5775] hsr_slave_0: entered promiscuous mode
[ 85.788085][ T5775] hsr_slave_1: entered promiscuous mode
[ 85.794799][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 85.802405][ T5775] Cannot create hsr debugfs directory
[ 85.902031][ T5773] hsr_slave_0: entered promiscuous mode
[ 85.909189][ T5773] hsr_slave_1: entered promiscuous mode
[ 85.916567][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 85.925371][ T5773] Cannot create hsr debugfs directory
[ 86.310110][ T5774] netdevsim netdevsim1 netdevsim0: renamed from eth0
[ 86.329196][ T5774] netdevsim netdevsim1 netdevsim1: renamed from eth1
[ 86.340403][ T5774] netdevsim netdevsim1 netdevsim2: renamed from eth2
[ 86.377960][ T5774] netdevsim netdevsim1 netdevsim3: renamed from eth3
[ 86.440185][ T5772] netdevsim netdevsim2 netdevsim0: renamed from eth0
[ 86.472107][ T5772] netdevsim netdevsim2 netdevsim1: renamed from eth1
[ 86.484624][ T5772] netdevsim netdevsim2 netdevsim2: renamed from eth2
[ 86.494967][ T5772] netdevsim netdevsim2 netdevsim3: renamed from eth3
[ 86.545822][ T5775] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 86.576513][ T5775] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 86.590550][ T5775] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 86.601115][ T5775] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 86.688301][ T5773] netdevsim netdevsim3 netdevsim0: renamed from eth0
[ 86.701658][ T5773] netdevsim netdevsim3 netdevsim1: renamed from eth1
[ 86.718260][ T5773] netdevsim netdevsim3 netdevsim2: renamed from eth2
[ 86.729008][ T5773] netdevsim netdevsim3 netdevsim3: renamed from eth3
[ 86.842050][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0
[ 86.891478][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0
[ 86.915772][ T5774] 8021q: adding VLAN 0 to HW filter on device team0
[ 86.955867][ T1007] bridge0: port 1(bridge_slave_0) entered blocking state
[ 86.963178][ T1007] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 86.979745][ T5772] 8021q: adding VLAN 0 to HW filter on device team0
[ 87.003169][ T1007] bridge0: port 2(bridge_slave_1) entered blocking state
[ 87.010402][ T1007] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 87.049631][ T1007] bridge0: port 1(bridge_slave_0) entered blocking state
[ 87.056867][ T1007] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 87.102481][ T12] bridge0: port 2(bridge_slave_1) entered blocking state
[ 87.109715][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 87.146426][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0
[ 87.202856][ T5775] 8021q: adding VLAN 0 to HW filter on device team0
[ 87.244791][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0
[ 87.286751][ T5774] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 87.329843][ T49] bridge0: port 1(bridge_slave_0) entered blocking state
[ 87.337192][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 87.380883][ T5773] 8021q: adding VLAN 0 to HW filter on device team0
[ 87.393681][ T3486] bridge0: port 2(bridge_slave_1) entered blocking state
[ 87.401053][ T3486] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 87.439034][ T1007] bridge0: port 1(bridge_slave_0) entered blocking state
[ 87.446400][ T1007] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 87.487783][ T1007] bridge0: port 2(bridge_slave_1) entered blocking state
[ 87.495017][ T1007] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 87.725986][ T5084] Bluetooth: hci3: command tx timeout
[ 87.794302][ T5084] Bluetooth: hci2: command tx timeout
[ 87.799804][ T5084] Bluetooth: hci1: command tx timeout
[ 87.805807][ T5788] Bluetooth: hci0: command tx timeout
[ 88.088561][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 88.152479][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 88.247287][ T5772] veth0_vlan: entered promiscuous mode
[ 88.296981][ T5772] veth1_vlan: entered promiscuous mode
[ 88.329847][ T5774] veth0_vlan: entered promiscuous mode
[ 88.345931][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 88.383672][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 88.398949][ T5772] veth0_macvtap: entered promiscuous mode
[ 88.408563][ T5774] veth1_vlan: entered promiscuous mode
[ 88.422377][ T5772] veth1_macvtap: entered promiscuous mode
[ 88.461837][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 88.489996][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 88.504171][ T5772] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.513278][ T5772] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.523238][ T5772] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.533793][ T5772] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.574409][ T5775] veth0_vlan: entered promiscuous mode
[ 88.613502][ T5775] veth1_vlan: entered promiscuous mode
[ 88.669243][ T5774] veth0_macvtap: entered promiscuous mode
[ 88.725588][ T5774] veth1_macvtap: entered promiscuous mode
[ 88.745202][ T5773] veth0_vlan: entered promiscuous mode
[ 88.755326][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 88.763420][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 88.819173][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[ 88.831865][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 88.849457][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 88.870987][ T5775] veth0_macvtap: entered promiscuous mode
[ 88.880818][ T5773] veth1_vlan: entered promiscuous mode
[ 88.886634][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 88.903280][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 88.910971][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[ 88.926216][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 88.938141][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 88.949576][ T5774] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.959876][ T5774] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.968869][ T5774] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.977665][ T5774] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 88.993685][ T5775] veth1_macvtap: entered promiscuous mode
[ 89.057233][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[ 89.068645][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 89.079582][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[ 89.091179][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 89.103162][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 89.158146][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[ 89.173572][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 89.184942][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[ 89.196915][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 89.210460][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 89.221426][ T5773] veth0_macvtap: entered promiscuous mode
[ 89.279348][ T5775] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.314546][ T5775] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.323330][ T5775] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.338997][ T5775] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.350872][ T5773] veth1_macvtap: entered promiscuous mode
[ 89.392544][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 89.444128][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 89.512790][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[ 89.526881][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 89.537404][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[ 89.548066][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 89.563135][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[ 89.575383][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 89.589901][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 89.606875][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[ 89.620922][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 89.633173][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[ 89.655292][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 89.668667][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[ 89.680671][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[ 89.692576][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 89.747299][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 89.758460][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 89.772994][ T5773] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.794412][ T5773] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.796165][ T5084] Bluetooth: hci3: command tx timeout
[ 89.803494][ T5773] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.803557][ T5773] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 89.875489][ T5084] Bluetooth: hci2: command tx timeout
[ 89.880983][ T5084] Bluetooth: hci1: command tx timeout
[ 89.888035][ T5788] Bluetooth: hci0: command tx timeout
[ 90.007163][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 90.039658][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 90.144493][ T1007] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 90.166265][ T1007] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 90.256130][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 90.276679][ T3486] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 90.289126][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 90.326986][ T3486] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 90.471010][ T5845] se_device not configured yet, cannot port link
[ 90.530274][ T5845]
[ 90.532697][ T5845] ======================================================
[ 90.539763][ T5845] WARNING: possible circular locking dependency detected
[ 90.546837][ T5845] syzkaller #0 Not tainted
[ 90.551290][ T5845] ------------------------------------------------------
[ 90.558346][ T5845] syz.1.2/5845 is trying to acquire lock:
[ 90.564096][ T5845] ffffffff8de55e88 (tpg_instances_lock){+.+.}-{3:3}, at: tcm_alloc+0x21/0x2d0
[ 90.573056][ T5845]
[ 90.573056][ T5845] but task is already holding lock:
[ 90.580450][ T5845] ffff88801ef18398 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x59/0x250
[ 90.589512][ T5845]
[ 90.589512][ T5845] which lock already depends on the new lock.
[ 90.589512][ T5845]
[ 90.599961][ T5845]
[ 90.599961][ T5845] the existing dependency chain (in reverse order) is:
[ 90.609013][ T5845]
[ 90.609013][ T5845] -> #2 (&gi->lock){+.+.}-{3:3}:
[ 90.616187][ T5845] __mutex_lock+0x135/0xc80
[ 90.621240][ T5845] config_usb_cfg_link+0x59/0x250
[ 90.626824][ T5845] configfs_symlink+0x5a5/0xfe0
[ 90.632220][ T5845] vfs_symlink+0x138/0x2b0
[ 90.637179][ T5845] do_symlinkat+0x1ba/0x400
[ 90.642230][ T5845] __x64_sys_symlinkat+0x99/0xb0
[ 90.647710][ T5845] do_syscall_64+0x55/0xb0
[ 90.652672][ T5845] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 90.659109][ T5845]
[ 90.659109][ T5845] -> #1 (&sb->s_type->i_mutex_key#20){++++}-{3:3}:
[ 90.667825][ T5845] down_write+0x97/0x200
[ 90.672605][ T5845] configfs_depend_item_unlocked+0x157/0x430
[ 90.679128][ T5845] usbg_make_tpg+0x1e1/0x550
[ 90.684286][ T5845] target_fabric_make_tpg+0xa4/0x6d0
[ 90.690126][ T5845] configfs_mkdir+0x515/0x9e0
[ 90.695387][ T5845] vfs_mkdir+0x2a5/0x470
[ 90.700176][ T5845] do_mkdirat+0x1dc/0x450
[ 90.705042][ T5845] __x64_sys_mkdirat+0x89/0xa0
[ 90.710349][ T5845] do_syscall_64+0x55/0xb0
[ 90.715335][ T5845] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 90.721775][ T5845]
[ 90.721775][ T5845] -> #0 (tpg_instances_lock){+.+.}-{3:3}:
[ 90.729708][ T5845] __lock_acquire+0x37ef/0x7d80
[ 90.735102][ T5845] lock_acquire+0x19e/0x420
[ 90.740148][ T5845] __mutex_lock+0x135/0xc80
[ 90.745188][ T5845] tcm_alloc+0x21/0x2d0
[ 90.749882][ T5845] usb_get_function+0x5d/0xb0
[ 90.755130][ T5845] config_usb_cfg_link+0x148/0x250
[ 90.760792][ T5845] configfs_symlink+0x5a5/0xfe0
[ 90.766189][ T5845] vfs_symlink+0x138/0x2b0
[ 90.771140][ T5845] do_symlinkat+0x1ba/0x400
[ 90.776193][ T5845] __x64_sys_symlinkat+0x99/0xb0
[ 90.781677][ T5845] do_syscall_64+0x55/0xb0
[ 90.786645][ T5845] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 90.793090][ T5845]
[ 90.793090][ T5845] other info that might help us debug this:
[ 90.793090][ T5845]
[ 90.803353][ T5845] Chain exists of:
[ 90.803353][ T5845] tpg_instances_lock --> &sb->s_type->i_mutex_key#20 --> &gi->lock
[ 90.803353][ T5845]
[ 90.817200][ T5845] Possible unsafe locking scenario:
[ 90.817200][ T5845]
[ 90.824665][ T5845] CPU0 CPU1
[ 90.830053][ T5845] ---- ----
[ 90.835439][ T5845] lock(&gi->lock);
[ 90.839361][ T5845] lock(&sb->s_type->i_mutex_key#20);
[ 90.847363][ T5845] lock(&gi->lock);
[ 90.853794][ T5845] lock(tpg_instances_lock);
[ 90.858537][ T5845]
[ 90.858537][ T5845] *** DEADLOCK ***
[ 90.858537][ T5845]
[ 90.866699][ T5845] 3 locks held by syz.1.2/5845:
[ 90.871563][ T5845] #0: ffff8881422f8418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90
[ 90.880837][ T5845] #1: ffff88805f3ae4d0 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: configfs_symlink+0x47a/0xfe0
[ 90.891670][ T5845] #2: ffff88801ef18398 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x59/0x250
[ 90.901108][ T5845]
[ 90.901108][ T5845] stack backtrace:
[ 90.907049][ T5845] CPU: 1 PID: 5845 Comm: syz.1.2 Not tainted syzkaller #0
[ 90.914200][ T5845] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 90.924320][ T5845] Call Trace:
[ 90.927629][ T5845]
[ 90.930590][ T5845] dump_stack_lvl+0x18c/0x250
[ 90.935324][ T5845] ? load_image+0x420/0x420
[ 90.939854][ T5845] ? show_regs_print_info+0x20/0x20
[ 90.945082][ T5845] ? print_circular_bug+0x12b/0x1a0
[ 90.950309][ T5845] check_noncircular+0x2fc/0x400
[ 90.955280][ T5845] ? print_deadlock_bug+0x5d0/0x5d0
[ 90.960512][ T5845] ? lockdep_lock+0xf5/0x230
[ 90.965129][ T5845] ? _find_first_zero_bit+0xd6/0x100
[ 90.970456][ T5845] __lock_acquire+0x37ef/0x7d80
[ 90.975342][ T5845] ? verify_lock_unused+0x140/0x140
[ 90.980573][ T5845] ? __lock_acquire+0x1336/0x7d80
[ 90.985621][ T5845] ? verify_lock_unused+0x140/0x140
[ 90.990851][ T5845] lock_acquire+0x19e/0x420
[ 90.995381][ T5845] ? tcm_alloc+0x21/0x2d0
[ 90.999755][ T5845] ? __might_sleep+0xe0/0xe0
[ 91.004371][ T5845] ? read_lock_is_recursive+0x20/0x20
[ 91.009768][ T5845] ? __mutex_trylock_common+0x160/0x270
[ 91.015367][ T5845] __mutex_lock+0x135/0xc80
[ 91.019899][ T5845] ? tcm_alloc+0x21/0x2d0
[ 91.024250][ T5845] ? trace_contention_end+0x39/0xe0
[ 91.029474][ T5845] ? __mutex_lock+0x30d/0xc80
[ 91.034189][ T5845] ? tcm_alloc+0x21/0x2d0
[ 91.038541][ T5845] ? mutex_lock_nested+0x20/0x20
[ 91.043501][ T5845] ? read_lock_is_recursive+0x20/0x20
[ 91.048895][ T5845] ? config_usb_cfg_link+0x59/0x250
[ 91.054138][ T5845] ? mutex_lock_nested+0x20/0x20
[ 91.059103][ T5845] ? configfs_symlink+0x469/0xfe0
[ 91.064161][ T5845] tcm_alloc+0x21/0x2d0
[ 91.068344][ T5845] usb_get_function+0x5d/0xb0
[ 91.073045][ T5845] config_usb_cfg_link+0x148/0x250
[ 91.078185][ T5845] configfs_symlink+0x5a5/0xfe0
[ 91.083089][ T5845] ? from_kgid+0x153/0x6a0
[ 91.087531][ T5845] ? generic_permission+0x1ed/0x590
[ 91.092749][ T5845] ? detach_groups+0x370/0x370
[ 91.097563][ T5845] ? inode_permission+0xf3/0x480
[ 91.102516][ T5845] ? bpf_lsm_inode_symlink+0x9/0x10
[ 91.107738][ T5845] ? security_inode_symlink+0xb6/0x100
[ 91.113225][ T5845] vfs_symlink+0x138/0x2b0
[ 91.117687][ T5845] do_symlinkat+0x1ba/0x400
[ 91.122212][ T5845] ? vfs_symlink+0x2b0/0x2b0
[ 91.126832][ T5845] __x64_sys_symlinkat+0x99/0xb0
[ 91.131799][ T5845] do_syscall_64+0x55/0xb0
[ 91.136275][ T5845] ? clear_bhb_loop+0x40/0x90
[ 91.141011][ T5845] ? clear_bhb_loop+0x40/0x90
[ 91.145720][ T5845] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 91.151663][ T5845] RIP: 0033:0x7f32e499e159
[ 91.156115][ T5845] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 91.175765][ T5845] RSP: 002b:00007f32e5873028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a
[ 91.184225][ T5845] RAX: ffffffffffffffda RBX: 00007f32e4c25fa0 RCX: 00007f32e499e159
[ 91.192234][ T5845] RDX: 0000200000000600 RSI: ffffffffffffff9c RDI: 00002000000005c0
[ 91.200251][ T5845] RBP: 00007f32e4a3506b R08: 0000000000000000 R09: 0000000000000000
[ 91.208259][ T5845] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 91.216252][ T5845] R13: 00007f32e4c26038 R14: 00007f32e4c25fa0 R15: 00007ffdfeadbc38
[ 91.224248][ T5845]
[ 91.294789][ T5850] =======================================================
[ 91.294789][ T5850] WARNING: The mand mount option has been deprecated and
[ 91.294789][ T5850] and is ignored by this kernel. Remove the mand
[ 91.294789][ T5850] option from the mount to silence this warning.
[ 91.294789][ T5850] =======================================================
[ 91.349684][ T5851] FAULT_INJECTION: forcing a failure.
[ 91.349684][ T5851] name failslab, interval 1, probability 0, space 0, times 1
[ 91.386747][ T5851] CPU: 1 PID: 5851 Comm: syz.3.4 Not tainted syzkaller #0
[ 91.393954][ T5851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
[ 91.404049][ T5851] Call Trace:
[ 91.407371][ T5851]
[ 91.410341][ T5851] dump_stack_lvl+0x18c/0x250
[ 91.415106][ T5851] ? show_regs_print_info+0x20/0x20
[ 91.420356][ T5851] ? load_image+0x420/0x420
[ 91.424931][ T5851] ? __might_sleep+0xe0/0xe0
[ 91.429588][ T5851] ? __lock_acquire+0x7d80/0x7d80
[ 91.434698][ T5851] should_fail_ex+0x394/0x4c0
[ 91.439432][ T5851] should_failslab+0x9/0x20
[ 91.444001][ T5851] slab_pre_alloc_hook+0x59/0x300
[ 91.449113][ T5851] ? lockdep_softirqs_off+0x440/0x440
[ 91.454535][ T5851] kmem_cache_alloc+0x5a/0x2c0
[ 91.459355][ T5851] ? security_inode_alloc+0x34/0x110
[ 91.464710][ T5851] security_inode_alloc+0x34/0x110
[ 91.469888][ T5851] inode_init_always+0x914/0xc90
[ 91.474875][ T5851] new_inode_pseudo+0x95/0x1d0
[ 91.479690][ T5851] create_pipe_files+0x51/0x700
[ 91.484596][ T5851] ? __ia32_sys_get_robust_list+0x110/0x110
[ 91.490538][ T5851] ? blkcg_maybe_throttle_current+0x19f/0xa90
[ 91.496653][ T5851] __do_pipe_flags+0x4c/0x2c0
[ 91.501372][ T5851] do_pipe2+0xab/0x190
[ 91.505473][ T5851] ? _compound_head+0x120/0x120
[ 91.510348][ T5851] ? lock_chain_count+0x20/0x20
[ 91.515219][ T5851] ? rcu_is_watching+0x15/0xb0
[ 91.520005][ T5851] __x64_sys_pipe+0x3a/0x40
[ 91.524536][ T5851] do_syscall_64+0x55/0xb0
[ 91.528989][ T5851] ? clear_bhb_loop+0x40/0x90
[ 91.533685][ T5851] ? clear_bhb_loop+0x40/0x90
[ 91.538386][ T5851] entry_SYSCALL_64_after_hwframe+0x68/0xd2
[ 91.544307][ T5851] RIP: 0033:0x7f586559e159
[ 91.548742][ T5851] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 91.568375][ T5851] RSP: 002b:00007f58664ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000016
[ 91.576841][ T5851] RAX: ffffffffffffffda RBX: 00007f5865825fa0 RCX: 00007f586559e159
[ 91.584839][ T5851] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 91.592830][ T5851] RBP: 00007f586563506b R08: 0000000000000000 R09: 0000000000000000
[ 91.600822][ T5851] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 91.608810][ T5851] R13: 00007f5865826038 R14: 00007f5865825fa0 R15: 00007fff9dbc2378
[ 91.616815][ T5851]
[ 91.874196][ T5084] Bluetooth: hci3: command tx timeout
[ 91.954149][ T5788] Bluetooth: hci0: command tx timeout
[ 91.954567][ T51] Bluetooth: hci2: command tx timeout
[ 91.959832][ T5084] Bluetooth: hci1: command tx timeout
[ 92.114943][ T175] cfg80211: failed to load regulatory.db