last executing test programs: 9.62989625s ago: executing program 1 (id=73): mkdir(&(0x7f0000000040)='./mount_sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./mount_sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000140)='./mount_dlm\x00', 0x1ff) mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./mount_dlm\x00', &(0x7f0000000200)='ocfs2_dlmfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000000240)='./mount_sys/fs/ocfs2/cluster_stack\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='user', 0x4) close(r0) mkdir(&(0x7f00000002c0)='./mount_config\x00', 0x1ff) r1 = open(&(0x7f0000000400)='./mount_config/dlm/ocfs2/recover_callbacks\x00', 0x1, 0x0) write(r1, &(0x7f0000000440)='1', 0x1) 6.881805778s ago: executing program 1 (id=76): mkdir(&(0x7f0000000040)='./mount_sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./mount_sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000140)='./mount_dlm\x00', 0x1ff) mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./mount_dlm\x00', &(0x7f0000000200)='ocfs2_dlmfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000000240)='./mount_sys/fs/ocfs2/cluster_stack\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='user', 0x4) close(r0) mkdir(&(0x7f00000002c0)='./mount_config\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='none\x00', &(0x7f0000000340)='./mount_config\x00', &(0x7f0000000380)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f00000003c0)='./mount_config/dlm/ocfs2\x00', 0x1ff) r1 = open(&(0x7f0000000480)='./mount_config/dlm/ocfs2/tcp_port\x00', 0x1, 0x0) write(r1, &(0x7f00000004c0)='21064', 0x5) 3.631696846s ago: executing program 1 (id=87): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000200304306000000000000109022400010000000009040000010300000009210000000122020009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\"\v'], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00140d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000b00)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="200e06"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000240)={&(0x7f0000000140)=[{0x3, 0x1000, 0x0, 0x0}], 0x1}) 2.311571335s ago: executing program 3 (id=93): r0 = socket$inet_icmp(0x2, 0x2, 0x1) close(r0) mkdir(&(0x7f0000000000)='config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff) r1 = openat(0xffffff9c, &(0x7f0000000400)='config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='0x1d6b\x00', 0x6) r2 = openat(0xffffff9c, &(0x7f0000000900)='config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r2, &(0x7f0000000a00)='fedcba9876543210\x00', 0x10) 2.201731155s ago: executing program 3 (id=94): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./cfg/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1/functions/midi2.0\x00', 0x1ff) symlinkat(&(0x7f0000000100)='./cfg/usb_gadget/g1/functions/midi2.0\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./cfg/usb_gadget/g1/configs/c.1/midi2.0\x00') 2.061480689s ago: executing program 3 (id=96): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x30, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x1, [{0x2, 0x1}]}, @void, @void, @void, @void, @void, @void}, 0x2f) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000380)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val, @void}, 0x20) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d50633"], 0x6f4}}, 0x0) 1.853701203s ago: executing program 0 (id=99): open(&(0x7f00000005c0)='./bus\x00', 0x147842, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./bus\x00', 0x0, 0x0) ioprio_set$pid(0x1, 0x0, 0x2007) r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x0) write(r1, &(0x7f0000004200)="a6", 0x1) sendfile(r1, r0, 0x0, 0xfff) 1.387799678s ago: executing program 2 (id=102): mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./mount_sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000000240)='./mount_sys/fs/ocfs2/cluster_stack\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='user', 0x4) 1.357368069s ago: executing program 0 (id=104): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, &(0x7f0000001d80)={0x2000000, [{0x3, 0x0, 0x81, 0x0}, {0x3, 0x0, 0x3, 0x0}, {0x1, 0x0, 0x2, 0x0}, {0x2, 0x0, 0xe1, 0x0}, {0x2, 0x0, 0x8, 0x0}, {0x2, 0x0, 0x5, 0x0}, {0x2, 0x0, 0x2, 0x0}, {0x1, 0x0, 0xffffffff, 0x0}, {0x1, 0x0, 0x3, 0x0}, {0x2, 0x0, 0x5, 0x0}, {0x4, 0x0, 0x2, 0x0}, {0x2, 0x0, 0xff, 0x0}, {0x1, 0x0, 0xab, 0x0}, {0x1, 0x0, 0x3, 0x0}, {0x0, 0x0, 0x7fffffff, 0x0}, {0x3, 0x0, 0x800, 0x0}]}) 1.268849526s ago: executing program 2 (id=105): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./cfg/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./cfg/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1/functions/midi2.0\x00', 0x1ff) symlinkat(&(0x7f0000000100)='./cfg/usb_gadget/g1/functions/midi2.0\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./cfg/usb_gadget/g1/configs/c.1/midi2.0\x00') 1.178474897s ago: executing program 2 (id=106): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @empty}], 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000140)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000002c0)=[{&(0x7f00000001c0)='N', 0x1}], 0x1, 0x0, 0x0, 0xc04c000}, 0x0) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000080)={0x0, 0x6, 0x2, 0x4}, &(0x7f0000000300)=0x10) 1.01595107s ago: executing program 0 (id=107): r0 = socket$inet_icmp(0x2, 0x2, 0x1) close(r0) mkdir(&(0x7f0000000000)='config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='config/usb_gadget/g1\x00', 0x1ff) r1 = openat(0xffffff9c, &(0x7f0000000900)='config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r1, &(0x7f0000000a00)='fedcba9876543210\x00', 0x10) 942.436697ms ago: executing program 0 (id=108): getpid() mkdir(&(0x7f0000000040)='./trace\x00', 0x1ff) mount(&(0x7f0000000000), &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='trace/events/sched/sched_switch/filter\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='prev_state.function == kallsyms_lookup_name\x00', 0x2c) 937.2191ms ago: executing program 3 (id=109): mkdir(&(0x7f0000000040)='./mount_sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./mount_sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000140)='./mount_dlm\x00', 0x1ff) mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./mount_dlm\x00', &(0x7f0000000200)='ocfs2_dlmfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000000240)='./mount_sys/fs/ocfs2/cluster_stack\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='user', 0x4) close(r0) mount(&(0x7f0000000300)=@filename='none\x00', &(0x7f0000000340)='./mount_config\x00', &(0x7f0000000380)='configfs\x00', 0x0, 0x0) r1 = open(&(0x7f0000000400)='./mount_config/dlm/ocfs2/recover_callbacks\x00', 0x1, 0x0) write(r1, &(0x7f0000000440)='1', 0x1) 703.958428ms ago: executing program 0 (id=110): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280), 0x800c42, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x0, 0x100) openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x21, 0x40000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) 703.698777ms ago: executing program 2 (id=111): mkdir(&(0x7f0000000040)='./mount_sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./mount_sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000140)='./mount_dlm\x00', 0x1ff) mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./mount_dlm\x00', &(0x7f0000000200)='ocfs2_dlmfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000000240)='./mount_sys/fs/ocfs2/cluster_stack\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='user', 0x4) close(r0) mkdir(&(0x7f00000002c0)='./mount_config\x00', 0x1ff) r1 = open(&(0x7f0000000480)='./mount_config/dlm/ocfs2/tcp_port\x00', 0x1, 0x0) write(r1, &(0x7f00000004c0)='21064', 0x5) 703.474934ms ago: executing program 3 (id=112): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000100)) 575.954988ms ago: executing program 2 (id=113): mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./mount_sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = open(&(0x7f0000000240)='./mount_sys/fs/ocfs2/cluster_stack\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='user', 0x4) 518.674283ms ago: executing program 0 (id=114): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) r2 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r2, 0xe) 348.551055ms ago: executing program 2 (id=115): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_X86_SET_MSR_FILTER(r1, 0x4188aec6, &(0x7f0000001d80)={0x2000000, [{0x3, 0x0, 0x81, 0x0}, {0x3, 0x0, 0x3, 0x0}, {0x1, 0x0, 0x2, 0x0}, {0x2, 0x0, 0xe1, 0x0}, {0x2, 0x0, 0x8, 0x0}, {0x2, 0x0, 0x5, 0x0}, {0x2, 0x0, 0x2, 0x0}, {0x1, 0x0, 0xffffffff, 0x0}, {0x1, 0x0, 0x3, 0x0}, {0x2, 0x0, 0x5, 0x0}, {0x4, 0x0, 0x2, 0x0}, {0x2, 0x0, 0xff, 0x0}, {0x1, 0x0, 0xab, 0x0}, {0x1, 0x0, 0x3, 0x0}, {0x0, 0x0, 0x7fffffff, 0x0}, {0x3, 0x0, 0x800, 0x0}]}) 348.17743ms ago: executing program 1 (id=116): r0 = socket$inet_icmp(0x2, 0x2, 0x1) close(r0) mkdir(&(0x7f0000000000)='config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) r1 = openat(0xffffff9c, &(0x7f0000000900)='config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r1, &(0x7f0000000a00)='fedcba9876543210\x00', 0x10) 204.073161ms ago: executing program 3 (id=117): mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0xf6c, 0x2) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) read$FUSE(r0, &(0x7f0000002640)={0x2020}, 0x2020) 136.348231ms ago: executing program 1 (id=118): getpid() mkdir(&(0x7f0000000040)='./trace\x00', 0x1ff) mount(&(0x7f0000000000), &(0x7f0000000080)='./trace\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='trace/events/sched/sched_switch/filter\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='prev_state.function == kallsyms_lookup_name\x00', 0x2c) 0s ago: executing program 1 (id=119): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./myconfig\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./myconfig\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./myconfig/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./myconfig/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./myconfig/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000600)='./myconfig/usb_gadget/g1/functions/acm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./myconfig/usb_gadget/g1/configs/c.1/acm.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./myconfig/usb_gadget/g1/max_speed\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='super-speed', 0xb) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./myconfig/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000e00)='0x0525', 0x6) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000f00)='./myconfig/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r2, &(0x7f0000001000)='0xa4a6', 0x6) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./myconfig/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000b00)='dummy_udc.0', 0xb) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./mydev\x00', 0x1ff) mount(0x0, &(0x7f0000002100)='./mydev\x00', &(0x7f0000002200)='devtmpfs\x00', 0x0, 0x0) nanosleep(&(0x7f0000000c00)={0x0, 0x5f5e100}, 0x0) nanosleep(&(0x7f0000000c00)={0x0, 0x5f5e100}, 0x0) nanosleep(&(0x7f0000000c00)={0x0, 0x5f5e100}, 0x0) nanosleep(&(0x7f0000000c00)={0x0, 0x5f5e100}, 0x0) nanosleep(&(0x7f0000000c00)={0x0, 0x5f5e100}, 0x0) nanosleep(&(0x7f0000000c00)={0x0, 0x5f5e100}, 0x0) nanosleep(&(0x7f0000000c00)={0x0, 0x5f5e100}, 0x0) nanosleep(&(0x7f0000000c00)={0x0, 0x5f5e100}, 0x0) nanosleep(&(0x7f0000000c00)={0x0, 0x5f5e100}, 0x0) nanosleep(&(0x7f0000000c00)={0x0, 0x5f5e100}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000002300)='./mydev/ttyACM0\x00', 0x802, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000002400)='./mydev/kmsg\x00', 0x1, 0x0) write(r5, &(0x7f0000002500)='hello world\n', 0xc) close(r5) write(r4, &(0x7f0000002500)='hello world\n', 0xc) read(r4, &(0x7f0000002600), 0x100) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.136' (ED25519) to the list of known hosts. [ 92.275883][ T1254] cfg80211: failed to load regulatory.db [ 93.816952][ T5584] cgroup: Unknown subsys name 'net' [ 94.061557][ T5584] cgroup: Unknown subsys name 'cpuset' [ 94.112911][ T5584] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 96.196589][ T5584] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 100.428757][ T4914] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 100.458417][ T4914] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 100.502034][ T5610] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 100.511503][ T5610] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 100.540712][ T5611] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 100.567805][ T5611] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 100.567898][ T5615] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 100.570606][ T5615] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 100.600183][ T5615] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 100.605888][ T5615] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 100.608392][ T5615] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 100.609259][ T5615] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 100.616508][ T5615] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 100.661379][ T5611] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 100.674348][ T5615] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 100.676723][ T5615] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 100.688559][ T5615] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 100.704446][ T5610] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 100.705111][ T5610] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 100.755245][ T4914] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 102.784750][ T5611] Bluetooth: hci1: command tx timeout [ 102.785173][ T5606] Bluetooth: hci2: command tx timeout [ 102.942235][ T5606] Bluetooth: hci3: command tx timeout [ 103.032247][ T5606] Bluetooth: hci0: command tx timeout [ 103.264540][ T5605] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.264947][ T5605] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.267899][ T5605] bridge_slave_0: entered allmulticast mode [ 103.271228][ T5605] bridge_slave_0: entered promiscuous mode [ 103.348489][ T5605] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.348754][ T5605] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.348987][ T5605] bridge_slave_1: entered allmulticast mode [ 103.351595][ T5605] bridge_slave_1: entered promiscuous mode [ 103.513539][ T5602] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.513841][ T5602] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.514061][ T5602] bridge_slave_0: entered allmulticast mode [ 103.516796][ T5602] bridge_slave_0: entered promiscuous mode [ 103.574839][ T5605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.607252][ T5602] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.607570][ T5602] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.607815][ T5602] bridge_slave_1: entered allmulticast mode [ 103.611128][ T5602] bridge_slave_1: entered promiscuous mode [ 103.614778][ T5604] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.616223][ T5604] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.617252][ T5604] bridge_slave_0: entered allmulticast mode [ 103.632944][ T5604] bridge_slave_0: entered promiscuous mode [ 103.671641][ T5605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.726016][ T5604] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.726286][ T5604] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.726493][ T5604] bridge_slave_1: entered allmulticast mode [ 103.729108][ T5604] bridge_slave_1: entered promiscuous mode [ 103.775237][ T5601] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.775516][ T5601] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.775727][ T5601] bridge_slave_0: entered allmulticast mode [ 103.778384][ T5601] bridge_slave_0: entered promiscuous mode [ 103.865267][ T5601] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.865704][ T5601] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.866020][ T5601] bridge_slave_1: entered allmulticast mode [ 103.868759][ T5601] bridge_slave_1: entered promiscuous mode [ 103.887050][ T5602] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.930862][ T5605] team0: Port device team_slave_0 added [ 103.960491][ T5602] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.973968][ T5604] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.977845][ T5605] team0: Port device team_slave_1 added [ 104.029497][ T5604] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.066325][ T5601] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.146811][ T5601] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.150538][ T5602] team0: Port device team_slave_0 added [ 104.189935][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.189954][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.189974][ T5605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.246693][ T5602] team0: Port device team_slave_1 added [ 104.250444][ T5604] team0: Port device team_slave_0 added [ 104.264102][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.264135][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.264214][ T5605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.344992][ T5604] team0: Port device team_slave_1 added [ 104.368401][ T5601] team0: Port device team_slave_0 added [ 104.414999][ T5601] team0: Port device team_slave_1 added [ 104.416865][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.416877][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.416896][ T5602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.499087][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.499101][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.499122][ T5602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.501405][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.501418][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.501438][ T5604] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.627397][ T5604] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.627411][ T5604] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.627432][ T5604] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.692631][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.692651][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.692679][ T5601] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.864165][ T5606] Bluetooth: hci1: command tx timeout [ 104.864203][ T5606] Bluetooth: hci2: command tx timeout [ 105.022544][ T5611] Bluetooth: hci3: command tx timeout [ 105.096676][ T5605] hsr_slave_0: entered promiscuous mode [ 105.098692][ T5605] hsr_slave_1: entered promiscuous mode [ 105.103176][ T5611] Bluetooth: hci0: command tx timeout [ 105.120770][ T5601] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 105.120782][ T5601] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 105.120802][ T5601] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 105.299781][ T5602] hsr_slave_0: entered promiscuous mode [ 105.301869][ T5602] hsr_slave_1: entered promiscuous mode [ 105.315362][ T5602] debugfs: 'hsr0' already exists in 'hsr' [ 105.315497][ T5602] Cannot create hsr debugfs directory [ 105.384893][ T5604] hsr_slave_0: entered promiscuous mode [ 105.386661][ T5604] hsr_slave_1: entered promiscuous mode [ 105.388153][ T5604] debugfs: 'hsr0' already exists in 'hsr' [ 105.388177][ T5604] Cannot create hsr debugfs directory [ 105.488462][ T5601] hsr_slave_0: entered promiscuous mode [ 105.490256][ T5601] hsr_slave_1: entered promiscuous mode [ 105.495529][ T5601] debugfs: 'hsr0' already exists in 'hsr' [ 105.495605][ T5601] Cannot create hsr debugfs directory [ 106.449340][ T5605] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 106.499625][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.534652][ T5605] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 106.560511][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.575376][ T5605] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 106.626164][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.663694][ T5605] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 106.689111][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.836253][ T5604] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 106.881644][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.899655][ T5604] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 106.938374][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.941840][ T5604] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 106.946642][ T5606] Bluetooth: hci1: command tx timeout [ 106.946745][ T5611] Bluetooth: hci2: command tx timeout [ 106.988281][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.026696][ T5604] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 107.050834][ T5604] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.105885][ T5611] Bluetooth: hci3: command tx timeout [ 107.192449][ T5611] Bluetooth: hci0: command tx timeout [ 107.290661][ T5602] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 107.318452][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.338422][ T5602] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 107.379797][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.393459][ T5602] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 107.428485][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.463099][ T5602] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 107.505067][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.678437][ T5601] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 107.708717][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.727121][ T5601] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 107.768543][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.789528][ T5601] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 107.835996][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.863621][ T5601] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 107.910887][ T5601] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.996289][ T5605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.159110][ T5605] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.205378][ T5604] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.277388][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.277592][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.347716][ T3334] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.347874][ T3334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.451654][ T5604] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.534584][ T3334] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.534709][ T3334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.579464][ T5602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.621058][ T3334] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.624809][ T3334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.761005][ T5602] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.825276][ T5601] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.844884][ T83] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.845101][ T83] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.917608][ T1441] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.917863][ T1441] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.022302][ T5611] Bluetooth: hci2: command tx timeout [ 109.022335][ T5611] Bluetooth: hci1: command tx timeout [ 109.064463][ T5601] 8021q: adding VLAN 0 to HW filter on device team0 [ 109.182917][ T5606] Bluetooth: hci3: command tx timeout [ 109.200040][ T3334] bridge0: port 1(bridge_slave_0) entered blocking state [ 109.200229][ T3334] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.264347][ T5606] Bluetooth: hci0: command tx timeout [ 109.341373][ T3334] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.341536][ T3334] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.264996][ T5605] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.563950][ T5604] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.733701][ T5605] veth0_vlan: entered promiscuous mode [ 110.846739][ T5605] veth1_vlan: entered promiscuous mode [ 110.959008][ T5602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.114001][ T5601] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.129329][ T5604] veth0_vlan: entered promiscuous mode [ 111.193790][ T5605] veth0_macvtap: entered promiscuous mode [ 111.208080][ T5604] veth1_vlan: entered promiscuous mode [ 111.237651][ T5605] veth1_macvtap: entered promiscuous mode [ 111.372390][ T5602] veth0_vlan: entered promiscuous mode [ 111.400981][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.457308][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.487870][ T5602] veth1_vlan: entered promiscuous mode [ 111.517167][ T5601] veth0_vlan: entered promiscuous mode [ 111.548160][ T3389] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.567356][ T5604] veth0_macvtap: entered promiscuous mode [ 111.594953][ T3389] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.606092][ T3389] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.643110][ T3389] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.645203][ T5604] veth1_macvtap: entered promiscuous mode [ 111.671980][ T5601] veth1_vlan: entered promiscuous mode [ 112.001313][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.107697][ T5604] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.109926][ T5602] veth0_macvtap: entered promiscuous mode [ 112.201961][ T5602] veth1_macvtap: entered promiscuous mode [ 112.236392][ T83] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.256648][ T83] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.272601][ T83] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.307163][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.307186][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.344216][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.370946][ T5601] veth0_macvtap: entered promiscuous mode [ 112.541289][ T5601] veth1_macvtap: entered promiscuous mode [ 112.653799][ T3334] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.653833][ T3334] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.687586][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.860856][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 113.069244][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 113.071028][ T83] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.118270][ T83] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.166973][ T83] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.170557][ T83] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.211473][ T3389] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.211493][ T3389] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.287886][ T5601] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 113.588273][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.733127][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.791763][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.793780][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.796362][ T169] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.796425][ T169] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.829515][ T5750] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 114.835826][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.835849][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.897937][ T5754] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5'. [ 114.970230][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.970264][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 115.733228][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 116.121141][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.121162][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.124621][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 116.276975][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 116.277001][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 116.277030][ T10] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 116.277046][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 116.826256][ T10] usb 4-1: config 0 descriptor?? [ 116.881001][ T5765] configfs-gadget.g1 gadget.0: Hardware params: access 3, format 2, channels 2, rate 48000 [ 116.960964][ T5765] udc dummy_udc.0: failed to start g1: -19 [ 117.164525][ T5765] UDC core: g1: couldn't find an available UDC or it's busy [ 117.220729][ T83] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.220750][ T83] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.990129][ T10] ft260 0003:0403:6030.0001: unknown main item tag 0x0 [ 117.990176][ T10] ft260 0003:0403:6030.0001: unknown main item tag 0x0 [ 118.301605][ T10] ft260 0003:0403:6030.0001: chip code: 0000 0000 [ 118.308969][ T10] ft260 0003:0403:6030.0001: failed to retrieve system status [ 118.347156][ T10] ft260 0003:0403:6030.0001: probe with driver ft260 failed with error -32 [ 120.378392][ T1254] usb 4-1: USB disconnect, device number 2 [ 120.846492][ T5816] netlink: 20 bytes leftover after parsing attributes in process `syz.0.22'. [ 121.267866][ T5818] netlink: 20 bytes leftover after parsing attributes in process `syz.0.22'. [ 122.116350][ T5768] udevd[5768]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 122.121906][ T5768] udevd[5768]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 122.322854][ T5759] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 122.476310][ T5849] Line length is too long: Should be less than 4094 [ 122.492158][ T5759] usb 1-1: Using ep0 maxpacket: 32 [ 122.511480][ T5759] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 122.511514][ T5759] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 122.511552][ T5759] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 122.511576][ T5759] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 122.585889][ T5759] usb 1-1: config 0 descriptor?? [ 123.107045][ T5759] ft260 0003:0403:6030.0002: unknown main item tag 0x0 [ 123.111387][ T5759] ft260 0003:0403:6030.0002: unknown main item tag 0x0 [ 123.149545][ T5861] netlink: 20 bytes leftover after parsing attributes in process `syz.3.40'. [ 123.210045][ T5759] ft260 0003:0403:6030.0002: chip code: 0000 0000 [ 123.416279][ T5759] ft260 0003:0403:6030.0002: failed to retrieve system status [ 123.416716][ T5759] ft260 0003:0403:6030.0002: probe with driver ft260 failed with error -32 [ 123.582000][ T5865] netlink: 20 bytes leftover after parsing attributes in process `syz.3.40'. [ 123.582033][ T5865] nbd: nbd64 already in use [ 124.168554][ T5768] udevd[5768]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 124.349884][ T5883] netlink: 'syz.3.46': attribute type 2 has an invalid length. [ 124.387250][ T5883] syz.3.46 uses obsolete (PF_INET,SOCK_PACKET) [ 125.238429][ T1254] usb 1-1: USB disconnect, device number 2 [ 126.170778][ T5930] netlink: 'syz.1.74': attribute type 2 has an invalid length. [ 126.310263][ T5932] Line length is too long: Should be less than 4094 [ 126.623267][ T1254] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 126.772223][ T1254] usb 4-1: Using ep0 maxpacket: 32 [ 126.776016][ T1254] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 126.776052][ T1254] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 126.776089][ T1254] usb 4-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 126.776114][ T1254] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.851617][ T1254] usb 4-1: config 0 descriptor?? [ 127.308552][ T1254] ft260 0003:0403:6030.0003: unknown main item tag 0x0 [ 127.308592][ T1254] ft260 0003:0403:6030.0003: unknown main item tag 0x0 [ 127.502887][ T1254] ft260 0003:0403:6030.0003: chip code: 0000 0000 [ 127.704535][ T1254] ft260 0003:0403:6030.0003: failed to retrieve system status [ 127.704827][ T1254] ft260 0003:0403:6030.0003: probe with driver ft260 failed with error -32 [ 129.459821][ T5759] usb 4-1: USB disconnect, device number 3 [ 129.892338][ T5697] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 130.042236][ T5697] usb 1-1: Using ep0 maxpacket: 32 [ 130.044434][ T5697] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 130.044460][ T5697] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 130.044488][ T5697] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 130.044507][ T5697] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.059866][ T5697] usb 1-1: config 0 descriptor?? [ 130.531308][ T5697] ft260 0003:0403:6030.0004: unknown main item tag 0x0 [ 130.531336][ T5697] ft260 0003:0403:6030.0004: unknown main item tag 0x0 [ 130.730696][ T5697] ft260 0003:0403:6030.0004: chip code: 0000 0000 [ 130.931426][ T5697] ft260 0003:0403:6030.0004: failed to retrieve system status [ 130.931786][ T5697] ft260 0003:0403:6030.0004: probe with driver ft260 failed with error -32 [ 132.709017][ T1254] usb 1-1: USB disconnect, device number 3 [ 133.092361][ T201] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 133.190339][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.190479][ T1339] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.242257][ T201] usb 2-1: Using ep0 maxpacket: 32 [ 133.244172][ T201] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 133.244206][ T201] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 133.244246][ T201] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 133.244270][ T201] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.324991][ T201] usb 2-1: config 0 descriptor?? [ 133.805592][ T201] ft260 0003:0403:6030.0005: unknown main item tag 0x0 [ 133.805630][ T201] ft260 0003:0403:6030.0005: unknown main item tag 0x0 [ 133.847468][ T5990] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 133.957430][ T201] ft260 0003:0403:6030.0005: chip code: 0000 0000 [ 134.164096][ T201] ft260 0003:0403:6030.0005: failed to retrieve system status [ 134.164526][ T201] ft260 0003:0403:6030.0005: probe with driver ft260 failed with error -32 [ 134.548916][ T6009] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 134.698852][ T6015] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 134.759896][ T6009] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 136.008940][ T5697] usb 2-1: USB disconnect, device number 2 [ 136.179226][ T6047] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 136.179424][ T6047] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 136.380610][ T6047] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 136.515456][ T6047] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 136.515586][ T6047] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 136.588427][ T6047] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 136.601983][ T6058] ================================================================== [ 136.601997][ T6058] BUG: KASAN: slab-use-after-free in filp_flush+0x31/0x190 [ 136.602018][ T6058] Read of size 8 at addr ffff88802569f990 by task syz.1.119/6058 [ 136.602037][ T6058] [ 136.602085][ T6058] CPU: 1 UID: 0 PID: 6058 Comm: syz.1.119 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 136.602111][ T6058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 136.602134][ T6058] Call Trace: [ 136.602143][ T6058] [ 136.602151][ T6058] dump_stack_lvl+0xe8/0x150 [ 136.602180][ T6058] print_address_description+0x55/0x1e0 [ 136.602216][ T6058] ? filp_flush+0x31/0x190 [ 136.602236][ T6058] print_report+0x58/0x70 [ 136.602266][ T6058] kasan_report+0x117/0x150 [ 136.602287][ T6058] ? filp_flush+0x31/0x190 [ 136.602316][ T6058] kasan_check_range+0x264/0x2c0 [ 136.602333][ T6058] filp_flush+0x31/0x190 [ 136.602348][ T6058] filp_close+0x1d/0x40 [ 136.602362][ T6058] gaudio_cleanup+0x54/0xf0 [ 136.602387][ T6058] f_audio_bind+0x4a0/0x630 [ 136.602411][ T6058] ? __pfx_f_audio_bind+0x10/0x10 [ 136.602434][ T6058] ? kasan_quarantine_put+0xbb/0x1f0 [ 136.602456][ T6058] ? lockdep_hardirqs_on+0x7a/0x110 [ 136.602474][ T6058] usb_add_function+0x290/0x930 [ 136.602521][ T6058] ? check_remote_wakeup_config+0x58/0x1c0 [ 136.602552][ T6058] configfs_composite_bind+0xde0/0x1410 [ 136.602587][ T6058] ? __pfx_configfs_composite_bind+0x10/0x10 [ 136.602615][ T6058] gadget_bind_driver+0x2ca/0x9e0 [ 136.602641][ T6058] ? __pfx_gadget_bind_driver+0x10/0x10 [ 136.602666][ T6058] really_probe+0x254/0xae0 [ 136.602688][ T6058] __driver_probe_device+0x1e8/0x360 [ 136.602708][ T6058] driver_probe_device+0x4f/0x240 [ 136.602730][ T6058] __driver_attach+0x339/0x600 [ 136.602749][ T6058] bus_for_each_dev+0x23e/0x2c0 [ 136.602774][ T6058] ? __pfx___driver_attach+0x10/0x10 [ 136.602798][ T6058] ? __pfx_bus_for_each_dev+0x10/0x10 [ 136.602825][ T6058] ? rt_spin_unlock+0x163/0x200 [ 136.602848][ T6058] bus_add_driver+0x348/0x670 [ 136.602875][ T6058] driver_register+0x23a/0x320 [ 136.602904][ T6058] usb_gadget_register_driver_owner+0xf9/0x270 [ 136.602932][ T6058] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 136.602949][ T6058] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 136.602967][ T6058] configfs_write_iter+0x33a/0x430 [ 136.602987][ T6058] vfs_write+0x61e/0xbb0 [ 136.603008][ T6058] ? __pfx_vfs_write+0x10/0x10 [ 136.603027][ T6058] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 136.603042][ T6058] ? lockdep_hardirqs_on+0x7a/0x110 [ 136.603058][ T6058] ? mutex_lock_nested+0x152/0x1d0 [ 136.603078][ T6058] ? fdget_pos+0x252/0x320 [ 136.603097][ T6058] ksys_write+0x156/0x270 [ 136.603116][ T6058] ? __pfx_ksys_write+0x10/0x10 [ 136.603138][ T6058] do_syscall_64+0x17b/0x530 [ 136.603153][ T6058] ? irqentry_exit+0x10f/0x8f0 [ 136.603168][ T6058] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.603184][ T6058] ? clear_bhb_loop+0x40/0x90 [ 136.603202][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.603218][ T6058] RIP: 0033:0x7f995589df99 [ 136.603240][ T6058] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.603254][ T6058] RSP: 002b:00007f9953af6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 136.603274][ T6058] RAX: ffffffffffffffda RBX: 00007f9955b25fa0 RCX: 00007f995589df99 [ 136.603286][ T6058] RDX: 000000000000000b RSI: 0000200000000b00 RDI: 0000000000000003 [ 136.603299][ T6058] RBP: 00007f9955934ec4 R08: 0000000000000000 R09: 0000000000000000 [ 136.603309][ T6058] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 136.603318][ T6058] R13: 00007f9955b26038 R14: 00007f9955b25fa0 R15: 00007ffc5a8fcc88 [ 136.603336][ T6058] [ 136.603341][ T6058] [ 136.603345][ T6058] Allocated by task 5765: [ 136.603352][ T6058] kasan_save_track+0x3e/0x80 [ 136.603374][ T6058] __kasan_slab_alloc+0x6c/0x80 [ 136.603397][ T6058] kmem_cache_alloc_noprof+0x358/0x680 [ 136.603418][ T6058] alloc_empty_file+0x5b/0x1d0 [ 136.603440][ T6058] path_openat+0x8f/0x3850 [ 136.603457][ T6058] do_file_open+0x23e/0x4a0 [ 136.603474][ T6058] filp_open+0x16d/0x1d0 [ 136.603496][ T6058] gaudio_setup+0x11b/0xf10 [ 136.603518][ T6058] f_audio_bind+0x137/0x630 [ 136.603538][ T6058] usb_add_function+0x290/0x930 [ 136.603555][ T6058] configfs_composite_bind+0xde0/0x1410 [ 136.603574][ T6058] gadget_bind_driver+0x2ca/0x9e0 [ 136.603587][ T6058] really_probe+0x254/0xae0 [ 136.603605][ T6058] __driver_probe_device+0x1e8/0x360 [ 136.603622][ T6058] driver_probe_device+0x4f/0x240 [ 136.603665][ T6058] __driver_attach+0x339/0x600 [ 136.603687][ T6058] bus_for_each_dev+0x23e/0x2c0 [ 136.603717][ T6058] bus_add_driver+0x348/0x670 [ 136.603747][ T6058] driver_register+0x23a/0x320 [ 136.603773][ T6058] usb_gadget_register_driver_owner+0xf9/0x270 [ 136.603813][ T6058] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 136.603828][ T6058] configfs_write_iter+0x33a/0x430 [ 136.603845][ T6058] vfs_write+0x61e/0xbb0 [ 136.603860][ T6058] ksys_write+0x156/0x270 [ 136.603876][ T6058] do_syscall_64+0x17b/0x530 [ 136.603890][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.603904][ T6058] [ 136.603908][ T6058] Freed by task 29: [ 136.603915][ T6058] kasan_save_track+0x3e/0x80 [ 136.603936][ T6058] kasan_save_free_info+0x40/0x50 [ 136.603953][ T6058] __kasan_slab_free+0x5c/0x80 [ 136.603975][ T6058] slab_free_after_rcu_debug+0x12a/0x220 [ 136.603991][ T6058] rcu_cpu_kthread+0x950/0x1480 [ 136.604006][ T6058] smpboot_thread_fn+0x57c/0xa80 [ 136.604023][ T6058] kthread+0x388/0x470 [ 136.604042][ T6058] ret_from_fork+0x514/0xb70 [ 136.604061][ T6058] ret_from_fork_asm+0x1a/0x30 [ 136.604082][ T6058] [ 136.604085][ T6058] Last potentially related work creation: [ 136.604091][ T6058] kasan_save_stack+0x3e/0x60 [ 136.604111][ T6058] kasan_record_aux_stack+0xbd/0xd0 [ 136.604128][ T6058] kmem_cache_free+0x513/0x6c0 [ 136.604154][ T6058] task_work_run+0x1d9/0x270 [ 136.604175][ T6058] exit_to_user_mode_loop+0x1fa/0x730 [ 136.604199][ T6058] do_syscall_64+0x33d/0x530 [ 136.604212][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.604227][ T6058] [ 136.604230][ T6058] Second to last potentially related work creation: [ 136.604235][ T6058] kasan_save_stack+0x3e/0x60 [ 136.604256][ T6058] kasan_record_aux_stack+0xbd/0xd0 [ 136.604272][ T6058] task_work_add+0xae/0x420 [ 136.604293][ T6058] __fput_deferred+0x183/0x3e0 [ 136.604307][ T6058] fput_close+0x11f/0x240 [ 136.604319][ T6058] filp_close+0x27/0x40 [ 136.604331][ T6058] gaudio_cleanup+0x54/0xf0 [ 136.604353][ T6058] f_audio_bind+0x4a0/0x630 [ 136.604374][ T6058] usb_add_function+0x290/0x930 [ 136.604391][ T6058] configfs_composite_bind+0xde0/0x1410 [ 136.604409][ T6058] gadget_bind_driver+0x2ca/0x9e0 [ 136.604423][ T6058] really_probe+0x254/0xae0 [ 136.604440][ T6058] __driver_probe_device+0x1e8/0x360 [ 136.604457][ T6058] driver_probe_device+0x4f/0x240 [ 136.604475][ T6058] __driver_attach+0x339/0x600 [ 136.604492][ T6058] bus_for_each_dev+0x23e/0x2c0 [ 136.604513][ T6058] bus_add_driver+0x348/0x670 [ 136.604535][ T6058] driver_register+0x23a/0x320 [ 136.604554][ T6058] usb_gadget_register_driver_owner+0xf9/0x270 [ 136.604579][ T6058] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 136.604594][ T6058] configfs_write_iter+0x33a/0x430 [ 136.604609][ T6058] vfs_write+0x61e/0xbb0 [ 136.604624][ T6058] ksys_write+0x156/0x270 [ 136.604640][ T6058] do_syscall_64+0x17b/0x530 [ 136.604654][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.604668][ T6058] [ 136.604671][ T6058] The buggy address belongs to the object at ffff88802569f800 [ 136.604671][ T6058] which belongs to the cache filp of size 408 [ 136.604684][ T6058] The buggy address is located 400 bytes inside of [ 136.604684][ T6058] freed 408-byte region [ffff88802569f800, ffff88802569f998) [ 136.604699][ T6058] [ 136.604703][ T6058] The buggy address belongs to the physical page: [ 136.604718][ T6058] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2569e [ 136.604732][ T6058] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 136.604744][ T6058] memcg:ffff88803fd5bc01 [ 136.604751][ T6058] flags: 0x80000000000040(head|node=0|zone=1) [ 136.604770][ T6058] page_type: f5(slab) [ 136.604785][ T6058] raw: 0080000000000040 ffff88801c6af780 dead000000000100 dead000000000122 [ 136.604834][ T6058] raw: 0000000000000000 0000000800100010 00000000f5000000 ffff88803fd5bc01 [ 136.604856][ T6058] head: 0080000000000040 ffff88801c6af780 dead000000000100 dead000000000122 [ 136.604876][ T6058] head: 0000000000000000 0000000800100010 00000000f5000000 ffff88803fd5bc01 [ 136.604897][ T6058] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 136.604915][ T6058] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002 [ 136.604926][ T6058] page dumped because: kasan: bad access detected [ 136.604950][ T6058] page_owner tracks the page as allocated [ 136.604955][ T6058] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4965, tgid 4965 (udevd), ts 36551115547 [ 136.604981][ T6058] post_alloc_hook+0x1f9/0x250 [ 136.605002][ T6058] get_page_from_freelist+0x264c/0x26c0 [ 136.605026][ T6058] __alloc_frozen_pages_noprof+0x222/0x5b0 [ 136.605051][ T6058] allocate_slab+0x7c/0x5e0 [ 136.605066][ T6058] refill_objects+0x2d8/0x350 [ 136.605083][ T6058] __pcs_replace_empty_main+0x330/0x690 [ 136.605099][ T6058] kmem_cache_alloc_noprof+0x455/0x680 [ 136.605119][ T6058] alloc_empty_file+0x5b/0x1d0 [ 136.605141][ T6058] path_openat+0x8f/0x3850 [ 136.605158][ T6058] do_file_open+0x23e/0x4a0 [ 136.605175][ T6058] do_sys_openat2+0x115/0x200 [ 136.605197][ T6058] __x64_sys_openat+0x138/0x170 [ 136.605220][ T6058] do_syscall_64+0x17b/0x530 [ 136.605234][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.605248][ T6058] page last free pid 4965 tgid 4965 ts 36533357873 stack trace: [ 136.605258][ T6058] __free_frozen_pages+0x1185/0x1270 [ 136.605279][ T6058] __slab_free+0x252/0x2a0 [ 136.605302][ T6058] qlist_free_all+0x99/0x100 [ 136.605322][ T6058] kasan_quarantine_reduce+0x148/0x160 [ 136.605342][ T6058] __kasan_slab_alloc+0x22/0x80 [ 136.605365][ T6058] __kmalloc_noprof+0x3b1/0x790 [ 136.605386][ T6058] tomoyo_realpath_from_path+0xef/0x640 [ 136.605409][ T6058] tomoyo_check_open_permission+0x229/0x470 [ 136.605428][ T6058] security_file_open+0x9c/0x200 [ 136.605445][ T6058] do_dentry_open+0x4be/0x1420 [ 136.605466][ T6058] vfs_open+0x3b/0x350 [ 136.605487][ T6058] path_openat+0x2e64/0x3850 [ 136.605504][ T6058] do_file_open+0x23e/0x4a0 [ 136.605521][ T6058] do_sys_openat2+0x115/0x200 [ 136.605544][ T6058] __x64_sys_openat+0x138/0x170 [ 136.605567][ T6058] do_syscall_64+0x17b/0x530 [ 136.605581][ T6058] [ 136.605584][ T6058] Memory state around the buggy address: [ 136.605592][ T6058] ffff88802569f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 136.605603][ T6058] ffff88802569f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 136.605613][ T6058] >ffff88802569f980: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc [ 136.605621][ T6058] ^ [ 136.605628][ T6058] ffff88802569fa00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 136.605638][ T6058] ffff88802569fa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 136.605647][ T6058] ================================================================== [ 136.634595][ T6058] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 136.634653][ T6058] CPU: 1 UID: 0 PID: 6058 Comm: syz.1.119 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 136.634724][ T6058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 136.634771][ T6058] Call Trace: [ 136.634804][ T6058] [ 136.634828][ T6058] vpanic+0x56c/0xa60 [ 136.634908][ T6058] ? __pfx_vpanic+0x10/0x10 [ 136.634987][ T6058] panic+0xc5/0xd0 [ 136.635036][ T6058] ? __pfx_panic+0x10/0x10 [ 136.635069][ T6058] ? preempt_schedule_thunk+0x16/0x40 [ 136.635093][ T6058] ? filp_flush+0x31/0x190 [ 136.635111][ T6058] ? preempt_schedule_thunk+0x16/0x40 [ 136.635133][ T6058] ? filp_flush+0x31/0x190 [ 136.635152][ T6058] check_panic_on_warn+0x89/0xb0 [ 136.635182][ T6058] ? filp_flush+0x31/0x190 [ 136.635201][ T6058] end_report+0x73/0x170 [ 136.635221][ T6058] ? filp_flush+0x31/0x190 [ 136.635239][ T6058] kasan_report+0x128/0x150 [ 136.635260][ T6058] ? filp_flush+0x31/0x190 [ 136.635282][ T6058] kasan_check_range+0x264/0x2c0 [ 136.635305][ T6058] filp_flush+0x31/0x190 [ 136.635326][ T6058] filp_close+0x1d/0x40 [ 136.635346][ T6058] gaudio_cleanup+0x54/0xf0 [ 136.635382][ T6058] f_audio_bind+0x4a0/0x630 [ 136.635412][ T6058] ? __pfx_f_audio_bind+0x10/0x10 [ 136.635448][ T6058] ? kasan_quarantine_put+0xbb/0x1f0 [ 136.635470][ T6058] ? lockdep_hardirqs_on+0x7a/0x110 [ 136.635487][ T6058] usb_add_function+0x290/0x930 [ 136.635507][ T6058] ? check_remote_wakeup_config+0x58/0x1c0 [ 136.635529][ T6058] configfs_composite_bind+0xde0/0x1410 [ 136.635555][ T6058] ? __pfx_configfs_composite_bind+0x10/0x10 [ 136.635576][ T6058] gadget_bind_driver+0x2ca/0x9e0 [ 136.635596][ T6058] ? __pfx_gadget_bind_driver+0x10/0x10 [ 136.635611][ T6058] really_probe+0x254/0xae0 [ 136.635633][ T6058] __driver_probe_device+0x1e8/0x360 [ 136.635654][ T6058] driver_probe_device+0x4f/0x240 [ 136.635675][ T6058] __driver_attach+0x339/0x600 [ 136.635695][ T6058] bus_for_each_dev+0x23e/0x2c0 [ 136.635719][ T6058] ? __pfx___driver_attach+0x10/0x10 [ 136.635738][ T6058] ? __pfx_bus_for_each_dev+0x10/0x10 [ 136.635764][ T6058] ? rt_spin_unlock+0x163/0x200 [ 136.635786][ T6058] bus_add_driver+0x348/0x670 [ 136.635821][ T6058] driver_register+0x23a/0x320 [ 136.635844][ T6058] usb_gadget_register_driver_owner+0xf9/0x270 [ 136.635872][ T6058] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 136.635916][ T6058] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 136.635942][ T6058] configfs_write_iter+0x33a/0x430 [ 136.635968][ T6058] vfs_write+0x61e/0xbb0 [ 136.635989][ T6058] ? __pfx_vfs_write+0x10/0x10 [ 136.636008][ T6058] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 136.636023][ T6058] ? lockdep_hardirqs_on+0x7a/0x110 [ 136.636038][ T6058] ? mutex_lock_nested+0x152/0x1d0 [ 136.636057][ T6058] ? fdget_pos+0x252/0x320 [ 136.636076][ T6058] ksys_write+0x156/0x270 [ 136.636095][ T6058] ? __pfx_ksys_write+0x10/0x10 [ 136.636117][ T6058] do_syscall_64+0x17b/0x530 [ 136.636132][ T6058] ? irqentry_exit+0x10f/0x8f0 [ 136.636146][ T6058] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.636162][ T6058] ? clear_bhb_loop+0x40/0x90 [ 136.636198][ T6058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.636220][ T6058] RIP: 0033:0x7f995589df99 [ 136.636240][ T6058] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.636258][ T6058] RSP: 002b:00007f9953af6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 136.636282][ T6058] RAX: ffffffffffffffda RBX: 00007f9955b25fa0 RCX: 00007f995589df99 [ 136.636300][ T6058] RDX: 000000000000000b RSI: 0000200000000b00 RDI: 0000000000000003 [ 136.636322][ T6058] RBP: 00007f9955934ec4 R08: 0000000000000000 R09: 0000000000000000 [ 136.636333][ T6058] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 136.636342][ T6058] R13: 00007f9955b26038 R14: 00007f9955b25fa0 R15: 00007ffc5a8fcc88 [ 136.636362][ T6058] [ 136.636536][ T6058] Kernel Offset: disabled