last executing test programs: 2.824700557s ago: executing program 3 (id=4): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000180)={'\x00', 0x1}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000002301000008000300", @ANYRES32=r2, @ANYBLOB="05001f0002000000"], 0x24}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) 2.160086719s ago: executing program 2 (id=3): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000001c0)={'wlan0\x00', 0x1003}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0), &(0x7f0000000400)=ANY=[@ANYBLOB="d000000008021100000008021100000108021100000000000f010000010882848b960c1218247206030303030303710701010001000000750401000100"], 0x3d) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) 2.007606775s ago: executing program 3 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/test\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/test/memory.limit_in_bytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='100000', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/test/memory.oom_control\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r2, &(0x7f0000000280)='0', 0x1) unshare(0x42000000) 1.743798608s ago: executing program 1 (id=2): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x1d0, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x138, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x1, 0xffffffff, 0xffffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x230) sendto$inet(r0, &(0x7f0000000100)='test', 0x4, 0x0, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10) 1.589622905s ago: executing program 0 (id=1): unshare(0x40000000) unshare(0x40000000) nanosleep(&(0x7f0000000000)={0x0, 0x5f5e100}, 0x0) 1.49336753s ago: executing program 1 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/gr_udc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/devices/serial8250\x00', 0x0, 0x0) r2 = openat(r1, &(0x7f0000000100)='driver_override\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)='gr_udc\x00', 0x7) r3 = openat(r0, &(0x7f0000000180)='bind\x00', 0x1, 0x0) write(r3, &(0x7f00000001c0)='serial8250\x00', 0xb) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/devices/alarmtimer\x00', 0x0, 0x0) r5 = openat(r4, &(0x7f0000000240)='driver_override\x00', 0x1, 0x0) write(r5, &(0x7f0000000280)='gr_udc\x00', 0x7) write(r3, &(0x7f00000002c0)='alarmtimer\x00', 0xb) r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/devices/PNP0103:00\x00', 0x0, 0x0) r7 = openat(r6, &(0x7f0000000340)='driver_override\x00', 0x1, 0x0) write(r7, &(0x7f0000000380)='gr_udc\x00', 0x7) write(r3, &(0x7f00000003c0)='PNP0103:00\x00', 0xb) r8 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/platform/devices/Fixed MDIO bus.0\x00', 0x0, 0x0) r9 = openat(r8, &(0x7f0000000440)='driver_override\x00', 0x1, 0x0) write(r9, &(0x7f0000000480)='gr_udc\x00', 0x7) write(r3, &(0x7f00000004c0)='Fixed MDIO bus.0\x00', 0x11) 1.48254262s ago: executing program 3 (id=7): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@dellink={0x34, 0x11, 0x5, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv_slave_0\x00'}]}, 0x34}}, 0x0) 1.262490991s ago: executing program 1 (id=8): r0 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20}, 0x10) listen(r0, 0x5) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000040)={0x1}, 0x8) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e20}, 0x10) close(r1) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) 1.05484302s ago: executing program 2 (id=9): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='proc\x00', &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='udp 20000\n', 0xa) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r2, &(0x7f0000000340)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r3, &(0x7f00000003c0)='localhost /tmp 2147483647 9218 65534 65534 1\n', 0x2f) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r4, &(0x7f0000000440)='localhost 1 \\x01000000 2147483647 /tmp\n', 0x27) close(r4) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r5, &(0x7f0000000500)={0x2, 0x4e20}, 0x10) sendto$inet(r5, &(0x7f0000000600)="1122334400000000000000020001878300000003000000010000000000000000000000000000000000000008010001000100000000000001", 0x38, 0x0, 0x0, 0x0) recvfrom$inet(r5, &(0x7f0000000700)=""/1024, 0x400, 0x0, 0x0, 0x0) 866.158039ms ago: executing program 0 (id=10): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) fcntl$setstatus(r0, 0x4, 0x800) connect$bt_rfcomm(r0, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x1}, 0xa) syz_emit_vhci(&(0x7f0000000100)=@HCI_EVENT_PKT={0x4, @hci_ev_disconn_complete={{0x5, 0x4}, {0x0, 0xc8, 0x13}}}, 0x7) nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0) 711.418956ms ago: executing program 2 (id=11): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='+4.2\n', 0x5) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1\n', 0x2) close(r2) 570.694223ms ago: executing program 1 (id=12): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r0, &(0x7f0000000070)='syz0:127.0.0.1\x00', 0xf) r1 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) mount$afs(0x0, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0) 415.41897ms ago: executing program 1 (id=13): r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000200)='127.0.0.1:6789:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000300)='mount_timeout\x00', &(0x7f0000000400)='1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000500)='osdkeepalive\x00', &(0x7f0000000600)='1\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 384.495262ms ago: executing program 2 (id=14): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@remote, @in6=@private1, 0x1, 0x794, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x3a, 0x0, 0xee00}, {@in6=@remote, 0x1, 0x6c}, @in6=@private1, {0x0, 0x5, 0x6, 0xffff, 0x8251c, 0x2, 0x83}, {0xfffffffffffffffc, 0x7fff, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x0, 0xa, 0x0, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x10) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@remote, @in6=@private1, 0x1, 0x794, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x3a, 0x0, 0xee00}, {@in6=@remote, 0x2, 0x6c}, @in6=@private1, {0x0, 0x5, 0x6, 0xffff, 0x8251c, 0x2, 0x83}, {0xfffffffffffffffc, 0x7fff, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x0, 0xa, 0x0, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x10) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@remote, @in6=@private1, 0x1, 0x794, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x3a, 0x0, 0xee00}, {@in6=@remote, 0x3, 0x6c}, @in6=@private1, {0x0, 0x5, 0x6, 0xffff, 0x8251c, 0x2, 0x83}, {0xfffffffffffffffc, 0x7fff, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x0, 0xa, 0x0, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x10) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@remote, @in6=@private1, 0x1, 0x794, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x3a, 0x0, 0xee00}, {@in6=@remote, 0x4, 0x6c}, @in6=@private1, {0x0, 0x5, 0x6, 0xffff, 0x8251c, 0x2, 0x83}, {0xfffffffffffffffc, 0x7fff, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x0, 0xa, 0x0, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x10) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@remote, @in6=@private1, 0x1, 0x794, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x3a, 0x0, 0xee00}, {@in6=@remote, 0x5, 0x6c}, @in6=@private1, {0x0, 0x5, 0x6, 0xffff, 0x8251c, 0x2, 0x83}, {0xfffffffffffffffc, 0x7fff, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x0, 0xa, 0x0, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x10) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@remote, @in6=@private1, 0x1, 0x794, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x3a, 0x0, 0xee00}, {@in6=@remote, 0x6, 0x6c}, @in6=@private1, {0x0, 0x5, 0x6, 0xffff, 0x8251c, 0x2, 0x83}, {0xfffffffffffffffc, 0x7fff, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x0, 0xa, 0x0, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x10) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@remote, @in6=@private1, 0x1, 0x794, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x3a, 0x0, 0xee00}, {@in6=@remote, 0x7, 0x6c}, @in6=@private1, {0x0, 0x5, 0x6, 0xffff, 0x8251c, 0x2, 0x83}, {0xfffffffffffffffc, 0x7fff, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x0, 0xa, 0x0, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x10) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@remote, @in6=@private1, 0x1, 0x794, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x3a, 0x0, 0xee00}, {@in6=@remote, 0x8, 0x6c}, @in6=@private1, {0x0, 0x5, 0x6, 0xffff, 0x8251c, 0x2, 0x83}, {0xfffffffffffffffc, 0x7fff, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x0, 0xa, 0x0, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x10) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@remote, @in6=@private1, 0x1, 0x794, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x3a, 0x0, 0xee00}, {@in6=@remote, 0x9, 0x6c}, @in6=@private1, {0x0, 0x5, 0x6, 0xffff, 0x8251c, 0x2, 0x83}, {0xfffffffffffffffc, 0x7fff, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x0, 0xa, 0x0, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x10) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@remote, @in6=@private1, 0x1, 0x794, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x3a, 0x0, 0xee00}, {@in6=@remote, 0xa, 0x6c}, @in6=@private1, {0x0, 0x5, 0x6, 0xffff, 0x8251c, 0x2, 0x83}, {0xfffffffffffffffc, 0x7fff, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x0, 0xa, 0x0, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0xc801}, 0x10) nanosleep(&(0x7f0000000300)={0x0, 0xbebc200}, 0x0) 226.671789ms ago: executing program 3 (id=15): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4321, @loopback}, 0x10) r1 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r1, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) connect$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4321, @loopback}}, 0x24) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)='a', 0x1}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000010010000010000000100000000000000"], 0x18}, 0x0) nanosleep(&(0x7f0000000300)={0x4}, 0x0) 143.917143ms ago: executing program 0 (id=16): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:00.0\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/devices/0000:00:1f.0\x00', 0x0, 0x0) 15.009389ms ago: executing program 2 (id=17): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pages=64\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='naa.6001405c935d7912\n', 0x16) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000480)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0/virtual_scsi_port\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='1\n', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000680)='dummy_udc.0\n', 0xc) close(r4) nanosleep(&(0x7f00000006c0)={0x1}, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000700), 0x1, 0x2) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) r6 = syz_open_dev$sg(&(0x7f0000000700), 0x0, 0x2) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) 0s ago: executing program 0 (id=18): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) sendmsg$NL80211_CMD_REQ_SET_REG(r0, &(0x7f0000002a00)={0x0, 0x0, &(0x7f00000029c0)={&(0x7f0000002980)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@NL80211_ATTR_REG_ALPHA2={0x7, 0x21, 'a\x00'}]}, 0x1c}}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.33' (ED25519) to the list of known hosts. [ 82.926688][ T5761] cgroup: Unknown subsys name 'net' [ 83.067294][ T5761] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 84.742988][ T5761] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 86.536606][ T5784] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 86.545339][ T5784] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 86.554169][ T5784] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 86.555410][ T5785] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 86.568006][ T5784] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 86.570770][ T5785] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 86.580030][ T5789] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 86.590303][ T5789] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 86.598165][ T5789] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 86.606398][ T5789] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 86.614510][ T5789] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 86.622516][ T5789] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 86.630559][ T5789] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 86.649809][ T5783] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 86.657568][ T5783] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 86.665838][ T5783] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 86.667911][ T5790] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 86.680938][ T5790] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 86.690024][ T5790] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 86.697823][ T5790] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 86.705293][ T5790] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 86.712657][ T5783] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 86.729331][ T5790] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 86.737133][ T5790] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 87.338913][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 87.472061][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 87.486002][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 87.512376][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 87.710709][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.719002][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.726687][ T5777] bridge_slave_0: entered allmulticast mode [ 87.734141][ T5777] bridge_slave_0: entered promiscuous mode [ 87.744321][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.751789][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.759370][ T5777] bridge_slave_1: entered allmulticast mode [ 87.766873][ T5777] bridge_slave_1: entered promiscuous mode [ 87.837222][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.847942][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.855455][ T5773] bridge_slave_0: entered allmulticast mode [ 87.863496][ T5773] bridge_slave_0: entered promiscuous mode [ 87.916234][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.925684][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.933461][ T5773] bridge_slave_1: entered allmulticast mode [ 87.941034][ T5773] bridge_slave_1: entered promiscuous mode [ 87.950652][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.963220][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.972830][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.980000][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.987202][ T5775] bridge_slave_0: entered allmulticast mode [ 87.994918][ T5775] bridge_slave_0: entered promiscuous mode [ 88.003328][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.010786][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.018045][ T5774] bridge_slave_0: entered allmulticast mode [ 88.025345][ T5774] bridge_slave_0: entered promiscuous mode [ 88.066922][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.075267][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.082714][ T5775] bridge_slave_1: entered allmulticast mode [ 88.090818][ T5775] bridge_slave_1: entered promiscuous mode [ 88.108510][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.117335][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.126360][ T5774] bridge_slave_1: entered allmulticast mode [ 88.134096][ T5774] bridge_slave_1: entered promiscuous mode [ 88.156060][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.168372][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.212364][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.225560][ T5777] team0: Port device team_slave_0 added [ 88.235188][ T5777] team0: Port device team_slave_1 added [ 88.255861][ T5773] team0: Port device team_slave_0 added [ 88.277251][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.305790][ T5773] team0: Port device team_slave_1 added [ 88.314313][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.370602][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.381099][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.388105][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.414338][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.428110][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.435248][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.461317][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.475949][ T5775] team0: Port device team_slave_0 added [ 88.523981][ T5775] team0: Port device team_slave_1 added [ 88.533376][ T5774] team0: Port device team_slave_0 added [ 88.543730][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.550755][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.576928][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.592189][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.599293][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.625421][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.649429][ T5774] team0: Port device team_slave_1 added [ 88.695112][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.702628][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.722200][ T5783] Bluetooth: hci3: command tx timeout [ 88.737404][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.773219][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.780458][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.806798][ T51] Bluetooth: hci2: command tx timeout [ 88.810111][ T5085] Bluetooth: hci1: command tx timeout [ 88.813216][ T5783] Bluetooth: hci0: command tx timeout [ 88.820610][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.837491][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.844690][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.871044][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.905933][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.915265][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.942082][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.966115][ T5777] hsr_slave_0: entered promiscuous mode [ 88.974662][ T5777] hsr_slave_1: entered promiscuous mode [ 88.988168][ T5773] hsr_slave_0: entered promiscuous mode [ 88.995007][ T5773] hsr_slave_1: entered promiscuous mode [ 89.002334][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.010767][ T5773] Cannot create hsr debugfs directory [ 89.054120][ T5775] hsr_slave_0: entered promiscuous mode [ 89.060950][ T5775] hsr_slave_1: entered promiscuous mode [ 89.067264][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.075082][ T5775] Cannot create hsr debugfs directory [ 89.139595][ T5774] hsr_slave_0: entered promiscuous mode [ 89.147657][ T5774] hsr_slave_1: entered promiscuous mode [ 89.155795][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.163888][ T5774] Cannot create hsr debugfs directory [ 89.631743][ T5773] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 89.646856][ T5773] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 89.672085][ T5773] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 89.684864][ T5773] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 89.740600][ T5777] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 89.755430][ T5777] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 89.781910][ T5777] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 89.793787][ T5777] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 89.913149][ T5775] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 89.923987][ T5775] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 89.941700][ T5775] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 89.963811][ T5775] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 90.050575][ T5774] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 90.070736][ T5774] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 90.084041][ T5774] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 90.094484][ T5774] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 90.142676][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.204361][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.241792][ T4532] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.249231][ T4532] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.295330][ T4532] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.302585][ T4532] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.327636][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.408347][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.448373][ T3487] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.455601][ T3487] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.504594][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.512369][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.526628][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.578041][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.603085][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.641105][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.648253][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.702056][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.709294][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.733313][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.796039][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.803334][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.812689][ T5783] Bluetooth: hci3: command tx timeout [ 90.821618][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.828881][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.878968][ T5783] Bluetooth: hci0: command tx timeout [ 90.882497][ T5085] Bluetooth: hci2: command tx timeout [ 90.891443][ T5783] Bluetooth: hci1: command tx timeout [ 91.073991][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.243809][ T5773] veth0_vlan: entered promiscuous mode [ 91.299858][ T5773] veth1_vlan: entered promiscuous mode [ 91.402300][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.457939][ T5773] veth0_macvtap: entered promiscuous mode [ 91.482648][ T5773] veth1_macvtap: entered promiscuous mode [ 91.527439][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.572079][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.584832][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.613032][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.625157][ T5773] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.635594][ T5773] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.644380][ T5773] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.654215][ T5773] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.674608][ T5777] veth0_vlan: entered promiscuous mode [ 91.721760][ T5777] veth1_vlan: entered promiscuous mode [ 91.805971][ T5775] veth0_vlan: entered promiscuous mode [ 91.846034][ T5774] veth0_vlan: entered promiscuous mode [ 91.865088][ T5777] veth0_macvtap: entered promiscuous mode [ 91.882554][ T5775] veth1_vlan: entered promiscuous mode [ 91.890905][ T5774] veth1_vlan: entered promiscuous mode [ 91.910936][ T5777] veth1_macvtap: entered promiscuous mode [ 91.970685][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 91.982005][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 91.995699][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.006738][ T3487] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.029532][ T3487] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.073396][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.085359][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.098076][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.121022][ T5775] veth0_macvtap: entered promiscuous mode [ 92.157987][ T5777] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.167375][ T5777] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.179017][ T5777] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.187791][ T5777] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.189731][ T8] cfg80211: failed to load regulatory.db [ 92.205001][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.217835][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.228402][ T5775] veth1_macvtap: entered promiscuous mode [ 92.278122][ T5774] veth0_macvtap: entered promiscuous mode [ 92.314367][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.341711][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.355133][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.366208][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.386773][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.412328][ T5774] veth1_macvtap: entered promiscuous mode [ 92.440721][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.451657][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.466213][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.477567][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.510572][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.567777][ T5775] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.582372][ T5775] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.596160][ T5775] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.608731][ T5775] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.633001][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.664917][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.675874][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.686757][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.696822][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.707859][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.723335][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.735105][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.752286][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.763101][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.779741][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.790876][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.807459][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.823851][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.841665][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.867935][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.879211][ T5085] Bluetooth: hci3: command tx timeout [ 92.894449][ T5774] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.903536][ T5774] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.912394][ T5774] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.921954][ T5774] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.959064][ T5085] Bluetooth: hci1: command tx timeout [ 92.960100][ T5783] Bluetooth: hci0: command tx timeout [ 92.969594][ T5085] Bluetooth: hci2: command tx timeout [ 92.992509][ T3487] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.001026][ T3487] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.112884][ T142] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.135139][ T142] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.252024][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.274533][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.316109][ T4532] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.342598][ T4532] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.477026][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.501210][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.541976][ T5850] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 93.709260][ T5857] ip_tables: iptables: counters copy to user failed while replacing table [ 93.952631][ T5865] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 93.978953][ T5863] gr_udc Fixed MDIO bus.0: invalid resource (null) [ 93.990891][ T5863] gr_udc: probe of Fixed MDIO bus.0 failed with error -22 [ 94.059372][ T5865] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 94.960634][ T5085] Bluetooth: hci3: command tx timeout [ 95.037741][ T8] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 95.049840][ T5783] Bluetooth: hci2: command tx timeout [ 95.055321][ T5783] Bluetooth: hci1: command tx timeout [ 95.061712][ T5085] Bluetooth: hci0: command tx timeout [ 95.321117][ T5817] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 95.406654][ T5894] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 95.435490][ T5894] [ 95.437901][ T5894] ====================================================== [ 95.444938][ T5894] WARNING: possible circular locking dependency detected [ 95.452008][ T5894] syzkaller #0 Not tainted [ 95.456710][ T5894] ------------------------------------------------------ [ 95.463751][ T5894] syz.2.17/5894 is trying to acquire lock: [ 95.469610][ T5894] ffffffff8de55e88 (tpg_instances_lock){+.+.}-{3:3}, at: tcm_alloc+0x21/0x2d0 [ 95.478668][ T5894] [ 95.478668][ T5894] but task is already holding lock: [ 95.486053][ T5894] ffff8880264c2398 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x59/0x250 [ 95.495051][ T5894] [ 95.495051][ T5894] which lock already depends on the new lock. [ 95.495051][ T5894] [ 95.505477][ T5894] [ 95.505477][ T5894] the existing dependency chain (in reverse order) is: [ 95.514534][ T5894] [ 95.514534][ T5894] -> #2 (&gi->lock){+.+.}-{3:3}: [ 95.521689][ T5894] __mutex_lock+0x135/0xc80 [ 95.526766][ T5894] config_usb_cfg_link+0x59/0x250 [ 95.532339][ T5894] configfs_symlink+0x5a5/0xfe0 [ 95.538002][ T5894] vfs_symlink+0x138/0x2b0 [ 95.542959][ T5894] do_symlinkat+0x1ba/0x400 [ 95.548009][ T5894] __x64_sys_symlinkat+0x99/0xb0 [ 95.553495][ T5894] do_syscall_64+0x55/0xb0 [ 95.558467][ T5894] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 95.564911][ T5894] [ 95.564911][ T5894] -> #1 (&sb->s_type->i_mutex_key#21){++++}-{3:3}: [ 95.573755][ T5894] down_write+0x97/0x200 [ 95.578646][ T5894] configfs_depend_item_unlocked+0x157/0x430 [ 95.585187][ T5894] usbg_make_tpg+0x1e1/0x550 [ 95.590343][ T5894] target_fabric_make_tpg+0xa4/0x6d0 [ 95.596188][ T5894] configfs_mkdir+0x515/0x9e0 [ 95.601420][ T5894] vfs_mkdir+0x2a5/0x470 [ 95.606222][ T5894] do_mkdirat+0x1dc/0x450 [ 95.611106][ T5894] __x64_sys_mkdirat+0x89/0xa0 [ 95.616451][ T5894] do_syscall_64+0x55/0xb0 [ 95.621422][ T5894] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 95.627870][ T5894] [ 95.627870][ T5894] -> #0 (tpg_instances_lock){+.+.}-{3:3}: [ 95.635806][ T5894] __lock_acquire+0x37ef/0x7d80 [ 95.641234][ T5894] lock_acquire+0x19e/0x420 [ 95.646282][ T5894] __mutex_lock+0x135/0xc80 [ 95.651325][ T5894] tcm_alloc+0x21/0x2d0 [ 95.656020][ T5894] usb_get_function+0x5d/0xb0 [ 95.661240][ T5894] config_usb_cfg_link+0x148/0x250 [ 95.666899][ T5894] configfs_symlink+0x5a5/0xfe0 [ 95.672339][ T5894] vfs_symlink+0x138/0x2b0 [ 95.677304][ T5894] do_symlinkat+0x1ba/0x400 [ 95.682362][ T5894] __x64_sys_symlinkat+0x99/0xb0 [ 95.687844][ T5894] do_syscall_64+0x55/0xb0 [ 95.692811][ T5894] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 95.699251][ T5894] [ 95.699251][ T5894] other info that might help us debug this: [ 95.699251][ T5894] [ 95.709502][ T5894] Chain exists of: [ 95.709502][ T5894] tpg_instances_lock --> &sb->s_type->i_mutex_key#21 --> &gi->lock [ 95.709502][ T5894] [ 95.723363][ T5894] Possible unsafe locking scenario: [ 95.723363][ T5894] [ 95.730830][ T5894] CPU0 CPU1 [ 95.736216][ T5894] ---- ---- [ 95.741612][ T5894] lock(&gi->lock); [ 95.745534][ T5894] lock(&sb->s_type->i_mutex_key#21); [ 95.753540][ T5894] lock(&gi->lock); [ 95.759979][ T5894] lock(tpg_instances_lock); [ 95.764687][ T5894] [ 95.764687][ T5894] *** DEADLOCK *** [ 95.764687][ T5894] [ 95.772859][ T5894] 3 locks held by syz.2.17/5894: [ 95.777838][ T5894] #0: ffff8881416f8418 (sb_writers#14){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 95.787211][ T5894] #1: ffff88805db4dfc0 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: configfs_symlink+0x47a/0xfe0 [ 95.798140][ T5894] #2: ffff8880264c2398 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x59/0x250 [ 95.807571][ T5894] [ 95.807571][ T5894] stack backtrace: [ 95.813523][ T5894] CPU: 0 PID: 5894 Comm: syz.2.17 Not tainted syzkaller #0 [ 95.822918][ T5894] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 95.833012][ T5894] Call Trace: [ 95.836318][ T5894] [ 95.839274][ T5894] dump_stack_lvl+0x18c/0x250 [ 95.843997][ T5894] ? load_image+0x420/0x420 [ 95.848533][ T5894] ? show_regs_print_info+0x20/0x20 [ 95.855413][ T5894] ? print_circular_bug+0x12b/0x1a0 [ 95.860646][ T5894] check_noncircular+0x2fc/0x400 [ 95.865615][ T5894] ? print_deadlock_bug+0x5d0/0x5d0 [ 95.870849][ T5894] ? lockdep_lock+0xf5/0x230 [ 95.875504][ T5894] ? _find_first_zero_bit+0xd6/0x100 [ 95.880832][ T5894] __lock_acquire+0x37ef/0x7d80 [ 95.885739][ T5894] ? verify_lock_unused+0x140/0x140 [ 95.890978][ T5894] ? __lock_acquire+0x1336/0x7d80 [ 95.896476][ T5894] ? verify_lock_unused+0x140/0x140 [ 95.901754][ T5894] lock_acquire+0x19e/0x420 [ 95.906292][ T5894] ? tcm_alloc+0x21/0x2d0 [ 95.910645][ T5894] ? __might_sleep+0xe0/0xe0 [ 95.915270][ T5894] ? read_lock_is_recursive+0x20/0x20 [ 95.920675][ T5894] ? __mutex_trylock_common+0x160/0x270 [ 95.926260][ T5894] __mutex_lock+0x135/0xc80 [ 95.930791][ T5894] ? tcm_alloc+0x21/0x2d0 [ 95.935148][ T5894] ? trace_contention_end+0x39/0xe0 [ 95.940376][ T5894] ? __mutex_lock+0x30d/0xc80 [ 95.945077][ T5894] ? tcm_alloc+0x21/0x2d0 [ 95.949431][ T5894] ? mutex_lock_nested+0x20/0x20 [ 95.954400][ T5894] ? read_lock_is_recursive+0x20/0x20 [ 95.959803][ T5894] ? config_usb_cfg_link+0x59/0x250 [ 95.965037][ T5894] ? mutex_lock_nested+0x20/0x20 [ 95.970004][ T5894] ? configfs_symlink+0x469/0xfe0 [ 95.975063][ T5894] tcm_alloc+0x21/0x2d0 [ 95.979425][ T5894] usb_get_function+0x5d/0xb0 [ 95.984142][ T5894] config_usb_cfg_link+0x148/0x250 [ 95.989287][ T5894] configfs_symlink+0x5a5/0xfe0 [ 95.994166][ T5894] ? from_kgid+0x153/0x6a0 [ 95.998618][ T5894] ? generic_permission+0x1ed/0x590 [ 96.003868][ T5894] ? detach_groups+0x370/0x370 [ 96.008665][ T5894] ? inode_permission+0xf3/0x480 [ 96.013626][ T5894] ? bpf_lsm_inode_symlink+0x9/0x10 [ 96.018851][ T5894] ? security_inode_symlink+0xb6/0x100 [ 96.024360][ T5894] vfs_symlink+0x138/0x2b0 [ 96.028812][ T5894] do_symlinkat+0x1ba/0x400 [ 96.033349][ T5894] ? vfs_symlink+0x2b0/0x2b0 [ 96.037967][ T5894] __x64_sys_symlinkat+0x99/0xb0 [ 96.042940][ T5894] do_syscall_64+0x55/0xb0 [ 96.047389][ T5894] ? clear_bhb_loop+0x40/0x90 [ 96.052100][ T5894] ? clear_bhb_loop+0x40/0x90 [ 96.056842][ T5894] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 96.062772][ T5894] RIP: 0033:0x7f44a079e159 [ 96.067239][ T5894] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.086965][ T5894] RSP: 002b:00007f44a16f8028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 96.095409][ T5894] RAX: ffffffffffffffda RBX: 00007f44a0a25fa0 RCX: 00007f44a079e159 [ 96.103413][ T5894] RDX: 0000200000000600 RSI: ffffffffffffff9c RDI: 00002000000005c0 [ 96.111433][ T5894] RBP: 00007f44a083506b R08: 0000000000000000 R09: 0000000000000000 [ 96.119474][ T5894] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.127495][ T5894] R13: 00007f44a0a26038 R14: 00007f44a0a25fa0 R15: 00007ffe83a18848 [ 96.135534][ T5894] [ 96.162048][ T5882] ceph: No mds server is up or the cluster is laggy [ 96.169944][ T5817] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 96.438740][ T23] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 96.620636][ T23] usb 1-1: Dual-Role OTG device on HNP port [ 96.626842][ T23] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 6.06 [ 96.636756][ T23] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.647182][ T790] Using the BOT protocol [ 96.654315][ T790] Using the UAS protocol [ 96.666655][ T23] scsi host1: uas [ 96.680663][ T142] scsi 1:0:0:0: Direct-Access LIO-ORG RAMDISK-MCP 4.0 PQ: 0 ANSI: 6 [ 96.698957][ T4532] sd 1:0:0:0: [sdb] 512 512-byte logical blocks: (262 kB/256 KiB) [ 96.714477][ T142] sd 1:0:0:0: Attached scsi generic sg1 type 0 [ 96.720860][ T4532] sd 1:0:0:0: [sdb] Write Protect is off [ 96.726579][ T4532] sd 1:0:0:0: [sdb] Mode Sense: 43 00 00 08 [ 96.738954][ T4532] sd 1:0:0:0: [sdb] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA [ 96.774512][ T4532] sd 1:0:0:0: [sdb] Attached SCSI disk [ 96.850462][ T5816] target: Unknown data direction for SCSI Opcode 0xa1