last executing test programs: 1m47.215296592s ago: executing program 1 (id=8): mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x7, 0x32, 0xffffffffffffffff, 0x0) rt_sigaction(0x8, &(0x7f0000000100)={&(0x7f0000000050)="dbe2c3", 0x4000000, &(0x7f0000000080)="48c7c00f0000000f05"}, 0x0, 0x8, 0x0) rt_sigaction(0xa, &(0x7f0000000140)={&(0x7f0000000000)="d92d0e000000d9eed9e8def99bc39090909090907b03", 0x4000000, &(0x7f0000000080)="48c7c00f0000000f05"}, 0x0, 0x8, 0x0) rt_sigprocmask(0x2, &(0x7f0000000180), 0x0, 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/x86_fpu/x86_fpu_before_save/enable\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='1\x00', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./tracing/events/x86_fpu/enable\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='1\x00', 0x1) close(r1) r2 = gettid() tkill(r2, 0xa) 1m42.562859189s ago: executing program 0 (id=9): syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040510410340001010203010902200001010080300904000002ff0000000905810240000009050202400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, &(0x7f0000000200)='test_data', 0x9) 1m28.245767163s ago: executing program 1 (id=10): r0 = syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x0, 0x0, 0xffffffffffff8001, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x12, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}]}}]}}, &(0x7f0000001400)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write(r0, 0x82, 0x5, &(0x7f0000002340)='hello') r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x16, 0x2) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000000500)) ioctl$USBDEVFS_CLAIMINTERFACE(r1, 0x8004550f, &(0x7f0000000400)) ioctl$USBDEVFS_SETINTERFACE(r1, 0x80085504, &(0x7f0000000300)) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {0x0, 0x1}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x6, 0x100, 0x0, 0x12}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_DISCARDURB(r1, 0x550b, &(0x7f0000000000)) ioctl$USBDEVFS_REAPURB(r1, 0x8008550c, &(0x7f0000000200)) 1m19.537808336s ago: executing program 0 (id=11): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_mnt\x00', 0x0, 0x0) r1 = fsopen(&(0x7f0000000000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) move_mount(r2, &(0x7f0000000000)='\x00', r0, &(0x7f0000000000)='\x00', 0x44) syz_usb_connect(0x3, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401107500500010000000109023c0001010080fa0904000006ff00000007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) nanosleep(&(0x7f0000000000)={0x0, 0x2faf080}, 0x0) 1m9.42984167s ago: executing program 1 (id=12): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller0\x00', 0x1}) r1 = socket(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1}) setsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f0000000300)={@multicast1, @empty}, 0xc) write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008064500001c000000004011000008080808e0000001"], 0x18) 57.04404428s ago: executing program 0 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./my_configfs\x00', 0x1c0) mount(0x0, &(0x7f0000000440)='./my_configfs\x00', &(0x7f0000000480)='configfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000004c0)='./my_configfs\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000500)=""/1024, 0x400) 53.922781092s ago: executing program 1 (id=14): r0 = syz_usb_connect(0x3, 0x4c, &(0x7f0000000080)=ANY=[@ANYBLOB="12011002000000401111222200010000000109023a00010100800009040000040806620007050102000200032401070581020002000324020705820200020003240307050202000200032404"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) 49.914927146s ago: executing program 0 (id=15): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/profiling', 0x1, 0x0) write(r0, &(0x7f0000000080)='1', 0x1) 35.231955779s ago: executing program 1 (id=16): r0 = syz_usb_connect(0x2, 0x48, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9170, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x4, 0xff, 0x0, 0x0, 0x0, [], [{{0x9, 0x5, 0x1, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}, {{0x9, 0x5, 0x83, 0x3, 0x40, 0x1}}, {{0x9, 0x5, 0x4, 0x2, 0x200}}]}}]}}]}}, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x83, 0x8, &(0x7f0000000200)="cc00040011223344") nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0) 17.831180642s ago: executing program 0 (id=17): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000300)={'wlan0\x00', 0x1}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)={0x60, r2, 0x0, 0x1, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x44, 0x33, @probe_request={{{}, {}, @device_b, @device_a, @from_mac}, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x2, [{0x2, 0x1}, {0x4, 0x1}]}, @void, @void, @void}}]}, 0x60}, 0x1, 0x0, 0x0, 0x8011}, 0x10) 12.931018985s ago: executing program 1 (id=18): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ed) mount(&(0x7f0000000040)=@filename='configfs\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='0x0525\x00', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='0xa4a5\x00', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/target\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.5001405000000001\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ed) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/nexus\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='naa.5001405000000002\x00', 0x15) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000480)='1\x00', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ed) symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f00000005c0)='dummy_udc.0\x00', 0xc) nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0) 0s ago: executing program 0 (id=19): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f00000002c0)={0x0, {'syz0\x00', 'syz0\x00', 'syz1\x00', &(0x7f0000000540)=""/20, 0x13, 0x3}}, 0x120) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000200000040341a0208000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x200) pread64(r1, &(0x7f0000000300)=""/4, 0x4, 0x3) nanosleep(&(0x7f0000000300)={0x2}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:60190' (ED25519) to the list of known hosts. syzkaller login: [ 493.489506][ T3215] cgroup: Unknown subsys name 'net' [ 494.404373][ T3215] cgroup: Unknown subsys name 'cpuset' [ 494.630291][ T3215] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 583.815406][ T3215] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 750.164235][ T3223] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 750.366643][ T3223] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 754.605982][ T3225] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 754.757763][ T3225] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 767.221001][ T3223] hsr_slave_0: entered promiscuous mode [ 767.255297][ T3223] hsr_slave_1: entered promiscuous mode [ 770.873678][ T3225] hsr_slave_0: entered promiscuous mode [ 770.920206][ T3225] hsr_slave_1: entered promiscuous mode [ 770.948381][ T3225] debugfs: 'hsr0' already exists in 'hsr' [ 770.970957][ T3225] Cannot create hsr debugfs directory [ 786.275837][ T3223] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 786.557864][ T3223] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 787.167313][ T3223] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 787.322198][ T3223] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 788.110658][ T3223] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 788.397316][ T3223] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 788.805464][ T3223] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 789.183594][ T3223] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 790.884239][ T3225] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 791.084306][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 791.499012][ T3225] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 792.042516][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 792.136271][ T3225] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 792.447148][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 792.692519][ T3225] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 793.034041][ T3225] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 830.130313][ T3223] 8021q: adding VLAN 0 to HW filter on device bond0 [ 832.405946][ T3225] 8021q: adding VLAN 0 to HW filter on device bond0 [ 915.132724][ T3223] veth0_vlan: entered promiscuous mode [ 916.631565][ T3223] veth1_vlan: entered promiscuous mode [ 916.783925][ T3225] veth0_vlan: entered promiscuous mode [ 918.062858][ T3225] veth1_vlan: entered promiscuous mode [ 920.272289][ T3223] veth0_macvtap: entered promiscuous mode [ 921.595754][ T3223] veth1_macvtap: entered promiscuous mode [ 922.342632][ T3225] veth0_macvtap: entered promiscuous mode [ 923.216725][ T3225] veth1_macvtap: entered promiscuous mode [ 928.115651][ T988] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 928.177649][ T988] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 928.344358][ T988] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 928.347474][ T988] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 929.595430][ T3785] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 930.185580][ T988] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 930.626436][ T46] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 930.795875][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 936.990548][ T3223] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 959.669224][ T3781] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 963.946645][ T3781] usb 2-1: device descriptor read/all, error -71 [ 965.505592][ T3840] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 966.717904][ T3840] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 966.724012][ T3840] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 966.726400][ T3840] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 966.728511][ T3840] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 64 [ 966.743730][ T3840] usb 1-1: New USB device found, idVendor=9710, idProduct=7720, bcdDevice= 1.00 [ 966.746780][ T3840] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 967.942086][ T3856] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 968.124715][ T3856] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 968.227463][ T3856] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 968.341075][ T3856] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 969.502259][ T3840] mos7720 1-1:1.0: Moschip 2 port adapter converter detected [ 972.647772][ T3840] usb 1-1: mos7720: usb_control_msg() failed: -32 [ 973.279471][ T3840] usb 1-1: Moschip 2 port adapter converter now attached to ttyUSB0 [ 977.763556][ T3840] usb 1-1: Moschip 2 port adapter converter now attached to ttyUSB1 [ 980.016997][ C0] usb 1-1: mos7720_interrupt_callback - Error -19 submitting control urb [ 980.023477][ T3840] usb 1-1: USB disconnect, device number 2 [ 981.940367][ T3217] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 984.655530][ T3840] moschip7720 ttyUSB0: Moschip 2 port adapter converter now disconnected from ttyUSB0 [ 986.178095][ T3840] moschip7720 ttyUSB1: Moschip 2 port adapter converter now disconnected from ttyUSB1 [ 986.500259][ T3840] mos7720 1-1:1.0: device disconnected [ 992.036799][ T3217] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 992.535442][ T3217] usb 2-1: Using ep0 maxpacket: 32 [ 992.879671][ T3217] usb 2-1: unable to get BOS descriptor or descriptor too short [ 993.460248][ T3217] usb 2-1: New USB device found, idVendor=0499, idProduct=1054, bcdDevice= 0.40 [ 993.474373][ T3217] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 993.499388][ T3217] usb 2-1: Product: syz [ 993.505761][ T3217] usb 2-1: Manufacturer: syz [ 993.507675][ T3217] usb 2-1: SerialNumber: syz [ 997.807678][ T3217] usb 2-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 998.003699][ T3217] usb 2-1: unit 37 not found! [ 998.007740][ T3217] usb 2-1: unit 0 not found! [ 1001.459407][ T3217] usb 2-1: USB disconnect, device number 5 [ 1018.324502][ T3217] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 1020.267522][ T3217] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1020.269432][ T3217] usb 1-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 1020.276567][ T3217] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1020.283456][ T3217] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1020.718971][ T3217] usb 1-1: New USB device found, idVendor=0451, idProduct=3410, bcdDevice= 1.00 [ 1020.736880][ T3217] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1020.744660][ T3217] usb 1-1: Product: syz [ 1020.752168][ T3217] usb 1-1: Manufacturer: syz [ 1020.754889][ T3217] usb 1-1: SerialNumber: syz [ 1022.015262][ T3939] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1022.532878][ T3217] ti_usb_3410_5052 1-1:1.0: required endpoints missing [ 1030.389247][ T29] usb 1-1: USB disconnect, device number 3 [ 1035.927783][ T3840] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 1038.668362][ T3840] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1039.887347][ T3840] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1039.913231][ T3840] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1039.915501][ T3840] usb 2-1: SerialNumber: syz [ 1046.677877][ T3840] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -110 [ 1048.393737][ T3840] usb 2-1: USB disconnect, device number 6 [ 1049.544750][ T3842] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 1050.060130][ T3842] usb 1-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 1.00 [ 1050.070083][ T3842] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1051.588807][ T3842] usb 1-1: USB2VGA dongle found at address 4 [ 1051.934448][ T3842] usb 1-1: Allocated 8 output buffers [ 1053.232288][ T3842] usb 1-1: Failed to early initialize device [ 1054.139802][ T3842] usb 1-1: USB disconnect, device number 4 [ 1065.925521][ T3881] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 1066.942705][ T3881] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1067.153455][ T3881] usb 2-1: New USB device found, idVendor=1111, idProduct=2222, bcdDevice= 1.00 [ 1067.165518][ T3881] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1073.417050][ T3881] scsi host0: uas [ 1074.558333][ T3881] usb 2-1: USB disconnect, device number 7 [ 1080.013356][ T4018] kernel profiling enabled (shift: 1) [ 1085.546749][ T3840] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 1086.373675][ T3840] usb 2-1: not running at top speed; connect to a high speed hub [ 1087.484819][ T3840] usb 2-1: config index 0 descriptor too short (expected 72, got 54) [ 1087.490849][ T3840] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1087.498901][ T3840] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1087.512850][ T3840] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 512, setting to 64 [ 1087.750658][ T3840] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9170, bcdDevice= 1.08 [ 1087.759211][ T3840] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1087.763204][ T3840] usb 2-1: Product: syz [ 1087.766938][ T3840] usb 2-1: Manufacturer: syz [ 1087.772733][ T3840] usb 2-1: SerialNumber: syz [ 1088.247481][ T4020] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1088.386464][ T4020] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1088.913502][ T4020] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1096.009708][ T3881] usb 2-1: USB disconnect, device number 8 [ 1121.070447][ T4044] [ 1121.071596][ T4044] ====================================================== [ 1121.072667][ T4044] WARNING: possible circular locking dependency detected [ 1121.074503][ T4044] syzkaller #0 Not tainted [ 1121.075770][ T4044] ------------------------------------------------------ [ 1121.076818][ T4044] syz.1.18/4044 is trying to acquire lock: [ 1121.077927][ T4044] ffffffff89acc060 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x2a/0x3fc [ 1121.083118][ T4044] [ 1121.083118][ T4044] but task is already holding lock: [ 1121.084125][ T4044] ffffaf8030a1c390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x4a/0x31a [ 1121.087010][ T4044] [ 1121.087010][ T4044] which lock already depends on the new lock. [ 1121.087010][ T4044] [ 1121.088230][ T4044] [ 1121.088230][ T4044] the existing dependency chain (in reverse order) is: [ 1121.089478][ T4044] [ 1121.089478][ T4044] -> #3 (&gi->lock){+.+.}-{4:4}: [ 1121.091836][ T4044] lock_acquire+0x23e/0x4f2 [ 1121.094035][ T4044] __mutex_lock+0x164/0x192e [ 1121.095059][ T4044] mutex_lock_nested+0x14/0x1c [ 1121.096005][ T4044] config_usb_cfg_link+0x4a/0x31a [ 1121.096948][ T4044] configfs_symlink+0x460/0xfee [ 1121.097852][ T4044] vfs_symlink+0x162/0x45e [ 1121.098703][ T4044] filename_symlinkat+0x264/0x4ca [ 1121.099565][ T4044] __riscv_sys_symlinkat+0x90/0xce [ 1121.100516][ T4044] syscall_handler+0x92/0x114 [ 1121.101445][ T4044] do_trap_ecall_u+0x3e4/0x636 [ 1121.102414][ T4044] handle_exception+0x168/0x174 [ 1121.103433][ T4044] [ 1121.103433][ T4044] -> #2 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 1121.105055][ T4044] lock_acquire+0x23e/0x4f2 [ 1121.105975][ T4044] down_write+0x9c/0x18e [ 1121.106905][ T4044] configfs_depend_item_unlocked+0xdc/0x5b0 [ 1121.107893][ T4044] usbg_make_tpg+0x27e/0x602 [ 1121.108736][ T4044] target_fabric_make_tpg+0x88/0x76c [ 1121.109837][ T4044] configfs_mkdir+0x478/0xa24 [ 1121.110889][ T4044] vfs_mkdir+0x2ea/0x708 [ 1121.111758][ T4044] filename_mkdirat+0x414/0x54a [ 1121.112673][ T4044] __riscv_sys_mkdirat+0x84/0xbc [ 1121.113623][ T4044] syscall_handler+0x92/0x114 [ 1121.114719][ T4044] do_trap_ecall_u+0x3e4/0x636 [ 1121.115645][ T4044] handle_exception+0x168/0x174 [ 1121.116583][ T4044] [ 1121.116583][ T4044] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 1121.117974][ T4044] lock_acquire+0x23e/0x4f2 [ 1121.118918][ T4044] __mutex_lock+0x164/0x192e [ 1121.119862][ T4044] mutex_lock_nested+0x14/0x1c [ 1121.120817][ T4044] usbg_make_tpg+0x1d0/0x602 [ 1121.121587][ T4044] target_fabric_make_tpg+0x88/0x76c [ 1121.122618][ T4044] configfs_mkdir+0x478/0xa24 [ 1121.123451][ T4044] vfs_mkdir+0x2ea/0x708 [ 1121.124210][ T4044] filename_mkdirat+0x414/0x54a [ 1121.125042][ T4044] __riscv_sys_mkdirat+0x84/0xbc [ 1121.125918][ T4044] syscall_handler+0x92/0x114 [ 1121.126790][ T4044] do_trap_ecall_u+0x3e4/0x636 [ 1121.127624][ T4044] handle_exception+0x168/0x174 [ 1121.128459][ T4044] [ 1121.128459][ T4044] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 1121.129832][ T4044] check_noncircular+0x138/0x14c [ 1121.130719][ T4044] __lock_acquire+0xe9c/0x25aa [ 1121.131628][ T4044] lock_acquire+0x23e/0x4f2 [ 1121.132492][ T4044] __mutex_lock+0x164/0x192e [ 1121.133424][ T4044] mutex_lock_nested+0x14/0x1c [ 1121.134376][ T4044] tcm_alloc+0x2a/0x3fc [ 1121.135255][ T4044] usb_get_function+0x50/0xbc [ 1121.136119][ T4044] config_usb_cfg_link+0x1a4/0x31a [ 1121.137046][ T4044] configfs_symlink+0x460/0xfee [ 1121.137906][ T4044] vfs_symlink+0x162/0x45e [ 1121.138729][ T4044] filename_symlinkat+0x264/0x4ca [ 1121.139594][ T4044] __riscv_sys_symlinkat+0x90/0xce [ 1121.140443][ T4044] syscall_handler+0x92/0x114 [ 1121.141485][ T4044] do_trap_ecall_u+0x3e4/0x636 [ 1121.142408][ T4044] handle_exception+0x168/0x174 [ 1121.143250][ T4044] [ 1121.143250][ T4044] other info that might help us debug this: [ 1121.143250][ T4044] [ 1121.144180][ T4044] Chain exists of: [ 1121.144180][ T4044] tpg_instances_lock --> &sb->s_type->i_mutex_key#24 --> &gi->lock [ 1121.144180][ T4044] [ 1121.146336][ T4044] Possible unsafe locking scenario: [ 1121.146336][ T4044] [ 1121.147123][ T4044] CPU0 CPU1 [ 1121.147735][ T4044] ---- ---- [ 1121.148390][ T4044] lock(&gi->lock); [ 1121.149230][ T4044] lock(&sb->s_type->i_mutex_key#24); [ 1121.150582][ T4044] lock(&gi->lock); [ 1121.151611][ T4044] lock(tpg_instances_lock); [ 1121.152543][ T4044] [ 1121.152543][ T4044] *** DEADLOCK *** [ 1121.152543][ T4044] [ 1121.153374][ T4044] 3 locks held by syz.1.18/4044: [ 1121.154175][ T4044] #0: ffffaf8013f04450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x42/0x39e [ 1121.156307][ T4044] #1: ffffaf8021b98600 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x336/0xfee [ 1121.158418][ T4044] #2: ffffaf8030a1c390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x4a/0x31a [ 1121.160322][ T4044] [ 1121.160322][ T4044] stack backtrace: [ 1121.161477][ T4044] CPU: 0 UID: 0 PID: 4044 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT [ 1121.161952][ T4044] Hardware name: riscv-virtio,qemu (DT) [ 1121.162348][ T4044] Call Trace: [ 1121.162575][ T4044] [] dump_backtrace+0x2e/0x3c [ 1121.163050][ T4044] [] show_stack+0x30/0x3c [ 1121.163373][ T4044] [] dump_stack_lvl+0x114/0x1aa [ 1121.163855][ T4044] [] dump_stack+0x1c/0x24 [ 1121.164317][ T4044] [] print_circular_bug+0x250/0x29c [ 1121.164744][ T4044] [] check_noncircular+0x138/0x14c [ 1121.165117][ T4044] [] __lock_acquire+0xe9c/0x25aa [ 1121.165533][ T4044] [] lock_acquire+0x23e/0x4f2 [ 1121.165932][ T4044] [] __mutex_lock+0x164/0x192e [ 1121.166372][ T4044] [] mutex_lock_nested+0x14/0x1c [ 1121.166809][ T4044] [] tcm_alloc+0x2a/0x3fc [ 1121.167151][ T4044] [] usb_get_function+0x50/0xbc [ 1121.167497][ T4044] [] config_usb_cfg_link+0x1a4/0x31a [ 1121.167910][ T4044] [] configfs_symlink+0x460/0xfee [ 1121.168299][ T4044] [] vfs_symlink+0x162/0x45e [ 1121.168604][ T4044] [] filename_symlinkat+0x264/0x4ca [ 1121.168975][ T4044] [] __riscv_sys_symlinkat+0x90/0xce [ 1121.169351][ T4044] [] syscall_handler+0x92/0x114 [ 1121.169769][ T4044] [] do_trap_ecall_u+0x3e4/0x636 [ 1121.170154][ T4044] [] handle_exception+0x168/0x174 [ 1123.005935][ T894] hid-generic 0003:0000:0000.0001: unknown main item tag 0x0 [ 1123.018189][ T894] hid-generic 0003:0000:0000.0001: unknown main item tag 0x0 [ 1123.035530][ T894] hid-generic 0003:0000:0000.0001: unknown main item tag 0x0 [ 1123.049637][ T894] hid-generic 0003:0000:0000.0001: unknown main item tag 0x0 [ 1123.065919][ T894] hid-generic 0003:0000:0000.0001: unknown main item tag 0x0 [ 1123.084718][ T894] hid-generic 0003:0000:0000.0001: unknown main item tag 0x0 [ 1123.096237][ T894] hid-generic 0003:0000:0000.0001: unknown main item tag 0x0 [ 1123.116107][ T894] hid-generic 0003:0000:0000.0001: unknown main item tag 0x0 [ 1123.124626][ T894] hid-generic 0003:0000:0000.0001: unknown main item tag 0x0 [ 1123.136978][ T894] hid-generic 0003:0000:0000.0001: unknown main item tag 0x0 [ 1123.563173][ T894] hid-generic 0003:0000:0000.0001: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 1124.085675][ T3781] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 1125.523587][ T3781] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1125.527129][ T3781] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1125.537555][ T3781] usb 1-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 1125.548854][ T3781] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1126.208473][ T3781] usb 1-1: config 0 descriptor?? [ 1132.810090][ T3781] usbhid 1-1:0.0: can't add hid device: -32 [ 1132.823603][ T3781] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 1137.428216][ T816] usb 1-1: USB disconnect, device number 5