last executing test programs: 37.44197138s ago: executing program 4 (id=68): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="040000000000000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f6d00") r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dummy\x00', 0x42, 0x1ff) write(r1, &(0x7f0000000138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00mirror\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00core 2 1024 nosync 2 7:0 0 7:1 0 1 handle_errors\x00', 0x59) ioctl(r0, 0xc138fd09, &(0x7f0000000000)="040000000000000000000000a00100003801000001000000000000000000000000000000000000000000000000000000746573745f6d00") ioctl(r0, 0xc138fd06, &(0x7f0000000000)="040000000000000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f6d00") r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/dm-0\x00', 0x2, 0x0) write(r2, &(0x7f0000000600)='\x00'/4096, 0x1000) fsync(r2) read(r2, &(0x7f0000000700)=""/4096, 0x1000) syncfs(r2) nanosleep(&(0x7f0000000800)={0x0, 0x2faf080}, 0x0) 35.718372459s ago: executing program 1 (id=85): r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000680)={'bond0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='-bond_slave_0\n', 0xf) write(r1, &(0x7f0000000100)='-bond_slave_1\n', 0xf) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/net/bond0/bonding/mode\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='active-backup\n', 0xe) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/net/bond0/bonding/arp_interval\x00', 0x2, 0x0) write(r3, &(0x7f0000000300)='100\n', 0x4) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/net/bond0/bonding/arp_ip_target\x00', 0x2, 0x0) write(r4, &(0x7f0000000400)='+192.168.1.1\n', 0xd) close(r4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000500)={'bond_slave_0\x00', 0x1002}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r6, &(0x7f0000000600)='+bond_slave_0\n', 0xe) close(r6) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000680)={'bond0\x00', 0x1}) nanosleep(&(0x7f0000000700)={0x0, 0x11e1a300}, 0x0) 34.836987189s ago: executing program 1 (id=92): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/v4_end_grace\x00', 0x2, 0x0) write(r2, &(0x7f0000000340)='Y\n', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r3, &(0x7f00000003c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r4, &(0x7f0000000440)='localhost 1 \\x00000000 2147483647 /\n', 0x24) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r5, &(0x7f00000004c0)='localhost / 2147483647 9218 0 0 0\n', 0x22) close(r5) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f0000000540)='127.0.0.1:/\x00', &(0x7f0000000580)='./mnt\x00', &(0x7f00000005c0), 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1,proto=tcp,vers=4.0\x00']) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./mnt/dir0\x00', 0x1ed) 34.751014881s ago: executing program 5 (id=93): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='0\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/v4_end_grace\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)='1\n', 0x2) close(r1) 34.215937801s ago: executing program 2 (id=99): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='acpi-button\n\x00', 0xc) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='pcspkr\n\x00', 0x7) 33.966015277s ago: executing program 2 (id=100): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x2383, @loopback}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x2383, @loopback}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xe, 0x6, &(0x7f0000000500)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r1}, @generic={0xb7, 0x3}, @generic={0xb7, 0x4, 0x0, 0x0, 0x1}, @call={0x85, 0x0, 0x0, 0x34}, @exit], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@map=r1, r2, 0x5, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r1, &(0x7f0000000340), &(0x7f0000000380)=@tcp=r0}, 0x20) write(r0, &(0x7f0000000700)='h', 0x1) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) 33.434789861s ago: executing program 5 (id=102): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/platform/pcspkr/uevent\x00', 0x0, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/devices/platform/pcspkr/modalias\x00', 0x0, 0x0) close(r1) 33.43022239s ago: executing program 3 (id=103): mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000440)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/kernel/mm/transparent_hugepage/khugepaged/pages_to_scan\x00', 0x0, 0x0) read(r0, &(0x7f0000000500)=""/100, 0x64) 33.275080431s ago: executing program 2 (id=104): setns(0xc9, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl(r0, 0x8914, &(0x7f0000000100)="7465716c3000000000000000000000000100"/40) 33.093020104s ago: executing program 1 (id=105): setns(0xc9, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="30000000240001040100000000000000000000000100000000000000ffffffff000000000a0001007465716c30000000", 0x30) r1 = socket$inet(0x2, 0x2, 0x0) ioctl(r1, 0x8914, &(0x7f0000000100)="7465716c3000000000000000000000000100"/40) 33.088911718s ago: executing program 2 (id=106): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipe\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./pipe\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='-2 -3 +4\n\x00', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='tcp 2049\n\x00', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='1\n\x00', 0x2) nanosleep(&(0x7f0000000280)={0x0, 0x5f5e100}, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./pipe/nfsd/cld\x00', 0x2, 0x0) 32.868996098s ago: executing program 5 (id=107): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='-bond_slave_0\n', 0xf) write(r0, &(0x7f0000000100)='-bond_slave_1\n', 0xf) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='+bond_slave_0\n', 0xe) 32.867620961s ago: executing program 1 (id=108): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='1\n', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nullb/nullb1/power\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='1\n', 0x2) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='/dev/nullb1\n', 0xc) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) write(r4, &(0x7f0000000600)='1\n', 0x2) close(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r5, &(0x7f0000000740)='loop\n', 0x5) close(r5) symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/subsystems/testsubsys\x00') r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0) write(r6, &(0x7f0000000900)='transport=loop,nqn=testsubsys\n', 0x1e) close(r6) nanosleep(&(0x7f0000000940)={0x0, 0x1dcd6500}, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./dev/nvme0n1\x00', 0x2, 0x0) ioctl(r7, 0xc0101282, &(0x7f0000000a00)="00000000000000000100"/80) 32.715053978s ago: executing program 3 (id=109): mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/virtio-pci/module/version\x00', 0x0, 0x0) read(r0, &(0x7f0000000200)=""/256, 0x100) 32.588377975s ago: executing program 5 (id=110): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/rtc\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/rtc/rtc0\x00', 0x0, 0x0) 32.555517225s ago: executing program 3 (id=111): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices\x00', 0x10000, 0x0) getdents64(r0, &(0x7f0000000200)=""/1024, 0x400) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/class/i2c-adapter\x00', 0x10000, 0x0) getdents64(r1, &(0x7f0000000700)=""/1024, 0x400) r2 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/bus/i2c/drivers/ucsi_ccg\x00', 0x10000, 0x0) getdents64(r2, &(0x7f0000000c00)=""/1024, 0x400) 32.370986187s ago: executing program 5 (id=112): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/nfsv4recoverydir\x00', 0x0, 0x0) read(r0, &(0x7f0000000300)=""/100, 0x64) close(r0) 32.273773543s ago: executing program 5 (id=113): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x3, 0x1b1c, 0x1c03, 0x0, 0x0, "0600ff0901a1010902150026ff007508954081020903750895409102c0"}}, 0x135) read(r0, &(0x7f0000000600)=""/4096, 0x1000) read(r0, &(0x7f0000000600)=""/4096, 0x1000) read(r0, &(0x7f0000000600)=""/4096, 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x40, "fe0300"/64}}, 0x46) read(r0, &(0x7f0000000600)=""/4096, 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x40, "0399434f525341495200"/64}}, 0x46) read(r0, &(0x7f0000000600)=""/4096, 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x40, "039a48583535306900"/64}}, 0x46) nanosleep(&(0x7f0000000500)={0x4}, 0x0) 32.268828069s ago: executing program 3 (id=114): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc\x00', 0x0, 0x0) 32.138941945s ago: executing program 3 (id=115): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302000200"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f00000001c0)={0x40, 0x4, 0x2, ' \x00'}}) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000000100)) syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000000200)) nanosleep(&(0x7f0000000400)={0x1}, 0x0) 32.033815635s ago: executing program 0 (id=117): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x1000000) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x42, 0x1b6) ftruncate(r2, 0x1000000) r3 = syz_open_dev$loop(&(0x7f0000000140), 0x1, 0x2) ioctl$LOOP_SET_FD(r3, 0x4c00, r2) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file2\x00', 0x42, 0x1b6) ftruncate(r4, 0x1000000) r5 = syz_open_dev$loop(&(0x7f0000000140), 0x2, 0x2) ioctl$LOOP_SET_FD(r5, 0x4c00, r4) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r6, 0xc138fd03, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600") ioctl(r6, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000007c01000038010000010000000000000000000000000000000000000000000000000000006364657600") ioctl(r6, 0xc138fd0a, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600") 31.922004893s ago: executing program 1 (id=118): setns(0xc9, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl(r0, 0x8914, &(0x7f0000000100)="7465716c3000000000000000000000000100"/40) 31.859161306s ago: executing program 0 (id=119): setns(0xc9, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl(r0, 0x8914, &(0x7f0000000100)="7465716c3000000000000000000000000100"/40) ioctl(r0, 0x8914, &(0x7f0000000140)='teql0\x00'/40) 31.811261771s ago: executing program 1 (id=120): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='1\n', 0x2) 31.660494581s ago: executing program 0 (id=121): mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000440)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/kernel/mm/transparent_hugepage/khugepaged/pages_to_scan\x00', 0x0, 0x0) read(r0, &(0x7f0000000500)=""/100, 0x64) 31.475497761s ago: executing program 0 (id=122): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='-bond_slave_0\n', 0xf) write(r0, &(0x7f0000000100)='-bond_slave_1\n', 0xf) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./sys/class/net/bond0/bonding/slaves\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='+bond_slave_0\n', 0xe) 31.371032121s ago: executing program 0 (id=123): setns(0xc9, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="30000000240001040100000000000000000000000100000000000000ffffffff000000000a0001007465716c30000000", 0x30) r1 = socket$inet(0x2, 0x2, 0x0) ioctl(r1, 0x8914, &(0x7f0000000100)="7465716c3000000000000000000000000100"/40) 31.240372155s ago: executing program 0 (id=124): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x1000000) r1 = syz_open_dev$loop(0x0, 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) r2 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1b6) ftruncate(r2, 0x1000000) r3 = syz_open_dev$loop(0x0, 0x1, 0x2) ioctl$LOOP_SET_FD(r3, 0x4c00, r2) r4 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1b6) ftruncate(r4, 0x1000000) syz_open_dev$loop(0x0, 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r5, 0xc138fd03, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600") write(r5, &(0x7f0000000438)="000000000000000000800000000000000000000000000000636163686500000000000000373a3020373a3120373a3220", 0x30) ioctl(r5, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000007c01000038010000010000000000000000000000000000000000000000000000000000006364657600") r6 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/dm-0\x00', 0x2, 0x0) pwritev2(r6, &(0x7f0000000600)=[{&(0x7f0000000700)='\x00'/4096, 0x1000}], 0x1, 0x0, 0x0, 0x4) fsync(r6) 28.578992838s ago: executing program 3 (id=125): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='-2 -3 -4\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000700)='1\n', 0x2) close(r2) 22.390061808s ago: executing program 32 (id=68): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="040000000000000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f6d00") r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dummy\x00', 0x42, 0x1ff) write(r1, &(0x7f0000000138)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00mirror\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00core 2 1024 nosync 2 7:0 0 7:1 0 1 handle_errors\x00', 0x59) ioctl(r0, 0xc138fd09, &(0x7f0000000000)="040000000000000000000000a00100003801000001000000000000000000000000000000000000000000000000000000746573745f6d00") ioctl(r0, 0xc138fd06, &(0x7f0000000000)="040000000000000000000000380100003801000000000000000000000000000000000000000000000000000000000000746573745f6d00") r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./dev/dm-0\x00', 0x2, 0x0) write(r2, &(0x7f0000000600)='\x00'/4096, 0x1000) fsync(r2) read(r2, &(0x7f0000000700)=""/4096, 0x1000) syncfs(r2) nanosleep(&(0x7f0000000800)={0x0, 0x2faf080}, 0x0) 19.602470443s ago: executing program 6 (id=126): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040), &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='0\n\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='devices\n\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_disk/0:0:0:0/manage_system_start_stop\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='1\n\x00', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/scsi_disk/1:0:0:0/manage_system_start_stop\x00', 0x2, 0x0) write(r3, &(0x7f00000002c0)='1\n\x00', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_disk/2:0:0:0/manage_system_start_stop\x00', 0x2, 0x0) write(r4, &(0x7f0000000340)='1\n\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/power/state\x00', 0x2, 0x0) write(r5, &(0x7f00000003c0)='mem\n\x00', 0x4) close(r5) 17.867148196s ago: executing program 33 (id=106): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipe\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./pipe\x00', &(0x7f0000000080)='rpc_pipefs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='-2 -3 +4\n\x00', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='tcp 2049\n\x00', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='1\n\x00', 0x2) nanosleep(&(0x7f0000000280)={0x0, 0x5f5e100}, 0x0) openat(0xffffffffffffff9c, &(0x7f00000002c0)='./pipe/nfsd/cld\x00', 0x2, 0x0) 16.874127015s ago: executing program 34 (id=113): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x1d, 0x3, 0x1b1c, 0x1c03, 0x0, 0x0, "0600ff0901a1010902150026ff007508954081020903750895409102c0"}}, 0x135) read(r0, &(0x7f0000000600)=""/4096, 0x1000) read(r0, &(0x7f0000000600)=""/4096, 0x1000) read(r0, &(0x7f0000000600)=""/4096, 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x40, "fe0300"/64}}, 0x46) read(r0, &(0x7f0000000600)=""/4096, 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x40, "0399434f525341495200"/64}}, 0x46) read(r0, &(0x7f0000000600)=""/4096, 0x1000) write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x40, "039a48583535306900"/64}}, 0x46) nanosleep(&(0x7f0000000500)={0x4}, 0x0) 15.812759287s ago: executing program 35 (id=124): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x1000000) r1 = syz_open_dev$loop(0x0, 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) r2 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1b6) ftruncate(r2, 0x1000000) r3 = syz_open_dev$loop(0x0, 0x1, 0x2) ioctl$LOOP_SET_FD(r3, 0x4c00, r2) r4 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1b6) ftruncate(r4, 0x1000000) syz_open_dev$loop(0x0, 0x2, 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r5, 0xc138fd03, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600") write(r5, &(0x7f0000000438)="000000000000000000800000000000000000000000000000636163686500000000000000373a3020373a3120373a3220", 0x30) ioctl(r5, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000007c01000038010000010000000000000000000000000000000000000000000000000000006364657600") r6 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev/dm-0\x00', 0x2, 0x0) pwritev2(r6, &(0x7f0000000600)=[{&(0x7f0000000700)='\x00'/4096, 0x1000}], 0x1, 0x0, 0x0, 0x4) fsync(r6) 15.73847268s ago: executing program 36 (id=120): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='tcp 2049\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='1\n', 0x2) 13.32955276s ago: executing program 37 (id=125): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='-2 -3 -4\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000700)='1\n', 0x2) close(r2) 5.335053336s ago: executing program 8 (id=128): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302000200"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f00000001c0)={0x40, 0x4, 0x2, ' \x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000000100)) syz_usb_ep_write(r0, 0x81, 0xb, &(0x7f0000000200)) nanosleep(&(0x7f0000000400)={0x1}, 0x0) 4.269908319s ago: executing program 38 (id=126): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040), &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/suspend/parameters/pm_test_delay\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='0\n\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/power/pm_test\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='devices\n\x00', 0x8) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/scsi_disk/0:0:0:0/manage_system_start_stop\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='1\n\x00', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/scsi_disk/1:0:0:0/manage_system_start_stop\x00', 0x2, 0x0) write(r3, &(0x7f00000002c0)='1\n\x00', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/scsi_disk/2:0:0:0/manage_system_start_stop\x00', 0x2, 0x0) write(r4, &(0x7f0000000340)='1\n\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/power/state\x00', 0x2, 0x0) write(r5, &(0x7f00000003c0)='mem\n\x00', 0x4) close(r5) 3.629124574s ago: executing program 7 (id=140): syz_usb_connect(0x3, 0x3c, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002ef0201407205a65801000000000109022a000201008032080b01020000000009040000000000000009040100010000000007058102400000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) 3.615320388s ago: executing program 9 (id=129): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='sysfs\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/event_source/devices/cpu\x00', 0x0, 0x0) 3.322670183s ago: executing program 9 (id=141): syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040c00902020100000000010902200001010080320904000002ff0000000705820200020007050102000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x0, 0x2) 2.338938185s ago: executing program 4 (id=130): mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/tpm\x00', 0x0, 0x0) openat(r0, &(0x7f0000000200)='tpm0\x00', 0x0, 0x0) 2.15064469s ago: executing program 4 (id=142): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f0000000000)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/devices/system/cpu/vulnerabilities/srbds\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/devices/system/cpu/vulnerabilities/gather_data_sampling\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/devices/system/cpu/vulnerabilities/rfds\x00', 0x0, 0x0) 1.940291633s ago: executing program 4 (id=143): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x48050}, 0x4000) 1.804732379s ago: executing program 7 (id=144): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) 1.500582554s ago: executing program 7 (id=145): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1111, @loopback}, 0x10) listen(r0, 0x1) r1 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write(r1, &(0x7f0000000200)='nqn=test,transport=tcp,traddr=127.0.0.1,trsvcid=4369', 0x34) nanosleep(&(0x7f0000000080)={0x0, 0x5f5e100}, 0x0) r2 = accept$inet(r0, 0x0, 0x0) write(r2, &(0x7f0000000100)="01008000800000000000000200004000"/128, 0x80) nanosleep(&(0x7f0000000080)={0x0, 0x1dcd6500}, 0x0) close(r2) close(r0) close(r1) 1.450822928s ago: executing program 8 (id=146): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/i2c-dev/i2c-0/name\x00', 0x0, 0x0) read(r0, &(0x7f0000000100), 0x100) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/i2c-dev/i2c-1/name\x00', 0x0, 0x0) read(r1, &(0x7f0000000300), 0x100) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/i2c-dev/i2c-2/name\x00', 0x0, 0x0) read(r2, &(0x7f0000000500), 0x100) 1.272212623s ago: executing program 2 (id=131): r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600") ioctl(r0, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000007c01000038010000010000000000000000000000000000000000000000000000000000006364657600") ioctl(r0, 0xc138fd0a, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600") 1.010175836s ago: executing program 2 (id=147): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000200)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f00"/308) ioctl(r0, 0xc138fd09, &(0x7f0000000400)="0400000000000000000000008001000038010000010000000000000000000000000000000000000000000000000000006d79706f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000063616368650000000000000000000000313a3020313a3120313a3220363420302064656661756c742030000000000000") ioctl(r0, 0xc138fd06, &(0x7f0000000200)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f00"/308) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev/dm-0\x00', 0x2, 0x0) write(r1, &(0x7f0000000700)='\x00\x00\x00\x00', 0x4) 956.326195ms ago: executing program 8 (id=148): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='-2 -3 +4\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='udp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='1\n', 0x2) close(r2) 930.822503ms ago: executing program 4 (id=149): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/net/bonding_masters\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='-bond0\n', 0x7) write(r0, &(0x7f0000000140)='+bond0\n', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/class/net/bond0/bonding/mode\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='balance-rr\n', 0xb) close(r1) 748.116734ms ago: executing program 7 (id=150): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='md0\x00', 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='none\x00', 0x5) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='1:0\x00', 0x4) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/dev-ram0/bad_blocks\x00', 0x1, 0x0) write(r3, &(0x7f0000000480)='-0 8\n', 0x5) 659.980688ms ago: executing program 9 (id=151): r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 315.52563ms ago: executing program 7 (id=152): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb01001800000000000000200000002000000004000000000000000000"], 0x0, 0x3c}, 0x28) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000004000000000000000100"/48, @ANYRES32=r0, @ANYBLOB="010000000200"/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x3, 0x8, &(0x7f0000000500)=ANY=[@ANYBLOB="bf160000000000007962a80000000000150204000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000850000006c000000b7000000000000009500000000000000"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 93.520761ms ago: executing program 7 (id=153): syz_usb_connect(0x1, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040950b801701000102030109022700010100a0320904000003ff00000007058202400000070502024000000705810308000b"], 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'\x00', 0x1}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'\x00', 0x1}) 0s ago: executing program 4 (id=154): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f00000001c0)='tcp 2049\n', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='4\n', 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r2, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r3, &(0x7f0000000340)='localhost / 2147483647 196606 0 0 0\n', 0x24) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r4, &(0x7f00000003c0)='localhost 1 \\x00000000 2147483647 /\n', 0x24) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f0000000440)='127.0.0.1:/\x00', &(0x7f0000000400)='./mnt\x00', &(0x7f0000000480), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049,proto=tcp,vers=4.1,clientaddr=127.0.0.1']) r5 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/testfile\x00', 0x42, 0x1b6) write(r5, &(0x7f0000000700)='hello world\n', 0xc) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.140' (ED25519) to the list of known hosts. [ 86.115921][ T10] cfg80211: failed to load regulatory.db [ 86.744767][ T5600] cgroup: Unknown subsys name 'net' [ 86.877761][ T5600] cgroup: Unknown subsys name 'cpuset' [ 86.881828][ T5600] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 88.479438][ T5600] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 91.115292][ T5615] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 91.116943][ T5618] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 91.117483][ T5618] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 91.118540][ T5618] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 91.119449][ T5618] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 91.120663][ T5618] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 91.120820][ T5618] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 91.121959][ T5618] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 91.122823][ T5618] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 91.123777][ T5618] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 91.130069][ T5615] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 91.139535][ T5615] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 91.140797][ T5615] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 91.151482][ T5615] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 91.152620][ T5615] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 91.241333][ T52] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 91.243432][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 91.244631][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 91.245878][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 91.247777][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 91.294820][ T5615] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 91.296335][ T5615] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 91.296849][ T5615] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 91.299115][ T5615] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 91.299845][ T5615] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 91.348071][ T5622] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 91.351732][ T5622] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 91.352277][ T5622] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 91.356072][ T5622] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 91.356829][ T5622] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 93.153658][ T5622] Bluetooth: hci2: command tx timeout [ 93.153663][ T52] Bluetooth: hci0: command tx timeout [ 93.233170][ T5622] Bluetooth: hci1: command tx timeout [ 93.314269][ T5622] Bluetooth: hci3: command tx timeout [ 93.393008][ T52] Bluetooth: hci4: command tx timeout [ 93.393186][ T5622] Bluetooth: hci5: command tx timeout [ 93.638384][ T5625] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.638558][ T5625] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.638800][ T5625] bridge_slave_0: entered allmulticast mode [ 93.641994][ T5625] bridge_slave_0: entered promiscuous mode [ 93.707876][ T5625] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.708069][ T5625] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.708226][ T5625] bridge_slave_1: entered allmulticast mode [ 93.710480][ T5625] bridge_slave_1: entered promiscuous mode [ 93.927964][ T5625] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 93.938049][ T5623] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.938169][ T5623] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.938327][ T5623] bridge_slave_0: entered allmulticast mode [ 93.941021][ T5623] bridge_slave_0: entered promiscuous mode [ 93.961598][ T5625] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 93.997526][ T5623] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.997687][ T5623] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.997855][ T5623] bridge_slave_1: entered allmulticast mode [ 93.999544][ T5623] bridge_slave_1: entered promiscuous mode [ 94.091727][ T5625] team0: Port device team_slave_0 added [ 94.169645][ T5625] team0: Port device team_slave_1 added [ 94.201660][ T5623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.257910][ T5623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.258132][ T5612] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.258295][ T5612] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.258430][ T5612] bridge_slave_0: entered allmulticast mode [ 94.260061][ T5612] bridge_slave_0: entered promiscuous mode [ 94.282847][ T5625] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 94.282900][ T5625] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.282944][ T5625] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.285643][ T5625] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 94.285663][ T5625] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.285707][ T5625] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 94.396425][ T5612] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.396542][ T5612] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.396692][ T5612] bridge_slave_1: entered allmulticast mode [ 94.398721][ T5612] bridge_slave_1: entered promiscuous mode [ 94.451542][ T5613] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.451708][ T5613] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.451862][ T5613] bridge_slave_0: entered allmulticast mode [ 94.454678][ T5613] bridge_slave_0: entered promiscuous mode [ 94.457997][ T5613] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.458114][ T5613] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.458536][ T5613] bridge_slave_1: entered allmulticast mode [ 94.460729][ T5613] bridge_slave_1: entered promiscuous mode [ 94.466130][ T5623] team0: Port device team_slave_0 added [ 94.469910][ T5623] team0: Port device team_slave_1 added [ 94.505382][ T5625] hsr_slave_0: entered promiscuous mode [ 94.506775][ T5625] hsr_slave_1: entered promiscuous mode [ 94.533932][ T5630] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.534109][ T5630] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.534452][ T5630] bridge_slave_0: entered allmulticast mode [ 94.536412][ T5630] bridge_slave_0: entered promiscuous mode [ 94.585501][ T5612] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.614055][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.614160][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.614880][ T5617] bridge_slave_0: entered allmulticast mode [ 94.616560][ T5617] bridge_slave_0: entered promiscuous mode [ 94.624922][ T5630] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.625085][ T5630] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.625566][ T5630] bridge_slave_1: entered allmulticast mode [ 94.627830][ T5630] bridge_slave_1: entered promiscuous mode [ 94.638587][ T5613] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.674925][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 94.674947][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.674991][ T5623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 94.677954][ T5623] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 94.677978][ T5623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 94.678022][ T5623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 94.681395][ T5612] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.708568][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.708683][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.709162][ T5617] bridge_slave_1: entered allmulticast mode [ 94.711960][ T5617] bridge_slave_1: entered promiscuous mode [ 94.818851][ T5613] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.878983][ T5630] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.916861][ T5617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.920245][ T5630] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.938905][ T5612] team0: Port device team_slave_0 added [ 94.964441][ T5617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.981494][ T5613] team0: Port device team_slave_0 added [ 94.985557][ T5612] team0: Port device team_slave_1 added [ 95.035833][ T5613] team0: Port device team_slave_1 added [ 95.064222][ T5623] hsr_slave_0: entered promiscuous mode [ 95.065101][ T5623] hsr_slave_1: entered promiscuous mode [ 95.065737][ T5623] debugfs: 'hsr0' already exists in 'hsr' [ 95.065802][ T5623] Cannot create hsr debugfs directory [ 95.085958][ T5630] team0: Port device team_slave_0 added [ 95.126886][ T5617] team0: Port device team_slave_0 added [ 95.129374][ T5630] team0: Port device team_slave_1 added [ 95.145521][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.145543][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.145588][ T5612] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.195565][ T5617] team0: Port device team_slave_1 added [ 95.211144][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.211164][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.211204][ T5613] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.230389][ T5612] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.230411][ T5612] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.230455][ T5612] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.246526][ T5622] Bluetooth: hci0: command tx timeout [ 95.253131][ T5622] Bluetooth: hci2: command tx timeout [ 95.323590][ T5622] Bluetooth: hci1: command tx timeout [ 95.354120][ T5613] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.354141][ T5613] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.354182][ T5613] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.355592][ T5630] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.355611][ T5630] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.355656][ T5630] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.397001][ T5622] Bluetooth: hci3: command tx timeout [ 95.429356][ T5630] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.429379][ T5630] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.429423][ T5630] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.439857][ T5612] hsr_slave_0: entered promiscuous mode [ 95.441394][ T5612] hsr_slave_1: entered promiscuous mode [ 95.442374][ T5612] debugfs: 'hsr0' already exists in 'hsr' [ 95.442402][ T5612] Cannot create hsr debugfs directory [ 95.473215][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.473237][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.473286][ T5617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.492393][ T5622] Bluetooth: hci5: command tx timeout [ 95.492406][ T52] Bluetooth: hci4: command tx timeout [ 95.528351][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.528372][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.528416][ T5617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.670881][ T5613] hsr_slave_0: entered promiscuous mode [ 95.671953][ T5613] hsr_slave_1: entered promiscuous mode [ 95.672615][ T5613] debugfs: 'hsr0' already exists in 'hsr' [ 95.672642][ T5613] Cannot create hsr debugfs directory [ 95.822810][ T5617] hsr_slave_0: entered promiscuous mode [ 95.824635][ T5617] hsr_slave_1: entered promiscuous mode [ 95.825580][ T5617] debugfs: 'hsr0' already exists in 'hsr' [ 95.825606][ T5617] Cannot create hsr debugfs directory [ 95.838317][ T5630] hsr_slave_0: entered promiscuous mode [ 95.839519][ T5630] hsr_slave_1: entered promiscuous mode [ 95.840374][ T5630] debugfs: 'hsr0' already exists in 'hsr' [ 95.840400][ T5630] Cannot create hsr debugfs directory [ 96.075604][ T5625] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 96.082195][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 96.129050][ T5625] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 96.134105][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 96.177345][ T5625] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 96.181019][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 96.182298][ T5625] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 96.198550][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 96.403755][ T5623] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 96.408448][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 96.409963][ T5623] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 96.419407][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 96.449633][ T5623] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 96.454074][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 96.455197][ T5623] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 96.464174][ T5623] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 96.562352][ T5612] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 96.573784][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 96.575421][ T5612] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 96.580042][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 96.581190][ T5612] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 96.587584][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 96.590304][ T5612] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 96.602626][ T5612] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 96.736548][ T5617] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 96.741463][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 96.762071][ T5617] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 96.772812][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 96.793356][ T5617] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 96.797384][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 96.799078][ T5617] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 96.802691][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 96.853133][ T5625] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.926392][ T5613] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 96.930014][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 96.941511][ T5625] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.973473][ T5613] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 96.977706][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 96.980891][ T160] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.981020][ T160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.984964][ T160] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.985085][ T160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.015218][ T5613] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 97.031704][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.058686][ T5623] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.060767][ T5613] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 97.070483][ T5613] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.182155][ T5623] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.199965][ T5630] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 97.205488][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.226577][ T5630] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 97.229973][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.232046][ T5630] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 97.239753][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.248660][ T5625] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 97.282941][ T80] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.283067][ T80] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.288594][ T5630] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 97.295979][ T5630] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.313144][ T5622] Bluetooth: hci2: command tx timeout [ 97.318154][ T5622] Bluetooth: hci0: command tx timeout [ 97.339975][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.340099][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.361367][ T5612] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.393768][ T5622] Bluetooth: hci1: command tx timeout [ 97.475685][ T5622] Bluetooth: hci3: command tx timeout [ 97.512083][ T5612] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.557665][ T52] Bluetooth: hci5: command tx timeout [ 97.557762][ T5622] Bluetooth: hci4: command tx timeout [ 97.590788][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.590996][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.610968][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.638971][ T80] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.639241][ T80] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.740091][ T5617] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.776729][ T5613] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.810866][ T3326] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.810993][ T3326] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.858138][ T160] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.858275][ T160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.885924][ T5613] 8021q: adding VLAN 0 to HW filter on device team0 [ 97.938762][ T3326] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.938885][ T3326] bridge0: port 1(bridge_slave_0) entered forwarding state [ 97.966960][ T5630] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.997724][ T3326] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.997844][ T3326] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.186676][ T5630] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.290336][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.290461][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.300513][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.300632][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.338598][ T5613] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 98.479731][ T5625] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.881732][ T5625] veth0_vlan: entered promiscuous mode [ 98.969360][ T5625] veth1_vlan: entered promiscuous mode [ 99.146755][ T5623] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.206951][ T5625] veth0_macvtap: entered promiscuous mode [ 99.259805][ T5625] veth1_macvtap: entered promiscuous mode [ 99.393895][ T52] Bluetooth: hci2: command tx timeout [ 99.393953][ T5622] Bluetooth: hci0: command tx timeout [ 99.408357][ T5625] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.477969][ T5622] Bluetooth: hci1: command tx timeout [ 99.484051][ T5625] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.553521][ T5622] Bluetooth: hci3: command tx timeout [ 99.555494][ T3272] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.557115][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.634255][ T5622] Bluetooth: hci4: command tx timeout [ 99.634295][ T5622] Bluetooth: hci5: command tx timeout [ 99.637294][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.637650][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.970515][ T5612] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.001320][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.085501][ T3326] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.085532][ T3326] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.227435][ T3326] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.227467][ T3326] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.402344][ T5617] veth0_vlan: entered promiscuous mode [ 100.419444][ T5613] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.439028][ T5612] veth0_vlan: entered promiscuous mode [ 100.450938][ T5625] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 100.476710][ T5630] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.479573][ T5617] veth1_vlan: entered promiscuous mode [ 100.555332][ T5612] veth1_vlan: entered promiscuous mode [ 100.720870][ T5623] veth0_vlan: entered promiscuous mode [ 100.744203][ T5617] veth0_macvtap: entered promiscuous mode [ 100.776747][ T5612] veth0_macvtap: entered promiscuous mode [ 100.779118][ T5617] veth1_macvtap: entered promiscuous mode [ 100.791263][ T5623] veth1_vlan: entered promiscuous mode [ 100.844325][ T5612] veth1_macvtap: entered promiscuous mode [ 100.864798][ T5630] veth0_vlan: entered promiscuous mode [ 100.883847][ T5838] NFSD: Failed to start, no listeners configured. [ 100.908773][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.927749][ T5630] veth1_vlan: entered promiscuous mode [ 100.953051][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.959377][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.989033][ T5612] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.025689][ T5623] veth0_macvtap: entered promiscuous mode [ 101.079817][ T5623] veth1_macvtap: entered promiscuous mode [ 101.123229][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.124393][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.124459][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.124521][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.165389][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.170537][ T5623] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.207669][ T5630] veth0_macvtap: entered promiscuous mode [ 101.223917][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.224937][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.225002][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.225063][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.321155][ T5630] veth1_macvtap: entered promiscuous mode [ 101.339059][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.469874][ T3272] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.469903][ T3272] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.474561][ T3326] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.479159][ T3326] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.479226][ T3326] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.551906][ T5630] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.565480][ T3272] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.565507][ T3272] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.572439][ T5613] veth0_vlan: entered promiscuous mode [ 101.623336][ T5630] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.628417][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.628444][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.628500][ T5613] veth1_vlan: entered promiscuous mode [ 101.721114][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.721330][ T1151] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.721356][ T1151] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.774071][ T160] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.774141][ T160] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.774204][ T160] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.848479][ T160] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.848509][ T160] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.864062][ T5613] veth0_macvtap: entered promiscuous mode [ 101.869835][ T5613] veth1_macvtap: entered promiscuous mode [ 101.929994][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.930024][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.976386][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.049148][ T5613] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.108019][ T3272] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.108051][ T3272] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.134456][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.177926][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.178088][ T160] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.178141][ T160] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.320715][ T3272] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.320749][ T3272] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.493354][ T5846] NFSD: Unable to initialize client recovery tracking! (-110) [ 102.493379][ T5846] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 102.493396][ T5846] NFSD: starting 90-second grace period (net f00003cc) [ 102.602855][ T3272] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.602944][ T3272] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.705195][ T5739] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 102.771035][ T3272] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.771067][ T3272] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.895049][ T5739] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9170, bcdDevice= 1.08 [ 102.922016][ T5739] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 102.922055][ T5739] usb 5-1: Product: syz [ 102.922082][ T5739] usb 5-1: Manufacturer: syz [ 102.922109][ T5739] usb 5-1: SerialNumber: syz [ 103.069372][ T5617] svc: failed to register nfsdv3 RPC service (errno 111). [ 103.089348][ T5617] svc: failed to register nfsaclv3 RPC service (errno 111). [ 103.089377][ T5617] failed to unregister udp with rpcbind [ 103.089633][ T5617] svc: failed to register nfsdv3 RPC service (errno 97). [ 103.089659][ T5617] svc: failed to register nfsaclv3 RPC service (errno 97). [ 103.089681][ T5617] failed to unregister udp with rpcbind [ 103.193463][ T5739] usb 5-1: reset high-speed USB device number 2 using dummy_hcd [ 103.309030][ T5872] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 103.625942][ T5870] svc: failed to register lockdv1 RPC service (errno 111). [ 103.626167][ T5870] lockd_up: makesock failed, error=-111 [ 103.899450][ T5870] svc: failed to register nfsdv3 RPC service (errno 111). [ 103.901010][ T5870] svc: failed to register nfsaclv3 RPC service (errno 111). [ 103.901038][ T5870] failed to unregister tcp with rpcbind [ 103.901472][ T5870] svc: failed to register nfsdv3 RPC service (errno 97). [ 103.901500][ T5870] svc: failed to register nfsaclv3 RPC service (errno 97). [ 103.901521][ T5870] failed to unregister tcp with rpcbind [ 103.967061][ T5873] svc: failed to register lockdv1 RPC service (errno 111). [ 104.116612][ T5873] svc: failed to register nfsdv3 RPC service (errno 512). [ 104.116895][ T5873] svc: failed to register nfsaclv3 RPC service (errno 512). [ 104.116920][ T5873] failed to unregister tcp with rpcbind [ 104.117190][ T5873] svc: failed to register nfsdv3 RPC service (errno 97). [ 104.117217][ T5873] svc: failed to register nfsaclv3 RPC service (errno 97). [ 104.117270][ T5873] failed to unregister tcp with rpcbind [ 104.205799][ T5613] svc: failed to register nfsdv3 RPC service (errno 111). [ 104.207404][ T5613] svc: failed to register nfsaclv3 RPC service (errno 111). [ 104.207431][ T5613] failed to unregister udp with rpcbind [ 104.207604][ T5613] svc: failed to register nfsdv3 RPC service (errno 97). [ 104.207630][ T5613] svc: failed to register nfsaclv3 RPC service (errno 97). [ 104.207653][ T5613] failed to unregister udp with rpcbind [ 104.270315][ T5877] svc: failed to register lockdv1 RPC service (errno 111). [ 104.391202][ T5897] kAFS: unable to lookup cell 'testcell' [ 104.461520][ T5877] svc: failed to register nfsdv3 RPC service (errno 111). [ 104.465060][ T5877] svc: failed to register nfsaclv3 RPC service (errno 512). [ 104.465086][ T5877] failed to unregister tcp with rpcbind [ 104.465282][ T5877] svc: failed to register nfsdv3 RPC service (errno 97). [ 104.465307][ T5877] svc: failed to register nfsaclv3 RPC service (errno 97). [ 104.465329][ T5877] failed to unregister tcp with rpcbind [ 105.714764][ T5889] NFSD: Unable to initialize client recovery tracking! (-110) [ 105.714798][ T5889] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 105.714816][ T5889] NFSD: starting 10-second grace period (net f00003cc) [ 106.012718][ T5900] NFSD: Failed to start, no listeners configured. [ 106.045957][ T5739] usb 5-1: USB disconnect, device number 2 [ 106.181440][ T5913] Bluetooth: MGMT ver 1.23 [ 106.310913][ T30] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 106.339604][ T30] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 106.383930][ T5919] lo speed is unknown, defaulting to 1000 [ 106.403144][ T5919] lo speed is unknown, defaulting to 1000 [ 106.460038][ T5919] lo speed is unknown, defaulting to 1000 [ 106.495361][ T5914] svc: failed to register lockdv1 RPC service (errno 111). [ 106.556860][ T5925] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 106.594359][ T5739] libceph: mon0 (1)127.0.0.1:6789 socket error on write [ 106.741223][ T5914] svc: failed to register nfsdv3 RPC service (errno 111). [ 106.752656][ T5914] svc: failed to register nfsaclv3 RPC service (errno 111). [ 106.752685][ T5914] failed to unregister udp with rpcbind [ 106.753698][ T5914] svc: failed to register nfsdv3 RPC service (errno 97). [ 106.753726][ T5914] svc: failed to register nfsaclv3 RPC service (errno 97). [ 106.753749][ T5914] failed to unregister udp with rpcbind [ 107.007279][ T5912] ceph: No mds server is up or the cluster is laggy [ 107.013495][ T5929] NFSD: Failed to start, no listeners configured. [ 107.027801][ T5919] infiniband syz0: set active [ 107.027827][ T5919] infiniband syz0: added lo [ 107.029419][ T5739] lo speed is unknown, defaulting to 1000 [ 107.087302][ T5919] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 107.087368][ T5919] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 107.087448][ T5919] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 107.193009][ T5734] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 107.219788][ T5919] RDS/IB: syz0: added [ 107.227361][ T5919] smc: adding ib device syz0 with port count 1 [ 107.227473][ T5919] smc: ib device syz0 port 1 has no pnetid [ 107.230165][ T5345] lo speed is unknown, defaulting to 1000 [ 107.295349][ T5919] lo speed is unknown, defaulting to 1000 [ 107.345946][ T5734] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 107.369595][ T5734] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.369636][ T5734] usb 6-1: Product: syz [ 107.369661][ T5734] usb 6-1: Manufacturer: syz [ 107.369687][ T5734] usb 6-1: SerialNumber: syz [ 107.422993][ T5739] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 107.559236][ T5943] ptp ptp0: only physical clock in use now [ 107.575135][ T5943] ptp ptp0: new virtual clock ptp1 [ 107.575167][ T5943] ptp ptp0: guarantee physical clock free running [ 107.589411][ T5739] usb 2-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 107.609678][ T5739] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.609746][ T5739] usb 2-1: Product: syz [ 107.609779][ T5739] usb 2-1: Manufacturer: syz [ 107.609806][ T5739] usb 2-1: SerialNumber: syz [ 107.825968][ T5919] lo speed is unknown, defaulting to 1000 [ 108.049866][ T5734] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 108.049945][ T5734] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 108.052382][ T5734] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 108.095158][ T5734] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -32 [ 108.118125][ T5919] lo speed is unknown, defaulting to 1000 [ 108.387445][ T5739] usb 2-1: failed to set cport flags for port 0 [ 108.387543][ T5739] greybus greybus1: 0/0:0: failed to enable host cport: -110 [ 108.413805][ T5919] lo speed is unknown, defaulting to 1000 [ 108.430154][ T5739] es2_ap_driver 2-1:1.0: probe with driver es2_ap_driver failed with error -110 [ 108.601983][ T10] usb 2-1: USB disconnect, device number 2 [ 108.623037][ T5938] NFSD: Unable to initialize client recovery tracking! (-110) [ 108.623062][ T5938] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 108.623080][ T5938] NFSD: starting 10-second grace period (net f00003cc) [ 108.728887][ T5919] lo speed is unknown, defaulting to 1000 [ 108.879778][ T5939] NFSD: Failed to start, no listeners configured. [ 108.983577][ T5919] lo speed is unknown, defaulting to 1000 [ 109.310551][ T5955] svc: failed to register lockdv1 RPC service (errno 111). [ 109.515874][ T5955] svc: failed to register nfsdv3 RPC service (errno 111). [ 109.517394][ T5955] svc: failed to register nfsaclv3 RPC service (errno 111). [ 109.517421][ T5955] failed to unregister tcp with rpcbind [ 109.517614][ T5955] svc: failed to register nfsdv3 RPC service (errno 97). [ 109.517641][ T5955] svc: failed to register nfsaclv3 RPC service (errno 97). [ 109.517664][ T5955] failed to unregister tcp with rpcbind [ 109.522671][ T5966] rdma_rxe: rxe_newlink: failed to add lo [ 109.740519][ T5967] svc: failed to register lockdv1 RPC service (errno 111). [ 109.845982][ T5978] bonding: bond0 is being created... [ 109.848366][ T5978] bonding: bond0 already exists [ 109.866976][ T5978] bond0: (slave bond_slave_0): Releasing backup interface [ 109.884658][ T5978] bond0: (slave bond_slave_1): Releasing backup interface [ 109.906191][ T5967] svc: failed to register nfsdv3 RPC service (errno 111). [ 109.907646][ T5967] svc: failed to register nfsaclv3 RPC service (errno 111). [ 109.907672][ T5967] failed to unregister tcp with rpcbind [ 109.907855][ T5967] svc: failed to register nfsdv3 RPC service (errno 97). [ 109.907883][ T5967] svc: failed to register nfsaclv3 RPC service (errno 97). [ 109.907906][ T5967] failed to unregister tcp with rpcbind [ 109.933753][ T5978] bond0: (slave bond_slave_0): making interface the new active one [ 109.940985][ T5978] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 110.008800][ T5978] 8021q: adding VLAN 0 to HW filter on device bond0 [ 110.052982][ T5983] ptp ptp0: guarantee physical clock free running [ 110.127554][ T30] usb 6-1: USB disconnect, device number 2 [ 110.208814][ T3272] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 110.209365][ T3272] bond0: now running without any active interface! [ 110.536956][ T160] bond0: (slave bond_slave_0): link status definitely up [ 110.537053][ T160] bond0: (slave bond_slave_0): making interface the new active one [ 110.566117][ T160] bond0: active interface up! [ 110.659882][ T5999] tps6598x 0-0020: failed to read vendor ID: -5, vid: 0x0 [ 110.673508][ T5999] i2c i2c-0: new_device: Instantiated device tps6598x at 0x20 [ 110.676243][ T5995] i2c i2c-0: new_device: Instantiated device dummy at 0x22 [ 110.736943][ T5993] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 110.815350][ T1151] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 110.815648][ T1151] bond0: now running without any active interface! [ 111.092799][ T6017] comedi comedi3: pcl816: I/O port conflict (0x300,16) [ 111.102593][ T6016] comedi comedi0: no devices specified [ 111.144522][ T160] bond0: (slave bond_slave_0): link status definitely up [ 111.144626][ T160] bond0: (slave bond_slave_0): making interface the new active one [ 111.148910][ T160] bond0: active interface up! [ 111.174545][ T5972] NFSD: Unable to initialize client recovery tracking! (-110) [ 111.174571][ T5972] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 111.174588][ T5972] NFSD: starting 10-second grace period (net f00004af) [ 111.339869][ T6009] ftl_cs: FTL header not found. [ 111.428446][ T3272] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 111.428609][ T3272] bond0: now running without any active interface! [ 111.491170][ T6025] Invalid source name [ 111.491195][ T6025] UBIFS error (pid: 6025): cannot open "/dev/loop3", error -22 [ 111.549567][ T6022] device-mapper: raid1: Mirror read failed from 7:0. Trying alternative device. [ 111.552530][ T30] device-mapper: raid1: All sides of mirror have failed. [ 111.552753][ T30] device-mapper: raid1: Read failure on mirror device 7:1. Failing I/O. [ 111.552822][ T30] device-mapper: raid1: Mirror read failed. [ 111.554295][ T6022] Buffer I/O error on dev dm-0, logical block 0, async page read [ 111.636439][ T6009] block2mtd: mtd1: [/dev/ram0] erase_size = 64KiB [65536] [ 111.769322][ T6032] svc: failed to register lockdv1 RPC service (errno 111). [ 111.792712][ T6029] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 111.812266][ T6029] 8021q: adding VLAN 0 to HW filter on device bond0 [ 111.814431][ T1151] bond0: (slave bond_slave_0): interface is now down [ 111.814463][ T1151] bond0: no route to arp_ip_target 192.0.2.1 and arp_validate is set [ 111.826832][ T1151] bond0: (slave bond_slave_1): interface is now down [ 111.826968][ T1151] bond0: (slave dummy0): interface is now down [ 111.843119][ T1151] bond0: (slave bond_slave_0): interface is now down [ 111.843289][ T1151] bond0: (slave bond_slave_1): interface is now down [ 111.843420][ T1151] bond0: (slave dummy0): interface is now down [ 111.864978][ T12] bond0: (slave bond_slave_0): interface is now down [ 111.865132][ T12] bond0: (slave bond_slave_1): interface is now down [ 111.865262][ T12] bond0: (slave dummy0): interface is now down [ 111.897262][ T12] bond0: now running without any active interface! [ 112.029288][ T6032] svc: failed to register nfsdv3 RPC service (errno 111). [ 112.035659][ T6032] svc: failed to register nfsaclv3 RPC service (errno 111). [ 112.035686][ T6032] failed to unregister tcp with rpcbind [ 112.035889][ T6032] svc: failed to register nfsdv3 RPC service (errno 97). [ 112.035915][ T6032] svc: failed to register nfsaclv3 RPC service (errno 97). [ 112.035937][ T6032] failed to unregister tcp with rpcbind [ 112.410245][ T6042] bond0: (slave bond_slave_0): Releasing backup interface [ 112.474559][ T6049] bond0: (slave bond_slave_1): Releasing backup interface [ 112.648786][ T6042] bond0: (slave bond_slave_0): making interface the new active one [ 112.662071][ T6042] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 112.663146][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 112.720126][ T6042] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.833821][ T10] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 112.840042][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.840081][ T10] usb 1-1: Product: syz [ 112.840108][ T10] usb 1-1: Manufacturer: syz [ 112.840135][ T10] usb 1-1: SerialNumber: syz [ 113.058473][ T12] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 113.065623][ T12] bond0: now running without any active interface! [ 113.260278][ T6075] comedi comedi3: pcl816: I/O port conflict (0x300,16) [ 113.272820][ T30] device-mapper: raid1: Primary mirror (7:0) failed while out-of-sync: Reads may fail. [ 113.274546][ T30] device-mapper: raid1: Read failure on mirror device 7:0. Failing I/O. [ 113.274569][ T30] device-mapper: raid1: Mirror read failed. [ 113.274678][ T30] Buffer I/O error on dev dm-0, logical block 1, async page read [ 113.319911][ T30] device-mapper: raid1: Unable to read primary mirror during recovery [ 113.319932][ T30] device-mapper: raid1: Primary mirror (7:0) failed while out-of-sync: Reads may fail. [ 113.370718][ T30] device-mapper: raid1: Unable to read primary mirror during recovery [ 113.554688][ T13] bond0: (slave bond_slave_0): link status definitely up [ 113.555462][ T13] bond0: (slave bond_slave_0): making interface the new active one [ 113.560961][ T13] bond0: active interface up! [ 113.779466][ T6083] bond0: (slave dummy0): Enslaving as a backup interface with an up link [ 113.805943][ T6083] 8021q: adding VLAN 0 to HW filter on device bond0 [ 113.815990][ T160] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 113.816223][ T160] bond0: (slave dummy0): link status definitely down, disabling slave [ 113.839132][ T160] bond0: now running without any active interface! [ 113.982203][ T6092] bonding: bond0 is being created... [ 113.989425][ T6092] bonding: bond0 already exists [ 114.002785][ T6092] bond0: (slave bond_slave_0): Releasing backup interface [ 114.028367][ T6092] bond0: (slave bond_slave_1): Releasing backup interface [ 114.102112][ T6092] bond0: (slave bond_slave_0): making interface the new active one [ 114.113645][ T6092] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 114.701627][ T6109] NFSD: Failed to start, no listeners configured. [ 114.768885][ T6113] bond0: (slave bond_slave_0): Releasing backup interface [ 114.830826][ T6113] bond0: option slaves: invalid value (-bond_slave_1) [ 114.901742][ T6113] bond0: ARP target 192.168.1.1 is already present [ 114.901782][ T6113] bond0: option arp_ip_target: invalid value (+192.168.1.1) [ 114.949548][ T6113] bond0: (slave bond_slave_0): making interface the new active one [ 114.951493][ T6113] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 115.001491][ T6113] 8021q: adding VLAN 0 to HW filter on device bond0 [ 115.119641][ T10] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000404. ret = -EPROTO [ 115.119718][ T10] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 115.148717][ T10] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 115.168178][ T10] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 115.197103][ T10] usb 1-1: USB disconnect, device number 2 [ 115.446034][ T1151] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 115.456690][ T1151] bond0: now running without any active interface! [ 116.553104][ T6129] NFSD: Unable to initialize client recovery tracking! (-110) [ 116.553130][ T6129] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 116.553149][ T6129] NFSD: starting 10-second grace period (net f00003cc) [ 116.852985][ T30] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 117.007567][ T30] usb 1-1: New USB device found, idVendor=0846, idProduct=1001, bcdDevice= 1.00 [ 117.008918][ T30] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 117.008968][ T30] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 117.010764][ T6140] svc: failed to register nfsdv3 RPC service (errno 111). [ 117.012745][ T6140] svc: failed to register nfsaclv3 RPC service (errno 512). [ 117.012800][ T6140] failed to unregister tcp with rpcbind [ 117.020505][ T30] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.020542][ T30] usb 1-1: Product: syz [ 117.020568][ T30] usb 1-1: Manufacturer: syz [ 117.020593][ T30] usb 1-1: SerialNumber: syz [ 117.028979][ T6140] svc: failed to register nfsdv3 RPC service (errno 97). [ 117.029011][ T6140] svc: failed to register nfsaclv3 RPC service (errno 97). [ 117.029043][ T6140] failed to unregister tcp with rpcbind [ 117.331353][ T30] kaweth 1-1:1.0: Firmware present in device. [ 117.460909][ T6182] null_blk: nullb1: using native zone append [ 117.543279][ T6185] nvmet: adding nsid 1 to subsystem testsubsys [ 117.584332][ T6185] nvmet: failed to open block device /dev/nullb1: (-2) [ 117.609433][ T30] kaweth 1-1:1.0: Error reading configuration (-71), no net device created [ 117.609674][ T30] kaweth 1-1:1.0: probe with driver kaweth failed with error -5 [ 117.666573][ T30] usb 1-1: USB disconnect, device number 3 [ 117.758853][ T6182] null_blk: disk nullb1 created [ 117.871006][ T12] nvmet: Created nvm controller 1 for subsystem testsubsys for NQN nqn.2014-08.org.nvmexpress:uuid:57cb6dbc-c2a9-4c4b-b11c-369166444a7a. [ 117.917460][ T6185] nvme nvme0: creating 2 I/O queues. [ 117.928009][ T6185] nvme nvme0: new ctrl: "testsubsys" [ 118.277927][ T6206] loop2: detected capacity change from 0 to 32768 [ 118.292083][ T6206] device-mapper: table: 248:2: zero-length target [ 118.292102][ T6206] device-mapper: ioctl: error adding target to table [ 118.394089][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 118.553863][ T10] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 118.558364][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.558403][ T10] usb 4-1: Product: syz [ 118.558430][ T10] usb 4-1: Manufacturer: syz [ 118.558457][ T10] usb 4-1: SerialNumber: syz [ 119.129129][ T6235] device-mapper: table: 248:2: cache: Insufficient args (-EINVAL) [ 119.129166][ T6235] device-mapper: ioctl: error adding target to table [ 119.304445][ T10] usb 4-1: failed to set cport flags for port 0 [ 119.304540][ T10] greybus greybus1: 0/0:0: failed to enable host cport: -110 [ 119.310064][ T10] es2_ap_driver 4-1:1.0: probe with driver es2_ap_driver failed with error -110 [ 121.635610][ T5739] usb 4-1: USB disconnect, device number 2 [ 126.533597][ T3272] bond0: (slave bond_slave_0): link status definitely up [ 126.533719][ T3272] bond0: (slave bond_slave_0): making interface the new active one [ 126.534512][ T3272] bond0: active interface up! [ 126.893773][ T1151] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 126.893972][ T1151] bond0: now running without any active interface! [ 128.000563][ T5622] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 128.007062][ T5622] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 128.008070][ T5622] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 128.010409][ T5622] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 128.011247][ T5622] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 128.408438][ T6268] lo speed is unknown, defaulting to 1000 [ 128.876608][ T6268] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.876752][ T6268] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.876875][ T6268] bridge_slave_0: entered allmulticast mode [ 128.878589][ T6268] bridge_slave_0: entered promiscuous mode [ 128.882169][ T6268] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.882337][ T6268] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.882480][ T6268] bridge_slave_1: entered allmulticast mode [ 128.884908][ T6268] bridge_slave_1: entered promiscuous mode [ 128.937119][ T6268] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 128.940293][ T6268] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 128.975808][ T6268] team0: Port device team_slave_0 added [ 128.978604][ T6268] team0: Port device team_slave_1 added [ 129.012742][ T6268] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 129.012767][ T6268] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 129.012804][ T6268] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 129.017067][ T6268] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 129.017088][ T6268] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 129.017132][ T6268] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 129.108092][ T6268] hsr_slave_0: entered promiscuous mode [ 129.109147][ T6268] hsr_slave_1: entered promiscuous mode [ 129.109779][ T6268] debugfs: 'hsr0' already exists in 'hsr' [ 129.109813][ T6268] Cannot create hsr debugfs directory [ 129.299582][ T6268] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 129.305580][ T6268] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 129.306595][ T6268] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 129.315983][ T6268] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 129.319994][ T6268] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 129.335120][ T6268] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 129.336421][ T6268] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 129.348555][ T6268] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 129.384945][ T6268] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.385050][ T6268] bridge0: port 2(bridge_slave_1) entered forwarding state [ 129.385548][ T6268] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.385676][ T6268] bridge0: port 1(bridge_slave_0) entered forwarding state [ 129.457683][ T6268] 8021q: adding VLAN 0 to HW filter on device bond0 [ 129.479448][ T1151] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.482539][ T1151] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.503492][ T6268] 8021q: adding VLAN 0 to HW filter on device team0 [ 129.511449][ T3272] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.511561][ T3272] bridge0: port 1(bridge_slave_0) entered forwarding state [ 129.535066][ T1151] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.535193][ T1151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 130.033222][ T5622] Bluetooth: hci6: command tx timeout [ 130.037450][ T6268] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 130.342025][ T6268] veth0_vlan: entered promiscuous mode [ 130.359546][ T6268] veth1_vlan: entered promiscuous mode [ 130.396677][ T6268] veth0_macvtap: entered promiscuous mode [ 130.401022][ T6268] veth1_macvtap: entered promiscuous mode [ 130.419935][ T6268] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 130.439455][ T6268] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 130.475048][ T1151] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.537587][ T1151] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 130.537615][ T1151] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 130.543080][ T13] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.544192][ T13] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.562467][ T49] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 130.600803][ T1151] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 130.600834][ T1151] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 130.708123][ T6311] PM: suspend entry (deep) [ 130.943981][ T12] bond0: (slave bond_slave_0): link status definitely up [ 130.944100][ T12] bond0: (slave bond_slave_0): making interface the new active one [ 130.945445][ T12] bond0: active interface up! [ 131.344694][ T160] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 131.344864][ T160] bond0: now running without any active interface! [ 132.123050][ T5622] Bluetooth: hci6: command tx timeout [ 132.206706][ T1306] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.206804][ T1306] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.579355][ T52] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 132.583681][ T52] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 132.591491][ T52] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 132.593956][ T52] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 132.594788][ T52] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 133.086745][ T6323] lo speed is unknown, defaulting to 1000 [ 133.563995][ T5622] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 133.569246][ T5622] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 133.570232][ T5622] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 133.571601][ T5622] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 133.580857][ T5622] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 133.734348][ T6323] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.734564][ T6323] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.734915][ T6323] bridge_slave_0: entered allmulticast mode [ 133.737248][ T6323] bridge_slave_0: entered promiscuous mode [ 133.749571][ T6323] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.749762][ T6323] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.749915][ T6323] bridge_slave_1: entered allmulticast mode [ 133.761144][ T6323] bridge_slave_1: entered promiscuous mode [ 133.835407][ T6323] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 133.839125][ T6323] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 133.909869][ T6323] team0: Port device team_slave_0 added [ 133.921993][ T6323] team0: Port device team_slave_1 added [ 133.959960][ T6323] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 133.959986][ T6323] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 133.960031][ T6323] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 133.962285][ T6323] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 133.962313][ T6323] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 133.962359][ T6323] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 134.127506][ T6323] hsr_slave_0: entered promiscuous mode [ 134.128617][ T6323] hsr_slave_1: entered promiscuous mode [ 134.129494][ T6323] debugfs: 'hsr0' already exists in 'hsr' [ 134.129521][ T6323] Cannot create hsr debugfs directory [ 134.193897][ T5622] Bluetooth: hci6: command tx timeout [ 134.245820][ T6343] lo speed is unknown, defaulting to 1000 [ 134.524215][ T6323] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 134.560582][ T6323] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 134.561742][ T6323] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 134.605231][ T6323] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 134.608672][ T6323] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 134.642482][ T6323] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 134.647402][ T6323] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 134.670050][ T6323] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 134.676488][ T5622] Bluetooth: hci7: command tx timeout [ 134.770913][ T52] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 134.772856][ T52] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 134.773763][ T52] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 134.775518][ T52] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 134.778536][ T52] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 134.888567][ T5622] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 134.891355][ T5622] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 134.901408][ T5622] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 134.926335][ T5622] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 134.927051][ T5622] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 135.229518][ T6323] 8021q: adding VLAN 0 to HW filter on device bond0 [ 135.285566][ T6323] 8021q: adding VLAN 0 to HW filter on device team0 [ 135.331147][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 135.331272][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 135.375470][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 135.375597][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 135.636822][ T5622] Bluetooth: hci8: command tx timeout [ 135.660334][ T6343] bridge0: port 1(bridge_slave_0) entered blocking state [ 135.660506][ T6343] bridge0: port 1(bridge_slave_0) entered disabled state [ 135.660672][ T6343] bridge_slave_0: entered allmulticast mode [ 135.676601][ T6343] bridge_slave_0: entered promiscuous mode [ 135.707901][ T6343] bridge0: port 2(bridge_slave_1) entered blocking state [ 135.708048][ T6343] bridge0: port 2(bridge_slave_1) entered disabled state [ 135.708211][ T6343] bridge_slave_1: entered allmulticast mode [ 135.711265][ T6343] bridge_slave_1: entered promiscuous mode [ 135.756378][ T6365] lo speed is unknown, defaulting to 1000 [ 135.831234][ T6343] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 135.848261][ T6343] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 135.969258][ T6343] team0: Port device team_slave_0 added [ 135.972623][ T6343] team0: Port device team_slave_1 added [ 136.043998][ T6343] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 136.044025][ T6343] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 136.044070][ T6343] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 136.046923][ T6343] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 136.046945][ T6343] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 136.046990][ T6343] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 136.207559][ T6343] hsr_slave_0: entered promiscuous mode [ 136.210269][ T6343] hsr_slave_1: entered promiscuous mode [ 136.212634][ T6343] debugfs: 'hsr0' already exists in 'hsr' [ 136.212662][ T6343] Cannot create hsr debugfs directory [ 136.274021][ T5622] Bluetooth: hci6: command tx timeout [ 136.448238][ T6368] lo speed is unknown, defaulting to 1000 [ 136.754437][ T5622] Bluetooth: hci7: command tx timeout [ 136.790337][ T6323] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 136.843411][ T5622] Bluetooth: hci9: command tx timeout [ 136.995967][ T5622] Bluetooth: hci10: command tx timeout [ 137.161479][ T52] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 137.164206][ T52] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 137.164849][ T52] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 137.166240][ T52] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 137.167246][ T52] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 137.258099][ T6343] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 137.273183][ T6343] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 137.283735][ T6343] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 137.302219][ T6343] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 137.322545][ T6343] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 137.338943][ T6343] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 137.365046][ T6343] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 137.385587][ T6343] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 137.677415][ T6365] bridge0: port 1(bridge_slave_0) entered blocking state [ 137.677620][ T6365] bridge0: port 1(bridge_slave_0) entered disabled state [ 137.677807][ T6365] bridge_slave_0: entered allmulticast mode [ 137.679871][ T6365] bridge_slave_0: entered promiscuous mode [ 137.714366][ T5622] Bluetooth: hci8: command tx timeout [ 137.737050][ T6365] bridge0: port 2(bridge_slave_1) entered blocking state [ 137.737835][ T6365] bridge0: port 2(bridge_slave_1) entered disabled state [ 137.738015][ T6365] bridge_slave_1: entered allmulticast mode [ 137.740218][ T6365] bridge_slave_1: entered promiscuous mode [ 137.876891][ T6365] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 137.912275][ T6365] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 138.044376][ T6365] team0: Port device team_slave_0 added [ 138.083013][ T6365] team0: Port device team_slave_1 added [ 138.104200][ T6323] veth0_vlan: entered promiscuous mode [ 138.147823][ T6365] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 138.147847][ T6365] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 138.147888][ T6365] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 138.209376][ T6365] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 138.209399][ T6365] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 138.209440][ T6365] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 138.210071][ T6409] lo speed is unknown, defaulting to 1000 [ 138.385665][ T6368] bridge0: port 1(bridge_slave_0) entered blocking state [ 138.385875][ T6368] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.386305][ T6368] bridge_slave_0: entered allmulticast mode [ 138.391131][ T6368] bridge_slave_0: entered promiscuous mode [ 138.422396][ T6323] veth1_vlan: entered promiscuous mode [ 138.439792][ T6365] hsr_slave_0: entered promiscuous mode [ 138.440942][ T6365] hsr_slave_1: entered promiscuous mode [ 138.441752][ T6365] debugfs: 'hsr0' already exists in 'hsr' [ 138.441779][ T6365] Cannot create hsr debugfs directory [ 138.442517][ T6368] bridge0: port 2(bridge_slave_1) entered blocking state [ 138.474321][ T6368] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.474528][ T6368] bridge_slave_1: entered allmulticast mode [ 138.492553][ T6368] bridge_slave_1: entered promiscuous mode [ 138.538430][ T6368] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 138.574461][ T6368] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 138.675671][ T6368] team0: Port device team_slave_0 added [ 138.704280][ T6368] team0: Port device team_slave_1 added [ 138.768884][ T6343] 8021q: adding VLAN 0 to HW filter on device bond0 [ 138.794039][ T6368] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 138.794079][ T6368] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 138.794124][ T6368] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 138.836525][ T5622] Bluetooth: hci7: command tx timeout [ 138.838868][ T6368] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 138.838890][ T6368] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 138.838934][ T6368] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 138.913333][ T5622] Bluetooth: hci9: command tx timeout [ 138.959226][ T6323] veth0_macvtap: entered promiscuous mode [ 139.019526][ T6368] hsr_slave_0: entered promiscuous mode [ 139.020426][ T6368] hsr_slave_1: entered promiscuous mode [ 139.021091][ T6368] debugfs: 'hsr0' already exists in 'hsr' [ 139.021118][ T6368] Cannot create hsr debugfs directory [ 139.025812][ T6343] 8021q: adding VLAN 0 to HW filter on device team0 [ 139.043641][ T6323] veth1_macvtap: entered promiscuous mode [ 139.083302][ T5622] Bluetooth: hci10: command tx timeout [ 139.114606][ T3272] bridge0: port 1(bridge_slave_0) entered blocking state [ 139.114720][ T3272] bridge0: port 1(bridge_slave_0) entered forwarding state [ 139.237947][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 139.238058][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 139.244188][ T5622] Bluetooth: hci11: command tx timeout [ 139.305401][ T6365] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 139.318955][ T6365] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 139.329661][ T6323] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 139.360575][ T6365] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 139.365265][ T6365] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 139.385411][ T6323] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 139.408367][ T6365] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 139.411824][ T6365] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 139.460012][ T6365] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 139.465244][ T6365] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 139.672710][ T6368] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.686625][ T6409] bridge0: port 1(bridge_slave_0) entered blocking state [ 139.686749][ T6409] bridge0: port 1(bridge_slave_0) entered disabled state [ 139.686909][ T6409] bridge_slave_0: entered allmulticast mode [ 139.688630][ T6409] bridge_slave_0: entered promiscuous mode [ 139.692178][ T6409] bridge0: port 2(bridge_slave_1) entered blocking state [ 139.692294][ T6409] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.692789][ T6409] bridge_slave_1: entered allmulticast mode [ 139.697828][ T6409] bridge_slave_1: entered promiscuous mode [ 139.729597][ T3272] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.793630][ T5622] Bluetooth: hci8: command tx timeout [ 139.850819][ T6368] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.880014][ T6409] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 139.917585][ T6409] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 139.944295][ T80] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 139.977327][ T6409] team0: Port device team_slave_0 added [ 140.009749][ T6368] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.031070][ T6409] team0: Port device team_slave_1 added [ 140.102916][ T6409] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 140.102939][ T6409] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 140.102985][ T6409] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 140.126018][ T3272] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.129315][ T37] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 140.176951][ T6368] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 140.198539][ T6409] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 140.198561][ T6409] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 140.198606][ T6409] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 140.216348][ T3272] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 140.216375][ T3272] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 140.404985][ T6409] hsr_slave_0: entered promiscuous mode [ 140.407841][ T6409] hsr_slave_1: entered promiscuous mode [ 140.408687][ T6409] debugfs: 'hsr0' already exists in 'hsr' [ 140.408713][ T6409] Cannot create hsr debugfs directory [ 140.409491][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 140.409517][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 140.771698][ T6368] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 140.792218][ T6368] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 140.820765][ T6368] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 140.830767][ T6368] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 140.907710][ T6365] 8021q: adding VLAN 0 to HW filter on device bond0 [ 140.909948][ T6368] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 140.917859][ T5622] Bluetooth: hci7: command tx timeout [ 140.922646][ T6368] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 140.926266][ T6368] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 140.940516][ T6368] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 140.950418][ T6343] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 141.003644][ T5622] Bluetooth: hci9: command tx timeout [ 141.147074][ T6365] 8021q: adding VLAN 0 to HW filter on device team0 [ 141.163682][ T5622] Bluetooth: hci10: command tx timeout [ 141.199081][ T6409] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.260277][ T3272] bridge0: port 1(bridge_slave_0) entered blocking state [ 141.260403][ T3272] bridge0: port 1(bridge_slave_0) entered forwarding state [ 141.313302][ T5622] Bluetooth: hci11: command tx timeout [ 141.350900][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 141.351027][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 141.396643][ T6483] bonding: bond0 is being created... [ 141.400973][ T6483] bonding: bond0 already exists [ 141.469367][ T6409] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.487716][ T6482] bond0: (slave bond_slave_0): Releasing backup interface [ 141.608176][ T6409] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.687032][ T6409] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 141.883825][ T5622] Bluetooth: hci8: command tx timeout [ 141.927093][ T6368] 8021q: adding VLAN 0 to HW filter on device bond0 [ 142.027305][ T6343] veth0_vlan: entered promiscuous mode [ 142.086724][ T6368] 8021q: adding VLAN 0 to HW filter on device team0 [ 142.133531][ T6343] veth1_vlan: entered promiscuous mode [ 142.161108][ T3272] bridge0: port 1(bridge_slave_0) entered blocking state [ 142.161240][ T3272] bridge0: port 1(bridge_slave_0) entered forwarding state [ 142.285540][ T6409] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 142.292224][ T6409] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 142.340396][ T6409] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 142.361781][ T6409] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 142.374446][ T3272] bridge0: port 2(bridge_slave_1) entered blocking state [ 142.374568][ T3272] bridge0: port 2(bridge_slave_1) entered forwarding state [ 142.388189][ T6409] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 142.411551][ T6409] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 142.419986][ T6409] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 142.446976][ T6409] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 142.578541][ T6501] lo speed is unknown, defaulting to 1000 [ 142.880296][ T6343] veth0_macvtap: entered promiscuous mode [ 142.968023][ T6343] veth1_macvtap: entered promiscuous mode [ 143.076506][ T5622] Bluetooth: hci9: command tx timeout [ 143.185897][ T6343] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 143.233929][ T5622] Bluetooth: hci10: command tx timeout [ 143.257634][ T6343] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 143.398713][ T5622] Bluetooth: hci11: command tx timeout [ 143.535281][ T49] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 143.661003][ T37] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 143.695186][ T3326] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 143.779829][ T3326] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 143.797754][ T6409] 8021q: adding VLAN 0 to HW filter on device bond0 [ 143.837162][ T6365] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 144.056749][ T3272] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 144.056781][ T3272] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 144.090191][ T6409] 8021q: adding VLAN 0 to HW filter on device team0 [ 144.180723][ T145] bridge0: port 1(bridge_slave_0) entered blocking state [ 144.180866][ T145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 144.209748][ T145] bridge0: port 2(bridge_slave_1) entered blocking state [ 144.209888][ T145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 144.440948][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 144.440979][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 144.824769][ T6368] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 145.057960][ T6365] veth0_vlan: entered promiscuous mode [ 145.094864][ T6365] veth1_vlan: entered promiscuous mode [ 145.298165][ T6365] veth0_macvtap: entered promiscuous mode [ 145.314258][ T6365] veth1_macvtap: entered promiscuous mode [ 145.374243][ T30] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 145.399219][ T6365] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 145.423858][ T6365] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 145.474324][ T5622] Bluetooth: hci11: command tx timeout [ 145.516964][ T12] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 145.517037][ T12] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 145.528315][ T30] usb 9-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 145.539842][ T30] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 145.539880][ T30] usb 9-1: Product: syz [ 145.539906][ T30] usb 9-1: Manufacturer: syz [ 145.539932][ T30] usb 9-1: SerialNumber: syz [ 145.724678][ T3272] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 145.908131][ T3326] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.040597][ T3272] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 146.040627][ T3272] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 146.215733][ T6573] null_blk: rnullb0: using native zone append [ 146.273389][ T3272] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 146.273420][ T3272] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 146.369614][ T30] usb 9-1: failed to set cport flags for port 0 [ 146.369711][ T30] greybus greybus1: 0/0:0: failed to enable host cport: -110 [ 146.402834][ T6573] null_blk: disk rnullb0 created [ 146.405696][ T30] es2_ap_driver 9-1:1.0: probe with driver es2_ap_driver failed with error -110 [ 146.439806][ T6368] veth0_vlan: entered promiscuous mode [ 146.477597][ T6368] veth1_vlan: entered promiscuous mode [ 146.512816][ T52] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 146.521485][ T52] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 146.528832][ T52] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 146.536880][ T52] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 146.540321][ T52] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 146.807972][ T6368] veth0_macvtap: entered promiscuous mode [ 146.848753][ T6368] veth1_macvtap: entered promiscuous mode [ 146.905859][ T6368] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 146.910659][ T6368] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 147.025758][ T80] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 147.059722][ T6409] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 147.092604][ T3326] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 147.092799][ T3326] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 147.154221][ T5776] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 147.314888][ T5776] usb 8-1: New USB device found, idVendor=0572, idProduct=58a6, bcdDevice= 0.01 [ 147.317195][ T5776] usb 8-1: config 1 interface 1 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 147.317257][ T5776] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.392724][ T5776] cx231xx 8-1:1.1: New device @ 480 Mbps (0572:58a6) with 2 interfaces [ 147.474813][ T3326] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 147.474853][ T3326] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 147.503561][ T5731] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 147.516488][ T5776] cx231xx 8-1:1.1: Failed to read PCB config [ 147.516620][ T5776] cx231xx 8-1:1.1: probe with driver cx231xx failed with error -110 [ 147.625481][ T160] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 147.625513][ T160] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 147.655457][ T5731] usb 10-1: New USB device found, idVendor=09c0, idProduct=0202, bcdDevice= 0.01 [ 147.657126][ T5731] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.658783][ T6409] veth0_vlan: entered promiscuous mode [ 147.664257][ T37] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 147.691248][ T30] usb 8-1: USB disconnect, device number 2 [ 147.722511][ T6409] veth1_vlan: entered promiscuous mode [ 147.744752][ T5731] dvb-usb: found a 'Genpix 8PSK-to-USB2 Rev.2 DVB-S receiver' in warm state. [ 147.811067][ T6409] veth0_macvtap: entered promiscuous mode [ 147.839428][ T6409] veth1_macvtap: entered promiscuous mode [ 147.969403][ T6409] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 148.018137][ T6409] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 148.133712][ T80] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 148.157288][ T6583] lo speed is unknown, defaulting to 1000 [ 148.201689][ T80] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 148.281158][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 148.351436][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 148.540044][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 148.540076][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 148.594920][ T5622] Bluetooth: hci12: command tx timeout [ 148.677890][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 148.677922][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 148.742644][ T5754] usb 9-1: USB disconnect, device number 2 [ 148.958208][ T6622] nvme_tcp: queue 0: data digest mismatch host: disabled ctrl: enabled [ 148.995992][ T5731] gp8psk: usb in 128 operation failed. [ 148.997104][ T5731] gp8psk: usb in 137 operation failed. [ 148.997126][ T5731] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 148.999786][ T5731] dvbdev: DVB: registering new adapter (Genpix 8PSK-to-USB2 Rev.2 DVB-S receiver) [ 148.999862][ T5731] usb 10-1: media controller created [ 149.204380][ T5731] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 149.287921][ T6617] rdma_rxe: rxe_newlink: failed to add lo [ 149.368369][ T5731] gp8psk_fe: Frontend attached [ 149.368604][ T5731] usb 10-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)... [ 149.382020][ T5731] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered. [ 149.518112][ T6633] device-mapper: table: 248:3: zero-length target [ 149.518136][ T6633] device-mapper: ioctl: error adding target to table [ 149.651579][ T6639] bonding: bond0 is being deleted... [ 149.725624][ T5731] gp8psk: usb in 138 operation failed. [ 149.725647][ T5731] dvb-usb: Genpix 8PSK-to-USB2 Rev.2 DVB-S receiver successfully initialized and connected. [ 149.725668][ T5731] gp8psk: found Genpix USB device pID = 202 (hex) [ 149.726803][ T6644] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 149.746405][ T5731] usb 10-1: USB disconnect, device number 2 [ 149.830697][ T6639] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 149.870465][ T6639] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 149.879332][ T6644] md: could not open device unknown-block(1,0). [ 149.891673][ T6639] bond0 (unregistering): Released all slaves [ 149.998493][ T6642] bonding: bond0 is being created... [ 150.100878][ T5731] dvb-usb: Genpix 8PSK-to-USB2 Rev.2 DVB-S receive successfully deinitialized and disconnected. [ 150.439332][ T5731] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 150.503023][ T1229] usb 8-1: new low-speed USB device number 3 using dummy_hcd [ 150.529822][ T6583] bridge0: port 1(bridge_slave_0) entered blocking state [ 150.529954][ T6583] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.530069][ T6583] bridge_slave_0: entered allmulticast mode [ 150.531889][ T6583] bridge_slave_0: entered promiscuous mode [ 150.536480][ T6583] bridge0: port 2(bridge_slave_1) entered blocking state [ 150.536602][ T6583] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.536751][ T6583] bridge_slave_1: entered allmulticast mode [ 150.538958][ T6583] bridge_slave_1: entered promiscuous mode [ 150.604974][ T5731] usb 10-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00 [ 150.606783][ T5731] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 150.606838][ T5731] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 150.606882][ T5731] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 150.609108][ T6583] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 150.610771][ T5731] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 150.610809][ T5731] usb 10-1: Product: syz [ 150.610843][ T5731] usb 10-1: Manufacturer: syz [ 150.613418][ T6583] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 150.649740][ T6583] team0: Port device team_slave_0 added [ 150.653375][ T6583] team0: Port device team_slave_1 added [ 150.676983][ T5622] Bluetooth: hci12: command tx timeout [ 150.696626][ T1229] usb 8-1: Invalid ep0 maxpacket: 64 [ 150.724349][ T6648] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 150.725924][ T6648] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 150.726103][ T6648] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 150.731946][ T6583] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 150.731968][ T6583] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 150.732013][ T6583] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 150.737910][ T6583] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 150.737931][ T6583] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 150.737976][ T6583] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 150.826773][ T6583] hsr_slave_0: entered promiscuous mode [ 150.828041][ T6583] hsr_slave_1: entered promiscuous mode [ 150.828849][ T6583] debugfs: 'hsr0' already exists in 'hsr' [ 150.828876][ T6583] Cannot create hsr debugfs directory [ 150.853264][ T1229] usb 8-1: new low-speed USB device number 4 using dummy_hcd [ 151.023180][ T1229] usb 8-1: Invalid ep0 maxpacket: 64 [ 151.025532][ T1229] usb usb8-port1: attempt power cycle [ 151.080351][ T6583] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.168128][ T6583] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.246772][ T6583] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.299847][ T6583] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.365917][ T1229] usb 8-1: new low-speed USB device number 5 using dummy_hcd [ 151.414528][ T1229] usb 8-1: Invalid ep0 maxpacket: 64 [ 151.450381][ T6583] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 151.455639][ T6583] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 151.458132][ T6583] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 151.471161][ T6583] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 151.480856][ T6583] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 151.497234][ T6583] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 151.498669][ T6583] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 151.503549][ T6583] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 151.546505][ T1229] usb 8-1: new low-speed USB device number 6 using dummy_hcd [ 151.564913][ T1229] usb 8-1: Invalid ep0 maxpacket: 64 [ 151.565465][ T1229] usb usb8-port1: unable to enumerate USB device [ 151.622442][ T6583] 8021q: adding VLAN 0 to HW filter on device bond0 [ 151.652320][ T6583] 8021q: adding VLAN 0 to HW filter on device team0 [ 151.667786][ T3326] bridge0: port 1(bridge_slave_0) entered blocking state [ 151.667896][ T3326] bridge0: port 1(bridge_slave_0) entered forwarding state [ 151.681109][ T145] bridge0: port 2(bridge_slave_1) entered blocking state [ 151.681253][ T145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 151.948947][ T5731] redrat3 10-1:1.0: Firmware rev:  [ 152.253040][ T5731] rc_core: IR keymap rc-hauppauge not found [ 152.253065][ T5731] Registered IR keymap rc-empty [ 152.363291][ T5731] rc rc0: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/rc/rc0 [ 152.368315][ T5731] input: RedRat3 Infrared Remote Transceiver as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/rc/rc0/input5 [ 152.371678][ T6583] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 152.754699][ T5622] Bluetooth: hci12: command tx timeout [ 152.762831][ T5731] redrat3 10-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0 [ 152.763164][ T5731] redrat3 10-1:1.0: redrat3_enable_detector: detector status: -5, should be 1 [ 152.807632][ T5731] redrat3 10-1:1.0: probe with driver redrat3 failed with error -5 [ 152.830989][ T5731] usb 10-1: USB disconnect, device number 3 [ 152.845292][ T6270] ================================================================== [ 152.845312][ T6270] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 152.845371][ T6270] Read of size 1 at addr ffff88807cd92758 by task udevd/6270 [ 152.845400][ T6270] [ 152.845414][ T6270] CPU: 1 UID: 0 PID: 6270 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 152.845458][ T6270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 152.845480][ T6270] Call Trace: [ 152.845492][ T6270] [ 152.845506][ T6270] dump_stack_lvl+0x100/0x190 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 152.845559][ T6270] print_report+0x13d/0x4b0 [ 152.845617][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.845665][ T6270] ? __virt_addr_valid+0x239/0x430 [ 152.845738][ T6270] ? string+0x471/0x4d0 [ 152.845787][ T6270] kasan_report+0xdf/0x1c0 [ 152.845826][ T6270] ? string+0x471/0x4d0 [ 152.845889][ T6270] string+0x471/0x4d0 [ 152.845942][ T6270] ? __pfx_string+0x10/0x10 [ 152.845991][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.846040][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.846086][ T6270] ? kasan_save_stack+0x3f/0x50 [ 152.846144][ T6270] ? kasan_save_stack+0x30/0x50 [ 152.846209][ T6270] vsnprintf+0x422/0x1300 [ 152.846271][ T6270] ? __pfx_vsnprintf+0x10/0x10 [ 152.846329][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.846380][ T6270] vscnprintf+0x40/0x90 [ 152.846437][ T6270] sysfs_emit+0x165/0x180 [ 152.846497][ T6270] ? __pfx_sysfs_emit+0x10/0x10 [ 152.846557][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.846603][ T6270] ? lock_acquire+0x1d1/0x380 [ 152.846639][ T6270] ? sysfs_file_kobj+0x21/0x290 [ 152.846699][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.846745][ T6270] ? find_held_lock+0x2b/0x80 [ 152.846796][ T6270] ? sysfs_file_kobj+0xe4/0x290 [ 152.846867][ T6270] ? __pfx_input_dev_show_name+0x10/0x10 [ 152.846931][ T6270] input_dev_show_name+0x5b/0x70 [ 152.846989][ T6270] dev_attr_show+0x52/0xa0 [ 152.847050][ T6270] ? __pfx_dev_attr_show+0x10/0x10 [ 152.847109][ T6270] sysfs_kf_seq_show+0x217/0x3f0 [ 152.847149][ T6270] seq_read_iter+0x32f/0x1270 [ 152.847220][ T6270] kernfs_fop_read_iter+0x46c/0x610 [ 152.847277][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.847323][ T6270] ? rw_verify_area+0xce/0x6d0 [ 152.847370][ T6270] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 152.847429][ T6270] vfs_read+0x82e/0xb40 [ 152.847485][ T6270] ? __pfx_vfs_read+0x10/0x10 [ 152.847538][ T6270] ? __pfx_do_sys_openat2+0x10/0x10 [ 152.847593][ T6270] ksys_read+0x12a/0x250 [ 152.847644][ T6270] ? __pfx_ksys_read+0x10/0x10 [ 152.847699][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.847749][ T6270] do_syscall_64+0x123/0x790 [ 152.847812][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.847860][ T6270] RIP: 0033:0x7f21672a7407 [ 152.847888][ T6270] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 152.847925][ T6270] RSP: 002b:00007ffe2dc1dbb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 152.847966][ T6270] RAX: ffffffffffffffda RBX: 00007f21679c2880 RCX: 00007f21672a7407 [ 152.847995][ T6270] RDX: 0000000000001000 RSI: 00007ffe2dc1e090 RDI: 0000000000000008 [ 152.848020][ T6270] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 152.848043][ T6270] R10: 0000000000000000 R11: 0000000000000202 R12: 000055816fd9cc10 [ 152.848068][ T6270] R13: 00007ffe2dc1dc90 R14: 00007ffe2dc1e090 R15: 000055815110bbcc [ 152.848107][ T6270] [ 152.848120][ T6270] [ 152.848129][ T6270] Allocated by task 5731: [ 152.848146][ T6270] kasan_save_stack+0x30/0x50 [ 152.848202][ T6270] kasan_save_track+0x14/0x30 [ 152.848257][ T6270] __kasan_kmalloc+0xaa/0xb0 [ 152.848310][ T6270] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 152.848356][ T6270] redrat3_dev_probe+0x326/0x2b50 [ 152.848394][ T6270] usb_probe_interface+0x386/0x9b0 [ 152.848432][ T6270] really_probe+0x241/0xa60 [ 152.848479][ T6270] __driver_probe_device+0x210/0x460 [ 152.848530][ T6270] driver_probe_device+0x4a/0x140 [ 152.848582][ T6270] __device_attach_driver+0x1df/0x320 [ 152.848632][ T6270] bus_for_each_drv+0x159/0x1e0 [ 152.848669][ T6270] __device_attach+0x1e4/0x4d0 [ 152.848717][ T6270] device_initial_probe+0xaf/0xd0 [ 152.848767][ T6270] bus_probe_device+0x64/0x160 [ 152.848808][ T6270] device_add+0x121d/0x1970 [ 152.848870][ T6270] usb_set_configuration+0xd97/0x1c60 [ 152.848927][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 152.848975][ T6270] usb_probe_device+0xef/0x400 [ 152.849009][ T6270] really_probe+0x241/0xa60 [ 152.849054][ T6270] __driver_probe_device+0x210/0x460 [ 152.849103][ T6270] driver_probe_device+0x4a/0x140 [ 152.849151][ T6270] __device_attach_driver+0x1df/0x320 [ 152.849199][ T6270] bus_for_each_drv+0x159/0x1e0 [ 152.849235][ T6270] __device_attach+0x1e4/0x4d0 [ 152.849283][ T6270] device_initial_probe+0xaf/0xd0 [ 152.849331][ T6270] bus_probe_device+0x64/0x160 [ 152.849372][ T6270] device_add+0x121d/0x1970 [ 152.849424][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 152.849474][ T6270] hub_event.cold+0x1e3/0xe90 [ 152.849522][ T6270] process_one_work+0xac7/0x1b10 [ 152.849573][ T6270] worker_thread+0x5ef/0xe50 [ 152.849627][ T6270] kthread+0x373/0x450 [ 152.849672][ T6270] ret_from_fork+0x730/0xd60 [ 152.849705][ T6270] ret_from_fork_asm+0x1a/0x30 [ 152.849738][ T6270] [ 152.849746][ T6270] Freed by task 5731: [ 152.849763][ T6270] kasan_save_stack+0x30/0x50 [ 152.849817][ T6270] kasan_save_track+0x14/0x30 [ 152.849879][ T6270] kasan_save_free_info+0x3b/0x70 [ 152.849922][ T6270] __kasan_slab_free+0x5f/0x80 [ 152.849979][ T6270] kfree+0x22b/0x6d0 [ 152.850019][ T6270] redrat3_dev_probe+0x107a/0x2b50 [ 152.850058][ T6270] usb_probe_interface+0x386/0x9b0 [ 152.850094][ T6270] really_probe+0x241/0xa60 [ 152.850144][ T6583] veth0_vlan: entered promiscuous mode [ 152.850140][ T6270] __driver_probe_device+0x210/0x460 [ 152.850193][ T6270] driver_probe_device+0x4a/0x140 [ 152.850241][ T6270] __device_attach_driver+0x1df/0x320 [ 152.850291][ T6270] bus_for_each_drv+0x159/0x1e0 [ 152.850328][ T6270] __device_attach+0x1e4/0x4d0 [ 152.850376][ T6270] device_initial_probe+0xaf/0xd0 [ 152.850427][ T6270] bus_probe_device+0x64/0x160 [ 152.850468][ T6270] device_add+0x121d/0x1970 [ 152.850523][ T6270] usb_set_configuration+0xd97/0x1c60 [ 152.850579][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 152.850628][ T6270] usb_probe_device+0xef/0x400 [ 152.850659][ T6270] really_probe+0x241/0xa60 [ 152.850705][ T6270] __driver_probe_device+0x210/0x460 [ 152.850759][ T6270] driver_probe_device+0x4a/0x140 [ 152.850807][ T6270] __device_attach_driver+0x1df/0x320 [ 152.850864][ T6270] bus_for_each_drv+0x159/0x1e0 [ 152.850901][ T6270] __device_attach+0x1e4/0x4d0 [ 152.850949][ T6270] device_initial_probe+0xaf/0xd0 [ 152.851000][ T6270] bus_probe_device+0x64/0x160 [ 152.851040][ T6270] device_add+0x121d/0x1970 [ 152.851094][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 152.851144][ T6270] hub_event.cold+0x1e3/0xe90 [ 152.851192][ T6270] process_one_work+0xac7/0x1b10 [ 152.851247][ T6270] worker_thread+0x5ef/0xe50 [ 152.851297][ T6270] kthread+0x373/0x450 [ 152.851342][ T6270] ret_from_fork+0x730/0xd60 [ 152.851377][ T6270] ret_from_fork_asm+0x1a/0x30 [ 152.851410][ T6270] [ 152.851418][ T6270] The buggy address belongs to the object at ffff88807cd92000 [ 152.851418][ T6270] which belongs to the cache kmalloc-2k of size 2048 [ 152.851447][ T6270] The buggy address is located 1880 bytes inside of [ 152.851447][ T6270] freed 2048-byte region [ffff88807cd92000, ffff88807cd92800) [ 152.851483][ T6270] [ 152.851492][ T6270] The buggy address belongs to the physical page: [ 152.851506][ T6270] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7cd90 [ 152.851538][ T6270] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 152.851569][ T6270] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 152.851600][ T6270] page_type: f5(slab) [ 152.851630][ T6270] raw: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 152.851664][ T6270] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 152.851700][ T6270] head: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 152.851733][ T6270] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 152.851766][ T6270] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 152.851804][ T6270] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 152.851825][ T6270] page dumped because: kasan: bad access detected [ 152.851841][ T6270] page_owner tracks the page as allocated [ 152.851859][ T6270] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5623, tgid 5623 (syz-executor), ts 96697253716 [ 152.851918][ T6270] post_alloc_hook+0xfd/0x120 [ 152.851960][ T6270] get_page_from_freelist+0x110d/0x35d0 [ 152.852008][ T6270] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 152.852057][ T6270] new_slab+0xa9/0x6e0 [ 152.852099][ T6270] refill_objects+0xe3/0x410 [ 152.852142][ T6270] __pcs_replace_empty_main+0x35e/0x650 [ 152.852188][ T6270] __kmalloc_node_track_caller_noprof+0x6a8/0x870 [ 152.852248][ T6270] kmalloc_reserve+0xe8/0x350 [ 152.852283][ T6270] pskb_expand_head+0x249/0x10e0 [ 152.852333][ T6270] netlink_trim+0x22d/0x2f0 [ 152.852366][ T6270] netlink_broadcast_filtered+0x6d/0xf20 [ 152.852410][ T6270] nlmsg_notify+0xb1/0x290 [ 152.852454][ T6270] rtmsg_ifinfo+0x177/0x1b0 [ 152.852487][ T6270] __dev_notify_flags+0x362/0x4b0 [ 152.852534][ T6270] netif_change_flags+0x108/0x160 [ 152.852583][ T6270] do_setlink.isra.0+0x1ac4/0x3e60 [ 152.852636][ T6270] page last free pid 5362 tgid 5362 ts 61481229891 stack trace: [ 152.852660][ T6270] __free_frozen_pages+0x79f/0x10f0 [ 152.852698][ T6270] qlist_free_all+0x47/0xf0 [ 152.852746][ T6270] kasan_quarantine_reduce+0x1a0/0x1f0 [ 152.852804][ T6270] __kasan_slab_alloc+0x69/0x90 [ 152.852835][ T6270] __kmalloc_noprof+0x2cc/0x840 [ 152.852891][ T6270] tomoyo_supervisor+0x65d/0x1340 [ 152.852934][ T6270] tomoyo_path_permission+0x270/0x3b0 [ 152.852984][ T6270] tomoyo_path_perm+0x364/0x460 [ 152.853036][ T6270] security_inode_getattr+0x116/0x280 [ 152.853090][ T6270] vfs_fstat+0x4b/0xe0 [ 152.853124][ T6270] __do_sys_newfstat+0x8b/0x110 [ 152.853162][ T6270] do_syscall_64+0x123/0x790 [ 152.853222][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.853258][ T6270] [ 152.853266][ T6270] Memory state around the buggy address: [ 152.853282][ T6270] ffff88807cd92600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 152.853308][ T6270] ffff88807cd92680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 152.853333][ T6270] >ffff88807cd92700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 152.853353][ T6270] ^ [ 152.853374][ T6270] ffff88807cd92780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 152.853400][ T6270] ffff88807cd92800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 152.853420][ T6270] ================================================================== [ 152.862202][ T6270] Disabling lock debugging due to kernel taint [ 152.862218][ T6270] ================================================================== [ 152.862232][ T6270] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 152.862285][ T6270] Read of size 1 at addr ffff88807cd92759 by task udevd/6270 [ 152.862313][ T6270] [ 152.862332][ T6270] CPU: 1 UID: 0 PID: 6270 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 152.862386][ T6270] Tainted: [B]=BAD_PAGE [ 152.862401][ T6270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 152.862423][ T6270] Call Trace: [ 152.862434][ T6270] [ 152.862448][ T6270] dump_stack_lvl+0x100/0x190 [ 152.862499][ T6270] print_report+0x13d/0x4b0 [ 152.862553][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.862598][ T6270] ? __virt_addr_valid+0x239/0x430 [ 152.862659][ T6270] ? string+0x471/0x4d0 [ 152.862708][ T6270] kasan_report+0xdf/0x1c0 [ 152.862746][ T6270] ? string+0x471/0x4d0 [ 152.862798][ T6270] string+0x471/0x4d0 [ 152.862857][ T6270] ? __pfx_string+0x10/0x10 [ 152.862905][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.862951][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.862995][ T6270] ? kasan_save_stack+0x3f/0x50 [ 152.863050][ T6270] ? kasan_save_stack+0x30/0x50 [ 152.863108][ T6270] vsnprintf+0x422/0x1300 [ 152.863168][ T6270] ? __pfx_vsnprintf+0x10/0x10 [ 152.863224][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.863271][ T6270] vscnprintf+0x40/0x90 [ 152.863326][ T6270] sysfs_emit+0x165/0x180 [ 152.863383][ T6270] ? __pfx_sysfs_emit+0x10/0x10 [ 152.863441][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.863485][ T6270] ? lock_acquire+0x1d1/0x380 [ 152.863519][ T6270] ? sysfs_file_kobj+0x21/0x290 [ 152.863576][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.863620][ T6270] ? find_held_lock+0x2b/0x80 [ 152.863668][ T6270] ? sysfs_file_kobj+0xe4/0x290 [ 152.863728][ T6270] ? __pfx_input_dev_show_name+0x10/0x10 [ 152.863786][ T6270] input_dev_show_name+0x5b/0x70 [ 152.863846][ T6270] dev_attr_show+0x52/0xa0 [ 152.863905][ T6270] ? __pfx_dev_attr_show+0x10/0x10 [ 152.863962][ T6270] sysfs_kf_seq_show+0x217/0x3f0 [ 152.864000][ T6270] seq_read_iter+0x32f/0x1270 [ 152.864066][ T6270] kernfs_fop_read_iter+0x46c/0x610 [ 152.864121][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.864165][ T6270] ? rw_verify_area+0xce/0x6d0 [ 152.864210][ T6270] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 152.864267][ T6270] vfs_read+0x82e/0xb40 [ 152.864319][ T6270] ? __pfx_vfs_read+0x10/0x10 [ 152.864370][ T6270] ? __pfx_do_sys_openat2+0x10/0x10 [ 152.864421][ T6270] ksys_read+0x12a/0x250 [ 152.864471][ T6270] ? __pfx_ksys_read+0x10/0x10 [ 152.864523][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 152.864571][ T6270] do_syscall_64+0x123/0x790 [ 152.864630][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.864668][ T6270] RIP: 0033:0x7f21672a7407 [ 152.864695][ T6270] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 152.864731][ T6270] RSP: 002b:00007ffe2dc1dbb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 152.864765][ T6270] RAX: ffffffffffffffda RBX: 00007f21679c2880 RCX: 00007f21672a7407 [ 152.864791][ T6270] RDX: 0000000000001000 RSI: 00007ffe2dc1e090 RDI: 0000000000000008 [ 152.864814][ T6270] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 152.864837][ T6270] R10: 0000000000000000 R11: 0000000000000202 R12: 000055816fd9cc10 [ 152.864865][ T6270] R13: 00007ffe2dc1dc90 R14: 00007ffe2dc1e090 R15: 000055815110bbcc [ 152.864901][ T6270] [ 152.864914][ T6270] [ 152.864922][ T6270] Allocated by task 5731: [ 152.864937][ T6270] kasan_save_stack+0x30/0x50 [ 152.864990][ T6270] kasan_save_track+0x14/0x30 [ 152.865042][ T6270] __kasan_kmalloc+0xaa/0xb0 [ 152.865093][ T6270] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 152.865136][ T6270] redrat3_dev_probe+0x326/0x2b50 [ 152.865173][ T6270] usb_probe_interface+0x386/0x9b0 [ 152.865209][ T6270] really_probe+0x241/0xa60 [ 152.865254][ T6270] __driver_probe_device+0x210/0x460 [ 152.865302][ T6270] driver_probe_device+0x4a/0x140 [ 152.865348][ T6270] __device_attach_driver+0x1df/0x320 [ 152.865396][ T6270] bus_for_each_drv+0x159/0x1e0 [ 152.865432][ T6270] __device_attach+0x1e4/0x4d0 [ 152.865478][ T6270] device_initial_probe+0xaf/0xd0 [ 152.865527][ T6270] bus_probe_device+0x64/0x160 [ 152.865566][ T6270] device_add+0x121d/0x1970 [ 152.865618][ T6270] usb_set_configuration+0xd97/0x1c60 [ 152.865671][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 152.865718][ T6270] usb_probe_device+0xef/0x400 [ 152.865748][ T6270] really_probe+0x241/0xa60 [ 152.865791][ T6270] __driver_probe_device+0x210/0x460 [ 152.865838][ T6270] driver_probe_device+0x4a/0x140 [ 152.865889][ T6270] __device_attach_driver+0x1df/0x320 [ 152.865937][ T6270] bus_for_each_drv+0x159/0x1e0 [ 152.865972][ T6270] __device_attach+0x1e4/0x4d0 [ 152.866018][ T6270] device_initial_probe+0xaf/0xd0 [ 152.866066][ T6270] bus_probe_device+0x64/0x160 [ 152.866105][ T6270] device_add+0x121d/0x1970 [ 152.866157][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 152.866206][ T6270] hub_event.cold+0x1e3/0xe90 [ 152.866252][ T6270] process_one_work+0xac7/0x1b10 [ 152.866301][ T6270] worker_thread+0x5ef/0xe50 [ 152.866350][ T6270] kthread+0x373/0x450 [ 152.866393][ T6270] ret_from_fork+0x730/0xd60 [ 152.866426][ T6270] ret_from_fork_asm+0x1a/0x30 [ 152.866458][ T6270] [ 152.866466][ T6270] Freed by task 5731: [ 152.866481][ T6270] kasan_save_stack+0x30/0x50 [ 152.866533][ T6270] kasan_save_track+0x14/0x30 [ 152.866585][ T6270] kasan_save_free_info+0x3b/0x70 [ 152.866627][ T6270] __kasan_slab_free+0x5f/0x80 [ 152.866682][ T6270] kfree+0x22b/0x6d0 [ 152.866719][ T6270] redrat3_dev_probe+0x107a/0x2b50 [ 152.866756][ T6270] usb_probe_interface+0x386/0x9b0 [ 152.866791][ T6270] really_probe+0x241/0xa60 [ 152.866835][ T6270] __driver_probe_device+0x210/0x460 [ 152.866887][ T6270] driver_probe_device+0x4a/0x140 [ 152.866933][ T6270] __device_attach_driver+0x1df/0x320 [ 152.866981][ T6270] bus_for_each_drv+0x159/0x1e0 [ 152.867016][ T6270] __device_attach+0x1e4/0x4d0 ** 54 printk messages dropped ** [ 152.869116][ T6270] netif_change_flags+0x108/0x160 ** 104 printk messages dropped ** [ 152.880444][ T6270] usb_probe_device+0xef/0x400 [ 152.880474][ T6270] really_probe+0x241/0xa60 [ 152.880517][ T6270] __driver_probe_device+0x210/0x460 [ 152.880564][ T6270] driver_probe_device+0x4a/0x140 [ 152.880610][ T6270] __device_attach_driver+0x1df/0x320 [ 152.880658][ T6270] bus_for_each_drv+0x159/0x1e0 [ 152.880693][ T6270] __device_attach+0x1e4/0x4d0 ** 65 printk messages dropped ** [ 152.883242][ T6270] post_alloc_hook+0xfd/0x120 ** 117 printk messages dropped ** [ 152.891895][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 152.891942][ T6270] usb_probe_device+0xef/0x400 [ 152.891973][ T6270] really_probe+0x241/0xa60 [ 152.892017][ T6270] __driver_probe_device+0x210/0x460 [ 152.892064][ T6270] driver_probe_device+0x4a/0x140 [ 152.892111][ T6270] __device_attach_driver+0x1df/0x320 [ 152.892159][ T6270] bus_for_each_drv+0x159/0x1e0 [ 152.892194][ T6270] __device_attach+0x1e4/0x4d0 ** 34 printk messages dropped ** [ 152.893699][ T6270] __device_attach_driver+0x1df/0x320 ** 148 printk messages dropped ** [ 152.899846][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 152.899893][ T6270] usb_probe_device+0xef/0x400 [ 152.899923][ T6270] really_probe+0x241/0xa60 [ 152.899967][ T6270] __driver_probe_device+0x210/0x460 [ 152.900014][ T6270] driver_probe_device+0x4a/0x140 [ 152.900061][ T6270] __device_attach_driver+0x1df/0x320 [ 152.900109][ T6270] bus_for_each_drv+0x159/0x1e0 [ 152.900145][ T6270] __device_attach+0x1e4/0x4d0 [ 152.900191][ T6270] device_initial_probe+0xaf/0xd0 [ 152.900241][ T6270] bus_probe_device+0x64/0x160 ** 12 printk messages dropped ** [ 152.900762][ T6270] kasan_save_free_info+0x3b/0x70 ** 168 printk messages dropped ** [ 152.949383][ T6270] usb_set_configuration+0xd97/0x1c60 [ 152.949438][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 152.949485][ T6270] usb_probe_device+0xef/0x400 [ 152.949515][ T6270] really_probe+0x241/0xa60 [ 152.949559][ T6270] __driver_probe_device+0x210/0x460 [ 152.949606][ T6270] driver_probe_device+0x4a/0x140 [ 152.949653][ T6270] __device_attach_driver+0x1df/0x320 [ 152.949702][ T6270] bus_for_each_drv+0x159/0x1e0 [ 152.949738][ T6270] __device_attach+0x1e4/0x4d0 [ 152.949784][ T6270] device_initial_probe+0xaf/0xd0 ** 65 printk messages dropped ** [ 152.952368][ T6270] get_page_from_freelist+0x110d/0x35d0 ** 116 printk messages dropped ** [ 152.980354][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 152.980401][ T6270] usb_probe_device+0xef/0x400 [ 152.980431][ T6270] really_probe+0x241/0xa60 [ 152.980474][ T6270] __driver_probe_device+0x210/0x460 ** 58 printk messages dropped ** [ 152.982904][ T6270] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) ** 127 printk messages dropped ** [ 153.024647][ T6270] device_add+0x121d/0x1970 [ 153.024702][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.024759][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.024808][ T6270] usb_probe_device+0xef/0x400 [ 153.024839][ T6270] really_probe+0x241/0xa60 [ 153.024891][ T6270] __driver_probe_device+0x210/0x460 [ 153.024941][ T6270] driver_probe_device+0x4a/0x140 ** 16 printk messages dropped ** [ 153.025658][ T6270] kasan_save_track+0x14/0x30 ** 167 printk messages dropped ** [ 153.072764][ T6270] bus_probe_device+0x64/0x160 [ 153.072804][ T6270] device_add+0x121d/0x1970 [ 153.072862][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.072917][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.072964][ T6270] usb_probe_device+0xef/0x400 [ 153.072993][ T6270] really_probe+0x241/0xa60 [ 153.073038][ T6270] __driver_probe_device+0x210/0x460 [ 153.073085][ T6270] driver_probe_device+0x4a/0x140 [ 153.073132][ T6270] __device_attach_driver+0x1df/0x320 [ 153.073180][ T6270] bus_for_each_drv+0x159/0x1e0 ** 100 printk messages dropped ** [ 153.077197][ T6270] >ffff88807cd92700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ** 80 printk messages dropped ** [ 153.140296][ T6270] bus_probe_device+0x64/0x160 [ 153.140336][ T6270] device_add+0x121d/0x1970 [ 153.140389][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.140444][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.140491][ T6270] usb_probe_device+0xef/0x400 [ 153.140520][ T6270] really_probe+0x241/0xa60 [ 153.140565][ T6270] __driver_probe_device+0x210/0x460 [ 153.140612][ T6270] driver_probe_device+0x4a/0x140 [ 153.140659][ T6270] __device_attach_driver+0x1df/0x320 [ 153.140708][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.140743][ T6270] __device_attach+0x1e4/0x4d0 [ 153.140791][ T6270] device_initial_probe+0xaf/0xd0 [ 153.140840][ T6270] bus_probe_device+0x64/0x160 [ 153.140883][ T6270] device_add+0x121d/0x1970 [ 153.140935][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.140983][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.141030][ T6270] process_one_work+0xac7/0x1b10 [ 153.141079][ T6270] worker_thread+0x5ef/0xe50 [ 153.141129][ T6270] kthread+0x373/0x450 [ 153.141172][ T6270] ret_from_fork+0x730/0xd60 [ 153.141206][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.141239][ T6270] [ 153.141247][ T6270] Freed by task 5731: [ 153.141263][ T6270] kasan_save_stack+0x30/0x50 [ 153.141315][ T6270] kasan_save_track+0x14/0x30 [ 153.141367][ T6270] kasan_save_free_info+0x3b/0x70 [ 153.141410][ T6270] __kasan_slab_free+0x5f/0x80 [ 153.141465][ T6270] kfree+0x22b/0x6d0 [ 153.141502][ T6270] redrat3_dev_probe+0x107a/0x2b50 [ 153.141539][ T6270] usb_probe_interface+0x386/0x9b0 [ 153.141574][ T6270] really_probe+0x241/0xa60 [ 153.141618][ T6270] __driver_probe_device+0x210/0x460 [ 153.141665][ T6270] driver_probe_device+0x4a/0x140 [ 153.141712][ T6270] __device_attach_driver+0x1df/0x320 [ 153.141760][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.141796][ T6270] __device_attach+0x1e4/0x4d0 [ 153.141842][ T6270] device_initial_probe+0xaf/0xd0 [ 153.141897][ T6270] bus_probe_device+0x64/0x160 [ 153.141937][ T6270] device_add+0x121d/0x1970 [ 153.141989][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.142044][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.142090][ T6270] usb_probe_device+0xef/0x400 [ 153.142120][ T6270] really_probe+0x241/0xa60 [ 153.142165][ T6270] __driver_probe_device+0x210/0x460 [ 153.142212][ T6270] driver_probe_device+0x4a/0x140 [ 153.142258][ T6270] __device_attach_driver+0x1df/0x320 [ 153.142306][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.142342][ T6270] __device_attach+0x1e4/0x4d0 [ 153.142389][ T6270] device_initial_probe+0xaf/0xd0 [ 153.142438][ T6270] bus_probe_device+0x64/0x160 [ 153.142477][ T6270] device_add+0x121d/0x1970 [ 153.142529][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.142577][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.142623][ T6270] process_one_work+0xac7/0x1b10 [ 153.142673][ T6270] worker_thread+0x5ef/0xe50 [ 153.142722][ T6270] kthread+0x373/0x450 [ 153.142765][ T6270] ret_from_fork+0x730/0xd60 [ 153.142798][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.142830][ T6270] [ 153.142838][ T6270] The buggy address belongs to the object at ffff88807cd92000 [ 153.142838][ T6270] which belongs to the cache kmalloc-2k of size 2048 [ 153.142871][ T6270] The buggy address is located 1889 bytes inside of [ 153.142871][ T6270] freed 2048-byte region [ffff88807cd92000, ffff88807cd92800) [ 153.142907][ T6270] [ 153.142915][ T6270] The buggy address belongs to the physical page: [ 153.142930][ T6270] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7cd90 [ 153.142962][ T6270] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 153.142992][ T6270] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 153.143023][ T6270] page_type: f5(slab) [ 153.143053][ T6270] raw: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 153.143087][ T6270] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 153.143121][ T6270] head: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 153.143154][ T6270] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 153.143188][ T6270] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 153.143224][ T6270] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 153.143246][ T6270] page dumped because: kasan: bad access detected [ 153.143262][ T6270] page_owner tracks the page as allocated [ 153.143274][ T6270] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5623, tgid 5623 (syz-executor), ts 96697253716 [ 153.143336][ T6270] post_alloc_hook+0xfd/0x120 [ 153.143376][ T6270] get_page_from_freelist+0x110d/0x35d0 [ 153.143421][ T6270] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 153.143468][ T6270] new_slab+0xa9/0x6e0 [ 153.143509][ T6270] refill_objects+0xe3/0x410 [ 153.143553][ T6270] __pcs_replace_empty_main+0x35e/0x650 [ 153.143596][ T6270] __kmalloc_node_track_caller_noprof+0x6a8/0x870 [ 153.143651][ T6270] kmalloc_reserve+0xe8/0x350 [ 153.143686][ T6270] pskb_expand_head+0x249/0x10e0 [ 153.143734][ T6270] netlink_trim+0x22d/0x2f0 [ 153.143766][ T6270] netlink_broadcast_filtered+0x6d/0xf20 [ 153.143809][ T6270] nlmsg_notify+0xb1/0x290 [ 153.143859][ T6270] rtmsg_ifinfo+0x177/0x1b0 [ 153.143891][ T6270] __dev_notify_flags+0x362/0x4b0 [ 153.143937][ T6270] netif_change_flags+0x108/0x160 [ 153.143983][ T6270] do_setlink.isra.0+0x1ac4/0x3e60 [ 153.144036][ T6270] page last free pid 5362 tgid 5362 ts 61481229891 stack trace: [ 153.144060][ T6270] __free_frozen_pages+0x79f/0x10f0 [ 153.144097][ T6270] qlist_free_all+0x47/0xf0 [ 153.144145][ T6270] kasan_quarantine_reduce+0x1a0/0x1f0 [ 153.144197][ T6270] __kasan_slab_alloc+0x69/0x90 [ 153.144227][ T6270] __kmalloc_noprof+0x2cc/0x840 [ 153.144276][ T6270] tomoyo_supervisor+0x65d/0x1340 [ 153.144317][ T6270] tomoyo_path_permission+0x270/0x3b0 [ 153.144366][ T6270] tomoyo_path_perm+0x364/0x460 [ 153.144417][ T6270] security_inode_getattr+0x116/0x280 [ 153.144469][ T6270] vfs_fstat+0x4b/0xe0 [ 153.144503][ T6270] __do_sys_newfstat+0x8b/0x110 [ 153.144540][ T6270] do_syscall_64+0x123/0x790 [ 153.144594][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.144630][ T6270] [ 153.144638][ T6270] Memory state around the buggy address: [ 153.144656][ T6270] ffff88807cd92600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.144682][ T6270] ffff88807cd92680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.144708][ T6270] >ffff88807cd92700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.144727][ T6270] ^ [ 153.144748][ T6270] ffff88807cd92780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.144773][ T6270] ffff88807cd92800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 153.144793][ T6270] ================================================================== [ 153.160316][ T6583] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 153.213475][ T6583] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 153.253433][ T6270] ================================================================== [ 153.253455][ T6270] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 153.253512][ T6270] Read of size 1 at addr ffff88807cd92762 by task udevd/6270 [ 153.253541][ T6270] [ 153.253560][ T6270] CPU: 1 UID: 0 PID: 6270 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 153.253611][ T6270] Tainted: [B]=BAD_PAGE [ 153.253628][ T6270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 153.253650][ T6270] Call Trace: [ 153.253663][ T6270] [ 153.253676][ T6270] dump_stack_lvl+0x100/0x190 [ 153.253729][ T6270] print_report+0x13d/0x4b0 [ 153.253784][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.253830][ T6270] ? __virt_addr_valid+0x239/0x430 [ 153.253899][ T6270] ? string+0x471/0x4d0 [ 153.253946][ T6270] kasan_report+0xdf/0x1c0 [ 153.253984][ T6270] ? string+0x471/0x4d0 [ 153.254038][ T6270] string+0x471/0x4d0 [ 153.254110][ T6270] ? __pfx_string+0x10/0x10 [ 153.254158][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.254207][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.254253][ T6270] ? kasan_save_stack+0x3f/0x50 [ 153.254308][ T6270] ? kasan_save_stack+0x30/0x50 [ 153.254367][ T6270] vsnprintf+0x422/0x1300 [ 153.254427][ T6270] ? __pfx_vsnprintf+0x10/0x10 [ 153.254483][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.254532][ T6270] vscnprintf+0x40/0x90 [ 153.254587][ T6270] sysfs_emit+0x165/0x180 [ 153.254645][ T6270] ? __pfx_sysfs_emit+0x10/0x10 [ 153.254703][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.254747][ T6270] ? lock_acquire+0x1d1/0x380 [ 153.254782][ T6270] ? sysfs_file_kobj+0x21/0x290 [ 153.254840][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.254890][ T6270] ? find_held_lock+0x2b/0x80 [ 153.254938][ T6270] ? sysfs_file_kobj+0xe4/0x290 [ 153.254999][ T6270] ? __pfx_input_dev_show_name+0x10/0x10 [ 153.255056][ T6270] input_dev_show_name+0x5b/0x70 [ 153.255112][ T6270] dev_attr_show+0x52/0xa0 [ 153.255171][ T6270] ? __pfx_dev_attr_show+0x10/0x10 [ 153.255228][ T6270] sysfs_kf_seq_show+0x217/0x3f0 [ 153.255267][ T6270] seq_read_iter+0x32f/0x1270 [ 153.255334][ T6270] kernfs_fop_read_iter+0x46c/0x610 [ 153.255390][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.255434][ T6270] ? rw_verify_area+0xce/0x6d0 [ 153.255479][ T6270] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 153.255536][ T6270] vfs_read+0x82e/0xb40 [ 153.255588][ T6270] ? __pfx_vfs_read+0x10/0x10 [ 153.255640][ T6270] ? __pfx_do_sys_openat2+0x10/0x10 [ 153.255691][ T6270] ksys_read+0x12a/0x250 [ 153.255741][ T6270] ? __pfx_ksys_read+0x10/0x10 [ 153.255793][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.255847][ T6270] do_syscall_64+0x123/0x790 [ 153.255908][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.255946][ T6270] RIP: 0033:0x7f21672a7407 [ 153.255975][ T6270] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 153.256012][ T6270] RSP: 002b:00007ffe2dc1dbb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 153.256048][ T6270] RAX: ffffffffffffffda RBX: 00007f21679c2880 RCX: 00007f21672a7407 [ 153.256074][ T6270] RDX: 0000000000001000 RSI: 00007ffe2dc1e090 RDI: 0000000000000008 [ 153.256098][ T6270] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 153.256121][ T6270] R10: 0000000000000000 R11: 0000000000000202 R12: 000055816fd9cc10 [ 153.256145][ T6270] R13: 00007ffe2dc1dc90 R14: 00007ffe2dc1e090 R15: 000055815110bbcc [ 153.256182][ T6270] [ 153.256196][ T6270] [ 153.256203][ T6270] Allocated by task 5731: [ 153.256220][ T6270] kasan_save_stack+0x30/0x50 [ 153.256273][ T6270] kasan_save_track+0x14/0x30 [ 153.256325][ T6270] __kasan_kmalloc+0xaa/0xb0 [ 153.256377][ T6270] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 153.256421][ T6270] redrat3_dev_probe+0x326/0x2b50 [ 153.256458][ T6270] usb_probe_interface+0x386/0x9b0 [ 153.256494][ T6270] really_probe+0x241/0xa60 [ 153.256539][ T6270] __driver_probe_device+0x210/0x460 [ 153.256587][ T6270] driver_probe_device+0x4a/0x140 [ 153.256634][ T6270] __device_attach_driver+0x1df/0x320 [ 153.256682][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.256719][ T6270] __device_attach+0x1e4/0x4d0 [ 153.256765][ T6270] device_initial_probe+0xaf/0xd0 [ 153.256814][ T6270] bus_probe_device+0x64/0x160 [ 153.256859][ T6270] device_add+0x121d/0x1970 [ 153.256912][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.256966][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.257013][ T6270] usb_probe_device+0xef/0x400 [ 153.257043][ T6270] really_probe+0x241/0xa60 [ 153.257088][ T6270] __driver_probe_device+0x210/0x460 [ 153.257135][ T6270] driver_probe_device+0x4a/0x140 [ 153.257182][ T6270] __device_attach_driver+0x1df/0x320 [ 153.257230][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.257266][ T6270] __device_attach+0x1e4/0x4d0 [ 153.257311][ T6270] device_initial_probe+0xaf/0xd0 [ 153.257361][ T6270] bus_probe_device+0x64/0x160 [ 153.257400][ T6270] device_add+0x121d/0x1970 [ 153.257452][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.257501][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.257547][ T6270] process_one_work+0xac7/0x1b10 [ 153.257598][ T6270] worker_thread+0x5ef/0xe50 [ 153.257647][ T6270] kthread+0x373/0x450 [ 153.257690][ T6270] ret_from_fork+0x730/0xd60 [ 153.257724][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.257757][ T6270] [ 153.257764][ T6270] Freed by task 5731: [ 153.257780][ T6270] kasan_save_stack+0x30/0x50 [ 153.257832][ T6270] kasan_save_track+0x14/0x30 [ 153.257891][ T6270] kasan_save_free_info+0x3b/0x70 [ 153.257933][ T6270] __kasan_slab_free+0x5f/0x80 [ 153.257992][ T6270] kfree+0x22b/0x6d0 [ 153.258030][ T6270] redrat3_dev_probe+0x107a/0x2b50 [ 153.258068][ T6270] usb_probe_interface+0x386/0x9b0 [ 153.258102][ T6270] really_probe+0x241/0xa60 [ 153.258147][ T6270] __driver_probe_device+0x210/0x460 [ 153.258194][ T6270] driver_probe_device+0x4a/0x140 [ 153.258241][ T6270] __device_attach_driver+0x1df/0x320 [ 153.258290][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.258326][ T6270] __device_attach+0x1e4/0x4d0 [ 153.258372][ T6270] device_initial_probe+0xaf/0xd0 [ 153.258421][ T6270] bus_probe_device+0x64/0x160 [ 153.258460][ T6270] device_add+0x121d/0x1970 [ 153.258512][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.258567][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.258613][ T6270] usb_probe_device+0xef/0x400 [ 153.258643][ T6270] really_probe+0x241/0xa60 [ 153.258687][ T6270] __driver_probe_device+0x210/0x460 [ 153.258734][ T6270] driver_probe_device+0x4a/0x140 [ 153.258781][ T6270] __device_attach_driver+0x1df/0x320 [ 153.258829][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.258870][ T6270] __device_attach+0x1e4/0x4d0 [ 153.258917][ T6270] device_initial_probe+0xaf/0xd0 [ 153.258966][ T6270] bus_probe_device+0x64/0x160 [ 153.259005][ T6270] device_add+0x121d/0x1970 [ 153.259057][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.259105][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.259152][ T6270] process_one_work+0xac7/0x1b10 [ 153.259202][ T6270] worker_thread+0x5ef/0xe50 [ 153.259251][ T6270] kthread+0x373/0x450 [ 153.259296][ T6270] ret_from_fork+0x730/0xd60 [ 153.259328][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.259360][ T6270] [ 153.259367][ T6270] The buggy address belongs to the object at ffff88807cd92000 [ 153.259367][ T6270] which belongs to the cache kmalloc-2k of size 2048 [ 153.259396][ T6270] The buggy address is located 1890 bytes inside of [ 153.259396][ T6270] freed 2048-byte region [ffff88807cd92000, ffff88807cd92800) [ 153.259433][ T6270] [ 153.259442][ T6270] The buggy address belongs to the physical page: [ 153.259457][ T6270] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7cd90 [ 153.259488][ T6270] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 153.259517][ T6270] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 153.259548][ T6270] page_type: f5(slab) [ 153.259579][ T6270] raw: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 153.259612][ T6270] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 153.259647][ T6270] head: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 153.259681][ T6270] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 153.259714][ T6270] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 153.259748][ T6270] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 153.259769][ T6270] page dumped because: kasan: bad access detected [ 153.259785][ T6270] page_owner tracks the page as allocated [ 153.259796][ T6270] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5623, tgid 5623 (syz-executor), ts 96697253716 [ 153.259860][ T6270] post_alloc_hook+0xfd/0x120 [ 153.259900][ T6270] get_page_from_freelist+0x110d/0x35d0 [ 153.259946][ T6270] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 153.259993][ T6270] new_slab+0xa9/0x6e0 [ 153.260034][ T6270] refill_objects+0xe3/0x410 [ 153.260076][ T6270] __pcs_replace_empty_main+0x35e/0x650 [ 153.260119][ T6270] __kmalloc_node_track_caller_noprof+0x6a8/0x870 [ 153.260174][ T6270] kmalloc_reserve+0xe8/0x350 [ 153.260209][ T6270] pskb_expand_head+0x249/0x10e0 [ 153.260257][ T6270] netlink_trim+0x22d/0x2f0 [ 153.260289][ T6270] netlink_broadcast_filtered+0x6d/0xf20 [ 153.260333][ T6270] nlmsg_notify+0xb1/0x290 [ 153.260376][ T6270] rtmsg_ifinfo+0x177/0x1b0 [ 153.260409][ T6270] __dev_notify_flags+0x362/0x4b0 [ 153.260455][ T6270] netif_change_flags+0x108/0x160 [ 153.260502][ T6270] do_setlink.isra.0+0x1ac4/0x3e60 [ 153.260554][ T6270] page last free pid 5362 tgid 5362 ts 61481229891 stack trace: [ 153.260578][ T6270] __free_frozen_pages+0x79f/0x10f0 [ 153.260615][ T6270] qlist_free_all+0x47/0xf0 [ 153.260662][ T6270] kasan_quarantine_reduce+0x1a0/0x1f0 [ 153.260715][ T6270] __kasan_slab_alloc+0x69/0x90 [ 153.260745][ T6270] __kmalloc_noprof+0x2cc/0x840 [ 153.260794][ T6270] tomoyo_supervisor+0x65d/0x1340 [ 153.260835][ T6270] tomoyo_path_permission+0x270/0x3b0 [ 153.260889][ T6270] tomoyo_path_perm+0x364/0x460 [ 153.260939][ T6270] security_inode_getattr+0x116/0x280 [ 153.260992][ T6270] vfs_fstat+0x4b/0xe0 [ 153.261026][ T6270] __do_sys_newfstat+0x8b/0x110 [ 153.261063][ T6270] do_syscall_64+0x123/0x790 [ 153.261118][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.261153][ T6270] [ 153.261162][ T6270] Memory state around the buggy address: [ 153.261179][ T6270] ffff88807cd92600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.261204][ T6270] ffff88807cd92680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.261230][ T6270] >ffff88807cd92700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.261250][ T6270] ^ [ 153.261270][ T6270] ffff88807cd92780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.261296][ T6270] ffff88807cd92800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 153.261316][ T6270] ================================================================== [ 153.373554][ T6270] ================================================================== [ 153.373574][ T6270] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 153.373631][ T6270] Read of size 1 at addr ffff88807cd92763 by task udevd/6270 [ 153.373660][ T6270] [ 153.373678][ T6270] CPU: 1 UID: 0 PID: 6270 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 153.373731][ T6270] Tainted: [B]=BAD_PAGE [ 153.373745][ T6270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 153.373768][ T6270] Call Trace: [ 153.373780][ T6270] [ 153.373794][ T6270] dump_stack_lvl+0x100/0x190 [ 153.373855][ T6270] print_report+0x13d/0x4b0 [ 153.373911][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.373955][ T6270] ? __virt_addr_valid+0x239/0x430 [ 153.374018][ T6270] ? string+0x471/0x4d0 [ 153.374065][ T6270] kasan_report+0xdf/0x1c0 [ 153.374123][ T6270] ? string+0x471/0x4d0 [ 153.374175][ T6270] string+0x471/0x4d0 [ 153.374225][ T6270] ? __pfx_string+0x10/0x10 [ 153.374273][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.374320][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.374365][ T6270] ? kasan_save_stack+0x3f/0x50 [ 153.374421][ T6270] ? kasan_save_stack+0x30/0x50 [ 153.374480][ T6270] vsnprintf+0x422/0x1300 [ 153.374542][ T6270] ? __pfx_vsnprintf+0x10/0x10 [ 153.374599][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.374647][ T6270] vscnprintf+0x40/0x90 [ 153.374702][ T6270] sysfs_emit+0x165/0x180 [ 153.374759][ T6270] ? __pfx_sysfs_emit+0x10/0x10 [ 153.374817][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.374866][ T6270] ? lock_acquire+0x1d1/0x380 [ 153.374901][ T6270] ? sysfs_file_kobj+0x21/0x290 [ 153.374959][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.375003][ T6270] ? find_held_lock+0x2b/0x80 [ 153.375051][ T6270] ? sysfs_file_kobj+0xe4/0x290 [ 153.375113][ T6270] ? __pfx_input_dev_show_name+0x10/0x10 [ 153.375172][ T6270] input_dev_show_name+0x5b/0x70 [ 153.375228][ T6270] dev_attr_show+0x52/0xa0 [ 153.375286][ T6270] ? __pfx_dev_attr_show+0x10/0x10 [ 153.375343][ T6270] sysfs_kf_seq_show+0x217/0x3f0 [ 153.375381][ T6270] seq_read_iter+0x32f/0x1270 [ 153.375447][ T6270] kernfs_fop_read_iter+0x46c/0x610 [ 153.375502][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.375548][ T6270] ? rw_verify_area+0xce/0x6d0 [ 153.375593][ T6270] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 153.375650][ T6270] vfs_read+0x82e/0xb40 [ 153.375702][ T6270] ? __pfx_vfs_read+0x10/0x10 [ 153.375754][ T6270] ? __pfx_do_sys_openat2+0x10/0x10 [ 153.375805][ T6270] ksys_read+0x12a/0x250 [ 153.375860][ T6270] ? __pfx_ksys_read+0x10/0x10 [ 153.375913][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.375961][ T6270] do_syscall_64+0x123/0x790 [ 153.376022][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.376061][ T6270] RIP: 0033:0x7f21672a7407 [ 153.376089][ T6270] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 153.376126][ T6270] RSP: 002b:00007ffe2dc1dbb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 153.376162][ T6270] RAX: ffffffffffffffda RBX: 00007f21679c2880 RCX: 00007f21672a7407 [ 153.376188][ T6270] RDX: 0000000000001000 RSI: 00007ffe2dc1e090 RDI: 0000000000000008 [ 153.376213][ T6270] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 153.376236][ T6270] R10: 0000000000000000 R11: 0000000000000202 R12: 000055816fd9cc10 [ 153.376260][ T6270] R13: 00007ffe2dc1dc90 R14: 00007ffe2dc1e090 R15: 000055815110bbcc [ 153.376297][ T6270] [ 153.376311][ T6270] [ 153.376319][ T6270] Allocated by task 5731: [ 153.376337][ T6270] kasan_save_stack+0x30/0x50 [ 153.376392][ T6270] kasan_save_track+0x14/0x30 [ 153.376445][ T6270] __kasan_kmalloc+0xaa/0xb0 [ 153.376497][ T6270] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 153.376545][ T6270] redrat3_dev_probe+0x326/0x2b50 [ 153.376581][ T6270] usb_probe_interface+0x386/0x9b0 [ 153.376619][ T6270] really_probe+0x241/0xa60 [ 153.376665][ T6270] __driver_probe_device+0x210/0x460 [ 153.376713][ T6270] driver_probe_device+0x4a/0x140 [ 153.376760][ T6270] __device_attach_driver+0x1df/0x320 [ 153.376808][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.376850][ T6270] __device_attach+0x1e4/0x4d0 [ 153.376897][ T6270] device_initial_probe+0xaf/0xd0 [ 153.376945][ T6270] bus_probe_device+0x64/0x160 [ 153.376985][ T6270] device_add+0x121d/0x1970 [ 153.377037][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.377092][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.377139][ T6270] usb_probe_device+0xef/0x400 [ 153.377169][ T6270] really_probe+0x241/0xa60 [ 153.377214][ T6270] __driver_probe_device+0x210/0x460 [ 153.377261][ T6270] driver_probe_device+0x4a/0x140 [ 153.377308][ T6270] __device_attach_driver+0x1df/0x320 [ 153.377356][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.377393][ T6270] __device_attach+0x1e4/0x4d0 [ 153.377439][ T6270] device_initial_probe+0xaf/0xd0 [ 153.377488][ T6270] bus_probe_device+0x64/0x160 [ 153.377526][ T6270] device_add+0x121d/0x1970 [ 153.377579][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.377627][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.377674][ T6270] process_one_work+0xac7/0x1b10 [ 153.377725][ T6270] worker_thread+0x5ef/0xe50 [ 153.377774][ T6270] kthread+0x373/0x450 [ 153.377817][ T6270] ret_from_fork+0x730/0xd60 [ 153.377856][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.377889][ T6270] [ 153.377897][ T6270] Freed by task 5731: [ 153.377913][ T6270] kasan_save_stack+0x30/0x50 [ 153.377968][ T6270] kasan_save_track+0x14/0x30 [ 153.378020][ T6270] kasan_save_free_info+0x3b/0x70 [ 153.378063][ T6270] __kasan_slab_free+0x5f/0x80 [ 153.378118][ T6270] kfree+0x22b/0x6d0 [ 153.378156][ T6270] redrat3_dev_probe+0x107a/0x2b50 [ 153.378194][ T6270] usb_probe_interface+0x386/0x9b0 [ 153.378229][ T6270] really_probe+0x241/0xa60 [ 153.378274][ T6270] __driver_probe_device+0x210/0x460 [ 153.378320][ T6270] driver_probe_device+0x4a/0x140 [ 153.378367][ T6270] __device_attach_driver+0x1df/0x320 [ 153.378415][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.378451][ T6270] __device_attach+0x1e4/0x4d0 [ 153.378498][ T6270] device_initial_probe+0xaf/0xd0 [ 153.378547][ T6270] bus_probe_device+0x64/0x160 [ 153.378587][ T6270] device_add+0x121d/0x1970 [ 153.378639][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.378693][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.378739][ T6270] usb_probe_device+0xef/0x400 [ 153.378769][ T6270] really_probe+0x241/0xa60 [ 153.378813][ T6270] __driver_probe_device+0x210/0x460 [ 153.378866][ T6270] driver_probe_device+0x4a/0x140 [ 153.378912][ T6270] __device_attach_driver+0x1df/0x320 [ 153.378960][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.378996][ T6270] __device_attach+0x1e4/0x4d0 [ 153.379043][ T6270] device_initial_probe+0xaf/0xd0 [ 153.379092][ T6270] bus_probe_device+0x64/0x160 [ 153.379131][ T6270] device_add+0x121d/0x1970 [ 153.379183][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.379232][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.379278][ T6270] process_one_work+0xac7/0x1b10 [ 153.379328][ T6270] worker_thread+0x5ef/0xe50 [ 153.379376][ T6270] kthread+0x373/0x450 [ 153.379420][ T6270] ret_from_fork+0x730/0xd60 [ 153.379452][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.379484][ T6270] [ 153.379492][ T6270] The buggy address belongs to the object at ffff88807cd92000 [ 153.379492][ T6270] which belongs to the cache kmalloc-2k of size 2048 [ 153.379521][ T6270] The buggy address is located 1891 bytes inside of [ 153.379521][ T6270] freed 2048-byte region [ffff88807cd92000, ffff88807cd92800) [ 153.379558][ T6270] [ 153.379567][ T6270] The buggy address belongs to the physical page: [ 153.379582][ T6270] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7cd90 [ 153.379613][ T6270] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 153.379642][ T6270] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 153.379672][ T6270] page_type: f5(slab) [ 153.379702][ T6270] raw: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 153.379736][ T6270] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 153.379770][ T6270] head: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 153.379804][ T6270] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 153.379838][ T6270] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 153.379877][ T6270] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 153.379898][ T6270] page dumped because: kasan: bad access detected [ 153.379914][ T6270] page_owner tracks the page as allocated [ 153.379926][ T6270] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5623, tgid 5623 (syz-executor), ts 96697253716 [ 153.379984][ T6270] post_alloc_hook+0xfd/0x120 [ 153.380025][ T6270] get_page_from_freelist+0x110d/0x35d0 [ 153.380070][ T6270] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 153.380118][ T6270] new_slab+0xa9/0x6e0 [ 153.380158][ T6270] refill_objects+0xe3/0x410 [ 153.380201][ T6270] __pcs_replace_empty_main+0x35e/0x650 [ 153.380244][ T6270] __kmalloc_node_track_caller_noprof+0x6a8/0x870 [ 153.380300][ T6270] kmalloc_reserve+0xe8/0x350 [ 153.380334][ T6270] pskb_expand_head+0x249/0x10e0 [ 153.380383][ T6270] netlink_trim+0x22d/0x2f0 [ 153.380415][ T6270] netlink_broadcast_filtered+0x6d/0xf20 [ 153.380458][ T6270] nlmsg_notify+0xb1/0x290 [ 153.380501][ T6270] rtmsg_ifinfo+0x177/0x1b0 [ 153.380534][ T6270] __dev_notify_flags+0x362/0x4b0 [ 153.380580][ T6270] netif_change_flags+0x108/0x160 [ 153.380626][ T6270] do_setlink.isra.0+0x1ac4/0x3e60 [ 153.380679][ T6270] page last free pid 5362 tgid 5362 ts 61481229891 stack trace: [ 153.380702][ T6270] __free_frozen_pages+0x79f/0x10f0 [ 153.380739][ T6270] qlist_free_all+0x47/0xf0 [ 153.380787][ T6270] kasan_quarantine_reduce+0x1a0/0x1f0 [ 153.380839][ T6270] __kasan_slab_alloc+0x69/0x90 [ 153.380875][ T6270] __kmalloc_noprof+0x2cc/0x840 [ 153.380924][ T6270] tomoyo_supervisor+0x65d/0x1340 [ 153.380966][ T6270] tomoyo_path_permission+0x270/0x3b0 [ 153.381014][ T6270] tomoyo_path_perm+0x364/0x460 [ 153.381064][ T6270] security_inode_getattr+0x116/0x280 [ 153.381116][ T6270] vfs_fstat+0x4b/0xe0 [ 153.381150][ T6270] __do_sys_newfstat+0x8b/0x110 [ 153.381186][ T6270] do_syscall_64+0x123/0x790 [ 153.381243][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.381280][ T6270] [ 153.381288][ T6270] Memory state around the buggy address: [ 153.381305][ T6270] ffff88807cd92600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.381331][ T6270] ffff88807cd92680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.381357][ T6270] >ffff88807cd92700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.381378][ T6270] ^ [ 153.381399][ T6270] ffff88807cd92780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.381424][ T6270] ffff88807cd92800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 153.381444][ T6270] ================================================================== [ 153.418409][ T80] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 153.425211][ T145] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 153.425988][ T145] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 153.500627][ T6270] ================================================================== [ 153.500647][ T6270] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 153.500703][ T6270] Read of size 1 at addr ffff88807cd92764 by task udevd/6270 [ 153.500733][ T6270] [ 153.500751][ T6270] CPU: 1 UID: 0 PID: 6270 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 153.500803][ T6270] Tainted: [B]=BAD_PAGE [ 153.500817][ T6270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 153.500839][ T6270] Call Trace: [ 153.500856][ T6270] [ 153.500870][ T6270] dump_stack_lvl+0x100/0x190 [ 153.500922][ T6270] print_report+0x13d/0x4b0 [ 153.500978][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.501024][ T6270] ? __virt_addr_valid+0x239/0x430 [ 153.501086][ T6270] ? string+0x471/0x4d0 [ 153.501133][ T6270] kasan_report+0xdf/0x1c0 [ 153.501171][ T6270] ? string+0x471/0x4d0 [ 153.501225][ T6270] string+0x471/0x4d0 [ 153.501275][ T6270] ? __pfx_string+0x10/0x10 [ 153.501323][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.501370][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.501414][ T6270] ? kasan_save_stack+0x3f/0x50 [ 153.501469][ T6270] ? kasan_save_stack+0x30/0x50 [ 153.501528][ T6270] vsnprintf+0x422/0x1300 [ 153.501587][ T6270] ? __pfx_vsnprintf+0x10/0x10 [ 153.501644][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.501696][ T6270] vscnprintf+0x40/0x90 [ 153.501751][ T6270] sysfs_emit+0x165/0x180 [ 153.501809][ T6270] ? __pfx_sysfs_emit+0x10/0x10 [ 153.501873][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.501918][ T6270] ? lock_acquire+0x1d1/0x380 [ 153.501952][ T6270] ? sysfs_file_kobj+0x21/0x290 [ 153.502010][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.502055][ T6270] ? find_held_lock+0x2b/0x80 [ 153.502103][ T6270] ? sysfs_file_kobj+0xe4/0x290 [ 153.502167][ T6270] ? __pfx_input_dev_show_name+0x10/0x10 [ 153.502224][ T6270] input_dev_show_name+0x5b/0x70 [ 153.502281][ T6270] dev_attr_show+0x52/0xa0 [ 153.502339][ T6270] ? __pfx_dev_attr_show+0x10/0x10 [ 153.502397][ T6270] sysfs_kf_seq_show+0x217/0x3f0 [ 153.502436][ T6270] seq_read_iter+0x32f/0x1270 [ 153.502502][ T6270] kernfs_fop_read_iter+0x46c/0x610 [ 153.502557][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.502602][ T6270] ? rw_verify_area+0xce/0x6d0 [ 153.502648][ T6270] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 153.502705][ T6270] vfs_read+0x82e/0xb40 [ 153.502757][ T6270] ? __pfx_vfs_read+0x10/0x10 [ 153.502808][ T6270] ? __pfx_do_sys_openat2+0x10/0x10 [ 153.502865][ T6270] ksys_read+0x12a/0x250 [ 153.502915][ T6270] ? __pfx_ksys_read+0x10/0x10 [ 153.502968][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.503015][ T6270] do_syscall_64+0x123/0x790 [ 153.503076][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.503115][ T6270] RIP: 0033:0x7f21672a7407 [ 153.503143][ T6270] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 153.503180][ T6270] RSP: 002b:00007ffe2dc1dbb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 153.503216][ T6270] RAX: ffffffffffffffda RBX: 00007f21679c2880 RCX: 00007f21672a7407 [ 153.503242][ T6270] RDX: 0000000000001000 RSI: 00007ffe2dc1e090 RDI: 0000000000000008 [ 153.503266][ T6270] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 153.503289][ T6270] R10: 0000000000000000 R11: 0000000000000202 R12: 000055816fd9cc10 [ 153.503313][ T6270] R13: 00007ffe2dc1dc90 R14: 00007ffe2dc1e090 R15: 000055815110bbcc [ 153.503350][ T6270] [ 153.503364][ T6270] [ 153.503372][ T6270] Allocated by task 5731: [ 153.503389][ T6270] kasan_save_stack+0x30/0x50 [ 153.503443][ T6270] kasan_save_track+0x14/0x30 [ 153.503496][ T6270] __kasan_kmalloc+0xaa/0xb0 [ 153.503546][ T6270] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 153.503590][ T6270] redrat3_dev_probe+0x326/0x2b50 [ 153.503628][ T6270] usb_probe_interface+0x386/0x9b0 [ 153.503665][ T6270] really_probe+0x241/0xa60 [ 153.503710][ T6270] __driver_probe_device+0x210/0x460 [ 153.503757][ T6270] driver_probe_device+0x4a/0x140 [ 153.503804][ T6270] __device_attach_driver+0x1df/0x320 [ 153.503857][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.503893][ T6270] __device_attach+0x1e4/0x4d0 [ 153.503940][ T6270] device_initial_probe+0xaf/0xd0 [ 153.503989][ T6270] bus_probe_device+0x64/0x160 [ 153.504029][ T6270] device_add+0x121d/0x1970 [ 153.504081][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.504136][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.504183][ T6270] usb_probe_device+0xef/0x400 [ 153.504213][ T6270] really_probe+0x241/0xa60 [ 153.504257][ T6270] __driver_probe_device+0x210/0x460 [ 153.504305][ T6270] driver_probe_device+0x4a/0x140 [ 153.504351][ T6270] __device_attach_driver+0x1df/0x320 [ 153.504401][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.504436][ T6270] __device_attach+0x1e4/0x4d0 [ 153.504483][ T6270] device_initial_probe+0xaf/0xd0 [ 153.504532][ T6270] bus_probe_device+0x64/0x160 [ 153.504572][ T6270] device_add+0x121d/0x1970 [ 153.504624][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.504675][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.504723][ T6270] process_one_work+0xac7/0x1b10 [ 153.504774][ T6270] worker_thread+0x5ef/0xe50 [ 153.504823][ T6270] kthread+0x373/0x450 [ 153.504874][ T6270] ret_from_fork+0x730/0xd60 [ 153.504909][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.504941][ T6270] [ 153.504949][ T6270] Freed by task 5731: [ 153.504965][ T6270] kasan_save_stack+0x30/0x50 [ 153.505017][ T6270] kasan_save_track+0x14/0x30 [ 153.505070][ T6270] kasan_save_free_info+0x3b/0x70 [ 153.505112][ T6270] __kasan_slab_free+0x5f/0x80 [ 153.505172][ T6270] kfree+0x22b/0x6d0 [ 153.505209][ T6270] redrat3_dev_probe+0x107a/0x2b50 [ 153.505249][ T6270] usb_probe_interface+0x386/0x9b0 [ 153.505285][ T6270] really_probe+0x241/0xa60 [ 153.505331][ T6270] __driver_probe_device+0x210/0x460 [ 153.505378][ T6270] driver_probe_device+0x4a/0x140 [ 153.505425][ T6270] __device_attach_driver+0x1df/0x320 [ 153.505474][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.505512][ T6270] __device_attach+0x1e4/0x4d0 [ 153.505559][ T6270] device_initial_probe+0xaf/0xd0 [ 153.505608][ T6270] bus_probe_device+0x64/0x160 [ 153.505647][ T6270] device_add+0x121d/0x1970 [ 153.505699][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.505754][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.505801][ T6270] usb_probe_device+0xef/0x400 [ 153.505830][ T6270] really_probe+0x241/0xa60 [ 153.505880][ T6270] __driver_probe_device+0x210/0x460 [ 153.505928][ T6270] driver_probe_device+0x4a/0x140 [ 153.505974][ T6270] __device_attach_driver+0x1df/0x320 [ 153.506023][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.506058][ T6270] __device_attach+0x1e4/0x4d0 [ 153.506105][ T6270] device_initial_probe+0xaf/0xd0 [ 153.506154][ T6270] bus_probe_device+0x64/0x160 [ 153.506194][ T6270] device_add+0x121d/0x1970 [ 153.506247][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.506295][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.506341][ T6270] process_one_work+0xac7/0x1b10 [ 153.506391][ T6270] worker_thread+0x5ef/0xe50 [ 153.506440][ T6270] kthread+0x373/0x450 [ 153.506484][ T6270] ret_from_fork+0x730/0xd60 [ 153.506517][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.506549][ T6270] [ 153.506557][ T6270] The buggy address belongs to the object at ffff88807cd92000 [ 153.506557][ T6270] which belongs to the cache kmalloc-2k of size 2048 [ 153.506586][ T6270] The buggy address is located 1892 bytes inside of [ 153.506586][ T6270] freed 2048-byte region [ffff88807cd92000, ffff88807cd92800) [ 153.506622][ T6270] [ 153.506631][ T6270] The buggy address belongs to the physical page: [ 153.506645][ T6270] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7cd90 [ 153.506676][ T6270] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 153.506705][ T6270] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 153.506736][ T6270] page_type: f5(slab) [ 153.506766][ T6270] raw: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 153.506800][ T6270] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 153.506834][ T6270] head: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 153.506872][ T6270] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 153.506906][ T6270] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 153.506939][ T6270] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 153.506960][ T6270] page dumped because: kasan: bad access detected [ 153.506977][ T6270] page_owner tracks the page as allocated [ 153.506989][ T6270] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5623, tgid 5623 (syz-executor), ts 96697253716 [ 153.507047][ T6270] post_alloc_hook+0xfd/0x120 [ 153.507088][ T6270] get_page_from_freelist+0x110d/0x35d0 [ 153.507133][ T6270] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 153.507180][ T6270] new_slab+0xa9/0x6e0 [ 153.507221][ T6270] refill_objects+0xe3/0x410 [ 153.507263][ T6270] __pcs_replace_empty_main+0x35e/0x650 [ 153.507305][ T6270] __kmalloc_node_track_caller_noprof+0x6a8/0x870 [ 153.507360][ T6270] kmalloc_reserve+0xe8/0x350 [ 153.507396][ T6270] pskb_expand_head+0x249/0x10e0 [ 153.507444][ T6270] netlink_trim+0x22d/0x2f0 [ 153.507476][ T6270] netlink_broadcast_filtered+0x6d/0xf20 [ 153.507519][ T6270] nlmsg_notify+0xb1/0x290 [ 153.507563][ T6270] rtmsg_ifinfo+0x177/0x1b0 [ 153.507595][ T6270] __dev_notify_flags+0x362/0x4b0 [ 153.507642][ T6270] netif_change_flags+0x108/0x160 [ 153.507689][ T6270] do_setlink.isra.0+0x1ac4/0x3e60 [ 153.507741][ T6270] page last free pid 5362 tgid 5362 ts 61481229891 stack trace: [ 153.507765][ T6270] __free_frozen_pages+0x79f/0x10f0 [ 153.507801][ T6270] qlist_free_all+0x47/0xf0 [ 153.507855][ T6270] kasan_quarantine_reduce+0x1a0/0x1f0 [ 153.507906][ T6270] __kasan_slab_alloc+0x69/0x90 [ 153.507936][ T6270] __kmalloc_noprof+0x2cc/0x840 [ 153.507989][ T6270] tomoyo_supervisor+0x65d/0x1340 [ 153.508031][ T6270] tomoyo_path_permission+0x270/0x3b0 [ 153.508080][ T6270] tomoyo_path_perm+0x364/0x460 [ 153.508129][ T6270] security_inode_getattr+0x116/0x280 [ 153.508182][ T6270] vfs_fstat+0x4b/0xe0 [ 153.508216][ T6270] __do_sys_newfstat+0x8b/0x110 [ 153.508253][ T6270] do_syscall_64+0x123/0x790 [ 153.508308][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.508344][ T6270] [ 153.508352][ T6270] Memory state around the buggy address: [ 153.508369][ T6270] ffff88807cd92600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.508396][ T6270] ffff88807cd92680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.508421][ T6270] >ffff88807cd92700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.508441][ T6270] ^ [ 153.508462][ T6270] ffff88807cd92780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.508488][ T6270] ffff88807cd92800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 153.508508][ T6270] ================================================================== [ 153.605802][ T6270] ================================================================== [ 153.605822][ T6270] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 153.605884][ T6270] Read of size 1 at addr ffff88807cd92765 by task udevd/6270 [ 153.605916][ T6270] [ 153.605936][ T6270] CPU: 1 UID: 0 PID: 6270 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 153.605987][ T6270] Tainted: [B]=BAD_PAGE [ 153.606001][ T6270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 153.606023][ T6270] Call Trace: [ 153.606035][ T6270] [ 153.606048][ T6270] dump_stack_lvl+0x100/0x190 [ 153.606099][ T6270] print_report+0x13d/0x4b0 [ 153.606156][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.606201][ T6270] ? __virt_addr_valid+0x239/0x430 [ 153.606264][ T6270] ? string+0x471/0x4d0 [ 153.606311][ T6270] kasan_report+0xdf/0x1c0 [ 153.606349][ T6270] ? string+0x471/0x4d0 [ 153.606402][ T6270] string+0x471/0x4d0 [ 153.606452][ T6270] ? __pfx_string+0x10/0x10 [ 153.606500][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.606546][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.606591][ T6270] ? kasan_save_stack+0x3f/0x50 [ 153.606647][ T6270] ? kasan_save_stack+0x30/0x50 [ 153.606706][ T6270] vsnprintf+0x422/0x1300 [ 153.606766][ T6270] ? __pfx_vsnprintf+0x10/0x10 [ 153.606822][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.606879][ T6270] vscnprintf+0x40/0x90 [ 153.606934][ T6270] sysfs_emit+0x165/0x180 [ 153.606991][ T6270] ? __pfx_sysfs_emit+0x10/0x10 [ 153.607049][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.607094][ T6270] ? lock_acquire+0x1d1/0x380 [ 153.607128][ T6270] ? sysfs_file_kobj+0x21/0x290 [ 153.607186][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.607231][ T6270] ? find_held_lock+0x2b/0x80 [ 153.607279][ T6270] ? sysfs_file_kobj+0xe4/0x290 [ 153.607340][ T6270] ? __pfx_input_dev_show_name+0x10/0x10 [ 153.607398][ T6270] input_dev_show_name+0x5b/0x70 [ 153.607454][ T6270] dev_attr_show+0x52/0xa0 [ 153.607512][ T6270] ? __pfx_dev_attr_show+0x10/0x10 [ 153.607571][ T6270] sysfs_kf_seq_show+0x217/0x3f0 [ 153.607610][ T6270] seq_read_iter+0x32f/0x1270 [ 153.607678][ T6270] kernfs_fop_read_iter+0x46c/0x610 [ 153.607733][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.607778][ T6270] ? rw_verify_area+0xce/0x6d0 [ 153.607823][ T6270] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 153.607886][ T6270] vfs_read+0x82e/0xb40 [ 153.607939][ T6270] ? __pfx_vfs_read+0x10/0x10 [ 153.607993][ T6270] ? __pfx_do_sys_openat2+0x10/0x10 [ 153.608044][ T6270] ksys_read+0x12a/0x250 [ 153.608093][ T6270] ? __pfx_ksys_read+0x10/0x10 [ 153.608146][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.608195][ T6270] do_syscall_64+0x123/0x790 [ 153.608256][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.608294][ T6270] RIP: 0033:0x7f21672a7407 [ 153.608322][ T6270] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 153.608359][ T6270] RSP: 002b:00007ffe2dc1dbb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 153.608395][ T6270] RAX: ffffffffffffffda RBX: 00007f21679c2880 RCX: 00007f21672a7407 [ 153.608422][ T6270] RDX: 0000000000001000 RSI: 00007ffe2dc1e090 RDI: 0000000000000008 [ 153.608446][ T6270] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 153.608469][ T6270] R10: 0000000000000000 R11: 0000000000000202 R12: 000055816fd9cc10 [ 153.608494][ T6270] R13: 00007ffe2dc1dc90 R14: 00007ffe2dc1e090 R15: 000055815110bbcc [ 153.608531][ T6270] [ 153.608543][ T6270] [ 153.608552][ T6270] Allocated by task 5731: [ 153.608568][ T6270] kasan_save_stack+0x30/0x50 [ 153.608622][ T6270] kasan_save_track+0x14/0x30 [ 153.608674][ T6270] __kasan_kmalloc+0xaa/0xb0 [ 153.608726][ T6270] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 153.608770][ T6270] redrat3_dev_probe+0x326/0x2b50 [ 153.608807][ T6270] usb_probe_interface+0x386/0x9b0 [ 153.608848][ T6270] really_probe+0x241/0xa60 [ 153.608893][ T6270] __driver_probe_device+0x210/0x460 [ 153.608940][ T6270] driver_probe_device+0x4a/0x140 [ 153.608987][ T6270] __device_attach_driver+0x1df/0x320 [ 153.609036][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.609072][ T6270] __device_attach+0x1e4/0x4d0 [ 153.609118][ T6270] device_initial_probe+0xaf/0xd0 [ 153.609168][ T6270] bus_probe_device+0x64/0x160 [ 153.609207][ T6270] device_add+0x121d/0x1970 [ 153.609259][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.609314][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.609361][ T6270] usb_probe_device+0xef/0x400 [ 153.609391][ T6270] really_probe+0x241/0xa60 [ 153.609435][ T6270] __driver_probe_device+0x210/0x460 [ 153.609482][ T6270] driver_probe_device+0x4a/0x140 [ 153.609528][ T6270] __device_attach_driver+0x1df/0x320 [ 153.609576][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.609612][ T6270] __device_attach+0x1e4/0x4d0 [ 153.609658][ T6270] device_initial_probe+0xaf/0xd0 [ 153.609707][ T6270] bus_probe_device+0x64/0x160 [ 153.609747][ T6270] device_add+0x121d/0x1970 [ 153.609799][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.609852][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.609898][ T6270] process_one_work+0xac7/0x1b10 [ 153.609948][ T6270] worker_thread+0x5ef/0xe50 [ 153.609997][ T6270] kthread+0x373/0x450 [ 153.610041][ T6270] ret_from_fork+0x730/0xd60 [ 153.610075][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.610108][ T6270] [ 153.610115][ T6270] Freed by task 5731: [ 153.610131][ T6270] kasan_save_stack+0x30/0x50 [ 153.610183][ T6270] kasan_save_track+0x14/0x30 [ 153.610236][ T6270] kasan_save_free_info+0x3b/0x70 [ 153.610279][ T6270] __kasan_slab_free+0x5f/0x80 [ 153.610333][ T6270] kfree+0x22b/0x6d0 [ 153.610370][ T6270] redrat3_dev_probe+0x107a/0x2b50 [ 153.610407][ T6270] usb_probe_interface+0x386/0x9b0 [ 153.610443][ T6270] really_probe+0x241/0xa60 [ 153.610488][ T6270] __driver_probe_device+0x210/0x460 [ 153.610535][ T6270] driver_probe_device+0x4a/0x140 [ 153.610582][ T6270] __device_attach_driver+0x1df/0x320 [ 153.610630][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.610666][ T6270] __device_attach+0x1e4/0x4d0 [ 153.610712][ T6270] device_initial_probe+0xaf/0xd0 [ 153.610761][ T6270] bus_probe_device+0x64/0x160 [ 153.610801][ T6270] device_add+0x121d/0x1970 [ 153.610857][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.610911][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.610958][ T6270] usb_probe_device+0xef/0x400 [ 153.610988][ T6270] really_probe+0x241/0xa60 [ 153.611032][ T6270] __driver_probe_device+0x210/0x460 [ 153.611079][ T6270] driver_probe_device+0x4a/0x140 [ 153.611127][ T6270] __device_attach_driver+0x1df/0x320 [ 153.611175][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.611210][ T6270] __device_attach+0x1e4/0x4d0 [ 153.611257][ T6270] device_initial_probe+0xaf/0xd0 [ 153.611305][ T6270] bus_probe_device+0x64/0x160 [ 153.611344][ T6270] device_add+0x121d/0x1970 [ 153.611396][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.611444][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.611491][ T6270] process_one_work+0xac7/0x1b10 [ 153.611540][ T6270] worker_thread+0x5ef/0xe50 [ 153.611589][ T6270] kthread+0x373/0x450 [ 153.611632][ T6270] ret_from_fork+0x730/0xd60 [ 153.611665][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.611697][ T6270] [ 153.611705][ T6270] The buggy address belongs to the object at ffff88807cd92000 [ 153.611705][ T6270] which belongs to the cache kmalloc-2k of size 2048 [ 153.611734][ T6270] The buggy address is located 1893 bytes inside of [ 153.611734][ T6270] freed 2048-byte region [ffff88807cd92000, ffff88807cd92800) [ 153.611771][ T6270] [ 153.611779][ T6270] The buggy address belongs to the physical page: [ 153.611793][ T6270] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7cd90 [ 153.611826][ T6270] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 153.611859][ T6270] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 153.611889][ T6270] page_type: f5(slab) [ 153.611920][ T6270] raw: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 153.611953][ T6270] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 153.611988][ T6270] head: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 153.612021][ T6270] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 153.612055][ T6270] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 153.612088][ T6270] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 153.612109][ T6270] page dumped because: kasan: bad access detected [ 153.612125][ T6270] page_owner tracks the page as allocated [ 153.612136][ T6270] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5623, tgid 5623 (syz-executor), ts 96697253716 [ 153.612194][ T6270] post_alloc_hook+0xfd/0x120 [ 153.612234][ T6270] get_page_from_freelist+0x110d/0x35d0 [ 153.612279][ T6270] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 153.612327][ T6270] new_slab+0xa9/0x6e0 [ 153.612366][ T6270] refill_objects+0xe3/0x410 [ 153.612409][ T6270] __pcs_replace_empty_main+0x35e/0x650 [ 153.612452][ T6270] __kmalloc_node_track_caller_noprof+0x6a8/0x870 [ 153.612507][ T6270] kmalloc_reserve+0xe8/0x350 [ 153.612541][ T6270] pskb_expand_head+0x249/0x10e0 [ 153.612589][ T6270] netlink_trim+0x22d/0x2f0 [ 153.612621][ T6270] netlink_broadcast_filtered+0x6d/0xf20 [ 153.612665][ T6270] nlmsg_notify+0xb1/0x290 [ 153.612709][ T6270] rtmsg_ifinfo+0x177/0x1b0 [ 153.612740][ T6270] __dev_notify_flags+0x362/0x4b0 [ 153.612786][ T6270] netif_change_flags+0x108/0x160 [ 153.612833][ T6270] do_setlink.isra.0+0x1ac4/0x3e60 [ 153.612889][ T6270] page last free pid 5362 tgid 5362 ts 61481229891 stack trace: [ 153.612912][ T6270] __free_frozen_pages+0x79f/0x10f0 [ 153.612950][ T6270] qlist_free_all+0x47/0xf0 [ 153.612997][ T6270] kasan_quarantine_reduce+0x1a0/0x1f0 [ 153.613049][ T6270] __kasan_slab_alloc+0x69/0x90 [ 153.613079][ T6270] __kmalloc_noprof+0x2cc/0x840 [ 153.613128][ T6270] tomoyo_supervisor+0x65d/0x1340 [ 153.613168][ T6270] tomoyo_path_permission+0x270/0x3b0 [ 153.613218][ T6270] tomoyo_path_perm+0x364/0x460 [ 153.613267][ T6270] security_inode_getattr+0x116/0x280 [ 153.613320][ T6270] vfs_fstat+0x4b/0xe0 [ 153.613354][ T6270] __do_sys_newfstat+0x8b/0x110 [ 153.613391][ T6270] do_syscall_64+0x123/0x790 [ 153.613446][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.613482][ T6270] [ 153.613490][ T6270] Memory state around the buggy address: [ 153.613507][ T6270] ffff88807cd92600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.613533][ T6270] ffff88807cd92680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.613558][ T6270] >ffff88807cd92700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.613578][ T6270] ^ [ 153.613598][ T6270] ffff88807cd92780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.613624][ T6270] ffff88807cd92800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 153.613644][ T6270] ================================================================== [ 153.687166][ T6270] ================================================================== [ 153.687186][ T6270] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 153.687242][ T6270] Read of size 1 at addr ffff88807cd92766 by task udevd/6270 [ 153.687270][ T6270] [ 153.687290][ T6270] CPU: 1 UID: 0 PID: 6270 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 153.687342][ T6270] Tainted: [B]=BAD_PAGE [ 153.687356][ T6270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 153.687379][ T6270] Call Trace: [ 153.687391][ T6270] [ 153.687405][ T6270] dump_stack_lvl+0x100/0x190 [ 153.687456][ T6270] print_report+0x13d/0x4b0 [ 153.687512][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.687557][ T6270] ? __virt_addr_valid+0x239/0x430 [ 153.687619][ T6270] ? string+0x471/0x4d0 [ 153.687666][ T6270] kasan_report+0xdf/0x1c0 [ 153.687705][ T6270] ? string+0x471/0x4d0 [ 153.687758][ T6270] string+0x471/0x4d0 [ 153.687808][ T6270] ? __pfx_string+0x10/0x10 [ 153.687862][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.687908][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.687953][ T6270] ? kasan_save_stack+0x3f/0x50 [ 153.688012][ T6270] ? kasan_save_stack+0x30/0x50 [ 153.688070][ T6270] vsnprintf+0x422/0x1300 [ 153.688130][ T6270] ? __pfx_vsnprintf+0x10/0x10 [ 153.688187][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.688234][ T6270] vscnprintf+0x40/0x90 [ 153.688289][ T6270] sysfs_emit+0x165/0x180 [ 153.688347][ T6270] ? __pfx_sysfs_emit+0x10/0x10 [ 153.688404][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.688449][ T6270] ? lock_acquire+0x1d1/0x380 [ 153.688484][ T6270] ? sysfs_file_kobj+0x21/0x290 [ 153.688541][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.688589][ T6270] ? find_held_lock+0x2b/0x80 [ 153.688637][ T6270] ? sysfs_file_kobj+0xe4/0x290 [ 153.688698][ T6270] ? __pfx_input_dev_show_name+0x10/0x10 [ 153.688756][ T6270] input_dev_show_name+0x5b/0x70 [ 153.688812][ T6270] dev_attr_show+0x52/0xa0 [ 153.688876][ T6270] ? __pfx_dev_attr_show+0x10/0x10 [ 153.688932][ T6270] sysfs_kf_seq_show+0x217/0x3f0 [ 153.688972][ T6270] seq_read_iter+0x32f/0x1270 [ 153.689042][ T6270] kernfs_fop_read_iter+0x46c/0x610 [ 153.689099][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.689177][ T6270] ? rw_verify_area+0xce/0x6d0 [ 153.689222][ T6270] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 153.689280][ T6270] vfs_read+0x82e/0xb40 [ 153.689332][ T6270] ? __pfx_vfs_read+0x10/0x10 [ 153.689383][ T6270] ? __pfx_do_sys_openat2+0x10/0x10 [ 153.689433][ T6270] ksys_read+0x12a/0x250 [ 153.689483][ T6270] ? __pfx_ksys_read+0x10/0x10 [ 153.689536][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.689585][ T6270] do_syscall_64+0x123/0x790 [ 153.689646][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.689684][ T6270] RIP: 0033:0x7f21672a7407 [ 153.689712][ T6270] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 153.689750][ T6270] RSP: 002b:00007ffe2dc1dbb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 153.689786][ T6270] RAX: ffffffffffffffda RBX: 00007f21679c2880 RCX: 00007f21672a7407 [ 153.689812][ T6270] RDX: 0000000000001000 RSI: 00007ffe2dc1e090 RDI: 0000000000000008 [ 153.689836][ T6270] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 153.689866][ T6270] R10: 0000000000000000 R11: 0000000000000202 R12: 000055816fd9cc10 [ 153.689890][ T6270] R13: 00007ffe2dc1dc90 R14: 00007ffe2dc1e090 R15: 000055815110bbcc [ 153.689927][ T6270] [ 153.689940][ T6270] [ 153.689948][ T6270] Allocated by task 5731: [ 153.689964][ T6270] kasan_save_stack+0x30/0x50 [ 153.690029][ T6270] kasan_save_track+0x14/0x30 [ 153.690082][ T6270] __kasan_kmalloc+0xaa/0xb0 [ 153.690133][ T6270] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 153.690176][ T6270] redrat3_dev_probe+0x326/0x2b50 [ 153.690215][ T6270] usb_probe_interface+0x386/0x9b0 [ 153.690252][ T6270] really_probe+0x241/0xa60 [ 153.690298][ T6270] __driver_probe_device+0x210/0x460 [ 153.690345][ T6270] driver_probe_device+0x4a/0x140 [ 153.690392][ T6270] __device_attach_driver+0x1df/0x320 [ 153.690440][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.690477][ T6270] __device_attach+0x1e4/0x4d0 [ 153.690524][ T6270] device_initial_probe+0xaf/0xd0 [ 153.690573][ T6270] bus_probe_device+0x64/0x160 [ 153.690612][ T6270] device_add+0x121d/0x1970 [ 153.690665][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.690719][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.690766][ T6270] usb_probe_device+0xef/0x400 [ 153.690795][ T6270] really_probe+0x241/0xa60 [ 153.690840][ T6270] __driver_probe_device+0x210/0x460 [ 153.690891][ T6270] driver_probe_device+0x4a/0x140 [ 153.690939][ T6270] __device_attach_driver+0x1df/0x320 [ 153.690987][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.691022][ T6270] __device_attach+0x1e4/0x4d0 [ 153.691069][ T6270] device_initial_probe+0xaf/0xd0 [ 153.691117][ T6270] bus_probe_device+0x64/0x160 [ 153.691157][ T6270] device_add+0x121d/0x1970 [ 153.691209][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.691257][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.691304][ T6270] process_one_work+0xac7/0x1b10 [ 153.691354][ T6270] worker_thread+0x5ef/0xe50 [ 153.691403][ T6270] kthread+0x373/0x450 [ 153.691447][ T6270] ret_from_fork+0x730/0xd60 [ 153.691480][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.691513][ T6270] [ 153.691521][ T6270] Freed by task 5731: [ 153.691537][ T6270] kasan_save_stack+0x30/0x50 [ 153.691589][ T6270] kasan_save_track+0x14/0x30 [ 153.691641][ T6270] kasan_save_free_info+0x3b/0x70 [ 153.691684][ T6270] __kasan_slab_free+0x5f/0x80 [ 153.691738][ T6270] kfree+0x22b/0x6d0 [ 153.691776][ T6270] redrat3_dev_probe+0x107a/0x2b50 [ 153.691813][ T6270] usb_probe_interface+0x386/0x9b0 [ 153.691854][ T6270] really_probe+0x241/0xa60 [ 153.691899][ T6270] __driver_probe_device+0x210/0x460 [ 153.691946][ T6270] driver_probe_device+0x4a/0x140 [ 153.691993][ T6270] __device_attach_driver+0x1df/0x320 [ 153.692041][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.692077][ T6270] __device_attach+0x1e4/0x4d0 [ 153.692123][ T6270] device_initial_probe+0xaf/0xd0 [ 153.692172][ T6270] bus_probe_device+0x64/0x160 [ 153.692211][ T6270] device_add+0x121d/0x1970 [ 153.692263][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.692318][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.692364][ T6270] usb_probe_device+0xef/0x400 [ 153.692393][ T6270] really_probe+0x241/0xa60 [ 153.692438][ T6270] __driver_probe_device+0x210/0x460 [ 153.692485][ T6270] driver_probe_device+0x4a/0x140 [ 153.692531][ T6270] __device_attach_driver+0x1df/0x320 [ 153.692579][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.692615][ T6270] __device_attach+0x1e4/0x4d0 [ 153.692661][ T6270] device_initial_probe+0xaf/0xd0 [ 153.692710][ T6270] bus_probe_device+0x64/0x160 [ 153.692749][ T6270] device_add+0x121d/0x1970 [ 153.692801][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.692854][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.692900][ T6270] process_one_work+0xac7/0x1b10 [ 153.692950][ T6270] worker_thread+0x5ef/0xe50 [ 153.692999][ T6270] kthread+0x373/0x450 [ 153.693042][ T6270] ret_from_fork+0x730/0xd60 [ 153.693074][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.693106][ T6270] [ 153.693114][ T6270] The buggy address belongs to the object at ffff88807cd92000 [ 153.693114][ T6270] which belongs to the cache kmalloc-2k of size 2048 [ 153.693143][ T6270] The buggy address is located 1894 bytes inside of [ 153.693143][ T6270] freed 2048-byte region [ffff88807cd92000, ffff88807cd92800) [ 153.693180][ T6270] [ 153.693188][ T6270] The buggy address belongs to the physical page: [ 153.693202][ T6270] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7cd90 [ 153.693234][ T6270] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 153.693263][ T6270] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 153.693295][ T6270] page_type: f5(slab) [ 153.693325][ T6270] raw: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 153.693359][ T6270] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 153.693393][ T6270] head: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 153.693426][ T6270] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 153.693460][ T6270] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 153.693494][ T6270] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 153.693515][ T6270] page dumped because: kasan: bad access detected [ 153.693531][ T6270] page_owner tracks the page as allocated [ 153.693544][ T6270] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5623, tgid 5623 (syz-executor), ts 96697253716 [ 153.693601][ T6270] post_alloc_hook+0xfd/0x120 [ 153.693642][ T6270] get_page_from_freelist+0x110d/0x35d0 [ 153.693686][ T6270] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 153.693734][ T6270] new_slab+0xa9/0x6e0 [ 153.693775][ T6270] refill_objects+0xe3/0x410 [ 153.693818][ T6270] __pcs_replace_empty_main+0x35e/0x650 [ 153.693865][ T6270] __kmalloc_node_track_caller_noprof+0x6a8/0x870 [ 153.693920][ T6270] kmalloc_reserve+0xe8/0x350 [ 153.693955][ T6270] pskb_expand_head+0x249/0x10e0 [ 153.694002][ T6270] netlink_trim+0x22d/0x2f0 [ 153.694035][ T6270] netlink_broadcast_filtered+0x6d/0xf20 [ 153.694095][ T6270] nlmsg_notify+0xb1/0x290 [ 153.694138][ T6270] rtmsg_ifinfo+0x177/0x1b0 [ 153.694170][ T6270] __dev_notify_flags+0x362/0x4b0 [ 153.694217][ T6270] netif_change_flags+0x108/0x160 [ 153.694263][ T6270] do_setlink.isra.0+0x1ac4/0x3e60 [ 153.694316][ T6270] page last free pid 5362 tgid 5362 ts 61481229891 stack trace: [ 153.694339][ T6270] __free_frozen_pages+0x79f/0x10f0 [ 153.694377][ T6270] qlist_free_all+0x47/0xf0 [ 153.694424][ T6270] kasan_quarantine_reduce+0x1a0/0x1f0 [ 153.694476][ T6270] __kasan_slab_alloc+0x69/0x90 [ 153.694506][ T6270] __kmalloc_noprof+0x2cc/0x840 [ 153.694555][ T6270] tomoyo_supervisor+0x65d/0x1340 [ 153.694596][ T6270] tomoyo_path_permission+0x270/0x3b0 [ 153.694645][ T6270] tomoyo_path_perm+0x364/0x460 [ 153.694695][ T6270] security_inode_getattr+0x116/0x280 [ 153.694747][ T6270] vfs_fstat+0x4b/0xe0 [ 153.694782][ T6270] __do_sys_newfstat+0x8b/0x110 [ 153.694818][ T6270] do_syscall_64+0x123/0x790 [ 153.694879][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.694914][ T6270] [ 153.694923][ T6270] Memory state around the buggy address: [ 153.694939][ T6270] ffff88807cd92600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.694965][ T6270] ffff88807cd92680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.694991][ T6270] >ffff88807cd92700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.695011][ T6270] ^ [ 153.695031][ T6270] ffff88807cd92780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.695057][ T6270] ffff88807cd92800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 153.695077][ T6270] ================================================================== [ 153.705184][ T37] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 153.759856][ T6270] ================================================================== [ 153.759876][ T6270] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 153.759933][ T6270] Read of size 1 at addr ffff88807cd92767 by task udevd/6270 [ 153.759962][ T6270] [ 153.759981][ T6270] CPU: 1 UID: 0 PID: 6270 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 153.760033][ T6270] Tainted: [B]=BAD_PAGE [ 153.760046][ T6270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 153.760069][ T6270] Call Trace: [ 153.760081][ T6270] [ 153.760094][ T6270] dump_stack_lvl+0x100/0x190 [ 153.760145][ T6270] print_report+0x13d/0x4b0 [ 153.760201][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.760246][ T6270] ? __virt_addr_valid+0x239/0x430 [ 153.760309][ T6270] ? string+0x471/0x4d0 [ 153.760360][ T6270] kasan_report+0xdf/0x1c0 [ 153.760398][ T6270] ? string+0x471/0x4d0 [ 153.760451][ T6270] string+0x471/0x4d0 [ 153.760501][ T6270] ? __pfx_string+0x10/0x10 [ 153.760548][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.760596][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.760640][ T6270] ? kasan_save_stack+0x3f/0x50 [ 153.760696][ T6270] ? kasan_save_stack+0x30/0x50 [ 153.760754][ T6270] vsnprintf+0x422/0x1300 [ 153.760814][ T6270] ? __pfx_vsnprintf+0x10/0x10 [ 153.760876][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.760924][ T6270] vscnprintf+0x40/0x90 [ 153.760979][ T6270] sysfs_emit+0x165/0x180 [ 153.761037][ T6270] ? __pfx_sysfs_emit+0x10/0x10 [ 153.761094][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.761139][ T6270] ? lock_acquire+0x1d1/0x380 [ 153.761173][ T6270] ? sysfs_file_kobj+0x21/0x290 [ 153.761231][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.761276][ T6270] ? find_held_lock+0x2b/0x80 [ 153.761324][ T6270] ? sysfs_file_kobj+0xe4/0x290 [ 153.761385][ T6270] ? __pfx_input_dev_show_name+0x10/0x10 [ 153.761443][ T6270] input_dev_show_name+0x5b/0x70 [ 153.761499][ T6270] dev_attr_show+0x52/0xa0 [ 153.761557][ T6270] ? __pfx_dev_attr_show+0x10/0x10 [ 153.761615][ T6270] sysfs_kf_seq_show+0x217/0x3f0 [ 153.761655][ T6270] seq_read_iter+0x32f/0x1270 [ 153.761724][ T6270] kernfs_fop_read_iter+0x46c/0x610 [ 153.761781][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.761826][ T6270] ? rw_verify_area+0xce/0x6d0 [ 153.761881][ T6270] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 153.761938][ T6270] vfs_read+0x82e/0xb40 [ 153.761990][ T6270] ? __pfx_vfs_read+0x10/0x10 [ 153.762042][ T6270] ? __pfx_do_sys_openat2+0x10/0x10 [ 153.762093][ T6270] ksys_read+0x12a/0x250 [ 153.762143][ T6270] ? __pfx_ksys_read+0x10/0x10 [ 153.762196][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.762244][ T6270] do_syscall_64+0x123/0x790 [ 153.762305][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.762344][ T6270] RIP: 0033:0x7f21672a7407 [ 153.762372][ T6270] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 153.762409][ T6270] RSP: 002b:00007ffe2dc1dbb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 153.762444][ T6270] RAX: ffffffffffffffda RBX: 00007f21679c2880 RCX: 00007f21672a7407 [ 153.762470][ T6270] RDX: 0000000000001000 RSI: 00007ffe2dc1e090 RDI: 0000000000000008 [ 153.762495][ T6270] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 153.762518][ T6270] R10: 0000000000000000 R11: 0000000000000202 R12: 000055816fd9cc10 [ 153.762543][ T6270] R13: 00007ffe2dc1dc90 R14: 00007ffe2dc1e090 R15: 000055815110bbcc [ 153.762579][ T6270] [ 153.762592][ T6270] [ 153.762600][ T6270] Allocated by task 5731: [ 153.762617][ T6270] kasan_save_stack+0x30/0x50 [ 153.762671][ T6270] kasan_save_track+0x14/0x30 [ 153.762723][ T6270] __kasan_kmalloc+0xaa/0xb0 [ 153.762774][ T6270] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 153.762817][ T6270] redrat3_dev_probe+0x326/0x2b50 [ 153.762862][ T6270] usb_probe_interface+0x386/0x9b0 [ 153.762899][ T6270] really_probe+0x241/0xa60 [ 153.762945][ T6270] __driver_probe_device+0x210/0x460 [ 153.762992][ T6270] driver_probe_device+0x4a/0x140 [ 153.763039][ T6270] __device_attach_driver+0x1df/0x320 [ 153.763088][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.763124][ T6270] __device_attach+0x1e4/0x4d0 [ 153.763171][ T6270] device_initial_probe+0xaf/0xd0 [ 153.763220][ T6270] bus_probe_device+0x64/0x160 [ 153.763259][ T6270] device_add+0x121d/0x1970 [ 153.763312][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.763366][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.763413][ T6270] usb_probe_device+0xef/0x400 [ 153.763443][ T6270] really_probe+0x241/0xa60 [ 153.763488][ T6270] __driver_probe_device+0x210/0x460 [ 153.763535][ T6270] driver_probe_device+0x4a/0x140 [ 153.763581][ T6270] __device_attach_driver+0x1df/0x320 [ 153.763630][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.763666][ T6270] __device_attach+0x1e4/0x4d0 [ 153.763711][ T6270] device_initial_probe+0xaf/0xd0 [ 153.763760][ T6270] bus_probe_device+0x64/0x160 [ 153.763800][ T6270] device_add+0x121d/0x1970 [ 153.763859][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.763908][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.763954][ T6270] process_one_work+0xac7/0x1b10 [ 153.764004][ T6270] worker_thread+0x5ef/0xe50 [ 153.764053][ T6270] kthread+0x373/0x450 [ 153.764097][ T6270] ret_from_fork+0x730/0xd60 [ 153.764130][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.764163][ T6270] [ 153.764171][ T6270] Freed by task 5731: [ 153.764187][ T6270] kasan_save_stack+0x30/0x50 [ 153.764240][ T6270] kasan_save_track+0x14/0x30 [ 153.764292][ T6270] kasan_save_free_info+0x3b/0x70 [ 153.764335][ T6270] __kasan_slab_free+0x5f/0x80 [ 153.764389][ T6270] kfree+0x22b/0x6d0 [ 153.764427][ T6270] redrat3_dev_probe+0x107a/0x2b50 [ 153.764464][ T6270] usb_probe_interface+0x386/0x9b0 [ 153.764500][ T6270] really_probe+0x241/0xa60 [ 153.764545][ T6270] __driver_probe_device+0x210/0x460 [ 153.764592][ T6270] driver_probe_device+0x4a/0x140 [ 153.764639][ T6270] __device_attach_driver+0x1df/0x320 [ 153.764688][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.764723][ T6270] __device_attach+0x1e4/0x4d0 [ 153.764769][ T6270] device_initial_probe+0xaf/0xd0 [ 153.764818][ T6270] bus_probe_device+0x64/0x160 [ 153.764863][ T6270] device_add+0x121d/0x1970 [ 153.764916][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.764970][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.765016][ T6270] usb_probe_device+0xef/0x400 [ 153.765046][ T6270] really_probe+0x241/0xa60 [ 153.765090][ T6270] __driver_probe_device+0x210/0x460 [ 153.765137][ T6270] driver_probe_device+0x4a/0x140 [ 153.765184][ T6270] __device_attach_driver+0x1df/0x320 [ 153.765232][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.765268][ T6270] __device_attach+0x1e4/0x4d0 [ 153.765314][ T6270] device_initial_probe+0xaf/0xd0 [ 153.765360][ T6270] bus_probe_device+0x64/0x160 [ 153.765394][ T6270] device_add+0x121d/0x1970 [ 153.765446][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.765495][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.765542][ T6270] process_one_work+0xac7/0x1b10 [ 153.765591][ T6270] worker_thread+0x5ef/0xe50 [ 153.765641][ T6270] kthread+0x373/0x450 [ 153.765684][ T6270] ret_from_fork+0x730/0xd60 [ 153.765717][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.765749][ T6270] [ 153.765758][ T6270] The buggy address belongs to the object at ffff88807cd92000 [ 153.765758][ T6270] which belongs to the cache kmalloc-2k of size 2048 [ 153.765787][ T6270] The buggy address is located 1895 bytes inside of [ 153.765787][ T6270] freed 2048-byte region [ffff88807cd92000, ffff88807cd92800) [ 153.765823][ T6270] [ 153.765831][ T6270] The buggy address belongs to the physical page: [ 153.765851][ T6270] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7cd90 [ 153.765883][ T6270] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 153.765912][ T6270] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 153.765943][ T6270] page_type: f5(slab) [ 153.765974][ T6270] raw: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 153.766007][ T6270] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 153.766041][ T6270] head: 00fff00000000040 ffff88801c02f000 dead000000000100 dead000000000122 [ 153.766075][ T6270] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 153.766109][ T6270] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 153.766142][ T6270] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 153.766163][ T6270] page dumped because: kasan: bad access detected [ 153.766179][ T6270] page_owner tracks the page as allocated [ 153.766191][ T6270] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5623, tgid 5623 (syz-executor), ts 96697253716 [ 153.766248][ T6270] post_alloc_hook+0xfd/0x120 [ 153.766289][ T6270] get_page_from_freelist+0x110d/0x35d0 [ 153.766334][ T6270] __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 153.766382][ T6270] new_slab+0xa9/0x6e0 [ 153.766422][ T6270] refill_objects+0xe3/0x410 [ 153.766465][ T6270] __pcs_replace_empty_main+0x35e/0x650 [ 153.766508][ T6270] __kmalloc_node_track_caller_noprof+0x6a8/0x870 [ 153.766563][ T6270] kmalloc_reserve+0xe8/0x350 [ 153.766598][ T6270] pskb_expand_head+0x249/0x10e0 [ 153.766646][ T6270] netlink_trim+0x22d/0x2f0 [ 153.766678][ T6270] netlink_broadcast_filtered+0x6d/0xf20 [ 153.766721][ T6270] nlmsg_notify+0xb1/0x290 [ 153.766765][ T6270] rtmsg_ifinfo+0x177/0x1b0 [ 153.766797][ T6270] __dev_notify_flags+0x362/0x4b0 [ 153.766849][ T6270] netif_change_flags+0x108/0x160 [ 153.766896][ T6270] do_setlink.isra.0+0x1ac4/0x3e60 [ 153.766948][ T6270] page last free pid 5362 tgid 5362 ts 61481229891 stack trace: [ 153.766972][ T6270] __free_frozen_pages+0x79f/0x10f0 [ 153.767009][ T6270] qlist_free_all+0x47/0xf0 [ 153.767056][ T6270] kasan_quarantine_reduce+0x1a0/0x1f0 [ 153.767108][ T6270] __kasan_slab_alloc+0x69/0x90 [ 153.767137][ T6270] __kmalloc_noprof+0x2cc/0x840 [ 153.767186][ T6270] tomoyo_supervisor+0x65d/0x1340 [ 153.767228][ T6270] tomoyo_path_permission+0x270/0x3b0 [ 153.767277][ T6270] tomoyo_path_perm+0x364/0x460 [ 153.767327][ T6270] security_inode_getattr+0x116/0x280 [ 153.767379][ T6270] vfs_fstat+0x4b/0xe0 [ 153.767414][ T6270] __do_sys_newfstat+0x8b/0x110 [ 153.767450][ T6270] do_syscall_64+0x123/0x790 [ 153.767505][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.767541][ T6270] [ 153.767549][ T6270] Memory state around the buggy address: [ 153.767566][ T6270] ffff88807cd92600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.767592][ T6270] ffff88807cd92680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.767617][ T6270] >ffff88807cd92700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.767637][ T6270] ^ [ 153.767658][ T6270] ffff88807cd92780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 153.767683][ T6270] ffff88807cd92800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 153.767703][ T6270] ================================================================== [ 153.824933][ T6270] ================================================================== [ 153.824952][ T6270] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 [ 153.825008][ T6270] Read of size 1 at addr ffff88807cd92768 by task udevd/6270 [ 153.825037][ T6270] [ 153.825055][ T6270] CPU: 1 UID: 0 PID: 6270 Comm: udevd Tainted: G B syzkaller #0 PREEMPT(full) [ 153.825107][ T6270] Tainted: [B]=BAD_PAGE [ 153.825120][ T6270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2026 [ 153.825143][ T6270] Call Trace: [ 153.825155][ T6270] [ 153.825169][ T6270] dump_stack_lvl+0x100/0x190 [ 153.825224][ T6270] print_report+0x13d/0x4b0 [ 153.825280][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.825325][ T6270] ? __virt_addr_valid+0x239/0x430 [ 153.825388][ T6270] ? string+0x471/0x4d0 [ 153.825434][ T6270] kasan_report+0xdf/0x1c0 [ 153.825472][ T6270] ? string+0x471/0x4d0 [ 153.825525][ T6270] string+0x471/0x4d0 [ 153.825575][ T6270] ? __pfx_string+0x10/0x10 [ 153.825622][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.825669][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.825713][ T6270] ? kasan_save_stack+0x3f/0x50 [ 153.825769][ T6270] ? kasan_save_stack+0x30/0x50 [ 153.825834][ T6270] vsnprintf+0x422/0x1300 [ 153.825903][ T6270] ? __pfx_vsnprintf+0x10/0x10 [ 153.825960][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.826009][ T6270] vscnprintf+0x40/0x90 [ 153.826064][ T6270] sysfs_emit+0x165/0x180 [ 153.826122][ T6270] ? __pfx_sysfs_emit+0x10/0x10 [ 153.826179][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.826224][ T6270] ? lock_acquire+0x1d1/0x380 [ 153.826258][ T6270] ? sysfs_file_kobj+0x21/0x290 [ 153.826316][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.826361][ T6270] ? find_held_lock+0x2b/0x80 [ 153.826410][ T6270] ? sysfs_file_kobj+0xe4/0x290 [ 153.826470][ T6270] ? __pfx_input_dev_show_name+0x10/0x10 [ 153.826528][ T6270] input_dev_show_name+0x5b/0x70 [ 153.826584][ T6270] dev_attr_show+0x52/0xa0 [ 153.826642][ T6270] ? __pfx_dev_attr_show+0x10/0x10 [ 153.826699][ T6270] sysfs_kf_seq_show+0x217/0x3f0 [ 153.826738][ T6270] seq_read_iter+0x32f/0x1270 [ 153.826804][ T6270] kernfs_fop_read_iter+0x46c/0x610 [ 153.826865][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.826910][ T6270] ? rw_verify_area+0xce/0x6d0 [ 153.826955][ T6270] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 153.827012][ T6270] vfs_read+0x82e/0xb40 [ 153.827064][ T6270] ? __pfx_vfs_read+0x10/0x10 [ 153.827116][ T6270] ? __pfx_do_sys_openat2+0x10/0x10 [ 153.827166][ T6270] ksys_read+0x12a/0x250 [ 153.827217][ T6270] ? __pfx_ksys_read+0x10/0x10 [ 153.827269][ T6270] ? srso_alias_return_thunk+0x5/0xfbef5 [ 153.827317][ T6270] do_syscall_64+0x123/0x790 [ 153.827379][ T6270] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.827417][ T6270] RIP: 0033:0x7f21672a7407 [ 153.827445][ T6270] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 153.827482][ T6270] RSP: 002b:00007ffe2dc1dbb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [ 153.827518][ T6270] RAX: ffffffffffffffda RBX: 00007f21679c2880 RCX: 00007f21672a7407 [ 153.827544][ T6270] RDX: 0000000000001000 RSI: 00007ffe2dc1e090 RDI: 0000000000000008 [ 153.827569][ T6270] RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000 [ 153.827593][ T6270] R10: 0000000000000000 R11: 0000000000000202 R12: 000055816fd9cc10 [ 153.827617][ T6270] R13: 00007ffe2dc1dc90 R14: 00007ffe2dc1e090 R15: 000055815110bbcc [ 153.827653][ T6270] [ 153.827667][ T6270] [ 153.827675][ T6270] Allocated by task 5731: [ 153.827691][ T6270] kasan_save_stack+0x30/0x50 [ 153.827745][ T6270] kasan_save_track+0x14/0x30 [ 153.827798][ T6270] __kasan_kmalloc+0xaa/0xb0 [ 153.827854][ T6270] __kmalloc_cache_noprof+0x2f8/0x6d0 [ 153.827897][ T6270] redrat3_dev_probe+0x326/0x2b50 [ 153.827935][ T6270] usb_probe_interface+0x386/0x9b0 [ 153.827976][ T6270] really_probe+0x241/0xa60 [ 153.828021][ T6270] __driver_probe_device+0x210/0x460 [ 153.828068][ T6270] driver_probe_device+0x4a/0x140 [ 153.828115][ T6270] __device_attach_driver+0x1df/0x320 [ 153.828163][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.828199][ T6270] __device_attach+0x1e4/0x4d0 [ 153.828246][ T6270] device_initial_probe+0xaf/0xd0 [ 153.828295][ T6270] bus_probe_device+0x64/0x160 [ 153.828335][ T6270] device_add+0x121d/0x1970 [ 153.828387][ T6270] usb_set_configuration+0xd97/0x1c60 [ 153.828442][ T6270] usb_generic_driver_probe+0xa1/0xe0 [ 153.828488][ T6270] usb_probe_device+0xef/0x400 [ 153.828518][ T6270] really_probe+0x241/0xa60 [ 153.828563][ T6270] __driver_probe_device+0x210/0x460 [ 153.828610][ T6270] driver_probe_device+0x4a/0x140 [ 153.828657][ T6270] __device_attach_driver+0x1df/0x320 [ 153.828704][ T6270] bus_for_each_drv+0x159/0x1e0 [ 153.828741][ T6270] __device_attach+0x1e4/0x4d0 [ 153.828787][ T6270] device_initial_probe+0xaf/0xd0 [ 153.828836][ T6270] bus_probe_device+0x64/0x160 [ 153.828882][ T6270] device_add+0x121d/0x1970 [ 153.828934][ T6270] usb_new_device.part.0+0xcc2/0x1686 [ 153.828983][ T6270] hub_event.cold+0x1e3/0xe90 [ 153.829030][ T6270] process_one_work+0xac7/0x1b10 [ 153.829079][ T6270] worker_thread+0x5ef/0xe50 [ 153.829129][ T6270] kthread+0x373/0x450 [ 153.829172][ T6270] ret_from_fork+0x730/0xd60 [ 153.829206][ T6270] ret_from_fork_asm+0x1a/0x30 [ 153.829239][ T6270] [ 153.829246][ T6270] Freed by task 5731: