last executing test programs: 350.5422ms ago: executing program 0 (id=1): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x23c34600}, 0x0) r1 = syz_open_dev$hidraw(&(0x7f0000000200), 0x1, 0x2) write$hidraw(r1, &(0x7f0000000300)="0102030405060708", 0x8) read$hidraw(r1, &(0x7f0000000400), 0x40) nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0) 101.168924ms ago: executing program 1 (id=2): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f00000000c0), 0x2) nanosleep(&(0x7f0000000300)={0x1}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000200)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000201), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000202)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000203)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000204)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000205)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000206)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000207)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000208)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000209)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f000000020a)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f000000020b)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f000000020c), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f000000020d), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f000000020e), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f000000020f)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000210)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000211)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000212)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000213)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000214)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000215)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000216), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000217), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000218)={0x2, 0xa}, 0x2) 69.0379ms ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='none\x00', &(0x7f0000000600)='./sys\x00', &(0x7f0000000700)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000900)='0000:00:02.0\x00', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0) write(r1, &(0x7f0000000100)='thunderbolt\x00', 0xb) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers/thunderbolt/bind\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='0000:00:02.0\x00', 0xc) close(r2) 9.494765ms ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./my_config\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000100)='./my_config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./my_config/gpio-sim/dev0/bank0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_config/gpio-sim/dev0/bank0/num_lines\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='4\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./my_config/gpio-sim/dev0/bank0/label\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='my_gpio_chip\x00', 0xd) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./my_config/gpio-sim/dev0/live\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='1\x00', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./my_config/gpio-aggregator/device0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_config/gpio-aggregator/device0/line0\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./my_config/gpio-aggregator/device0/line0/key\x00', 0x1, 0x0) write(r3, &(0x7f0000000a00)='my_gpio_chip\x00', 0xd) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./my_config/gpio-aggregator/device0/line0/offset\x00', 0x1, 0x0) write(r4, &(0x7f0000000c00)='0\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./my_config/gpio-aggregator/device0/live\x00', 0x1, 0x0) write(r5, &(0x7f0000000e00)='1\x00', 0x2) 0s ago: executing program 4 (id=5): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000001810050be017000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000000)='BBBBBBB') kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.204' (ED25519) to the list of known hosts. [ 27.728099][ T4700] cgroup: Unknown subsys name 'net' [ 27.868131][ T4700] cgroup: Unknown subsys name 'cpuset' [ 27.870123][ T4700] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 28.057199][ T4700] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 28.799522][ T4712] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 28.807405][ T4716] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 28.808931][ T4716] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 28.810300][ T4716] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 28.811937][ T4713] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 28.813624][ T4713] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 28.815930][ T4716] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 28.816278][ T4716] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 28.816837][ T4716] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 28.817116][ T4716] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 28.821575][ T4720] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 28.823207][ T4720] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 28.824676][ T4720] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 28.826522][ T50] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 28.830163][ T4720] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 28.836567][ T4718] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 28.838991][ T4718] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 28.841723][ T4720] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 28.842254][ T4720] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 28.845826][ T4716] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 28.846273][ T4716] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 28.846387][ T4716] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 28.850546][ T4720] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 28.850687][ T4720] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 28.857939][ T4713] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 29.220574][ T4710] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.220985][ T4710] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.221073][ T4710] bridge_slave_0: entered allmulticast mode [ 29.221604][ T4710] bridge_slave_0: entered promiscuous mode [ 29.223135][ T4710] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.223168][ T4710] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.223230][ T4710] bridge_slave_1: entered allmulticast mode [ 29.223660][ T4710] bridge_slave_1: entered promiscuous mode [ 29.250792][ T4710] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.256464][ T4710] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.260573][ T4721] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.261955][ T4721] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.263416][ T4721] bridge_slave_0: entered allmulticast mode [ 29.264887][ T4721] bridge_slave_0: entered promiscuous mode [ 29.284223][ T4721] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.285627][ T4721] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.286812][ T4721] bridge_slave_1: entered allmulticast mode [ 29.287329][ T4721] bridge_slave_1: entered promiscuous mode [ 29.295069][ T4710] team0: Port device team_slave_0 added [ 29.297109][ T4710] team0: Port device team_slave_1 added [ 29.314467][ T4710] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.315756][ T4710] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.318851][ T4710] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.320927][ T4721] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.321997][ T4721] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.331222][ T4710] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.332620][ T4710] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.337246][ T4710] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.350394][ T4721] team0: Port device team_slave_0 added [ 29.351828][ T4717] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.353229][ T4717] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.354739][ T4717] bridge_slave_0: entered allmulticast mode [ 29.356398][ T4717] bridge_slave_0: entered promiscuous mode [ 29.358493][ T4717] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.359793][ T4717] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.361198][ T4717] bridge_slave_1: entered allmulticast mode [ 29.362678][ T4717] bridge_slave_1: entered promiscuous mode [ 29.370808][ T4721] team0: Port device team_slave_1 added [ 29.382222][ T4722] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.382311][ T4722] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.382375][ T4722] bridge_slave_0: entered allmulticast mode [ 29.382806][ T4722] bridge_slave_0: entered promiscuous mode [ 29.392371][ T4721] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.393053][ T4721] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.393073][ T4721] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.393640][ T4722] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.393710][ T4722] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.393786][ T4722] bridge_slave_1: entered allmulticast mode [ 29.394259][ T4722] bridge_slave_1: entered promiscuous mode [ 29.397752][ T4717] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.398858][ T4717] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.407238][ T4710] hsr_slave_0: entered promiscuous mode [ 29.407626][ T4710] hsr_slave_1: entered promiscuous mode [ 29.408663][ T4721] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.408671][ T4721] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.408684][ T4721] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.434451][ T4717] team0: Port device team_slave_0 added [ 29.441478][ T4721] hsr_slave_0: entered promiscuous mode [ 29.441815][ T4721] hsr_slave_1: entered promiscuous mode [ 29.442028][ T4721] debugfs: 'hsr0' already exists in 'hsr' [ 29.442067][ T4721] Cannot create hsr debugfs directory [ 29.443418][ T4722] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.444789][ T4722] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.453195][ T4717] team0: Port device team_slave_1 added [ 29.462868][ T4722] team0: Port device team_slave_0 added [ 29.463923][ T4722] team0: Port device team_slave_1 added [ 29.490306][ T4714] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.491751][ T4714] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.493243][ T4714] bridge_slave_0: entered allmulticast mode [ 29.495135][ T4714] bridge_slave_0: entered promiscuous mode [ 29.500502][ T4722] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.500526][ T4722] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.500538][ T4722] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.501146][ T4722] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.501159][ T4722] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.501174][ T4722] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.512209][ T4722] hsr_slave_0: entered promiscuous mode [ 29.512491][ T4722] hsr_slave_1: entered promiscuous mode [ 29.512680][ T4722] debugfs: 'hsr0' already exists in 'hsr' [ 29.512690][ T4722] Cannot create hsr debugfs directory [ 29.529936][ T4717] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.531345][ T4717] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.536400][ T4717] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.539627][ T4717] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.540933][ T4717] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.545892][ T4717] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.546914][ T4714] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.547009][ T4714] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.547126][ T4714] bridge_slave_1: entered allmulticast mode [ 29.547556][ T4714] bridge_slave_1: entered promiscuous mode [ 29.586443][ T4714] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.602960][ T4714] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.607037][ T4717] hsr_slave_0: entered promiscuous mode [ 29.607414][ T4717] hsr_slave_1: entered promiscuous mode [ 29.607629][ T4717] debugfs: 'hsr0' already exists in 'hsr' [ 29.607639][ T4717] Cannot create hsr debugfs directory [ 29.627329][ T4714] team0: Port device team_slave_0 added [ 29.629363][ T4714] team0: Port device team_slave_1 added [ 29.644970][ T4714] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.644998][ T4714] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.645145][ T4714] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.645865][ T4714] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.645874][ T4714] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.645884][ T4714] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.670305][ T4714] hsr_slave_0: entered promiscuous mode [ 29.670649][ T4714] hsr_slave_1: entered promiscuous mode [ 29.670864][ T4714] debugfs: 'hsr0' already exists in 'hsr' [ 29.670874][ T4714] Cannot create hsr debugfs directory [ 29.695308][ T4710] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 29.698900][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.699298][ T4710] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 29.701325][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.706269][ T4710] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 29.708804][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.714215][ T4710] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 29.717308][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.746757][ T4721] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 29.749528][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.751217][ T4721] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 29.753641][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.759084][ T4710] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.759134][ T4710] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.759361][ T4710] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.759398][ T4710] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.760995][ T4721] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 29.762908][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.763313][ T4721] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 29.765159][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.796136][ T4717] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 29.798835][ T4717] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.799211][ T4717] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 29.802707][ T4717] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.808749][ T4710] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.810734][ T4717] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 29.813004][ T4717] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.813605][ T4717] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 29.815182][ T4717] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.822037][ T4721] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.822083][ T4721] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.822172][ T4721] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.822205][ T4721] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.838927][ T1934] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.840423][ T1934] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.842211][ T1934] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.843544][ T1934] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.855064][ T4722] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 29.858254][ T4722] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.862078][ T4710] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.864375][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.864486][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.865476][ T4722] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 29.867043][ T4722] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.867974][ T4722] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 29.870041][ T4722] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.875313][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.875369][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.879542][ T4722] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 29.881872][ T4722] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.910678][ T4714] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 29.913027][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 29.914841][ T4714] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 29.917229][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 29.927717][ T4721] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.934390][ T4714] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 29.939388][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 29.941011][ T4714] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 29.943141][ T4714] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 29.948083][ T4721] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.969898][ T4717] 8021q: adding VLAN 0 to HW filter on device bond0 [ 29.979586][ T1934] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.979632][ T1934] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.990071][ T4717] 8021q: adding VLAN 0 to HW filter on device team0 [ 29.993782][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.993835][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.003653][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.003702][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.014271][ T1155] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.014320][ T1155] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.040614][ T4722] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.048054][ T4721] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.050035][ T4721] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.078889][ T4722] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.092672][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.092725][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.093050][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.093078][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.098869][ T4710] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.113691][ T4722] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.113730][ T4722] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.117765][ T4714] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.135242][ T4714] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.155502][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.155561][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.165323][ T15] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.165378][ T15] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.168671][ T4710] veth0_vlan: entered promiscuous mode [ 30.189996][ T4710] veth1_vlan: entered promiscuous mode [ 30.202636][ T4714] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.204999][ T4714] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.211795][ T4710] veth0_macvtap: entered promiscuous mode [ 30.223362][ T4710] veth1_macvtap: entered promiscuous mode [ 30.233506][ T4710] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.236113][ T4710] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.284842][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.299114][ T39] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.299826][ T39] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.299939][ T39] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.312301][ T4721] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.343473][ T4717] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.362246][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.362287][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.380922][ T15] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.380961][ T15] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.401067][ T4722] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.409192][ T4717] veth0_vlan: entered promiscuous mode [ 30.421733][ T4717] veth1_vlan: entered promiscuous mode [ 30.430833][ T4722] veth0_vlan: entered promiscuous mode [ 30.440477][ T4722] veth1_vlan: entered promiscuous mode [ 30.446374][ T4714] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.451479][ T4710] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.462372][ T4717] veth0_macvtap: entered promiscuous mode [ 30.492570][ T4714] veth0_vlan: entered promiscuous mode [ 30.494076][ T4717] veth1_macvtap: entered promiscuous mode [ 30.504316][ T4714] veth1_vlan: entered promiscuous mode [ 30.510228][ T4721] veth0_vlan: entered promiscuous mode [ 30.514655][ T4721] veth1_vlan: entered promiscuous mode [ 30.517480][ T4722] veth0_macvtap: entered promiscuous mode [ 30.520294][ T4717] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.523497][ T4722] veth1_macvtap: entered promiscuous mode [ 30.532125][ T4717] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.533118][ T4722] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.534206][ T4722] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.543339][ T4721] veth0_macvtap: entered promiscuous mode [ 30.552550][ T4714] veth0_macvtap: entered promiscuous mode [ 30.554012][ T4721] veth1_macvtap: entered promiscuous mode [ 30.565902][ T4714] veth1_macvtap: entered promiscuous mode [ 30.592414][ T4714] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.595577][ T4721] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.606129][ T4714] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.611494][ T1892] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.611528][ T1892] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.623990][ T4721] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.634459][ T1892] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.634488][ T1892] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.650313][ T1892] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.650953][ T1892] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.650975][ T1892] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.650992][ T1892] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.662891][ T15] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.662928][ T15] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.676384][ T1892] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.676430][ T1892] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.687775][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.687810][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.699859][ T15] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.699894][ T15] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.707288][ T4819] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 30.739614][ T1892] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.739645][ T1892] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.739909][ T1892] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.739918][ T1892] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.748457][ T1934] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.751965][ T15] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.752083][ T15] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.752291][ T15] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.752387][ T15] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.752449][ T15] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.752606][ T15] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.752761][ T15] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.752881][ T15] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.752983][ T15] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.753068][ T15] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.753128][ T15] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.838901][ T4901] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 30.841604][ T4901] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 30.858070][ T4899] gpio-aggregator: Deferred probe canceled for creation via configfs. [ 30.867412][ T4819] usb 1-1: Using ep0 maxpacket: 16 [ 30.868250][ T4819] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 30.869201][ T4819] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 30.869216][ T4819] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 30.869234][ T4819] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 30.872313][ T4819] usb 1-1: config 0 descriptor?? [ 30.892067][ T4895] EXT4-fs (nvme0n1p2): shut down requested (2) [ 30.892189][ T4895] Aborting journal on device nvme0n1p2-8. Jan 1 00:00:30 syzkaller kern.alert kernel: [ 30.892067][ T4895] EXT4-fs (nvme0n1p2): shut down requested (2) [ 30.907067][ T4718] Bluetooth: hci4: command tx timeout [ 30.907259][ T4718] Bluetooth: hci3: command tx timeout [ 30.907284][ T4716] Bluetooth: hci1: command tx timeout [ 30.907471][ T4718] Bluetooth: hci0: command tx timeout [ 30.907626][ T4713] Bluetooth: hci2: command tx timeout [ 31.025490][ T4898] Unable to handle kernel paging request at virtual address ffff800098a1d640 [ 31.02741 ** replaying previous printk message ** [ 31.027416][ T4898] KASAN: probably user-memory-access in range [0x00000004c50eb200-0x00000004c50eb207] [ 31.027427][ T4898] Mem abort info: [ 31.027431][ T4898] ESR = 0x0000000096000007 [ 31.027436][ T4898] EC = 0x25: DABT (current EL), IL = 32 bits [ 31.027443][ T4898] SET = 0, FnV = 0 [ 31.027447][ T4898] EA = 0, S1PTW = 0 [ 31.027451][ T4898] FSC = 0x07: level 3 translation fault [ 31.027503][ T4898] Data abort info: [ 31.027506][ T4898] ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 [ 31.027511][ T4898] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 31.027517][ T4898] GCS = 0, Overlay = 0, DirtyBit = 0 [ 31.027522][ T4898] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000021b049000 [ 31.027528][ T4898] [ffff800098a1d640] pgd=0000000000000000, p4d=1000000221341003, pud=1000000221342003, pmd=100000010c78c403, pte=0000000000000000 [ 31.027626][ T4898] Internal error: Oops: 0000000096000007 [#1] SMP [ 31.043542][ T4898] Modules linked in: [ 31.044199][ T4898] CPU: 1 UID: 0 PID: 4898 Comm: syz.3.4 Not tainted syzkaller #0 PREEMPT [ 31.045716][ T4898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 31.047471][ T4898] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 31.048851][ T4898] pc : nhi_probe+0xc0/0x730 [ 31.049649][ T4898] lr : nhi_probe+0x34/0x730 [ 31.050559][ T4898] sp : ffff800094f675b0 [ 31.051281][ T4898] x29: ffff800094f675c0 x28: 1fffe00018004e1a x27: ffff0000c00270d0 [ 31.052630][ T4898] x26: 1fffe00018004e18 x25: ffff0000c2b100d0 x24: 1fffe00018004e19 [ 31.054057][ T4898] x23: dfff800000000000 x22: 1fffe00018004e27 x21: ffff0000c0027138 [ 31.055451][ T4898] x20: ffff0000c0027080 x19: ffff0000c00270c8 x18: 1fffe00034bb7428 [ 31.056847][ T4898] x17: 0000000000000003 x16: ffff800088b37000 x15: 0000000000000000 [ 31.058295][ T4898] x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 [ 31.059771][ T4898] x11: ffff80008a5d5e28 x10: 0000000000080000 x9 : 0000000000004181 [ 31.061183][ T4898] x8 : ffff800098a1d640 x7 : 0000000000000000 x6 : 0000000000000000 [ 31.062563][ T4898] x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff800080156118 [ 31.063997][ T4898] x2 : 0000000000000006 x1 : ffff0000c5c5ba80 x0 : 0000000000000001 [ 31.065389][ T4898] Call trace: [ 31.065953][ T4898] nhi_probe+0xc0/0x730 (P) [ 31.066753][ T4898] nhi_pci_probe+0x418/0x4e4 [ 31.067518][ T4898] local_pci_probe+0xc8/0x158 [ 31.068346][ T4898] pci_device_probe+0x460/0x8d4 [ 31.069177][ T4898] really_probe+0x29c/0x800 [ 31.069922][ T4898] __driver_probe_device+0x1e0/0x350 [ 31.070826][ T4898] device_driver_attach+0x58/0xac [ 31.071684][ T4898] bind_store+0xf4/0x14c [ 31.072412][ T4898] drv_attr_store+0x80/0xa4 [ 31.073184][ T4898] sysfs_kf_write+0xe0/0x108 [ 31.073978][ T4898] kernfs_fop_write_iter+0x260/0x3b8 [ 31.074884][ T4898] vfs_write+0x51c/0xa0c [ 31.075601][ T4898] ksys_write+0x12c/0x228 [ 31.076337][ T4898] __arm64_sys_write+0x84/0x98 [ 31.077190][ T4898] invoke_syscall+0x98/0x244 [ 31.078053][ T4898] el0_svc_common+0xec/0x23c [ 31.078925][ T4898] do_el0_svc+0x4c/0x5c [ 31.079650][ T4898] el0_svc+0x64/0x260 [ 31.080345][ T4898] el0t_64_sync_handler+0x44/0x104 [ 31.081251][ T4898] el0t_64_sync+0x198/0x19c [ 31.082076][ T4898] Code: d343feb6 9140e508 91190108 d503201f (b9400109) [ 31.083253][ T4898] ---[ end trace 0000000000000000 ]--- [ 31.320541][ T4898] Kernel panic - not syncing: Oops: Fatal exception [ 31.321675][ T4898] SMP: stopping secondary CPUs [ 31.322512][ T4898] Kernel Offset: disabled [ 31.323275][ T4898] CPU features: 0x14000000,003c0008,27020a02,a84ff6a7 [ 31.324410][ T4898] Memory Limit: none [ 31.553733][ T4898] Rebooting in 86400 seconds..