last executing test programs: 10.059340166s ago: executing program 1 (id=285): close(0x3) r0 = socket(0x1, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000010000000c00060001000000000000000c00020000000000000000001c0007"], 0x48}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="63812bbd7000fcdbdf2503000000080001"], 0x44}, 0x1, 0x0, 0x0, 0x440c0}, 0x40040) 9.606760507s ago: executing program 1 (id=290): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r0, 0x5) syz_emit_vhci(&(0x7f0000000340)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x42, 0xa}, {0x80, 0x40, 0x100, 0x100, 0xa}}}}, 0x17) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r1, 0x0, 0x10) 9.337101283s ago: executing program 2 (id=291): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', 0x0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000100)='3', 0x4e) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, 0x0, 0x0) 8.325247988s ago: executing program 2 (id=294): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x3) syz_emit_vhci(&(0x7f0000000500)=@HCI_EVENT_PKT={0x4, @hci_ev_user_confirm_req={{0x33, 0xa}, {@none, 0x7}}}, 0xd) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) 6.506708332s ago: executing program 3 (id=299): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xa, &(0x7f0000000440)=@framed={{}, [@generic={0x61, 0x8, 0x1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0x5, 0x4, 0x2, 0x4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) 6.506523642s ago: executing program 2 (id=300): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000200)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x6, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000300), 0x3) 6.425534094s ago: executing program 1 (id=301): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r0, {0x9}}, './my_configfs/usb_gadget/g1/functions/uvc.usb0\x00'}) ioctl$VIDIOC_S_EDID(r1, 0xc0245629, &(0x7f0000000380)={0x0, 0x6, 0xc93, '\x00', &(0x7f00000003c0)=0xe}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000400)={0x8, 0x100008b}, 0x0) r2 = syz_open_dev$dvb_frontend(&(0x7f0000000440), 0x0, 0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000004c0), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x141102) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000005c0)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7fce1dca24e3ee4c89a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d83104000000fda542e718f94b929ade", 0x55}], 0x1}, 0x20048000) bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0700000004000000080000000102020000000000", @ANYRES32, @ANYBLOB="0000007ced0628db0000000000000000000000a9c23f880000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000100"/28], 0x50) writev(0xffffffffffffffff, 0x0, 0x0) writev(r3, &(0x7f0000000700)=[{&(0x7f0000000740)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f00000007c0)='./my_configfs\x00', &(0x7f0000000800)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) chdir(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000008c0)='streaming/uncompressed/u\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='streaming/uncompressed/u/360p\x00', 0x1ff) symlink(&(0x7f0000000940)='streaming/header/h\x00', &(0x7f0000000980)='streaming/class/fs/h\x00') close(r2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r5 = syz_open_dev$usbfs(&(0x7f0000000000), 0x206, 0x48401) ioctl$USBDEVFS_ALLOW_SUSPEND(r5, 0x5522) ioctl$USBDEVFS_FORBID_SUSPEND(r5, 0x5521) 6.365575396s ago: executing program 2 (id=302): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r0, {0x9}}, './my_configfs/usb_gadget/g1/functions/uvc.usb0\x00'}) ioctl$VIDIOC_S_EDID(r1, 0xc0245629, &(0x7f0000000380)={0x0, 0x6, 0xc93, '\x00', &(0x7f00000003c0)=0xe}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000400)={0x8, 0x100008b}, 0x0) r2 = syz_open_dev$dvb_frontend(&(0x7f0000000440), 0x0, 0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000004c0), 0x80200, 0x0) r3 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000005c0)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7fce1dca24e3ee4c89a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d83104000000fda542e718f94b929ade", 0x55}], 0x1}, 0x20048000) write(r3, &(0x7f0000000640)="2400000021002551241c0165ff00fc020200000003100f000ee1000c08000b0000000000", 0x24) bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0700000004000000080000000102020000000000", @ANYRES32, @ANYBLOB="0000007ced0628db0000000000000000000000a9c23f880000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000100"/28], 0x50) writev(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000700)=[{&(0x7f0000000740)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f00000007c0)='./my_configfs\x00', &(0x7f0000000800)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) chdir(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000008c0)='streaming/uncompressed/u\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='streaming/uncompressed/u/360p\x00', 0x1ff) symlink(&(0x7f0000000940)='streaming/header/h\x00', &(0x7f0000000980)='streaming/class/fs/h\x00') close(r2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r4 = syz_open_dev$usbfs(&(0x7f0000000000), 0x206, 0x48401) ioctl$USBDEVFS_ALLOW_SUSPEND(r4, 0x5522) ioctl$USBDEVFS_FORBID_SUSPEND(r4, 0x5521) 6.310776476s ago: executing program 3 (id=303): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r1, &(0x7f0000000100)='3', 0x4e) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, 0x0, 0x0) 5.462684567s ago: executing program 0 (id=304): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) r1 = syz_open_dev$dri(0x0, 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000100)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_DIRTYFB(r0, 0xc01864b1, &(0x7f0000000180)={r3, 0x1, 0x0, 0x0, 0x0}) 5.403950069s ago: executing program 2 (id=305): openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x80, 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x86022, &(0x7f0000000040)={[{@nr_inodes={'nr_inodes', 0x3d, [0x35]}}]}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000002000100fffe0900010073797a300000000040000000030a01020000000000000000010000000900030073797a310000000014000480080002400000000008000140000000040900010073797a300000000064000000060a010400000000000000000100000008000b40000000000900010073797a30000000003c0004"], 0xec}}, 0x0) mount(0x0, 0x0, 0x0, 0x44021, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./file0\x00', 0x0) mount$bind(&(0x7f0000000680)='./file0\x00', &(0x7f00000006c0)='./file0\x00', 0x0, 0x2125099, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000700)='\x00', 0x89901) move_mount(r1, &(0x7f0000000740)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0x200) 5.35722564s ago: executing program 3 (id=306): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x48, 0x16, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'pim6reg1\x00'}]}]}]}], {0x14, 0x10}}, 0x90}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 5.35656839s ago: executing program 1 (id=307): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000180)='./debugfs\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debugfs/kvm/halt_poll_fail_ns\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='0', 0x1) 5.34437121s ago: executing program 0 (id=308): close(0x3) r0 = socket(0x1, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000010000000c00060001000000000000000c00020000000000000000001c0007"], 0x48}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="63812bbd7000fcdbdf2503000000080001"], 0x44}, 0x1, 0x0, 0x0, 0x440c0}, 0x40040) 4.448423572s ago: executing program 3 (id=309): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r0, 0x5) syz_emit_vhci(&(0x7f0000000340)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x42, 0xa}, {0x80, 0x40, 0x100, 0x100, 0xa}}}}, 0x17) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r1, 0x0, 0x10) 4.412000013s ago: executing program 2 (id=310): bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x86, 0x7, 0x7ffffffc, 0x717e387b, 0x40, "1aec4a0624788a22b2fb12dab240794233a5bd", 0x4, 0x2}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0x15) ioctl$TCSETS(r1, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400004, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$TCSETS(r1, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) 4.302597916s ago: executing program 0 (id=311): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=ANY=[@ANYBLOB="0900000004000000080000000a"], 0x50) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xb, &(0x7f0000000440)=@framed={{}, [@map_fd={0x18, 0x1, 0x1, 0x0, r1}, @generic={0x15, 0x8, 0x0, 0x2}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0x5, 0x4, 0x2, 0x4}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) 3.467234736s ago: executing program 1 (id=312): openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x80, 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x86022, &(0x7f0000000040)={[{@nr_inodes={'nr_inodes', 0x3d, [0x35]}}]}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000002000100fffe0900010073797a300000000040000000030a01020000000000000000010000000900030073797a310000000014000480080002400000000008000140000000040900010073797a300000000064000000060a010400000000000000000100000008000b40000000000900010073797a30000000003c0004"], 0xec}}, 0x0) mount(0x0, 0x0, 0x0, 0x44021, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./file0\x00', 0x0) mount$bind(&(0x7f0000000680)='./file0\x00', &(0x7f00000006c0)='./file0\x00', 0x0, 0x2125099, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000700)='\x00', 0x89901) move_mount(r2, &(0x7f0000000740)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./file0\x00', 0x200) madvise(&(0x7f00002d9000/0x2000)=nil, 0x2000, 0x70) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r3, 0x0, 0x41, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x44) getsockopt$EBT_SO_GET_ENTRIES(r3, 0x0, 0x81, &(0x7f0000000500)={'nat\x00', 0x0, 0x4, 0x0, [0x0, 0x7, 0x2, 0x0, 0x6, 0x5], 0x0, &(0x7f00000002c0), 0x0}, &(0x7f0000000580)=0x50) set_mempolicy(0x2, &(0x7f0000000600)=0x54, 0x6) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYRES8, @ANYRESHEX, @ANYRES16], 0x48) ptrace(0x4208, 0x0) 3.463521336s ago: executing program 0 (id=313): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1f00000007"], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) syz_open_dev$sndctrl(0x0, 0x458, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x4000, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="9000000000010506010000000000000002000000340001801400018008000100c0a8010108000200c0a801021c000280050001000600000006000200303900000600030000150000340002801400018008000100c0a8010208000200c0a801011c000280050001000600000006000200001500000600030030390000080007000000012c0c0005800800010066747000"], 0x90}}, 0x0) sendmsg$nl_netfilter(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="b800000000020104010000000000000002000000340001801400018008000100c0a8010108000200c0a801021c000280050001000600000006000200303900000600030000150000340002801400018008000100c0a8010208000200c0a801011c00028005000100060000000600020000000000060003004e200000340003801400018008000100ffffffff08000200ffffffff1c00028005000100ff000000060002000000000006000300ffff000008000400000001"], 0xb8}}, 0x0) sendmsg$nl_netfilter(r3, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x884}, 0x0) setsockopt$llc_int(r1, 0x10c, 0x6, 0x0, 0x0) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x20000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='sys_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='sys_mnt\x00', &(0x7f0000000280)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='sys_mnt/block/zram0/comp_algorithm\x00', 0x1, 0x0) write(r5, &(0x7f0000000340)='lzo', 0x3) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f0000001a00)={'dt2814\x00', [0x2003, 0x20, 0x8, 0x20000001, 0x25, 0x0, 0x400, 0x200002, 0x54c6cff3, 0xfd, 0x2, 0x3, 0xfffffff3, 0x400001, 0x6, 0x8, 0x2, 0x7f, 0xffffffff, 0x40000003, 0x200089, 0x2, 0x4, 0x30001e5b, 0x3, 0x0, 0x3, 0x6, 0x4006, 0x8000, 0x3]}) 1.965946692s ago: executing program 3 (id=314): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0e000000040000000800000002"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xd, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018", @ANYRES32=r0, @ANYBLOB="0000000000000000b708000000bc7a007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 1.862879365s ago: executing program 0 (id=315): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r1, &(0x7f0000000100)='3', 0x4e) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, 0x0, 0x0) 133.888606ms ago: executing program 3 (id=316): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000300)={{0x1, 0x1, 0x18, r0, {0x9}}, './my_configfs/usb_gadget/g1/functions/uvc.usb0\x00'}) ioctl$VIDIOC_S_EDID(r1, 0xc0245629, &(0x7f0000000380)={0x0, 0x6, 0xc93, '\x00', &(0x7f00000003c0)=0xe}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000400)={0x8, 0x100008b}, 0x0) r2 = syz_open_dev$dvb_frontend(&(0x7f0000000440), 0x0, 0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000004c0), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x141102) r4 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000005c0)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7fce1dca24e3ee4c89a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d83104000000fda542e718f94b929ade", 0x55}], 0x1}, 0x20048000) bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0700000004000000080000000102020000000000", @ANYRES32, @ANYBLOB="0000007ced0628db0000000000000000000000a9c23f880000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000100"/28], 0x50) writev(0xffffffffffffffff, 0x0, 0x0) writev(r3, &(0x7f0000000700)=[{&(0x7f0000000740)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f00000007c0)='./my_configfs\x00', &(0x7f0000000800)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) chdir(&(0x7f0000000880)='./my_configfs/usb_gadget/g1/functions/uvc.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000008c0)='streaming/uncompressed/u\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='streaming/uncompressed/u/360p\x00', 0x1ff) symlink(&(0x7f0000000940)='streaming/header/h\x00', &(0x7f0000000980)='streaming/class/fs/h\x00') close(r2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r5 = syz_open_dev$usbfs(&(0x7f0000000000), 0x206, 0x48401) ioctl$USBDEVFS_ALLOW_SUSPEND(r5, 0x5522) ioctl$USBDEVFS_FORBID_SUSPEND(r5, 0x5521) 531.5µs ago: executing program 1 (id=317): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pages=64\n', 0xc) close(r0) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000400)='naa.6001405', 0xb) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) 0s ago: executing program 0 (id=318): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1}}, @NFT_MSG_DELFLOWTABLE={0x48, 0x16, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'pim6reg1\x00'}]}]}]}], {0x14, 0x10}}, 0xa4}, 0x1, 0x0, 0x0, 0x40000}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.161' (ED25519) to the list of known hosts. [ 65.236204][ T5757] cgroup: Unknown subsys name 'net' [ 65.399976][ T5757] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 66.733379][ T5757] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 68.404864][ T5770] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 68.413222][ T5770] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 68.420797][ T5770] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 68.444904][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 68.454268][ T5772] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 68.461364][ T5772] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 68.469562][ T5772] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 68.477727][ T5772] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 68.503699][ T5772] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 68.515341][ T5779] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 68.522693][ T5779] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 68.522833][ T5772] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 68.543923][ T5772] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 68.556827][ T5781] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 68.571049][ T5772] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 68.577514][ T5783] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 68.579066][ T5772] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 68.585373][ T5086] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 68.592802][ T5772] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 68.600603][ T5086] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 68.613700][ T5086] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 68.625327][ T5086] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 68.633013][ T5086] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 68.647665][ T5770] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 69.036783][ T5768] chnl_net:caif_netlink_parms(): no params data found [ 69.111371][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 69.178977][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 69.195965][ T5768] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.203976][ T5768] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.211190][ T5768] bridge_slave_0: entered allmulticast mode [ 69.218212][ T5768] bridge_slave_0: entered promiscuous mode [ 69.231934][ T5768] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.239162][ T5768] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.246456][ T5768] bridge_slave_1: entered allmulticast mode [ 69.253423][ T5768] bridge_slave_1: entered promiscuous mode [ 69.288871][ T5771] chnl_net:caif_netlink_parms(): no params data found [ 69.334972][ T5768] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.369244][ T5768] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.423465][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.430586][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.440444][ T5777] bridge_slave_0: entered allmulticast mode [ 69.447280][ T5777] bridge_slave_0: entered promiscuous mode [ 69.462819][ T5768] team0: Port device team_slave_0 added [ 69.480095][ T5768] team0: Port device team_slave_1 added [ 69.486128][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.496290][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.503487][ T5777] bridge_slave_1: entered allmulticast mode [ 69.510125][ T5777] bridge_slave_1: entered promiscuous mode [ 69.548482][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.556854][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.566418][ T5774] bridge_slave_0: entered allmulticast mode [ 69.573017][ T5774] bridge_slave_0: entered promiscuous mode [ 69.608395][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.615575][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.622781][ T5774] bridge_slave_1: entered allmulticast mode [ 69.630539][ T5774] bridge_slave_1: entered promiscuous mode [ 69.639208][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.651311][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.658338][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.684684][ T5768] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.696674][ T5771] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.704094][ T5771] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.711260][ T5771] bridge_slave_0: entered allmulticast mode [ 69.720177][ T5771] bridge_slave_0: entered promiscuous mode [ 69.739618][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.749399][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.756731][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.782789][ T5768] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.800768][ T5771] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.808239][ T5771] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.815959][ T5771] bridge_slave_1: entered allmulticast mode [ 69.822615][ T5771] bridge_slave_1: entered promiscuous mode [ 69.866588][ T5777] team0: Port device team_slave_0 added [ 69.878241][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.899592][ T5777] team0: Port device team_slave_1 added [ 69.907786][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.927177][ T5771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.973732][ T5771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.013272][ T5774] team0: Port device team_slave_0 added [ 70.027943][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.036674][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.065367][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.080602][ T5768] hsr_slave_0: entered promiscuous mode [ 70.087547][ T5768] hsr_slave_1: entered promiscuous mode [ 70.100738][ T5774] team0: Port device team_slave_1 added [ 70.117191][ T5771] team0: Port device team_slave_0 added [ 70.126359][ T5771] team0: Port device team_slave_1 added [ 70.132737][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.139904][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.166502][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.221731][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.228812][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.255299][ T5771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.272288][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.279338][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.305359][ T5771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.317425][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.324578][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.350863][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.385410][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.392388][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 70.418406][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.480332][ T5777] hsr_slave_0: entered promiscuous mode [ 70.487078][ T5777] hsr_slave_1: entered promiscuous mode [ 70.493197][ T5777] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 70.501020][ T5777] Cannot create hsr debugfs directory [ 70.580601][ T5771] hsr_slave_0: entered promiscuous mode [ 70.587035][ T5770] Bluetooth: hci0: command tx timeout [ 70.593857][ T5771] hsr_slave_1: entered promiscuous mode [ 70.599831][ T5771] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 70.607875][ T5771] Cannot create hsr debugfs directory [ 70.653191][ T5770] Bluetooth: hci3: command tx timeout [ 70.659206][ T5770] Bluetooth: hci1: command tx timeout [ 70.694310][ T5774] hsr_slave_0: entered promiscuous mode [ 70.700602][ T5774] hsr_slave_1: entered promiscuous mode [ 70.707221][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 70.714881][ T5774] Cannot create hsr debugfs directory [ 70.733222][ T5770] Bluetooth: hci2: command tx timeout [ 70.806324][ T5768] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 70.837517][ T5768] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 70.884344][ T5768] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 70.895528][ T5768] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 71.048667][ T5777] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 71.070992][ T5777] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 71.080557][ T5777] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 71.093823][ T5777] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 71.180369][ T5771] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 71.196169][ T5771] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 71.208453][ T5771] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 71.225980][ T5771] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 71.298317][ T5774] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 71.308042][ T5774] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 71.319881][ T5774] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 71.329191][ T5774] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 71.368509][ T5768] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.432737][ T5768] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.442462][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.458685][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.465298][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.498117][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.511211][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.518489][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.529139][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.536290][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.584562][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.591737][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.611803][ T3480] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.618957][ T3480] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.641160][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.657234][ T5768] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 71.756501][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.766448][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.821181][ T3480] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.828331][ T3480] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.851338][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.875073][ T3456] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.882197][ T3456] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.938300][ T3456] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.945477][ T3456] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.976577][ T3456] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.983742][ T3456] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.047679][ T5771] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 72.142699][ T5768] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.237802][ T5768] veth0_vlan: entered promiscuous mode [ 72.272269][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.309547][ T5768] veth1_vlan: entered promiscuous mode [ 72.421413][ T5768] veth0_macvtap: entered promiscuous mode [ 72.444836][ T5777] veth0_vlan: entered promiscuous mode [ 72.467132][ T5768] veth1_macvtap: entered promiscuous mode [ 72.509924][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.521022][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.537165][ T5777] veth1_vlan: entered promiscuous mode [ 72.555508][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.571026][ T5768] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.582417][ T5768] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.592215][ T5768] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.601406][ T5768] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.615554][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.653983][ T5770] Bluetooth: hci0: command tx timeout [ 72.671013][ T5777] veth0_macvtap: entered promiscuous mode [ 72.699546][ T5777] veth1_macvtap: entered promiscuous mode [ 72.733535][ T51] Bluetooth: hci3: command tx timeout [ 72.739029][ T5770] Bluetooth: hci1: command tx timeout [ 72.760750][ T5771] veth0_vlan: entered promiscuous mode [ 72.795974][ T5771] veth1_vlan: entered promiscuous mode [ 72.813911][ T5770] Bluetooth: hci2: command tx timeout [ 72.841041][ T5774] veth0_vlan: entered promiscuous mode [ 72.852300][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.863736][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.877282][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.890551][ T1135] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.909651][ T1135] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.920877][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.934322][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.947171][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.958216][ T5774] veth1_vlan: entered promiscuous mode [ 72.984726][ T5777] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.995903][ T5777] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.004865][ T5777] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.016400][ T5777] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.036677][ T5771] veth0_macvtap: entered promiscuous mode [ 73.066745][ T5771] veth1_macvtap: entered promiscuous mode [ 73.075911][ T3480] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.090307][ T3480] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.118333][ T5774] veth0_macvtap: entered promiscuous mode [ 73.159427][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.172766][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.182663][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.193471][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.205424][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.230138][ T5774] veth1_macvtap: entered promiscuous mode [ 73.266578][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.282779][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.294199][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.312602][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.325254][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.334260][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.347074][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.357400][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.368003][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.378125][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.393685][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.409905][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.447618][ T5771] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.467096][ T5771] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.481876][ T5771] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.491966][ T5771] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.521332][ T3456] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.531371][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.542649][ T3456] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.550600][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.564426][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.575326][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.585495][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.596286][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.608015][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.632528][ T5774] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.641643][ T5774] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.650966][ T5774] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.659907][ T5774] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.049507][ T3480] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.153408][ T3480] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.652094][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.663416][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.734260][ T5770] Bluetooth: hci0: command tx timeout [ 74.789396][ T5841] syz.0.1[5841]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 74.813821][ T5770] Bluetooth: hci1: command tx timeout [ 74.819270][ T5770] Bluetooth: hci3: command tx timeout [ 74.827954][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.871689][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.893423][ T5770] Bluetooth: hci2: command tx timeout [ 74.978903][ T5845] device-mapper: table: 248:0: multipath: invalid number of paths (-EINVAL) [ 75.009638][ T3456] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.024486][ T5845] device-mapper: ioctl: error adding target to table [ 75.042027][ T3456] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.086814][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.118471][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.500914][ T5853] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 75.848412][ T5829] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 76.186094][ T5829] usb 4-1: config index 0 descriptor too short (expected 39, got 27) [ 76.281163][ T5829] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 76.397156][ T5829] usb 4-1: config 0 interface 0 has no altsetting 0 [ 76.482121][ T5829] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 76.503950][ T5829] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 76.922226][ T51] Bluetooth: hci3: command tx timeout [ 76.927997][ T5086] Bluetooth: hci1: command tx timeout [ 76.936778][ T5770] Bluetooth: hci0: command tx timeout [ 76.990163][ T5770] Bluetooth: hci2: command tx timeout [ 78.057965][ T5829] usb 4-1: Product: syz [ 78.062181][ T5829] usb 4-1: Manufacturer: syz [ 78.068726][ T5829] usb 4-1: SerialNumber: syz [ 78.078254][ T5829] usb 4-1: config 0 descriptor?? [ 78.088535][ T5829] hub 4-1:0.0: bad descriptor, ignoring hub [ 78.094929][ T5829] hub: probe of 4-1:0.0 failed with error -5 [ 78.106278][ T5829] usb 4-1: selecting invalid altsetting 0 [ 78.480163][ T5874] Bluetooth: MGMT ver 1.22 [ 78.817742][ T5852] usb 4-1: reset high-speed USB device number 2 using dummy_hcd [ 79.024604][ T5867] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 79.236277][ T5852] usb 4-1: failed to restore interface 0 altsetting 251 (error=-71) [ 79.266195][ T5811] usb 4-1: USB disconnect, device number 2 [ 79.494007][ T27] audit: type=1800 audit(1791749927.716:2): pid=5885 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.14" name="no_out_endpoint" dev="configfs" ino=6633 res=0 errno=0 [ 79.531656][ T5885] Need at least one configuration in g1. [ 79.539377][ T5885] udc dummy_udc.0: failed to start g1: -22 [ 79.546189][ T27] audit: type=1800 audit(1791749927.746:3): pid=5885 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.14" name="subclass" dev="configfs" ino=6634 res=0 errno=0 [ 79.566596][ T5885] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 79.597370][ T5885] UDC core: g1: couldn't find an available UDC or it's busy [ 79.607361][ T27] audit: type=1800 audit(1791749927.746:4): pid=5885 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.14" name="protocol" dev="configfs" ino=6635 res=0 errno=0 [ 79.642454][ T27] audit: type=1800 audit(1791749927.746:5): pid=5885 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.14" name="report_desc" dev="configfs" ino=6637 res=0 errno=0 [ 79.667922][ T27] audit: type=1800 audit(1791749927.746:6): pid=5885 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.14" name="UDC" dev="configfs" ino=6638 res=0 errno=0 [ 79.765643][ T5894] capability: warning: `syz.1.17' uses deprecated v2 capabilities in a way that may be insecure [ 80.979156][ T27] audit: type=1800 audit(1791749929.196:7): pid=5916 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.28" name="no_out_endpoint" dev="configfs" ino=8109 res=0 errno=0 [ 81.014916][ T5916] Need at least one configuration in g1. [ 81.020681][ T5916] udc dummy_udc.0: failed to start g1: -22 [ 81.031698][ T27] audit: type=1800 audit(1791749929.226:8): pid=5916 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.28" name="subclass" dev="configfs" ino=8110 res=0 errno=0 [ 81.053479][ T5916] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 81.066447][ T5916] UDC core: g1: couldn't find an available UDC or it's busy [ 81.076960][ T27] audit: type=1800 audit(1791749929.226:9): pid=5916 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.28" name="protocol" dev="configfs" ino=8111 res=0 errno=0 [ 81.209232][ T5921] netlink: 12 bytes leftover after parsing attributes in process `syz.0.30'. [ 81.296378][ T27] audit: type=1800 audit(1791749929.226:10): pid=5916 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.28" name="report_desc" dev="configfs" ino=8112 res=0 errno=0 [ 81.540039][ T27] audit: type=1800 audit(1791749929.236:11): pid=5916 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.28" name="UDC" dev="configfs" ino=8113 res=0 errno=0 [ 82.273110][ T5927] comedi comedi2: reset error (fatal) [ 82.786347][ T5938] FAULT_INJECTION: forcing a failure. [ 82.786347][ T5938] name failslab, interval 1, probability 0, space 0, times 1 [ 82.827759][ T5938] CPU: 1 PID: 5938 Comm: syz.3.34 Not tainted syzkaller #0 [ 82.834993][ T5938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 82.845084][ T5938] Call Trace: [ 82.848382][ T5938] [ 82.851328][ T5938] dump_stack_lvl+0x18c/0x250 [ 82.856050][ T5938] ? show_regs_print_info+0x20/0x20 [ 82.861276][ T5938] ? load_image+0x420/0x420 [ 82.865810][ T5938] ? __might_sleep+0xe0/0xe0 [ 82.870426][ T5938] ? __lock_acquire+0x7eb0/0x7eb0 [ 82.875484][ T5938] ? futex_wait+0x4a7/0x5c0 [ 82.880027][ T5938] should_fail_ex+0x394/0x4c0 [ 82.884738][ T5938] should_failslab+0x9/0x20 [ 82.889263][ T5938] slab_pre_alloc_hook+0x59/0x300 [ 82.894316][ T5938] ? load_msg+0x3c/0x380 [ 82.898589][ T5938] ? load_msg+0x3c/0x380 [ 82.902860][ T5938] __kmem_cache_alloc_node+0x53/0x250 [ 82.908263][ T5938] ? load_msg+0x3c/0x380 [ 82.912515][ T5938] __kmalloc+0xa7/0x240 [ 82.916677][ T5938] load_msg+0x3c/0x380 [ 82.920751][ T5938] ? slab_free_freelist_hook+0x130/0x1a0 [ 82.926384][ T5938] do_msgrcv+0x279/0x13d0 [ 82.930714][ T5938] ? kmem_cache_free+0xf8/0x290 [ 82.935572][ T5938] ? do_msgrcv+0x13d0/0x13d0 [ 82.940164][ T5938] ? putname+0x22/0x150 [ 82.944335][ T5938] ? ksys_msgrcv+0x40/0x40 [ 82.948764][ T5938] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 82.954747][ T5938] ? lock_chain_count+0x20/0x20 [ 82.959600][ T5938] ? lockdep_hardirqs_on+0x98/0x150 [ 82.964799][ T5938] ? __x64_sys_msgrcv+0x20/0xd0 [ 82.969655][ T5938] do_syscall_64+0x55/0xb0 [ 82.974076][ T5938] ? clear_bhb_loop+0x40/0x90 [ 82.978768][ T5938] ? clear_bhb_loop+0x40/0x90 [ 82.983528][ T5938] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 82.989477][ T5938] RIP: 0033:0x7f81bb59e1d9 [ 82.993902][ T5938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.013513][ T5938] RSP: 002b:00007f81bc4a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000046 [ 83.021931][ T5938] RAX: ffffffffffffffda RBX: 00007f81bb825fa0 RCX: 00007f81bb59e1d9 [ 83.029905][ T5938] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 83.037883][ T5938] RBP: 00007f81bb635888 R08: 0000000000004800 R09: 0000000000000000 [ 83.045853][ T5938] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 83.053828][ T5938] R13: 00007f81bb826038 R14: 00007f81bb825fa0 R15: 00007ffc323c6db8 [ 83.061814][ T5938] [ 83.246743][ T5945] dummy0 speed is unknown, defaulting to 1000 [ 83.253235][ T5945] dummy0 speed is unknown, defaulting to 1000 [ 83.262012][ T5945] dummy0 speed is unknown, defaulting to 1000 [ 83.276691][ T5945] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 83.293412][ T5945] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 83.341300][ T5948] loop0: detected capacity change from 0 to 4096 [ 83.361390][ T5945] dummy0 speed is unknown, defaulting to 1000 [ 83.379315][ T5945] dummy0 speed is unknown, defaulting to 1000 [ 83.387781][ T5945] dummy0 speed is unknown, defaulting to 1000 [ 83.399506][ T5945] dummy0 speed is unknown, defaulting to 1000 [ 83.428657][ T5948] ldm_parse_privhead(): Cannot find PRIVHEAD structure. LDM database is corrupt. Aborting. [ 83.444827][ T5948] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 83.452765][ T5952] Need at least one configuration in g1. [ 83.460776][ T5948] loop0: [ 83.499063][ T5946] infiniband spz1: RDMA CMA: cma_listen_on_dev, error -98 [ 83.540400][ T5952] udc dummy_udc.0: failed to start g1: -22 [ 83.557953][ T5952] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 83.591350][ T5952] UDC core: g1: couldn't find an available UDC or it's busy [ 83.766657][ T5962] netlink: 12 bytes leftover after parsing attributes in process `syz.0.44'. [ 84.963375][ T5966] comedi comedi2: reset error (fatal) [ 85.127908][ T5970] netlink: 28 bytes leftover after parsing attributes in process `syz.3.46'. [ 85.138454][ T5970] netlink: 'syz.3.46': attribute type 7 has an invalid length. [ 85.146147][ T5970] netlink: 'syz.3.46': attribute type 8 has an invalid length. [ 85.173567][ T5970] netlink: 4 bytes leftover after parsing attributes in process `syz.3.46'. [ 85.271802][ T5976] loop0: detected capacity change from 0 to 4096 [ 86.237513][ T5988] dummy0 speed is unknown, defaulting to 1000 [ 86.264773][ T5988] dummy0 speed is unknown, defaulting to 1000 [ 86.279694][ T27] kauditd_printk_skb: 5 callbacks suppressed [ 86.279707][ T27] audit: type=1800 audit(1791749934.496:17): pid=5990 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.55" name="no_out_endpoint" dev="configfs" ino=8211 res=0 errno=0 [ 86.287579][ T5990] Need at least one configuration in g1. [ 86.312426][ T5990] udc dummy_udc.0: failed to start g1: -22 [ 86.318878][ T5990] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 86.328358][ T5990] UDC core: g1: couldn't find an available UDC or it's busy [ 86.352666][ T5988] dummy0 speed is unknown, defaulting to 1000 [ 86.373483][ T27] audit: type=1800 audit(1791749934.496:18): pid=5990 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.55" name="subclass" dev="configfs" ino=8212 res=0 errno=0 [ 86.400929][ T5994] ip6tnl1: entered allmulticast mode [ 86.409788][ T5988] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 86.423695][ T27] audit: type=1800 audit(1791749934.496:19): pid=5990 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.55" name="protocol" dev="configfs" ino=8213 res=0 errno=0 [ 86.465953][ T27] audit: type=1800 audit(1791749934.516:20): pid=5990 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.55" name="report_desc" dev="configfs" ino=8214 res=0 errno=0 [ 86.489751][ T27] audit: type=1800 audit(1791749934.516:21): pid=5990 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.55" name="UDC" dev="configfs" ino=8215 res=0 errno=0 [ 86.692447][ T3480] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 86.759371][ T176] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 86.793845][ T3480] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 86.861763][ T5988] dummy0 speed is unknown, defaulting to 1000 [ 86.926103][ T5988] dummy0 speed is unknown, defaulting to 1000 [ 86.991928][ T5988] dummy0 speed is unknown, defaulting to 1000 [ 87.050170][ T5988] dummy0 speed is unknown, defaulting to 1000 [ 87.167554][ T1206] cfg80211: failed to load regulatory.db [ 87.364383][ T176] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 87.633144][ T6000] comedi comedi2: reset error (fatal) [ 87.693826][ T5830] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 87.853169][ T5086] Bluetooth: hci3: command tx timeout [ 87.927770][ T6010] netlink: 40 bytes leftover after parsing attributes in process `syz.2.59'. [ 88.027502][ T6010] nbd: device at index 0 is going down [ 89.631828][ T6025] netlink: 'syz.3.66': attribute type 4 has an invalid length. [ 89.640084][ T6025] netlink: 17 bytes leftover after parsing attributes in process `syz.3.66'. [ 89.741708][ T27] audit: type=1800 audit(1791749937.956:22): pid=6028 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.68" name="no_out_endpoint" dev="configfs" ino=6950 res=0 errno=0 [ 89.769171][ T6028] Need at least one configuration in g1. [ 89.775710][ T6028] udc dummy_udc.0: failed to start g1: -22 [ 89.781519][ T6028] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 89.789312][ T27] audit: type=1800 audit(1791749937.986:23): pid=6028 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.68" name="subclass" dev="configfs" ino=6951 res=0 errno=0 [ 89.819926][ T27] audit: type=1800 audit(1791749937.986:24): pid=6028 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.68" name="protocol" dev="configfs" ino=6952 res=0 errno=0 [ 89.872130][ T6028] UDC core: g1: couldn't find an available UDC or it's busy [ 89.891983][ T6034] siw: device registration error -23 [ 89.893098][ T27] audit: type=1800 audit(1791749937.986:25): pid=6028 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.68" name="report_desc" dev="configfs" ino=6953 res=0 errno=0 [ 89.964988][ T27] audit: type=1800 audit(1791749937.986:26): pid=6028 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.68" name="UDC" dev="configfs" ino=6954 res=0 errno=0 [ 89.972300][ T6034] siw: device registration error -23 [ 90.733297][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 91.007679][ T5830] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 91.327937][ T6050] netlink: 40 bytes leftover after parsing attributes in process `syz.1.73'. [ 91.435195][ T6050] nbd: couldn't find a device at index 0 [ 91.533214][ T5830] usb 4-1: Using ep0 maxpacket: 8 [ 91.929689][ T5830] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 91.940301][ T5830] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 91.951490][ T5830] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 91.962520][ T5830] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 91.971682][ T5830] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.000518][ T5830] hub 4-1:1.0: bad descriptor, ignoring hub [ 92.006530][ T5830] hub: probe of 4-1:1.0 failed with error -5 [ 92.023943][ T5830] cdc_wdm 4-1:1.0: skipping garbage [ 92.029184][ T5830] cdc_wdm 4-1:1.0: skipping garbage [ 92.051000][ T5830] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 92.058519][ T5830] cdc_wdm 4-1:1.0: Unknown control protocol [ 92.177004][ T27] audit: type=1326 audit(1791749940.386:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6056 comm="syz.1.76" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf9639e1d9 code=0x7ffc0000 [ 92.611428][ T27] audit: type=1326 audit(1791749940.436:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6056 comm="syz.1.76" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf9639e1d9 code=0x7ffc0000 [ 92.990517][ T27] audit: type=1326 audit(1791749940.466:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6056 comm="syz.1.76" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf9639e1d9 code=0x7ffc0000 [ 93.050240][ T27] audit: type=1326 audit(1791749940.466:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6056 comm="syz.1.76" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf9639e1d9 code=0x7ffc0000 [ 93.102708][ T27] audit: type=1326 audit(1791749940.466:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6056 comm="syz.1.76" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7faf9639e1d9 code=0x7ffc0000 [ 93.128249][ T6068] netlink: 'syz.2.78': attribute type 4 has an invalid length. [ 93.135956][ T6068] netlink: 17 bytes leftover after parsing attributes in process `syz.2.78'. [ 93.199332][ T27] audit: type=1326 audit(1791749940.486:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6056 comm="syz.1.76" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf9639e1d9 code=0x7ffc0000 [ 93.231457][ T27] audit: type=1326 audit(1791749940.486:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6056 comm="syz.1.76" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf9639e1d9 code=0x7ffc0000 [ 93.258846][ T27] audit: type=1326 audit(1791749940.496:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6056 comm="syz.1.76" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf9639e1d9 code=0x7ffc0000 [ 93.259088][ T6072] siw: device registration error -23 [ 93.297199][ T27] audit: type=1326 audit(1791749940.496:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6056 comm="syz.1.76" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf9639e1d9 code=0x7ffc0000 [ 93.331039][ T27] audit: type=1326 audit(1791749940.496:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6056 comm="syz.1.76" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=2 compat=0 ip=0x7faf9639e1d9 code=0x7ffc0000 [ 93.382960][ T6072] siw: device registration error -23 [ 93.395854][ T6076] Need at least one configuration in g1. [ 93.401623][ T6076] udc dummy_udc.0: failed to start g1: -22 [ 93.408682][ T6076] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 93.418243][ T6076] UDC core: g1: couldn't find an available UDC or it's busy [ 93.484977][ T6037] usb 4-1: reset high-speed USB device number 3 using dummy_hcd [ 93.524943][ T6083] ======================================================= [ 93.524943][ T6083] WARNING: The mand mount option has been deprecated and [ 93.524943][ T6083] and is ignored by this kernel. Remove the mand [ 93.524943][ T6083] option from the mount to silence this warning. [ 93.524943][ T6083] ======================================================= [ 94.373050][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 96.264869][ T5776] usb 4-1: USB disconnect, device number 3 [ 96.665763][ T6105] netlink: 'syz.1.90': attribute type 4 has an invalid length. [ 96.673457][ T6105] netlink: 17 bytes leftover after parsing attributes in process `syz.1.90'. [ 96.698373][ T6107] siw: device registration error -23 [ 96.794338][ T6107] siw: device registration error -23 [ 96.860144][ T6113] Need at least one configuration in g1. [ 96.870285][ T6113] udc dummy_udc.0: failed to start g1: -22 [ 96.876616][ T6113] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 96.893856][ T6113] UDC core: g1: couldn't find an available UDC or it's busy [ 98.966065][ T6140] comedi comedi2: reset error (fatal) [ 98.983294][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 100.541750][ T6148] netlink: 'syz.2.102': attribute type 4 has an invalid length. [ 100.550017][ T6148] netlink: 17 bytes leftover after parsing attributes in process `syz.2.102'. [ 104.898477][ T5812] IPVS: starting estimator thread 0... [ 105.048342][ T6181] IPVS: using max 18 ests per chain, 43200 per kthread [ 105.077865][ T6170] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.086406][ T6170] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.243056][ T6185] comedi comedi2: reset error (fatal) [ 107.176694][ T6170] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 107.225677][ T6170] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 107.800935][ T6170] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.810215][ T6170] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.819335][ T6170] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.828345][ T6170] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.934561][ T6178] netlink: 12 bytes leftover after parsing attributes in process `syz.2.111'. [ 107.954769][ T8] dummy0 speed is unknown, defaulting to 1000 [ 107.971951][ T6192] netlink: 'syz.0.113': attribute type 4 has an invalid length. [ 107.979762][ T6192] netlink: 17 bytes leftover after parsing attributes in process `syz.0.113'. [ 108.452505][ T6225] syz_tun: entered allmulticast mode [ 108.913687][ T6231] pim6reg: entered allmulticast mode [ 109.094997][ T6234] netlink: 40 bytes leftover after parsing attributes in process `syz.3.120'. [ 109.107426][ T6236] loop0: detected capacity change from 0 to 4096 [ 109.114994][ T6234] nbd: couldn't find a device at index 0 [ 109.196102][ T6236] loop0: [ 110.122011][ T6239] netlink: 'syz.3.123': attribute type 4 has an invalid length. [ 110.129835][ T6239] netlink: 17 bytes leftover after parsing attributes in process `syz.3.123'. [ 110.323064][ T6243] comedi comedi2: reset error (fatal) [ 111.106879][ T6260] Zero length message leads to an empty skb [ 112.285952][ T6276] loop0: detected capacity change from 0 to 4096 [ 112.385213][ T6276] loop0: [ 113.691050][ T6283] comedi comedi2: reset error (fatal) [ 114.973263][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 116.773185][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 117.709335][ T27] kauditd_printk_skb: 19 callbacks suppressed [ 117.709348][ T27] audit: type=1800 audit(1791749965.926:56): pid=6319 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.145" name="no_out_endpoint" dev="configfs" ino=8862 res=0 errno=0 [ 117.743513][ T6319] Need at least one configuration in g1. [ 117.773829][ T6319] udc dummy_udc.0: failed to start g1: -22 [ 117.827977][ T6319] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 117.986243][ T27] audit: type=1800 audit(1791749965.926:57): pid=6319 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.145" name="subclass" dev="configfs" ino=8863 res=0 errno=0 [ 118.084536][ T6319] UDC core: g1: couldn't find an available UDC or it's busy [ 119.561869][ T27] audit: type=1800 audit(1791749965.926:58): pid=6319 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.145" name="report_desc" dev="configfs" ino=8864 res=0 errno=0 [ 119.582364][ T27] audit: type=1800 audit(1791749965.966:59): pid=6319 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.145" name="UDC" dev="configfs" ino=8865 res=0 errno=0 [ 121.448678][ T6343] Process accounting resumed [ 121.483391][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 122.374691][ T6334] comedi comedi2: reset error (fatal) [ 122.588580][ T6347] FAULT_INJECTION: forcing a failure. [ 122.588580][ T6347] name fail_futex, interval 1, probability 0, space 0, times 1 [ 122.627803][ T6347] CPU: 1 PID: 6347 Comm: syz.2.153 Not tainted syzkaller #0 [ 122.635147][ T6347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 122.645224][ T6347] Call Trace: [ 122.648519][ T6347] [ 122.651462][ T6347] dump_stack_lvl+0x18c/0x250 [ 122.656182][ T6347] ? show_regs_print_info+0x20/0x20 [ 122.661407][ T6347] ? load_image+0x420/0x420 [ 122.665933][ T6347] ? mark_lock+0x94/0x320 [ 122.670302][ T6347] ? __lock_acquire+0x135d/0x7eb0 [ 122.675359][ T6347] should_fail_ex+0x394/0x4c0 [ 122.680071][ T6347] get_futex_key+0x136/0x1030 [ 122.684773][ T6347] ? futex_unqueue+0xcb/0xf0 [ 122.689390][ T6347] ? futex_setup_timer+0xc0/0xc0 [ 122.694349][ T6347] ? verify_lock_unused+0x140/0x140 [ 122.699578][ T6347] futex_wake+0x127/0x4f0 [ 122.703940][ T6347] ? futex_wake_mark+0x150/0x150 [ 122.708918][ T6347] do_futex+0x35d/0x3e0 [ 122.713098][ T6347] ? __fget_files+0x28/0x460 [ 122.717728][ T6347] ? __ia32_sys_get_robust_list+0x110/0x110 [ 122.723656][ T6347] __se_sys_futex+0x3a9/0x440 [ 122.728370][ T6347] ? __x64_sys_futex+0xf0/0xf0 [ 122.733168][ T6347] ? __x64_sys_futex+0x21/0xf0 [ 122.737960][ T6347] do_syscall_64+0x55/0xb0 [ 122.742393][ T6347] ? clear_bhb_loop+0x40/0x90 [ 122.747090][ T6347] ? clear_bhb_loop+0x40/0x90 [ 122.751787][ T6347] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 122.757712][ T6347] RIP: 0033:0x7f7fd519e1d9 [ 122.762161][ T6347] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 122.781792][ T6347] RSP: 002b:00007f7fd61280e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 122.790259][ T6347] RAX: ffffffffffffffda RBX: 00007f7fd5425fa8 RCX: 00007f7fd519e1d9 [ 122.798256][ T6347] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f7fd5425fac [ 122.806248][ T6347] RBP: 00007f7fd5425fa0 R08: 0000000000745a46 R09: 0000000000000000 [ 122.814236][ T6347] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 122.822226][ T6347] R13: 00007f7fd5426038 R14: 00007ffc4a771530 R15: 00007ffc4a771618 [ 122.830239][ T6347] [ 123.799797][ T6358] netlink: 'syz.2.158': attribute type 4 has an invalid length. [ 123.807529][ T6358] netlink: 17 bytes leftover after parsing attributes in process `syz.2.158'. [ 124.795173][ T27] audit: type=1800 audit(1791749973.016:60): pid=6370 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.159" name="no_out_endpoint" dev="configfs" ino=8928 res=0 errno=0 [ 124.825983][ T6370] Need at least one configuration in g1. [ 124.831749][ T6370] udc dummy_udc.0: failed to start g1: -22 [ 124.858929][ T6370] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 124.861996][ T27] audit: type=1800 audit(1791749973.016:61): pid=6370 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.159" name="subclass" dev="configfs" ino=8929 res=0 errno=0 [ 124.882156][ T6370] UDC core: g1: couldn't find an available UDC or it's busy [ 124.886889][ C0] vkms_vblank_simulate: vblank timer overrun [ 124.933123][ T27] audit: type=1800 audit(1791749973.016:62): pid=6370 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.159" name="report_desc" dev="configfs" ino=8930 res=0 errno=0 [ 124.953469][ C0] vkms_vblank_simulate: vblank timer overrun [ 124.990853][ T27] audit: type=1800 audit(1791749973.046:63): pid=6370 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.159" name="UDC" dev="configfs" ino=8931 res=0 errno=0 [ 125.095567][ T6380] netlink: 'syz.2.166': attribute type 4 has an invalid length. [ 125.103436][ T6380] netlink: 17 bytes leftover after parsing attributes in process `syz.2.166'. [ 127.628946][ T6395] ptp ptp0: max value is 20 [ 127.718649][ T6397] netlink: 'syz.1.170': attribute type 4 has an invalid length. [ 127.726439][ T6397] netlink: 17 bytes leftover after parsing attributes in process `syz.1.170'. [ 128.807827][ T6410] netlink: 'syz.0.176': attribute type 4 has an invalid length. [ 128.815708][ T6410] netlink: 17 bytes leftover after parsing attributes in process `syz.0.176'. [ 128.881224][ T27] audit: type=1800 audit(1791749977.096:64): pid=6417 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.177" name="no_out_endpoint" dev="configfs" ino=9591 res=0 errno=0 [ 128.901963][ C0] vkms_vblank_simulate: vblank timer overrun [ 128.913344][ T6417] Need at least one configuration in g1. [ 128.919219][ T6417] udc dummy_udc.0: failed to start g1: -22 [ 128.925425][ T6417] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 128.940337][ T27] audit: type=1800 audit(1791749977.126:65): pid=6417 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.177" name="subclass" dev="configfs" ino=9592 res=0 errno=0 [ 128.945755][ T6417] UDC core: g1: couldn't find an available UDC or it's busy [ 128.976086][ T27] audit: type=1800 audit(1791749977.126:66): pid=6417 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.177" name="report_desc" dev="configfs" ino=9593 res=0 errno=0 [ 128.997064][ T27] audit: type=1800 audit(1791749977.126:67): pid=6417 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.177" name="UDC" dev="configfs" ino=9594 res=0 errno=0 [ 130.103377][ T6429] bond0: Error: Cannot enslave bond to itself. [ 130.466938][ T6439] syz.3.185 (6439) used greatest stack depth: 16616 bytes left [ 130.558648][ T6448] netlink: 'syz.1.187': attribute type 4 has an invalid length. [ 130.566427][ T6448] netlink: 17 bytes leftover after parsing attributes in process `syz.1.187'. [ 130.601569][ T6447] netlink: 'syz.3.186': attribute type 4 has an invalid length. [ 130.609307][ T6447] netlink: 17 bytes leftover after parsing attributes in process `syz.3.186'. [ 131.501608][ T5086] Bluetooth: hci0: link tx timeout [ 131.507077][ T5086] Bluetooth: hci0: killing stalled connection 10:aa:aa:aa:aa:aa [ 131.529041][ T5770] Bluetooth: hci0: link tx timeout [ 131.535124][ T5770] Bluetooth: hci0: killing stalled connection 10:aa:aa:aa:aa:aa [ 131.608317][ T28] hid-sensor-hub 0003:1234:5678.0001: hidraw0: USB HID v0.01 Device [syz0] on syz0 [ 133.281464][ T1289] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.290186][ T1289] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.536296][ T5770] Bluetooth: hci0: command 0x0406 tx timeout [ 134.285697][ T6460] fido_id[6460]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 134.435440][ T6479] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 3, id = 0 [ 135.325091][ T6488] netlink: 'syz.0.198': attribute type 4 has an invalid length. [ 135.332767][ T6488] netlink: 17 bytes leftover after parsing attributes in process `syz.0.198'. [ 136.182581][ T6494] netlink: 'syz.3.199': attribute type 4 has an invalid length. [ 136.190366][ T6494] netlink: 17 bytes leftover after parsing attributes in process `syz.3.199'. [ 136.470732][ T5086] Bluetooth: hci1: link tx timeout [ 136.476274][ T5086] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 138.503168][ T5770] Bluetooth: hci1: command 0x0406 tx timeout [ 141.889227][ T6534] netlink: 'syz.0.209': attribute type 4 has an invalid length. [ 141.896927][ T6534] netlink: 17 bytes leftover after parsing attributes in process `syz.0.209'. [ 142.708115][ T6531] netlink: 'syz.3.211': attribute type 4 has an invalid length. [ 142.715816][ T6531] netlink: 17 bytes leftover after parsing attributes in process `syz.3.211'. [ 143.248623][ T6550] FAULT_INJECTION: forcing a failure. [ 143.248623][ T6550] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 143.300289][ T6550] CPU: 1 PID: 6550 Comm: syz.2.216 Not tainted syzkaller #0 [ 143.307627][ T6550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 143.317707][ T6550] Call Trace: [ 143.321005][ T6550] [ 143.323956][ T6550] dump_stack_lvl+0x18c/0x250 [ 143.328657][ T6550] ? show_regs_print_info+0x20/0x20 [ 143.333878][ T6550] ? load_image+0x420/0x420 [ 143.338408][ T6550] ? __might_fault+0xaa/0x120 [ 143.343107][ T6550] ? __lock_acquire+0x7eb0/0x7eb0 [ 143.348158][ T6550] should_fail_ex+0x394/0x4c0 [ 143.352855][ T6550] _copy_from_user+0x2f/0xe0 [ 143.357460][ T6550] __x64_sys_signalfd+0xf3/0x170 [ 143.362402][ T6550] ? __ia32_sys_signalfd4+0x1a0/0x1a0 [ 143.367777][ T6550] ? lockdep_hardirqs_on+0x98/0x150 [ 143.372985][ T6550] do_syscall_64+0x55/0xb0 [ 143.377403][ T6550] ? clear_bhb_loop+0x40/0x90 [ 143.382077][ T6550] ? clear_bhb_loop+0x40/0x90 [ 143.386759][ T6550] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 143.392688][ T6550] RIP: 0033:0x7f7fd519e1d9 [ 143.397107][ T6550] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 143.416718][ T6550] RSP: 002b:00007f7fd6128028 EFLAGS: 00000246 ORIG_RAX: 000000000000011a [ 143.425140][ T6550] RAX: ffffffffffffffda RBX: 00007f7fd5425fa0 RCX: 00007f7fd519e1d9 [ 143.433116][ T6550] RDX: 0000000000000008 RSI: 0000200000000380 RDI: ffffffffffffffff [ 143.441090][ T6550] RBP: 00007f7fd5235888 R08: 0000000000000000 R09: 0000000000000000 [ 143.449061][ T6550] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 143.457029][ T6550] R13: 00007f7fd5426038 R14: 00007f7fd5425fa0 R15: 00007ffc4a771618 [ 143.465019][ T6550] [ 143.615592][ T6555] Illegal XDP return value 4294967274 on prog (id 19) dev syz_tun, expect packet loss! [ 146.238667][ T6569] netlink: 'syz.0.222': attribute type 4 has an invalid length. [ 146.246378][ T6569] netlink: 17 bytes leftover after parsing attributes in process `syz.0.222'. [ 146.564496][ T6577] netlink: 'syz.3.224': attribute type 4 has an invalid length. [ 146.572641][ T6577] netlink: 17 bytes leftover after parsing attributes in process `syz.3.224'. [ 147.323595][ T176] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 147.502576][ T28] hid-sensor-hub 0003:1234:5678.0002: hidraw0: USB HID v0.01 Device [syz0] on syz0 [ 147.634428][ T176] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 147.643734][ T176] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 147.663203][ T176] usb 2-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 147.676772][ T176] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 147.685052][ T176] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 147.696385][ T176] usb 2-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 147.727411][ T176] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 147.755286][ T176] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 147.772585][ T6592] fido_id[6592]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 147.793356][ T176] usb 2-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 147.835477][ T176] usb 2-1: string descriptor 0 read error: -22 [ 147.841775][ T176] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 147.872153][ T176] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.909689][ T176] adutux 2-1:168.0: interrupt endpoints not found [ 148.039623][ T6603] netlink: 64 bytes leftover after parsing attributes in process `syz.0.232'. [ 148.337237][ T28] usb 2-1: USB disconnect, device number 2 [ 148.893248][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 148.952499][ T6597] comedi comedi2: reset error (fatal) [ 151.309312][ T176] hid-sensor-hub 0003:1234:5678.0003: hidraw0: USB HID v0.01 Device [syz0] on syz0 [ 151.394861][ T6636] netlink: 40 bytes leftover after parsing attributes in process `syz.3.241'. [ 151.394909][ T6636] nbd: couldn't find a device at index 0 [ 151.500452][ T6637] fido_id[6637]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 153.229373][ T6621] tty tty25: ldisc open failed (-12), clearing slot 24 [ 154.452403][ T6640] comedi comedi2: reset error (fatal) [ 155.214447][ T6674] netlink: 64 bytes leftover after parsing attributes in process `syz.1.253'. [ 158.303072][ T6704] comedi comedi2: reset error (fatal) [ 158.350929][ T6714] loop0: detected capacity change from 0 to 4096 [ 158.406630][ T6714] loop0: [ 158.741983][ T6727] jffs2: notice: (6727) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 158.828821][ T27] audit: type=1804 audit(1791750007.026:68): pid=6727 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.274" name="/newroot/66/mnt/fillfile" dev="jffs2" ino=2 res=1 errno=0 [ 160.458535][ T6753] loop0: detected capacity change from 0 to 4096 [ 160.554123][ T6753] loop0: [ 160.848256][ T6742] comedi comedi2: reset error (fatal) [ 161.579459][ T6766] netlink: 'syz.3.287': attribute type 4 has an invalid length. [ 161.587202][ T6766] netlink: 17 bytes leftover after parsing attributes in process `syz.3.287'. [ 164.183080][ T6792] comedi comedi2: reset error (fatal) [ 164.992737][ T6806] netlink: 'syz.1.301': attribute type 4 has an invalid length. [ 165.000566][ T6806] netlink: 17 bytes leftover after parsing attributes in process `syz.1.301'. [ 165.779863][ T6789] comedi comedi2: reset error (fatal) [ 165.819609][ T6808] netlink: 'syz.2.302': attribute type 4 has an invalid length. [ 165.827555][ T6808] netlink: 17 bytes leftover after parsing attributes in process `syz.2.302'. [ 167.078984][ T6836] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 167.087884][ T6836] CPU: 0 PID: 6836 Comm: syz.2.310 Not tainted syzkaller #0 [ 167.095197][ T6836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 167.105265][ T6836] Call Trace: [ 167.108557][ T6836] [ 167.111502][ T6836] dump_stack_lvl+0x18c/0x250 [ 167.116201][ T6836] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 167.121858][ T6836] ? show_regs_print_info+0x20/0x20 [ 167.127072][ T6836] ? load_image+0x420/0x420 [ 167.131605][ T6836] ? sysfs_create_dir_ns+0x243/0x2a0 [ 167.136924][ T6836] sysfs_create_dir_ns+0x26e/0x2a0 [ 167.142057][ T6836] ? __lock_acquire+0x7eb0/0x7eb0 [ 167.147102][ T6836] ? sysfs_warn_dup+0xa0/0xa0 [ 167.151792][ T6836] ? rcu_is_watching+0x15/0xb0 [ 167.156594][ T6836] ? do_raw_spin_unlock+0x121/0x230 [ 167.161826][ T6836] kobject_add_internal+0x617/0xc90 [ 167.167066][ T6836] kobject_add+0x164/0x240 [ 167.171510][ T6836] ? kobject_init+0x1d0/0x1d0 [ 167.176213][ T6836] ? get_device_parent+0x366/0x390 [ 167.181349][ T6836] device_add+0x3fa/0xc40 [ 167.185705][ T6836] tty_register_device_attr+0x428/0x990 [ 167.191289][ T6836] ? tty_register_device+0x30/0x30 [ 167.196442][ T6836] ? tty_port_init+0x132/0x1a0 [ 167.201228][ T6836] ? gsm_dlci_alloc+0x32a/0x630 [ 167.206100][ T6836] ? __might_fault+0xaa/0x120 [ 167.210800][ T6836] gsm_activate_mux+0x110/0x2a0 [ 167.215691][ T6836] gsmld_ioctl+0x12ca/0x1900 [ 167.220317][ T6836] ? gsmld_write+0x120/0x120 [ 167.224942][ T6836] ? __init_ldsem+0x150/0x150 [ 167.229642][ T6836] ? __fget_files+0x28/0x460 [ 167.234272][ T6836] ? gsmld_write+0x120/0x120 [ 167.238886][ T6836] tty_ioctl+0x9b5/0xdc0 [ 167.243155][ T6836] ? tty_get_icount+0xb0/0xb0 [ 167.247860][ T6836] __se_sys_ioctl+0xfd/0x170 [ 167.252481][ T6836] do_syscall_64+0x55/0xb0 [ 167.256918][ T6836] ? clear_bhb_loop+0x40/0x90 [ 167.261611][ T6836] ? clear_bhb_loop+0x40/0x90 [ 167.266307][ T6836] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 167.272224][ T6836] RIP: 0033:0x7f7fd519e1d9 [ 167.276652][ T6836] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 167.296275][ T6836] RSP: 002b:00007f7fd60e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 167.304710][ T6836] RAX: ffffffffffffffda RBX: 00007f7fd5426180 RCX: 00007f7fd519e1d9 [ 167.312696][ T6836] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 167.320680][ T6836] RBP: 00007f7fd5235888 R08: 0000000000000000 R09: 0000000000000000 [ 167.328667][ T6836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 167.336651][ T6836] R13: 00007f7fd5426218 R14: 00007f7fd5426180 R15: 00007ffc4a771618 [ 167.344663][ T6836] [ 167.348632][ T6836] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 169.083073][ T6844] comedi comedi2: reset error (fatal) [ 171.286760][ T6859] netlink: 'syz.3.316': attribute type 4 has an invalid length. [ 171.294516][ T6859] netlink: 17 bytes leftover after parsing attributes in process `syz.3.316'. [ 172.076326][ T6864] [ 172.078695][ T6864] ====================================================== [ 172.085710][ T6864] WARNING: possible circular locking dependency detected [ 172.092715][ T6864] syzkaller #0 Not tainted [ 172.097111][ T6864] ------------------------------------------------------ [ 172.104104][ T6864] syz.1.317/6864 is trying to acquire lock: [ 172.109970][ T6864] ffff88814889eef0 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: configfs_depend_item_unlocked+0x157/0x460 [ 172.121431][ T6864] [ 172.121431][ T6864] but task is already holding lock: [ 172.128786][ T6864] ffffffff8ec57308 (tpg_instances_lock){+.+.}-{3:3}, at: usbg_make_tpg+0xf9/0x550 [ 172.138000][ T6864] [ 172.138000][ T6864] which lock already depends on the new lock. [ 172.138000][ T6864] [ 172.148385][ T6864] [ 172.148385][ T6864] the existing dependency chain (in reverse order) is: [ 172.157377][ T6864] [ 172.157377][ T6864] -> #3 (tpg_instances_lock){+.+.}-{3:3}: [ 172.165265][ T6864] __mutex_lock+0x135/0xc80 [ 172.170276][ T6864] tcm_alloc_inst+0x65/0x190 [ 172.175372][ T6864] usb_get_function_instance+0xdd/0x2e0 [ 172.181421][ T6864] function_make+0x11c/0x350 [ 172.186531][ T6864] configfs_mkdir+0x515/0x9e0 [ 172.191751][ T6864] vfs_mkdir+0x2a5/0x470 [ 172.196508][ T6864] do_mkdirat+0x1dc/0x450 [ 172.201352][ T6864] __x64_sys_mkdirat+0x89/0xa0 [ 172.206630][ T6864] do_syscall_64+0x55/0xb0 [ 172.211560][ T6864] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 172.217976][ T6864] [ 172.217976][ T6864] -> #2 (func_lock){+.+.}-{3:3}: [ 172.225097][ T6864] __mutex_lock+0x135/0xc80 [ 172.230116][ T6864] usb_get_function_instance+0x2e/0x2e0 [ 172.236180][ T6864] function_make+0x11c/0x350 [ 172.241286][ T6864] configfs_mkdir+0x515/0x9e0 [ 172.246480][ T6864] vfs_mkdir+0x2a5/0x470 [ 172.251238][ T6864] do_mkdirat+0x1dc/0x450 [ 172.256081][ T6864] __x64_sys_mkdirat+0x89/0xa0 [ 172.261362][ T6864] do_syscall_64+0x55/0xb0 [ 172.266288][ T6864] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 172.272699][ T6864] [ 172.272699][ T6864] -> #1 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 172.280946][ T6864] __mutex_lock+0x135/0xc80 [ 172.285968][ T6864] configfs_rmdir+0x63c/0x980 [ 172.291175][ T6864] vfs_rmdir+0x352/0x4b0 [ 172.295930][ T6864] do_rmdir+0x29f/0x590 [ 172.300599][ T6864] __x64_sys_rmdir+0x49/0x50 [ 172.305700][ T6864] do_syscall_64+0x55/0xb0 [ 172.310638][ T6864] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 172.317051][ T6864] [ 172.317051][ T6864] -> #0 (&sb->s_type->i_mutex_key#21){++++}-{3:3}: [ 172.325739][ T6864] __lock_acquire+0x3a07/0x7eb0 [ 172.331105][ T6864] lock_acquire+0x19e/0x420 [ 172.336124][ T6864] down_write+0x97/0x200 [ 172.340881][ T6864] configfs_depend_item_unlocked+0x157/0x460 [ 172.347378][ T6864] usbg_make_tpg+0x1e1/0x550 [ 172.352486][ T6864] target_fabric_make_tpg+0xa4/0x6d0 [ 172.358285][ T6864] configfs_mkdir+0x515/0x9e0 [ 172.363476][ T6864] vfs_mkdir+0x2a5/0x470 [ 172.368234][ T6864] do_mkdirat+0x1dc/0x450 [ 172.373073][ T6864] __x64_sys_mkdirat+0x89/0xa0 [ 172.378354][ T6864] do_syscall_64+0x55/0xb0 [ 172.383283][ T6864] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 172.389700][ T6864] [ 172.389700][ T6864] other info that might help us debug this: [ 172.389700][ T6864] [ 172.399920][ T6864] Chain exists of: [ 172.399920][ T6864] &sb->s_type->i_mutex_key#21 --> func_lock --> tpg_instances_lock [ 172.399920][ T6864] [ 172.413737][ T6864] Possible unsafe locking scenario: [ 172.413737][ T6864] [ 172.421172][ T6864] CPU0 CPU1 [ 172.426525][ T6864] ---- ---- [ 172.431876][ T6864] lock(tpg_instances_lock); [ 172.436552][ T6864] lock(func_lock); [ 172.442957][ T6864] lock(tpg_instances_lock); [ 172.450146][ T6864] lock(&sb->s_type->i_mutex_key#21); [ 172.455600][ T6864] [ 172.455600][ T6864] *** DEADLOCK *** [ 172.455600][ T6864] [ 172.463727][ T6864] 4 locks held by syz.1.317/6864: [ 172.468737][ T6864] #0: ffff888141aba418 (sb_writers#14){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 172.477966][ T6864] #1: ffff888148a6aef0 (&sb->s_type->i_mutex_key#7/1){+.+.}-{3:3}, at: filename_create+0x20f/0x450 [ 172.488763][ T6864] #2: ffffffff8e92c330 (&subsys->su_mutex){+.+.}-{3:3}, at: configfs_mkdir+0x4b9/0x9e0 [ 172.498507][ T6864] #3: ffffffff8ec57308 (tpg_instances_lock){+.+.}-{3:3}, at: usbg_make_tpg+0xf9/0x550 [ 172.508157][ T6864] [ 172.508157][ T6864] stack backtrace: [ 172.514033][ T6864] CPU: 1 PID: 6864 Comm: syz.1.317 Not tainted syzkaller #0 [ 172.521307][ T6864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 172.531349][ T6864] Call Trace: [ 172.534626][ T6864] [ 172.537550][ T6864] dump_stack_lvl+0x18c/0x250 [ 172.542221][ T6864] ? load_image+0x420/0x420 [ 172.546722][ T6864] ? show_regs_print_info+0x20/0x20 [ 172.551913][ T6864] ? print_circular_bug+0x12b/0x1a0 [ 172.557108][ T6864] check_noncircular+0x2fc/0x400 [ 172.562041][ T6864] ? look_up_lock_class+0x75/0x140 [ 172.567146][ T6864] ? print_deadlock_bug+0x5d0/0x5d0 [ 172.572337][ T6864] ? lockdep_lock+0xf5/0x230 [ 172.576924][ T6864] ? __lock_acquire+0x36dd/0x7eb0 [ 172.581945][ T6864] ? _find_first_zero_bit+0xd6/0x100 [ 172.587231][ T6864] __lock_acquire+0x3a07/0x7eb0 [ 172.592087][ T6864] ? is_bpf_text_address+0x28f/0x2a0 [ 172.597369][ T6864] ? verify_lock_unused+0x140/0x140 [ 172.602568][ T6864] ? __kernel_text_address+0xd/0x30 [ 172.607771][ T6864] lock_acquire+0x19e/0x420 [ 172.612266][ T6864] ? configfs_depend_item_unlocked+0x157/0x460 [ 172.618416][ T6864] ? trace_raw_output_contention_end+0xd0/0xd0 [ 172.624563][ T6864] ? __might_sleep+0xe0/0xe0 [ 172.629148][ T6864] ? rcu_is_watching+0x15/0xb0 [ 172.633912][ T6864] ? read_lock_is_recursive+0x20/0x20 [ 172.639280][ T6864] ? trace_contention_end+0x39/0xe0 [ 172.644470][ T6864] ? __mutex_lock+0x30d/0xc80 [ 172.649145][ T6864] ? do_syscall_64+0x55/0xb0 [ 172.653726][ T6864] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 172.659795][ T6864] down_write+0x97/0x200 [ 172.664036][ T6864] ? configfs_depend_item_unlocked+0x157/0x460 [ 172.670183][ T6864] ? down_read_killable+0x340/0x340 [ 172.675379][ T6864] configfs_depend_item_unlocked+0x157/0x460 [ 172.681363][ T6864] usbg_make_tpg+0x1e1/0x550 [ 172.685964][ T6864] ? snprintf+0xe9/0x140 [ 172.690206][ T6864] ? configfs_mkdir+0x4b9/0x9e0 [ 172.695050][ T6864] ? usbg_drop_tport+0x20/0x20 [ 172.699808][ T6864] ? vscnprintf+0x80/0x80 [ 172.704137][ T6864] target_fabric_make_tpg+0xa4/0x6d0 [ 172.709420][ T6864] ? target_fabric_release_wwn+0xb0/0xb0 [ 172.715049][ T6864] configfs_mkdir+0x515/0x9e0 [ 172.719726][ T6864] vfs_mkdir+0x2a5/0x470 [ 172.723969][ T6864] do_mkdirat+0x1dc/0x450 [ 172.728293][ T6864] ? vfs_mkdir+0x470/0x470 [ 172.732705][ T6864] __x64_sys_mkdirat+0x89/0xa0 [ 172.737462][ T6864] do_syscall_64+0x55/0xb0 [ 172.741892][ T6864] ? clear_bhb_loop+0x40/0x90 [ 172.746578][ T6864] ? clear_bhb_loop+0x40/0x90 [ 172.751256][ T6864] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 172.757152][ T6864] RIP: 0033:0x7faf9639e1d9 [ 172.761559][ T6864] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 172.781160][ T6864] RSP: 002b:00007faf9731d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 172.789569][ T6864] RAX: ffffffffffffffda RBX: 00007faf96625fa0 RCX: 00007faf9639e1d9 [ 172.797536][ T6864] RDX: 00000000000001ff RSI: 0000200000000380 RDI: ffffffffffffff9c [ 172.805500][ T6864] RBP: 00007faf96435888 R08: 0000000000000000 R09: 0000000000000000 [ 172.813464][ T6864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 172.821425][ T6864] R13: 00007faf96626038 R14: 00007faf96625fa0 R15: 00007fffea01cfe8 [ 172.829403][ T6864] [ 178.093298][ T5770] Bluetooth: hci0: command 0x0406 tx timeout