last executing test programs: 2.185826779s ago: executing program 1 (id=2): syz_usb_connect(0x3, 0x5c, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff40b113420000010000000109024a0001010080fa0904000008ffffff000705810200020007058202000200070583020002000705840340000107050102000200070502020002000705030200020007050402000200"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$nl_generic(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000201000008000100000000000500590001000000"], 0x24}}, 0x0) 2.137975643s ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='proc\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./proc/sys/vm/nr_hugepages\x00', 0x2, 0x0) pwrite64(r0, &(0x7f0000000000)='2000\x00', 0x4, 0x0) pwrite64(r0, &(0x7f0000000000)='0\x00', 0x1, 0x0) nanosleep(&(0x7f0000000000)={0x1}, 0x0) 1.93582139s ago: executing program 0 (id=1): syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @HCI_EV_INQUIRY_COMPLETE={{0x1, 0x1}}}, 0x4) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r0, 0x400448ca, &(0x7f0000000000)='\x00\x00\x00\x00') ioctl$sock_bt_hci(r0, 0x400448c9, &(0x7f0000000000)='\x00\x00\x00\x00') 1.933605346s ago: executing program 2 (id=3): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c05c1060001010203010902200001010080fa0904000002ffffff000705810200020007050202000200"], 0x0) syz_usb_ep_read(r0, 0x2, 0x100, &(0x7f0000000500)=""/256) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00") syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00") syz_usb_ep_read(r0, 0x2, 0x100, &(0x7f0000000500)=""/256) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00") syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00") nanosleep(&(0x7f0000000400)={0x1}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000001000), r1) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000002000)={0x0, 0x0, &(0x7f0000002100)={&(0x7f0000002200)={0x1c, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x1c}}, 0x0) (async) syz_usb_ep_read(r0, 0x2, 0x100, &(0x7f0000000500)=""/256) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00") syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00") nanosleep(&(0x7f0000000400)={0x1}, 0x0) sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000003000)={0x0, 0x0, &(0x7f0000003100)={&(0x7f0000003200)={0x24, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x40}]}, 0x24}}, 0x0) syz_usb_ep_read(r0, 0x2, 0x100, &(0x7f0000000500)=""/256) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00") syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00") syz_usb_ep_read(r0, 0x2, 0x100, &(0x7f0000000500)=""/256) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00") syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00") syz_usb_ep_read(r0, 0x2, 0x100, &(0x7f0000000500)=""/256) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00") syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00") syz_usb_ep_read(r0, 0x2, 0x100, &(0x7f0000000500)=""/256) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00") syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00") syz_usb_ep_read(r0, 0x2, 0x100, &(0x7f0000000500)=""/256) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00") syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00") syz_usb_ep_read(r0, 0x2, 0x100, &(0x7f0000000500)=""/256) syz_usb_ep_write(r0, 0x81, 0x6, &(0x7f0000000100)="0000ff00ff00") syz_usb_ep_write(r0, 0x81, 0x14, &(0x7f0000000106)="0000ffffff0a00f6d7290000000000000003fd00") 1.81689497s ago: executing program 4 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/vm/min_free_kbytes\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='4000000', 0x7) 1.770725967s ago: executing program 4 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testnqn\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testnqn/attr_allow_any_host\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testnqn/namespaces/1\x00', 0x1ed) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./backing_file\x00', 0x42, 0x1ed) ftruncate(r1, 0x100000) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testnqn/namespaces/1/device_path\x00', 0x2, 0x0) write(r2, &(0x7f0000000480)='./backing_file\x00', 0xe) r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testnqn/namespaces/1/buffered_io\x00', 0x2, 0x0) write(r3, &(0x7f0000000500)='1\x00', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/subsystems/testnqn/namespaces/1/enable\x00', 0x2, 0x0) write(r4, &(0x7f0000000580)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1\x00', 0x1ed) r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r5, &(0x7f0000000680)='loop\x00', 0x4) symlinkat(&(0x7f00000006c0)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/subsystems/testnqn\x00') r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) write(r6, &(0x7f0000000780)='transport=loop,nqn=testnqn\x00', 0x1a) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000840)='./sys\x00', &(0x7f0000000880)='sysfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./sys/class/nvme/nvme0/nvme0n1/wwid\x00', 0x0, 0x0) read(r7, &(0x7f0000000900), 0x64) r8 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/nvme/nvme1/nvme1n1/wwid\x00', 0x0, 0x0) read(r8, &(0x7f0000000980), 0x64) 1.057758421s ago: executing program 0 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/yuyv\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/yuyv/720p\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/yuyv\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/yuyv\x00') symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00') symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00') symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00') symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6) nanosleep(&(0x7f00000007c0)={0x1}, 0x0) r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559}) 881.33982ms ago: executing program 4 (id=8): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='10\n\x00', 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/nfsv4leasetime\x00', 0x2, 0x0) write(r1, &(0x7f00000000c0)='10\n\x00', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r2, &(0x7f00000000c0)='-2 -3 +4\n\x00', 0x9) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f00000000c0)='tcp 2049\n\x00', 0x9) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f0000000140)='1\n\x00', 0x2) (async) nanosleep(&(0x7f0000000150)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r5, &(0x7f0000000240)='nfsd 127.0.0.1 2147483647 mydomain\n\x00', 0x23) r6 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r6, &(0x7f00000002c0)='mydomain 1 \\x00000000 2147483647 /\n\x00', 0x23) r7 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r7, &(0x7f0000000340)='mydomain / 2147483647 9218 0 0 0\n\x00', 0x21) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f00000003c0)='127.0.0.1:/\x00', &(0x7f0000000380)='./mnt\x00', &(0x7f0000000400), 0x0, &(0x7f0000000500)) 706.354567ms ago: executing program 3 (id=9): r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/infiniband_srp/srp-syz0-1/add_target\x00', 0x2, 0x0) r2 = syz_io_uring_setup(0x4, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000180)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000040)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r1, 0x0, &(0x7f0000000280)=[{&(0x7f0000000240)='id_ext=0,ioc_guid=0,src=127.0.0.1,dest=127.0.0.1:3260\x00', 0x35}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r2, 0x1, 0x0, 0x0, 0x0, 0x0) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000440)={0x0}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r6, &(0x7f0000000480)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0xcbc, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, r7}}, 0x30) write$RDMA_USER_CM_CMD_LISTEN(r6, &(0x7f0000000500)={0x7, 0x8, 0xfa00, {r7, 0x10}}, 0x10) write$RDMA_USER_CM_CMD_GET_EVENT(r6, &(0x7f0000000540)={0xc, 0x8, 0xfa00, {&(0x7f0000000580)}}, 0x10) write$RDMA_USER_CM_CMD_ACCEPT(r6, &(0x7f0000000600)={0x8, 0x120, 0xfa00, {0x0, {0x0, 0x0, "c00000000000000100000000000000000000010000000100", 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, r7}}, 0x128) 644.964061ms ago: executing program 1 (id=10): r0 = syz_usb_connect(0x0, 0x6b, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x1d19, 0x6108, 0x100, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x59, 0x4, 0x1, 0x0, 0xc0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, [@generic={0x8, 0xb, "000400000000"}], [{{0x9, 0x5, 0x81, 0x2, 0x200}}]}}, {{0x9, 0x4, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200}}]}}, {{0x9, 0x4, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, [], [{{0x9, 0x5, 0x83, 0x2, 0x200}}]}}, {{0x9, 0x4, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, [], [{{0x9, 0x5, 0x84, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0xc0, 0xd, 0x4, 'E\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) 282.401383ms ago: executing program 2 (id=11): r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)) r1 = openat(r0, &(0x7f0000000400)='test\x00', 0x42, 0x1ff) write(r1, &(0x7f0000000500)='hello\x00', 0x6) sync() 257.088158ms ago: executing program 2 (id=12): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind(r0, &(0x7f0000000300)=@hci={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000400)="2b00ffff11006fbaf18805e0496a9885d6ddfdb4e03e01", 0x17) read(r0, &(0x7f0000000600)=""/256, 0x100) r1 = syz_init_net_socket$bt_hci(0x1f, 0x5, 0x8) setsockopt(r1, 0x112, 0x11, &(0x7f0000000100)="00ff000000000000ff0000000500000001000000ff000000050000000100000000000000000000000000000000000000000000000a0000000a000000", 0x3c) connect(r1, &(0x7f0000000200)=@generic={0x1f, "0000000000000100"}, 0xa) 226.587158ms ago: executing program 2 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/power/state\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='disk', 0x5) 205.222238ms ago: executing program 2 (id=14): syz_open_dev$tty1(0xc, 0x4, 0x1) syz_open_dev$tty1(0xc, 0x4, 0x1) 198.131918ms ago: executing program 0 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./sys\x00', &(0x7f0000000340)='sysfs\x00', 0x0, 0x0) r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000040)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000080), 0x2) writev(r0, &(0x7f0000001000)=[{&(0x7f0000000100)="02fa", 0x2}, {&(0x7f0000000102)="02aa", 0x2}, {&(0x7f0000000104)="0200", 0x2}, {&(0x7f0000000106)="02fa", 0x2}, {&(0x7f0000000108)="0200", 0x2}, {&(0x7f000000010a)="0247", 0x2}, {&(0x7f000000010c)="0200", 0x2}, {&(0x7f000000010e)="02fa", 0x2}, {&(0x7f0000000110)="0200", 0x2}, {&(0x7f0000000112)="0247", 0x2}, {&(0x7f0000000114)="0200", 0x2}, {&(0x7f0000000116)="02fa", 0x2}, {&(0x7f0000000118)="0200", 0x2}, {&(0x7f000000011a)="0247", 0x2}, {&(0x7f000000011c)="0200", 0x2}, {&(0x7f000000011e)="02fa", 0x2}, {&(0x7f0000000120)="0200", 0x2}, {&(0x7f0000000122)="0247", 0x2}, {&(0x7f0000000124)="0200", 0x2}, {&(0x7f0000000126)="02fa", 0x2}, {&(0x7f0000000128)="0200", 0x2}, {&(0x7f000000012a)="0247", 0x2}, {&(0x7f000000012c)="0200", 0x2}, {&(0x7f000000012e)="02fa", 0x2}, {&(0x7f0000000130)="0200", 0x2}, {&(0x7f0000000132)="0247", 0x2}, {&(0x7f0000000134)="0200", 0x2}, {&(0x7f0000000136)="02fa", 0x2}, {&(0x7f0000000138)="0200", 0x2}, {&(0x7f000000013a)="0247", 0x2}, {&(0x7f000000013c)="0200", 0x2}, {&(0x7f000000013e)="02fa", 0x2}], 0x20) nanosleep(&(0x7f0000000240)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/serio/devices/serio0/protocol\x00', 0x2, 0x0) write(r1, &(0x7f0000000440)='synaptics\x00', 0xa) r2 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./sys/bus/serio/devices/serio1/protocol\x00', 0x2, 0x0) write(r2, &(0x7f0000000440)='synaptics\x00', 0xa) r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/bus/serio/devices/serio2/protocol\x00', 0x2, 0x0) write(r3, &(0x7f0000000440)='synaptics\x00', 0xa) 177.045873ms ago: executing program 2 (id=16): r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000406d0421c20000000000010902290001010080320904000002030101000921110100012217000705810340000a0705020340000a00000000"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022170000000600ff0900a10185020901150026ff00750895088102c0"], &(0x7f0000000080)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x17}}}}, &(0x7f0000000200)={0x2c, 0x0, &(0x7f0000000280)={0x0, 0xa, 0x1}, &(0x7f00000002a0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000240)={0x20, 0x1, 0x8, "0200000000000000"}, &(0x7f00000002c0)={0x20, 0x3, 0x1, 0x1}}) (async) nanosleep(&(0x7f0000000300)={0x1}, 0x0) syz_open_dev$hidraw(&(0x7f0000000500), 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0x9, &(0x7f0000000400)="028000000000000000") 20.111452ms ago: executing program 4 (id=17): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:01.0/driver_override\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='yenta_cardbus\x00', 0xe) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/yenta_cardbus/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000500)='0000:00:01.0\x00', 0xc) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pci/devices/0000:00:01.3/driver_override\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='yenta_cardbus\x00', 0xe) r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/yenta_cardbus/bind\x00', 0x1, 0x0) write(r3, &(0x7f0000000700)='0000:00:01.3\x00', 0xc) r4 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0) write(r4, &(0x7f0000000300)='yenta_cardbus\x00', 0xe) r5 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/yenta_cardbus/bind\x00', 0x1, 0x0) write(r5, &(0x7f0000000900)='0000:00:02.0\x00', 0xc) r6 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0) write(r6, &(0x7f0000000300)='yenta_cardbus\x00', 0xe) r7 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/drivers/yenta_cardbus/bind\x00', 0x1, 0x0) write(r7, &(0x7f0000000b00)='0000:00:03.0\x00', 0xc) 0s ago: executing program 4 (id=18): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_ACTIVATE(r0, 0x5606, 0x1) ioctl$VT_WAITACTIVE(r0, 0x5607) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0x1c, 0x20f}) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x1) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x1c) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{}, 'syz0\x00', 0x1}) ioctl$UI_DEV_CREATE(r1, 0x5501) write$input_event(r1, &(0x7f0000000100)={{}, 0x1, 0x1c, 0x1}, 0x18) write$input_event(r1, &(0x7f0000000140), 0x18) write$input_event(r1, &(0x7f0000000180)={{}, 0x1, 0x1c}, 0x18) write$input_event(r1, &(0x7f00000001c0), 0x18) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.32' (ED25519) to the list of known hosts. [ 21.081156][ T4666] cgroup: Unknown subsys name 'net' [ 21.181211][ T4666] cgroup: Unknown subsys name 'cpuset' [ 21.183245][ T4666] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 21.341049][ T4666] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 22.098826][ T4714] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 22.111971][ T4725] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 22.112271][ T4725] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 22.112974][ T4725] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 22.113155][ T4725] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 22.113533][ T4725] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 22.113675][ T4725] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 22.113950][ T4725] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 22.120156][ T4725] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 22.123779][ T4725] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 22.124049][ T4725] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 22.124214][ T4725] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 22.128123][ T4714] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 22.128244][ T4714] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 22.129030][ T4725] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 22.129167][ T4725] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 22.129876][ T4714] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 22.132860][ T4725] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 22.136731][ T4725] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 22.141992][ T4727] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 22.143308][ T4718] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 22.145335][ T4725] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 22.145581][ T4725] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 22.158393][ T4726] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 22.169966][ T4726] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 22.467029][ T4709] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.467370][ T4709] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.467439][ T4709] bridge_slave_0: entered allmulticast mode [ 22.467916][ T4709] bridge_slave_0: entered promiscuous mode [ 22.481409][ T4709] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.481480][ T4709] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.481567][ T4709] bridge_slave_1: entered allmulticast mode [ 22.481995][ T4709] bridge_slave_1: entered promiscuous mode [ 22.505174][ T4708] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.506570][ T4708] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.507994][ T4708] bridge_slave_0: entered allmulticast mode [ 22.509619][ T4708] bridge_slave_0: entered promiscuous mode [ 22.512764][ T4708] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.514218][ T4708] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.515589][ T4708] bridge_slave_1: entered allmulticast mode [ 22.517194][ T4708] bridge_slave_1: entered promiscuous mode [ 22.522973][ T4709] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 22.526216][ T4709] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 22.547824][ T4708] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 22.548761][ T4708] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 22.553049][ T4709] team0: Port device team_slave_0 added [ 22.557463][ T4709] team0: Port device team_slave_1 added [ 22.569954][ T4708] team0: Port device team_slave_0 added [ 22.578718][ T4708] team0: Port device team_slave_1 added [ 22.604724][ T4709] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 22.604748][ T4709] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 22.604766][ T4709] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 22.605582][ T4709] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 22.605590][ T4709] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 22.605606][ T4709] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 22.616194][ T4716] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.616262][ T4716] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.616878][ T4716] bridge_slave_0: entered allmulticast mode [ 22.617307][ T4716] bridge_slave_0: entered promiscuous mode [ 22.618559][ T4716] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.618580][ T4716] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.618665][ T4716] bridge_slave_1: entered allmulticast mode [ 22.619054][ T4716] bridge_slave_1: entered promiscuous mode [ 22.623250][ T4708] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 22.623258][ T4708] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 22.623272][ T4708] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 22.623782][ T4708] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 22.623789][ T4708] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 22.623804][ T4708] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 22.634133][ T4708] hsr_slave_0: entered promiscuous mode [ 22.634450][ T4708] hsr_slave_1: entered promiscuous mode [ 22.660671][ T4712] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.660780][ T4712] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.660876][ T4712] bridge_slave_0: entered allmulticast mode [ 22.661283][ T4712] bridge_slave_0: entered promiscuous mode [ 22.681275][ T4710] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.681319][ T4710] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.681376][ T4710] bridge_slave_0: entered allmulticast mode [ 22.681920][ T4710] bridge_slave_0: entered promiscuous mode [ 22.683181][ T4710] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.683220][ T4710] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.683310][ T4710] bridge_slave_1: entered allmulticast mode [ 22.683713][ T4710] bridge_slave_1: entered promiscuous mode [ 22.690842][ T4710] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 22.691758][ T4710] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 22.694711][ T4712] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.696141][ T4712] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.697436][ T4712] bridge_slave_1: entered allmulticast mode [ 22.698976][ T4712] bridge_slave_1: entered promiscuous mode [ 22.711749][ T4716] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 22.717761][ T4709] hsr_slave_0: entered promiscuous mode [ 22.719597][ T4709] hsr_slave_1: entered promiscuous mode [ 22.720985][ T4709] debugfs: 'hsr0' already exists in 'hsr' [ 22.722148][ T4709] Cannot create hsr debugfs directory [ 22.728468][ T4712] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 22.732139][ T4712] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 22.733020][ T4716] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 22.736597][ T4710] team0: Port device team_slave_0 added [ 22.737436][ T4710] team0: Port device team_slave_1 added [ 22.759673][ T4710] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 22.759698][ T4710] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 22.759728][ T4710] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 22.760433][ T4710] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 22.760449][ T4710] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 22.760471][ T4710] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 22.773621][ T4716] team0: Port device team_slave_0 added [ 22.774462][ T4716] team0: Port device team_slave_1 added [ 22.781031][ T4712] team0: Port device team_slave_0 added [ 22.781860][ T4712] team0: Port device team_slave_1 added [ 22.793187][ T4716] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 22.793217][ T4716] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 22.793244][ T4716] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 22.793876][ T4716] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 22.793897][ T4716] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 22.793918][ T4716] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 22.795999][ T4710] hsr_slave_0: entered promiscuous mode [ 22.796309][ T4710] hsr_slave_1: entered promiscuous mode [ 22.796526][ T4710] debugfs: 'hsr0' already exists in 'hsr' [ 22.796537][ T4710] Cannot create hsr debugfs directory [ 22.800262][ T4712] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 22.800270][ T4712] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 22.800287][ T4712] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 22.807770][ T4712] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 22.807779][ T4712] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 22.807790][ T4712] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 22.822866][ T4708] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 22.827937][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 22.845937][ T4708] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 22.848014][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 22.857690][ T4716] hsr_slave_0: entered promiscuous mode [ 22.857990][ T4716] hsr_slave_1: entered promiscuous mode [ 22.858300][ T4716] debugfs: 'hsr0' already exists in 'hsr' [ 22.858310][ T4716] Cannot create hsr debugfs directory [ 22.862294][ T4708] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 22.864718][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 22.870589][ T4712] hsr_slave_0: entered promiscuous mode [ 22.872028][ T4712] hsr_slave_1: entered promiscuous mode [ 22.873275][ T4712] debugfs: 'hsr0' already exists in 'hsr' [ 22.874327][ T4712] Cannot create hsr debugfs directory [ 22.883543][ T4708] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 22.885823][ T4708] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 22.960470][ T4708] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.960540][ T4708] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.960697][ T4708] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.960726][ T4708] bridge0: port 1(bridge_slave_0) entered forwarding state [ 22.977560][ T4709] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 22.981277][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 22.988172][ T4709] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 22.991642][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 22.991969][ T4709] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 22.993848][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 22.998478][ T4709] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 23.001069][ T4709] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 23.008660][ T4708] 8021q: adding VLAN 0 to HW filter on device bond0 [ 23.023463][ T4709] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.023513][ T4709] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.023610][ T4709] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.023647][ T4709] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.029593][ T4710] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 23.032168][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 23.032482][ T4710] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 23.034251][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 23.040930][ T4710] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 23.043028][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 23.045260][ T39] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.046669][ T39] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.048164][ T39] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.049506][ T39] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.058585][ T4710] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 23.060973][ T4710] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 23.067074][ T4708] 8021q: adding VLAN 0 to HW filter on device team0 [ 23.087934][ T4708] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 23.087968][ T4708] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 23.099418][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.099469][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.099953][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.099976][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.120883][ T4716] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 23.124396][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 23.126125][ T4716] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 23.128203][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 23.131469][ T4716] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 23.133716][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 23.136607][ T4716] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 23.138694][ T4716] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 23.143072][ T4709] 8021q: adding VLAN 0 to HW filter on device bond0 [ 23.157565][ T4709] 8021q: adding VLAN 0 to HW filter on device team0 [ 23.164783][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.164822][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.171993][ T4710] 8021q: adding VLAN 0 to HW filter on device bond0 [ 23.179751][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.179787][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.193509][ T4710] 8021q: adding VLAN 0 to HW filter on device team0 [ 23.199474][ T4709] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 23.200559][ T4709] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 23.203174][ T4712] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 23.206377][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 23.221829][ T4712] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 23.223908][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 23.224466][ T4712] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 23.227345][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 23.229145][ T4712] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 23.232156][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 23.234244][ T1330] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.234292][ T1330] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.234835][ T1330] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.234852][ T1330] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.265230][ T4716] 8021q: adding VLAN 0 to HW filter on device bond0 [ 23.273280][ T4710] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 23.274197][ T4710] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 23.301717][ T4708] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 23.308973][ T4716] 8021q: adding VLAN 0 to HW filter on device team0 [ 23.317107][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.317153][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.337070][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.337125][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.341968][ T4708] veth0_vlan: entered promiscuous mode [ 23.367985][ T4708] veth1_vlan: entered promiscuous mode [ 23.381661][ T4712] 8021q: adding VLAN 0 to HW filter on device bond0 [ 23.393699][ T4709] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 23.404164][ T4712] 8021q: adding VLAN 0 to HW filter on device team0 [ 23.408159][ T4708] veth0_macvtap: entered promiscuous mode [ 23.412073][ T4708] veth1_macvtap: entered promiscuous mode [ 23.434951][ T2666] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.434993][ T2666] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.450677][ T2666] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.450720][ T2666] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.460829][ T4712] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 23.465161][ T4709] veth0_vlan: entered promiscuous mode [ 23.474074][ T4709] veth1_vlan: entered promiscuous mode [ 23.476833][ T4708] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 23.485722][ T4708] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 23.493848][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.494078][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.494105][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.494122][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.497629][ T4710] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 23.539780][ T4709] veth0_macvtap: entered promiscuous mode [ 23.544320][ T4710] veth0_vlan: entered promiscuous mode [ 23.551620][ T4709] veth1_macvtap: entered promiscuous mode [ 23.555121][ T4710] veth1_vlan: entered promiscuous mode [ 23.566257][ T4709] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 23.572548][ T4709] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 23.574982][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 23.575011][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 23.588116][ T4710] veth0_macvtap: entered promiscuous mode [ 23.592559][ T4217] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.592616][ T4217] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.592641][ T4217] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.592664][ T4217] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.605190][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 23.605219][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 23.616474][ T4710] veth1_macvtap: entered promiscuous mode [ 23.635941][ T4716] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 23.646452][ T4710] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 23.654088][ T4710] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 23.659399][ T1330] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 23.659432][ T1330] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 23.674224][ T15] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.674282][ T15] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.674311][ T15] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.674332][ T15] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.688617][ T4716] veth0_vlan: entered promiscuous mode [ 23.704123][ T1330] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 23.704154][ T1330] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 23.707634][ T4712] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 23.709351][ T4708] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 23.729242][ T4716] veth1_vlan: entered promiscuous mode [ 23.748112][ T4888] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 23.748371][ T4888] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 23.763400][ T4716] veth0_macvtap: entered promiscuous mode [ 23.764516][ T4716] veth1_macvtap: entered promiscuous mode [ 23.773205][ T4716] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 23.785978][ T4716] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 23.792302][ T15] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 23.792333][ T15] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 23.795591][ T1330] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.795717][ T1330] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.795752][ T1330] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.795779][ T1330] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.864106][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 23.864140][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 23.866776][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 23.866789][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 23.908114][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 23.908158][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 23.911410][ T4712] veth0_vlan: entered promiscuous mode [ 23.919350][ T4712] veth1_vlan: entered promiscuous mode [ 23.943561][ T4712] veth0_macvtap: entered promiscuous mode [ 23.946342][ T4712] veth1_macvtap: entered promiscuous mode [ 23.962932][ T4712] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 23.978140][ T4712] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 23.989015][ T15] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.989061][ T15] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.989079][ T15] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 23.989095][ T15] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 24.021603][ T4901] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 24.021863][ T4901] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 24.053362][ T15] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 24.053396][ T15] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 24.066316][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 24.066344][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 24.160095][ T4904] digital: digital_start_poll: Unknown protocol [ 24.172097][ T4726] Bluetooth: hci3: command tx timeout [ 24.172814][ T4726] Bluetooth: hci4: command tx timeout [ 24.172875][ T4726] Bluetooth: hci0: command tx timeout [ 24.180009][ T50] Bluetooth: hci1: command tx timeout [ 24.208913][ T4908] nvmet: adding nsid 1 to subsystem testnqn [ 24.250104][ T50] Bluetooth: hci2: command tx timeout [ 24.295404][ T15] nvmet: Created nvm controller 1 for subsystem testnqn for NQN nqn.2014-08.org.nvmexpress:uuid:eeaa597f-1b67-429e-96ce-84a8a63de44c. [ 24.298781][ T4908] nvme nvme1: creating 2 I/O queues. [ 24.304328][ T4908] nvme nvme1: new ctrl: "testnqn" [ 24.843002][ T4902] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 24.888475][ T4916] UDC core: g1: couldn't find an available UDC or it's busy [ 25.273795][ T4926] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.275060][ T4926] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.280610][ T4923] lo speed is unknown, defaulting to 1000 [ 25.282886][ T4923] lo speed is unknown, defaulting to 1000 [ 25.283425][ T4923] lo speed is unknown, defaulting to 1000 [ 25.321683][ T4923] infiniband syz0: set active [ 25.321956][ T4711] lo speed is unknown, defaulting to 1000 [ 25.324069][ T4923] infiniband syz0: added lo [ 25.333288][ T4923] RDS/IB: syz0: added [ 25.333390][ T4923] smc: adding ib device syz0 with port count 1 [ 25.333691][ T4923] smc: ib device syz0 port 1 has no pnetid [ 25.334006][ T4711] lo speed is unknown, defaulting to 1000 [ 25.334764][ T4923] lo speed is unknown, defaulting to 1000 [ 25.376481][ T4923] lo speed is unknown, defaulting to 1000 [ 25.410933][ T4923] lo speed is unknown, defaulting to 1000 [ 25.445213][ T4923] lo speed is unknown, defaulting to 1000 [ 25.480802][ T4923] lo speed is unknown, defaulting to 1000 [ 25.745016][ T4941] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 25.746234][ T4941] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 25.923417][ T4947] input: syz0 as /devices/virtual/input/input3 [ 25.928710][ T4813] [ 25.929169][ T4813] ====================================================== [ 25.930435][ T4813] WARNING: possible circular locking dependency detected [ 25.931689][ T4813] syzkaller #0 Not tainted [ 25.932447][ T4813] ------------------------------------------------------ [ 25.933666][ T4813] kworker/1:5/4813 is trying to acquire lock: [ 25.934706][ T4813] ffff00000e09d2c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_flush_buffer+0x2c/0xa4 [ 25.936358][ T4813] [ 25.936358][ T4813] but task is already holding lock: [ 25.937643][ T4813] ffff0000c006a0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x78/0x2b4 [ 25.939154][ T4813] [ 25.939154][ T4813] which lock already depends on the new lock. [ 25.939154][ T4813] [ 25.940899][ T4813] [ 25.940899][ T4813] the existing dependency chain (in reverse order) is: [ 25.942459][ T4813] [ 25.942459][ T4813] -> #4 (&buf->lock){+.+.}-{4:4}: [ 25.943693][ T4813] __mutex_lock+0x164/0xf14 [ 25.944662][ T4813] mutex_lock_nested+0x24/0x30 [ 25.945568][ T4813] tty_buffer_flush+0x78/0x2b4 [ 25.946491][ T4813] tty_ldisc_flush+0x30/0x7c [ 25.947413][ T4813] __do_SAK+0x21c/0x604 [ 25.948213][ T4813] vc_SAK+0x74/0xa4 [ 25.948927][ T4813] process_scheduled_works+0x788/0x10b8 [ 25.950019][ T4813] worker_thread+0x798/0xbd0 [ 25.950906][ T4813] kthread+0x304/0x3d4 [ 25.951698][ T4813] ret_from_fork+0x10/0x20 [ 25.952487][ T4813] [ 25.952487][ T4813] -> #3 (console_lock){+.+.}-{0:0}: [ 25.953782][ T4813] console_lock+0x8c/0xac [ 25.954630][ T4813] console_call_setup+0x54/0xa4 [ 25.955571][ T4813] try_enable_preferred_console+0x444/0x5a4 [ 25.956695][ T4813] register_console+0x3a0/0xb98 [ 25.957673][ T4813] univ8250_console_init+0x5c/0x84 [ 25.958661][ T4813] console_init+0x14c/0x89c [ 25.959575][ T4813] start_kernel+0x25c/0x3c0 [ 25.960461][ T4813] __primary_switched+0x8c/0x94 [ 25.961496][ T4813] [ 25.961496][ T4813] -> #2 (console_mutex){+.+.}-{4:4}: [ 25.962837][ T4813] __mutex_lock+0x164/0xf14 [ 25.963642][ T4813] mutex_lock_nested+0x24/0x30 [ 25.964525][ T4813] console_list_lock+0x90/0xa8 [ 25.965428][ T4813] serial_core_register_port+0x1284/0x1b0c [ 25.966513][ T4813] serial_ctrl_register_port+0x28/0x38 [ 25.967525][ T4813] uart_add_one_port+0x28/0x38 [ 25.968465][ T4813] pl011_register_port+0x194/0x2ec [ 25.969411][ T4813] sbsa_uart_probe+0x334/0x46c [ 25.970284][ T4813] platform_probe+0x100/0x1a4 [ 25.971124][ T4813] really_probe+0x29c/0x800 [ 25.972008][ T4813] __driver_probe_device+0x1e0/0x350 [ 25.973159][ T4813] driver_probe_device+0x6c/0x19c [ 25.974168][ T4813] __device_attach_driver+0x198/0x2f8 [ 25.975220][ T4813] bus_for_each_drv+0x144/0x1dc [ 25.976181][ T4813] __device_attach+0x248/0x390 [ 25.977058][ T4813] device_initial_probe+0x90/0xc8 [ 25.977927][ T4813] bus_probe_device+0x58/0x120 [ 25.978757][ T4813] device_add+0x6cc/0x9e0 [ 25.979632][ T4813] platform_device_add+0x3dc/0x6f0 [ 25.980467][ T4813] platform_device_register_full+0x4fc/0x5ac [ 25.981616][ T4813] acpi_create_platform_device+0x50c/0x6e4 [ 25.982678][ T4813] acpi_default_enumeration+0x200/0x438 [ 25.983655][ T4813] acpi_bus_attach+0x64c/0x7e0 [ 25.984502][ T4813] acpi_dev_for_one_check+0xa0/0xb4 [ 25.985446][ T4813] device_for_each_child+0xf4/0x184 [ 25.986408][ T4813] acpi_dev_for_each_child+0x98/0xe4 [ 25.987362][ T4813] acpi_bus_attach+0x20c/0x7e0 [ 25.988237][ T4813] acpi_dev_for_one_check+0xa0/0xb4 [ 25.989202][ T4813] device_for_each_child+0xf4/0x184 [ 25.990218][ T4813] acpi_dev_for_each_child+0x98/0xe4 [ 25.991251][ T4813] acpi_bus_attach+0x20c/0x7e0 [ 25.992140][ T4813] acpi_bus_scan+0x104/0x310 [ 25.993011][ T4813] acpi_scan_init+0x168/0x3cc [ 25.993920][ T4813] acpi_init+0x15c/0x1f4 [ 25.994857][ T4813] do_one_initcall+0x274/0xc38 [ 25.995766][ T4813] do_initcall_level+0x12c/0x1c4 [ 25.996722][ T4813] do_initcalls+0x70/0xd0 [ 25.997508][ T4813] do_basic_setup+0x7c/0x90 [ 25.998418][ T4813] kernel_init_freeable+0x268/0x3a8 [ 25.999404][ T4813] kernel_init+0x24/0x1dc [ 26.000343][ T4813] ret_from_fork+0x10/0x20 [ 26.001217][ T4813] [ 26.001217][ T4813] -> #1 (&port->mutex){+.+.}-{4:4}: [ 26.002418][ T4813] __mutex_lock+0x164/0xf14 [ 26.003337][ T4813] mutex_lock_nested+0x24/0x30 [ 26.004235][ T4813] uart_set_termios+0x74/0x58c [ 26.005208][ T4813] tty_set_termios+0x3b0/0x6d0 [ 26.006078][ T4813] set_termios+0x428/0x618 [ 26.006914][ T4813] tty_mode_ioctl+0x45c/0x7f4 [ 26.007838][ T4813] n_tty_ioctl_helper+0xa8/0x2d8 [ 26.008796][ T4813] n_tty_ioctl+0x190/0x434 [ 26.009629][ T4813] tty_ioctl+0x900/0xd50 [ 26.010457][ T4813] __arm64_sys_ioctl+0x154/0x1cc [ 26.011314][ T4813] invoke_syscall+0x98/0x244 [ 26.012177][ T4813] el0_svc_common+0xec/0x23c [ 26.013017][ T4813] do_el0_svc+0x4c/0x5c [ 26.013825][ T4813] el0_svc+0x64/0x260 [ 26.014574][ T4813] el0t_64_sync_handler+0x48/0x148 [ 26.015476][ T4813] el0t_64_sync+0x198/0x19c [ 26.016356][ T4813] [ 26.016356][ T4813] -> #0 (&tty->termios_rwsem){++++}-{4:4}: [ 26.017760][ T4813] __lock_acquire+0x17c0/0x2ebc [ 26.018615][ T4813] lock_acquire+0x140/0x364 [ 26.019390][ T4813] down_write+0x50/0xc0 [ 26.020238][ T4813] n_tty_flush_buffer+0x2c/0xa4 [ 26.021147][ T4813] tty_buffer_flush+0x1b8/0x2b4 [ 26.022045][ T4813] tty_ldisc_flush+0x30/0x7c [ 26.022875][ T4813] __do_SAK+0x21c/0x604 [ 26.023664][ T4813] vc_SAK+0x74/0xa4 [ 26.024381][ T4813] process_scheduled_works+0x788/0x10b8 [ 26.025383][ T4813] worker_thread+0x798/0xbd0 [ 26.026233][ T4813] kthread+0x304/0x3d4 [ 26.026999][ T4813] ret_from_fork+0x10/0x20 [ 26.027829][ T4813] [ 26.027829][ T4813] other info that might help us debug this: [ 26.027829][ T4813] [ 26.029529][ T4813] Chain exists of: [ 26.029529][ T4813] &tty->termios_rwsem --> console_lock --> &buf->lock [ 26.029529][ T4813] [ 26.031687][ T4813] Possible unsafe locking scenario: [ 26.031687][ T4813] [ 26.033012][ T4813] CPU0 CPU1 [ 26.033870][ T4813] ---- ---- [ 26.034625][ T4813] lock(&buf->lock); [ 26.035217][ T4813] lock(console_lock); [ 26.036393][ T4813] lock(&buf->lock); [ 26.037528][ T4813] lock(&tty->termios_rwsem); [ 26.038424][ T4813] [ 26.038424][ T4813] *** DEADLOCK *** [ 26.038424][ T4813] [ 26.039839][ T4813] 5 locks held by kworker/1:5/4813: [ 26.040691][ T4813] #0: ffff0000c002b540 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x734/0x10b8 [ 26.042581][ T4813] #1: ffff800097777c40 ((work_completion)(&vc_cons[currcons].SAK_work)){+.+.}-{0:0}, at: process_scheduled_works+0x73c/0x10b8 [ 26.044711][ T4813] #2: ffff800088cec860 (console_lock){+.+.}-{0:0}, at: vc_SAK+0x2c/0xa4 [ 26.046135][ T4813] #3: ffff00000e09d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref+0x20/0x90 [ 26.047731][ T4813] #4: ffff0000c006a0b8 (&buf->lock){+.+.}-{4:4}, at: tty_buffer_flush+0x78/0x2b4 [ 26.049312][ T4813] [ 26.049312][ T4813] stack backtrace: [ 26.050276][ T4813] CPU: 1 UID: 0 PID: 4813 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT [ 26.051806][ T4813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 26.053598][ T4813] Workqueue: events vc_SAK [ 26.054380][ T4813] Call trace: [ 26.054924][ T4813] show_stack+0x2c/0x3c (C) [ 26.055660][ T4813] __dump_stack+0x30/0x40 [ 26.056375][ T4813] dump_stack_lvl+0xd8/0x12c [ 26.057196][ T4813] dump_stack+0x1c/0x28 [ 26.057844][ T4813] print_circular_bug+0x328/0x330 [ 26.058716][ T4813] check_noncircular+0x158/0x174 [ 26.059554][ T4813] __lock_acquire+0x17c0/0x2ebc [ 26.060300][ T4813] lock_acquire+0x140/0x364 [ 26.061048][ T4813] down_write+0x50/0xc0 [ 26.061806][ T4813] n_tty_flush_buffer+0x2c/0xa4 [ 26.062676][ T4813] tty_buffer_flush+0x1b8/0x2b4 [ 26.063560][ T4813] tty_ldisc_flush+0x30/0x7c [ 26.064378][ T4813] __do_SAK+0x21c/0x604 [ 26.065151][ T4813] vc_SAK+0x74/0xa4 [ 26.065771][ T4813] process_scheduled_works+0x788/0x10b8 [ 26.066723][ T4813] worker_thread+0x798/0xbd0 [ 26.067496][ T4813] kthread+0x304/0x3d4 [ 26.068208][ T4813] ret_from_fork+0x10/0x20 [ 26.249909][ T4726] Bluetooth: hci4: command tx timeout [ 26.249917][ T4727] Bluetooth: hci3: command tx timeout [ 26.251118][ T50] Bluetooth: hci1: command tx timeout [ 26.329872][ T50] Bluetooth: hci2: command tx timeout [ 28.330193][ T50] Bluetooth: hci1: command tx timeout [ 28.330226][ T50] Bluetooth: hci4: command tx timeout [ 28.330249][ T50] Bluetooth: hci3: command tx timeout [ 28.409833][ T50] Bluetooth: hci2: command tx timeout [ 30.409846][ T50] Bluetooth: hci4: command tx timeout [ 30.409875][ T4726] Bluetooth: hci1: command tx timeout [ 30.409886][ T4727] Bluetooth: hci3: command tx timeout [ 30.499841][ T50] Bluetooth: hci2: command tx timeout