last executing test programs: 13.015676714s ago: executing program 2 (id=6): mkdir(&(0x7f0000000000)='mysys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='mysys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, &(0x7f0000000400)='\x00') readlink(&(0x7f0000000500)='mysys/bus/usb/devices/usb1\x00', &(0x7f0000000600), 0x400) readlink(&(0x7f0000000700)='mysys/bus/usb/devices/usb2\x00', &(0x7f0000000800), 0x400) 12.814527186s ago: executing program 2 (id=7): mkdir(&(0x7f0000000100)='./my_sys\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='./my_sys\x00', &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) syz_usb_connect(0x3, 0x40, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000202000040e204101400010000000109022e000201008032090400000002020100052406000109040100020a0000000705810200020007050202000200"], 0x0) nanosleep(&(0x7f0000000400)={0x1, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./my_sys/bus/usb-serial/devices/ttyUSB0\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./my_sys/class/tty/ttyUSB0\x00', 0x0, 0x0) 10.725495635s ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1ff) ftruncate(r0, 0x1000000) pwrite64(r0, &(0x7f0000000200)="000000000000000008000000000000000000000000000000c68573f64e1a45ca8265f57f48ba6d810102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f1000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000100010000000000000400000000000001000100000000000000", 0xd0, 0x1000) r1 = syz_open_dev$loop(&(0x7f0000000300), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) close(r0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/fs/bcache/register\x00', 0x1, 0x0) write(r2, &(0x7f0000000900)='/dev/loop0\x00', 0xb) 10.115362857s ago: executing program 4 (id=5): r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040861246200000000000010902200001010080fa0904000002ff0401000705810240000007050202400000"], 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), r1) sendmsg$NFC_CMD_FW_DOWNLOAD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)={0x38, r2, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_FIRMWARE_NAME={0x19, 0x14, 'nfc/nfc_template.bin\x00'}]}, 0x38}}, 0x0) syz_usb_ep_write(r0, 0x81, 0x5, &(0x7f0000000500)="600002a001") nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x81, 0x3, &(0x7f0000000500)="400111") nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x81, 0x5, &(0x7f0000000500)="4002020000") nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x81, 0x4, &(0x7f0000000500)="40040400") nanosleep(&(0x7f0000000100)={0x0, 0x5f5e100}, 0x0) syz_usb_ep_write(r0, 0x81, 0x9, &(0x7f0000000500)="000000a50000ffff00") 9.209558636s ago: executing program 3 (id=8): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408c0d0301000100000001090212000101008032090400000001010000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000500)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000a00)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000f00)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000001400)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000001900)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000001e00)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000002300)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000002800)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000002d00)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000003200)) r1 = syz_open_dev$sndctrl(&(0x7f0000000140), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000003700)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000003c00)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000004100)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000004600)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000004b00)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000005000)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000005500)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000005a00)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000005f00)) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000006400)) 9.069353583s ago: executing program 2 (id=9): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000800000/0x2000)=nil, 0x2000, 0x3, 0x32, 0xffffffffffffffff, 0x0) getrandom(&(0x7f0000800000), 0x2000, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000800000/0x2000)=nil}) ioctl$KVM_PRE_FAULT_MEMORY(r2, 0xc040aed5, &(0x7f0000000200)={0x0, 0x2000}) madvise(&(0x7f0000800000/0x2000)=nil, 0x2000, 0x4) close(r2) close(r1) close(r0) 8.941588649s ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config\x00', 0x1ff) mount(&(0x7f0000000180)=@filename='none\x00', &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/bus/platform/drivers/dummy_udc/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='dummy_udc.0\n', 0xc) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000340)='0x1d6b\n', 0x7) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r2, &(0x7f00000003c0)='0x0104\n', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='dummy_udc.0\n', 0xc) 8.687083112s ago: executing program 0 (id=1): r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x1, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x0, 0x0) syz_open_dev$sndpcmc(&(0x7f00000000c0), 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000140), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r0, 0x81b85501, &(0x7f0000000200)=""/184) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81b85501, &(0x7f0000000300)=""/184) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000500)={{0x1, 0x3, 0x0, 0x0, 'syz0\x00'}}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000a00)={{0x2, 0x3, 0x0, 0x0, 'syz0\x00'}}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000f00)={{0x3, 0x3, 0x0, 0x0, 'syz0\x00'}}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000001400)={{0x4, 0x3, 0x0, 0x0, 'syz0\x00'}}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000001900)={{0x1, 0x3, 0x0, 0x0, 'syz0\x00'}}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000001e00)={{0x2, 0x3, 0x0, 0x0, 'syz0\x00'}}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000002300)={{0x3, 0x3, 0x0, 0x0, 'syz0\x00'}}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000002800)={{0x4, 0x3, 0x0, 0x0, 'syz0\x00'}}) 8.151218938s ago: executing program 0 (id=10): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000000000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_amd_vmsave={0x183, 0x18}, @nested_amd_vmload={0x182, 0x18}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 7.572059912s ago: executing program 1 (id=11): r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1\n\x00', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys/attr_qid_max\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='0\n\x00', 0x2) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/ports/1\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r3, &(0x7f0000000380)='loop\n\x00', 0x5) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/param_max_queue_size\x00', 0x1, 0x0) write(r4, &(0x7f0000000400)='16\n\x00', 0x3) close(r4) symlinkat(&(0x7f0000000440)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1/subsystems/testsubsys\x00') write(r0, &(0x7f0000000540)='transport=loop,nqn=testsubsys,nr_io_queues=1,queue_size=32\x00', 0x3b) 7.132033089s ago: executing program 4 (id=12): mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='0x1d6b\n', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000700)='0x0104\n', 0x7) close(r1) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r2, &(0x7f0000000a00)='fedcba9876543210\n', 0x11) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r3, &(0x7f0000000c00)='Linux Foundation\n', 0x11) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000d00)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x1, 0x0) write(r4, &(0x7f0000000e00)='Multifunction Gadget\n', 0x15) close(r4) mkdir(&(0x7f0000000f00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x1, 0x0) mkdir(&(0x7f0000001300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000001c00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0) write(r5, &(0x7f0000001d00)='veth0\n', 0x6) close(r5) symlink(&(0x7f0000001400)='./config/usb_gadget/g1/functions/ecm.usb0\x00', &(0x7f0000001500)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r6 = openat(0xffffffffffffff9c, &(0x7f0000001600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r6, &(0x7f0000001700)='dummy_udc.0\n', 0xc) close(r6) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000001900)={'veth0\x00', 0x1}) write(r7, &(0x7f0000001b00)="00112233445566778899aabb0800"/76, 0x40) 6.882342898s ago: executing program 2 (id=13): mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mkdir(&(0x7f0000000100)='./dev\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='configfs\x00', &(0x7f0000000300)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000600)='./dev\x00', &(0x7f0000000700)='devtmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/os_desc/use\x00', 0x1, 0x0) write(r0, &(0x7f0000000a00)='1\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/os_desc/b_vendor_code\x00', 0x1, 0x0) write(r1, &(0x7f0000000c00)='0x40\x00', 0x5) close(r1) mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1ff) symlink(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/ncm.usb0\x00', &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/ncm.usb0\x00') symlink(&(0x7f0000001100)='./config/usb_gadget/g1/configs/c.1\x00', &(0x7f0000001200)='./config/usb_gadget/g1/os_desc/c.1\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) close(r2) poll(0x0, 0x0, 0x3e8) r3 = syz_open_dev$usbfs(&(0x7f0000001600), 0x15, 0x2) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f0000001700)={0x80, 0x6, 0x100, 0x0, 0x12, 0x3e8, &(0x7f0000001800)='\x00'/18}) 6.795895599s ago: executing program 0 (id=14): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000240)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000340)='nfsd\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./export\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='nfsd 127.0.0.1 2147483647 client1\n\x00', 0x22) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)="636c69656e7431203120000000012032313437343833363437202e2f6578706f72740a00", 0x23) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./nfsd/portlist\x00', 0x1, 0x0) write(r3, &(0x7f0000000580)='tcp 2049\n\x00', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./nfsd/threads\x00', 0x1, 0x0) write(r4, &(0x7f0000000600)='2\n\x00', 0x2) close(r4) r5 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000040)='source\x00', &(0x7f0000000800)='127.0.0.1:./export\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f00000000c0)='addr\x00', &(0x7f0000000100)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000140)='vers\x00', &(0x7f0000000180)='4.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f00000001c0)='clientaddr\x00', &(0x7f0000000200)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) 6.091660383s ago: executing program 3 (id=15): r0 = syz_open_dev$usbfs(&(0x7f0000000200), 0x15, 0x2) r1 = syz_open_dev$usbfs(0x0, 0x1f, 0x2) r2 = syz_open_dev$usbfs(&(0x7f0000000280), 0x16, 0x2) r3 = syz_open_dev$usbfs(&(0x7f00000002c0), 0x20, 0x2) ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f0000000600)) ioctl$USBDEVFS_CLAIMINTERFACE(r1, 0x8004550f, &(0x7f0000000600)) ioctl$USBDEVFS_CLAIMINTERFACE(r2, 0x8004550f, &(0x7f0000000600)) ioctl$USBDEVFS_CLAIMINTERFACE(r3, 0x8004550f, &(0x7f0000000600)) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000300)=@urb_type_bulk={0x3, {0x1, 0x1}, 0x0, 0x0, &(0x7f0000000400)="00112233445566778899aabbccddeeff", 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000300)) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000300)) ioctl$USBDEVFS_SUBMITURB(r3, 0x8038550a, &(0x7f0000000300)) ioctl$USBDEVFS_DISCARDURB(r0, 0x550b, &(0x7f0000000500)=0x7f0000000300) ioctl$USBDEVFS_DISCARDURB(r1, 0x550b, &(0x7f0000000500)) ioctl$USBDEVFS_DISCARDURB(r2, 0x550b, &(0x7f0000000500)) ioctl$USBDEVFS_DISCARDURB(r3, 0x550b, &(0x7f0000000500)) 5.364138358s ago: executing program 2 (id=16): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000200000040a61b01000000010200010902200001010080320904000002ff0000000705010240000007058202400000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mknod(&(0x7f0000000400)='./dev_fe0\x00', 0x81b6, 0xd403) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev_fe0\x00', 0x2, 0x0) ioctl$FE_READ_STATUS(r0, 0x80046f45, &(0x7f0000000700)) mknod(&(0x7f0000000500)='./dev_fe1\x00', 0x81b6, 0xd443) openat(0xffffffffffffff9c, &(0x7f0000000500)='./dev_fe1\x00', 0x2, 0x0) mknod(&(0x7f0000000600)='./dev_fe2\x00', 0x81b6, 0xd483) openat(0xffffffffffffff9c, &(0x7f0000000600)='./dev_fe2\x00', 0x2, 0x0) 5.26020008s ago: executing program 3 (id=17): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='configfs\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(&(0x7f0000000400)=@filename='sysfs\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g_uac2/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='0x1234\n', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g_uac2/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='0x5678\n', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_chmask\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='0\n', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r3, &(0x7f0000000900)='1\n', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g_uac2/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g_uac2/configs/c.1/uac2.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000001500)='./config/usb_gadget/g_uac2/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000001600)='usbip-vudc.0\n', 0xd) close(r4) socketpair(0x1, 0x1, 0x0, &(0x7f0000001700)) write(0xffffffffffffffff, &(0x7f0000001900)='3\n', 0x2) close(0xffffffffffffffff) nanosleep(&(0x7f0000001a00)={0x0, 0x5f5e100}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000001b00)='./sys/devices/platform/usbip-vudc.0/usbip_sockfd\x00', 0x1, 0x0) write(r5, &(0x7f0000001c00)='-1\n', 0x3) close(r5) nanosleep(&(0x7f0000001d00)={0x0, 0x5f5e100}, 0x0) 4.919771604s ago: executing program 4 (id=18): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='configfs\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(&(0x7f0000000400)=@filename='sysfs\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g_uac2/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='0x1234\n', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g_uac2/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000400)='0x5678\n', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_chmask\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='0\n', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g_uac2/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g_uac2/configs/c.1/uac2.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000001500)='./config/usb_gadget/g_uac2/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000001600)='usbip-vudc.0\n', 0xd) 4.29992106s ago: executing program 1 (id=19): r0 = syz_usb_connect$rtl8150(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x110, 0xff, 0xff, 0x0, 0x40, 0xbda, 0x8150, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x80, 0x0, "", {{0x9, 0x4, 0x0, 0x7f, 0x3, 0xff, 0x11, 0x1, 0x5, "", {{0x9, 0x5, 0x81, 0x2, 0x40, 0x6, 0x9, 0x4}, {0x9, 0x5, 0x2, 0x2, 0x20, 0x2, 0x57, 0x6e}, {0x9, 0x5, 0x83, 0x3, 0x240, 0x3, 0x82, 0x8}}}}}}]}}, 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f0000000580)={0x14, 0x0, &(0x7f0000000480)={0x0, 0x3, 0x3}}, 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f0000002980)={0x14, 0x0, &(0x7f00000028c0)={0x0, 0x3, 0x3}}, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000004280)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000004240)={0x40, 0x5, 0x2, "2bd8"}}) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./my_ttyUSB0\x00', 0x81b6, 0xbc00) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./my_ttyUSB0\x00', 0x2, 0x0) write(r1, &(0x7f0000002000)="10011003", 0x4) 3.099180693s ago: executing program 4 (id=20): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mypath\x00', 0x42, 0x1ff) pwrite64(r0, &(0x7f0000000200)='/sys/class/i2c-adapter', 0x16, 0x0) pwrite64(r0, &(0x7f0000000300)='/i2c-0/new_device\x00', 0x12, 0x16) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mypath\x00', 0x0, 0x0) pread64(r1, &(0x7f0000000400), 0x28, 0x0) close(r1) syz_usb_connect(0x0, 0x24, &(0x7f0000000500)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x403, 0xc631, 0x100, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x1, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff, 0xff, 0xff}}]}}]}}, 0x0) nanosleep(&(0x7f0000000600)={0x1}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400), 0x1, 0x0) write(r2, &(0x7f0000000700)='ccgx-ucsi 0x08\x00', 0xf) 3.098718917s ago: executing program 3 (id=21): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000004c0)={[], 0x0, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_GET_LAPIC(r2, 0x8400ae8e, &(0x7f0000000100)) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000100)) ioctl$KVM_SIGNAL_MSI(r1, 0x4020ae10, &(0x7f0000000200)={0xfee00000, 0x0, 0x30}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.429689458s ago: executing program 2 (id=22): r0 = syz_usb_connect(0x3, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040460a019600010000000109022700010100a0320904000003ff000000070581020002000705020200020007058303080001"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x0, 0x6, "019622334455"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x0, 0x6, "019622334455"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x0, 0x6, "019622334455"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x0, 0x6, "019622334455"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x0, 0x6, "019622334455"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x0, 0x6, "019622334455"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x0, 0x6, "019622334455"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x0, 0x6, "019622334455"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x0, 0x6, "019622334455"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x0, 0x6, "019622334455"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x0, 0x6, "019622334455"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0x0, 0x6, "019622334455"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f00000002c0)={0x5}, 0x0) r1 = socket(0x2, 0x2, 0x0) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000300)={'syzkaller0\x00', @ifru_hwaddr=@local}) 2.228405695s ago: executing program 0 (id=23): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/num_groups\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='16\x00', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./my_configfs/usb_gadget/g1/functions/midi2.usb0/ep.0/block.0/midi1_num_groups\x00', 0x1, 0x0) write(r1, &(0x7f0000000340)='16\x00', 0x2) symlinkat(&(0x7f0000000380)='./my_configfs/usb_gadget/g1/functions/midi2.usb0\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./my_configfs/usb_gadget/g1/configs/c.1/midi2.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000440)='dummy_udc.0\x00', 0xb) 1.867785127s ago: executing program 1 (id=24): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000200)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x2c, 0x3, 0x1532, 0x11d, 0x0, 0x0, "0600ff0901a101850f090f150026ff0075089502b102850c090c75089510810285090909750895109102c0"}}, 0x1d4) nanosleep(&(0x7f0000000400)={0x0, 0x1dcd6500}, 0x0) read(r0, &(0x7f0000000800)=""/4096, 0x1000) nanosleep(&(0x7f0000000400)={0x0, 0x1dcd6500}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/power/state\x00', 0x1, 0x0) write(r1, &(0x7f0000000600)='freeze\n', 0x7) write(r1, &(0x7f0000000640)='mem\n', 0x4) write(r1, &(0x7f0000000680)='standby\n', 0x8) 1.668008899s ago: executing program 3 (id=25): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000480)=ANY=[@ANYBLOB="12010002000000402505a1a440010203010109025c0002010080000904000001020d00000524060001052400000d240f010000000006241a00000905810300020000000904010000020d00000904010102020d0000090582020002000000090502020002000000"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./sys\x00', &(0x7f0000000180)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/net/usb0/cdc_ncm/min_tx_pkt\x00', 0x2, 0x0) write(r1, &(0x7f0000000300)='10\n\x00', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/net/wwan0/cdc_ncm/min_tx_pkt\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='10\n\x00', 0x3) 0s ago: executing program 4 (id=26): mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mkdir(&(0x7f0000000100)='./dev\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='configfs\x00', &(0x7f0000000300)='./config\x00', &(0x7f0000000400)='configfs\x00', 0x0, 0x0) mount(0x0, 0x0, &(0x7f0000000700)='devtmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/os_desc/use\x00', 0x1, 0x0) write(r0, &(0x7f0000000a00)='1\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/os_desc/b_vendor_code\x00', 0x1, 0x0) write(r1, &(0x7f0000000c00)='0x40\x00', 0x5) close(r1) mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1ff) symlink(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/ncm.usb0\x00', &(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/ncm.usb0\x00') symlink(&(0x7f0000001100)='./config/usb_gadget/g1/configs/c.1\x00', &(0x7f0000001200)='./config/usb_gadget/g1/os_desc/c.1\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) close(r2) poll(0x0, 0x0, 0x3e8) r3 = syz_open_dev$usbfs(&(0x7f0000001600), 0x15, 0x2) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f0000001700)={0x80, 0x6, 0x100, 0x0, 0x12, 0x3e8, &(0x7f0000001800)='\x00'/18}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.23' (ED25519) to the list of known hosts. [ 76.619563][ T5573] cgroup: Unknown subsys name 'net' [ 76.831759][ T5573] cgroup: Unknown subsys name 'cpuset' [ 76.896234][ T5573] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 78.502374][ T5573] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 80.914162][ T5586] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 80.928774][ T5586] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 80.929591][ T5586] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 80.931046][ T5586] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 80.933345][ T5586] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 80.949069][ T5586] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 80.985225][ T5593] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 81.002989][ T5593] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 81.025605][ T5593] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 81.032840][ T5593] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 81.052449][ T5601] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 81.057809][ T5586] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 81.059287][ T5598] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 81.079133][ T5586] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 81.082166][ T5586] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 81.087164][ T5586] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 81.118347][ T5601] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 81.119547][ T5601] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 81.122898][ T4901] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 81.128372][ T5595] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 81.307433][ T59] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 81.312656][ T5604] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 81.314389][ T5604] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 81.345916][ T5604] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 81.350590][ T5604] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 83.106995][ T5586] Bluetooth: hci0: command tx timeout [ 83.186586][ T5586] Bluetooth: hci3: command tx timeout [ 83.348120][ T5586] Bluetooth: hci2: command tx timeout [ 83.348234][ T5586] Bluetooth: hci1: command tx timeout [ 83.426754][ T5604] Bluetooth: hci4: command tx timeout [ 83.725132][ T5584] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.726855][ T5584] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.727027][ T5584] bridge_slave_0: entered allmulticast mode [ 83.729538][ T5584] bridge_slave_0: entered promiscuous mode [ 83.771586][ T5589] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.771677][ T5589] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.771955][ T5589] bridge_slave_0: entered allmulticast mode [ 83.773297][ T5589] bridge_slave_0: entered promiscuous mode [ 83.803400][ T5584] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.803465][ T5584] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.803583][ T5584] bridge_slave_1: entered allmulticast mode [ 83.806956][ T5584] bridge_slave_1: entered promiscuous mode [ 83.855393][ T5589] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.855531][ T5589] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.855678][ T5589] bridge_slave_1: entered allmulticast mode [ 83.865107][ T5589] bridge_slave_1: entered promiscuous mode [ 83.870755][ T5588] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.870866][ T5588] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.871753][ T5588] bridge_slave_0: entered allmulticast mode [ 83.874516][ T5588] bridge_slave_0: entered promiscuous mode [ 83.933438][ T5588] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.933582][ T5588] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.933852][ T5588] bridge_slave_1: entered allmulticast mode [ 83.935267][ T5588] bridge_slave_1: entered promiscuous mode [ 83.937424][ T5590] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.937535][ T5590] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.938036][ T5590] bridge_slave_0: entered allmulticast mode [ 83.940408][ T5590] bridge_slave_0: entered promiscuous mode [ 84.016791][ T5590] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.016886][ T5590] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.016982][ T5590] bridge_slave_1: entered allmulticast mode [ 84.018353][ T5590] bridge_slave_1: entered promiscuous mode [ 84.023186][ T5584] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.023387][ T5602] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.023497][ T5602] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.023958][ T5602] bridge_slave_0: entered allmulticast mode [ 84.025486][ T5602] bridge_slave_0: entered promiscuous mode [ 84.034561][ T5589] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.109057][ T5584] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.109300][ T5602] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.109407][ T5602] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.109499][ T5602] bridge_slave_1: entered allmulticast mode [ 84.110853][ T5602] bridge_slave_1: entered promiscuous mode [ 84.113774][ T5589] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.237409][ T5588] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.290891][ T5588] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.293335][ T5590] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.353537][ T5590] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.355655][ T5584] team0: Port device team_slave_0 added [ 84.372974][ T5602] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.375609][ T5589] team0: Port device team_slave_0 added [ 84.411829][ T5584] team0: Port device team_slave_1 added [ 84.413774][ T5602] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.415401][ T5589] team0: Port device team_slave_1 added [ 84.419803][ T5588] team0: Port device team_slave_0 added [ 84.473994][ T5588] team0: Port device team_slave_1 added [ 84.475527][ T5590] team0: Port device team_slave_0 added [ 84.538401][ T5590] team0: Port device team_slave_1 added [ 84.539354][ T5584] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.539363][ T5584] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.539375][ T5584] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.542240][ T5602] team0: Port device team_slave_0 added [ 84.543013][ T5589] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.543025][ T5589] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.543045][ T5589] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.587614][ T5584] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.587629][ T5584] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.587650][ T5584] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.592685][ T5602] team0: Port device team_slave_1 added [ 84.593740][ T5589] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.593751][ T5589] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.593772][ T5589] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.597907][ T5588] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.597919][ T5588] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.597939][ T5588] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.684354][ T5588] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.684383][ T5588] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.684404][ T5588] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.689991][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.690005][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.690026][ T5590] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.732011][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.732026][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.732048][ T5590] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.742054][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.742069][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.742090][ T5602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.804603][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.804618][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 84.804640][ T5602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.901211][ T5589] hsr_slave_0: entered promiscuous mode [ 84.902692][ T5589] hsr_slave_1: entered promiscuous mode [ 84.933709][ T5584] hsr_slave_0: entered promiscuous mode [ 84.934988][ T5584] hsr_slave_1: entered promiscuous mode [ 84.938162][ T5584] debugfs: 'hsr0' already exists in 'hsr' [ 84.938283][ T5584] Cannot create hsr debugfs directory [ 84.973039][ T5588] hsr_slave_0: entered promiscuous mode [ 84.974423][ T5588] hsr_slave_1: entered promiscuous mode [ 84.975269][ T5588] debugfs: 'hsr0' already exists in 'hsr' [ 84.975290][ T5588] Cannot create hsr debugfs directory [ 85.020426][ T5590] hsr_slave_0: entered promiscuous mode [ 85.021658][ T5590] hsr_slave_1: entered promiscuous mode [ 85.022512][ T5590] debugfs: 'hsr0' already exists in 'hsr' [ 85.022532][ T5590] Cannot create hsr debugfs directory [ 85.141788][ T5602] hsr_slave_0: entered promiscuous mode [ 85.142505][ T5602] hsr_slave_1: entered promiscuous mode [ 85.143004][ T5602] debugfs: 'hsr0' already exists in 'hsr' [ 85.143019][ T5602] Cannot create hsr debugfs directory [ 85.185939][ T5604] Bluetooth: hci0: command tx timeout [ 85.265868][ T5604] Bluetooth: hci3: command tx timeout [ 85.425922][ T5586] Bluetooth: hci2: command tx timeout [ 85.426017][ T5604] Bluetooth: hci1: command tx timeout [ 85.505957][ T5604] Bluetooth: hci4: command tx timeout [ 86.311867][ T5589] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 86.359851][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.367958][ T5589] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 86.411678][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.419436][ T5589] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 86.459851][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.484851][ T5589] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 86.522714][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.618566][ T5584] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 86.651074][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.658488][ T5584] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 86.699048][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.703240][ T5584] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 86.739823][ T31] cfg80211: failed to load regulatory.db [ 86.741663][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.773553][ T5584] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 86.800013][ T5584] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.930316][ T5588] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 86.961715][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 86.971216][ T5588] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 87.012835][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.023524][ T5588] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 87.048954][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.071646][ T5588] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 87.108811][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.244506][ T5602] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 87.266403][ T5604] Bluetooth: hci0: command tx timeout [ 87.271125][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.288869][ T5602] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 87.328965][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.340574][ T5602] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 87.346497][ T5604] Bluetooth: hci3: command tx timeout [ 87.370236][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.398952][ T5602] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 87.439214][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.507114][ T5604] Bluetooth: hci1: command tx timeout [ 87.507145][ T5604] Bluetooth: hci2: command tx timeout [ 87.553120][ T5589] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.586825][ T5604] Bluetooth: hci4: command tx timeout [ 87.607075][ T5590] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 87.638735][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.648879][ T5590] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 87.694482][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 87.709100][ T5590] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 87.749140][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 87.754314][ T5590] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 87.790001][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 87.838454][ T5589] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.876693][ T1646] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.877041][ T1646] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.922474][ T5584] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.950377][ T751] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.950449][ T751] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.034058][ T5584] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.081964][ T3822] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.082078][ T3822] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.112000][ T5588] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.134552][ T3822] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.134658][ T3822] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.223782][ T5588] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.236490][ T5602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.310089][ T3822] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.310303][ T3822] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.372078][ T3822] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.372199][ T3822] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.455331][ T5602] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.524111][ T1646] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.524237][ T1646] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.531229][ T5590] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.590886][ T3342] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.591015][ T3342] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.719796][ T5590] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.843100][ T3342] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.843313][ T3342] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.891188][ T1646] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.891369][ T1646] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.251312][ T5589] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.345984][ T5604] Bluetooth: hci0: command tx timeout [ 89.425807][ T5604] Bluetooth: hci3: command tx timeout [ 89.596146][ T5604] Bluetooth: hci2: command tx timeout [ 89.596181][ T5604] Bluetooth: hci1: command tx timeout [ 89.665800][ T5586] Bluetooth: hci4: command tx timeout [ 89.669295][ T5584] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.710443][ T5589] veth0_vlan: entered promiscuous mode [ 89.769881][ T5589] veth1_vlan: entered promiscuous mode [ 90.044464][ T5589] veth0_macvtap: entered promiscuous mode [ 90.084777][ T5589] veth1_macvtap: entered promiscuous mode [ 90.199510][ T5588] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.241649][ T5589] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.286158][ T5589] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.562878][ T5602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.565450][ T5590] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.834914][ T5588] veth0_vlan: entered promiscuous mode [ 90.927509][ T5588] veth1_vlan: entered promiscuous mode [ 90.951758][ T1021] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.951782][ T1021] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.998490][ T5584] veth0_vlan: entered promiscuous mode [ 91.080796][ T5602] veth0_vlan: entered promiscuous mode [ 91.081204][ T3822] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.081219][ T3822] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.083917][ T5590] veth0_vlan: entered promiscuous mode [ 91.091906][ T5584] veth1_vlan: entered promiscuous mode [ 91.184733][ T5602] veth1_vlan: entered promiscuous mode [ 91.199606][ T5590] veth1_vlan: entered promiscuous mode [ 91.204710][ T5588] veth0_macvtap: entered promiscuous mode [ 91.241285][ T5588] veth1_macvtap: entered promiscuous mode [ 91.319409][ T5584] veth0_macvtap: entered promiscuous mode [ 91.359186][ T5588] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.389767][ T5584] veth1_macvtap: entered promiscuous mode [ 91.405352][ T5602] veth0_macvtap: entered promiscuous mode [ 91.418028][ T5588] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.422918][ T5590] veth0_macvtap: entered promiscuous mode [ 91.452016][ T5602] veth1_macvtap: entered promiscuous mode [ 91.460276][ T5590] veth1_macvtap: entered promiscuous mode [ 91.491815][ T5584] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.594232][ T5584] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.640569][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.643772][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.750798][ T5781] sd 0:0:1:0: device reset [ 91.764539][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.790975][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.224758][ T3829] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.224777][ T3829] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.576881][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 92.818582][ T1021] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.818600][ T1021] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.940541][ T9] usb 3-1: New USB device found, idVendor=04e2, idProduct=1410, bcdDevice= 1.00 [ 93.056502][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 93.370097][ T9] xr_serial 3-1:1.0: xr_serial converter detected [ 93.372987][ T3814] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.373002][ T3814] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.715117][ T3829] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.715134][ T3829] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.777966][ T3822] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.777984][ T3822] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.125133][ T3814] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.125151][ T3814] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.336979][ T3822] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.336999][ T3822] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.717169][ T2150] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.756836][ T1021] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.756855][ T1021] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.886969][ T3807] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.948270][ T3807] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.948709][ T3807] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.949136][ T3807] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.949374][ T3807] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.957987][ T9] xr_serial ttyUSB0: Failed to set reg 0x1a: -71 [ 94.958041][ T9] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 95.149212][ T2150] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.153943][ T3807] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.154344][ T3807] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.202847][ T5788] loop0: detected capacity change from 0 to 32768 [ 95.278094][ T94] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.361882][ T9] usb 3-1: USB disconnect, device number 2 [ 95.436179][ T5689] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 95.513880][ T5789] bcache: register_bcache() error : failed to open device [ 95.517221][ T751] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.666690][ T5689] usb 5-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 0.00 [ 95.671001][ T5689] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 95.671028][ T5689] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 95.671061][ T5689] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.712530][ T9] xr_serial 3-1:1.0: device disconnected [ 95.785414][ T5792] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 95.785606][ T5792] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 95.831447][ T1646] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.852939][ T67] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.871478][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.872159][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.872195][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.872226][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.872257][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.872287][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.872318][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.046792][ T5689] usb 5-1: NFC: intf ffff888036761000 id ffffffff8ebb3760 [ 96.108419][ T5799] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 96.326216][ T36] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 96.349854][ T5708] udevd[5708]: incorrect bcache checksum on /dev/loop0 [ 96.481020][ T36] usb 4-1: New USB device found, idVendor=0d8c, idProduct=0103, bcdDevice= 1.00 [ 96.512659][ T5689] nfcmrvl 5-1:1.0: NFC: registered with nci successfully [ 96.514645][ T36] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.993257][ T5689] usb 5-1: USB disconnect, device number 2 [ 97.059394][ T36] usb 4-1: cannot find UAC_HEADER [ 97.074378][ T5689] usb 5-1: NFC: intf ffff888036761000 [ 98.969992][ T1646] nvmet: connect request for invalid subsystem testsubsys! [ 98.998970][ T5819] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 99.080627][ T5836] Config c/1 of g1 needs at least one function. [ 99.148516][ T5836] udc dummy_udc.0: failed to start g1: -22 [ 99.148543][ T5836] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 99.262883][ T36] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 99.360769][ T5836] UDC core: g1: couldn't find an available UDC or it's busy [ 99.452677][ T36] usb 4-1: USB disconnect, device number 2 [ 99.966072][ T5722] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 100.169316][ T5722] usb 3-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.00 [ 100.170376][ T5722] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 100.170401][ T5722] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 100.173299][ T5722] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 100.173320][ T5722] usb 3-1: Product: syz [ 100.173333][ T5722] usb 3-1: Manufacturer: syz [ 100.574305][ T5843] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 100.574613][ T5843] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 100.921487][ T5722] as10x_usb: device has been detected [ 100.922427][ T5722] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 100.976499][ T997] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 101.111016][ T5722] usb 3-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 101.129402][ T997] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 101.130977][ T997] usb 2-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 101.131003][ T997] usb 2-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 101.131024][ T997] usb 2-1: config 1 interface 0 has no altsetting 0 [ 101.141942][ T997] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 101.141968][ T997] usb 2-1: Product: syz [ 101.141979][ T997] usb 2-1: Manufacturer: syz [ 101.141991][ T997] usb 2-1: SerialNumber: syz [ 101.231332][ T5851] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 101.231512][ T5851] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 101.301870][ T5827] NFSD: Failed to start, no listeners configured. [ 102.023355][ T5722] as10x_usb: error during firmware upload part1 [ 102.024301][ T5722] Registered device Abilis Systems DVB-Titan [ 102.175873][ T5793] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 102.196154][ T5722] usb 3-1: USB disconnect, device number 3 [ 102.312618][ T997] (unnamed net_device) (uninitialized): Assigned a random MAC address: ea:de:96:0d:20:c8 [ 102.366973][ T5793] usb 5-1: Using ep0 maxpacket: 8 [ 102.367750][ T5793] usb 5-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 102.372828][ T5793] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 102.394146][ T5722] Unregistered device Abilis Systems DVB-Titan [ 102.550130][ T5722] as10x_usb: device has been disconnected [ 102.750172][ T997] rtl8150 2-1:1.0: eth1: rtl8150 is detected [ 102.837880][ T997] usb 2-1: USB disconnect, device number 2 [ 103.130053][ T5722] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 103.331932][ T5722] usb 3-1: New USB device found, idVendor=0a46, idProduct=9601, bcdDevice= 1.00 [ 103.333248][ T5722] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.629873][ T5870] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 103.679984][ T5873] PM: suspend entry (deep) [ 103.752849][ T5318] hid-rmi 0003:1532:011D.0001: unknown main item tag 0x0 [ 103.924560][ T5870] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 1.40 [ 103.938636][ T5870] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 103.938668][ T5870] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 103.938683][ T5870] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 103.938728][ T5870] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 103.965849][ T5793] usb 5-1: string descriptor 0 read error: -71 [ 104.042479][ T5870] usb 4-1: New USB device strings: Mfr=2, Product=3, SerialNumber=1 [ 104.042503][ T5870] usb 4-1: Product: syz [ 104.042516][ T5870] usb 4-1: Manufacturer: syz [ 104.042528][ T5870] usb 4-1: SerialNumber: syz [ 104.184153][ T5793] i2c-tiny-usb 5-1:1.0: version 1.00 found at bus 005 address 003 [ 104.184575][ T5793] (null): error -EIO: failure setting delay to 10us [ 104.184643][ T5793] i2c-tiny-usb 5-1:1.0: probe with driver i2c-tiny-usb failed with error -5 [ 104.295163][ T5793] usb 5-1: USB disconnect, device number 3 [ 104.317031][ T5722] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 104.404612][ T5866] configfs-gadget.g1 gadget.0: HOST MAC 06:4b:66:5b:65:e3 [ 104.404635][ T5866] configfs-gadget.g1 gadget.0: MAC f2:a4:8e:6f:66:1e [ 104.543779][ T5870] cdc_ncm 4-1:1.0: skipping garbage [ 104.564689][ T5870] cdc_ncm 4-1:1.0: skipping garbage [ 104.564706][ T5870] cdc_ncm 4-1:1.0: skipping garbage [ 104.564725][ T5870] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 104.564758][ T5870] cdc_ncm 4-1:1.0: bind() failure [ 104.936305][ T5318] hid-rmi 0003:1532:011D.0001: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 105.490827][ T5877] fido_id[5877]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 105.547697][ T5866] ================================================================== [ 105.547711][ T5866] BUG: KASAN: stack-out-of-bounds in f_midi2_create_usb_configs+0x25ac/0x4380 [ 105.547754][ T5866] Write of size 1 at addr ffffc90005fa76f8 by task syz.0.23/5866 [ 105.547769][ T5866] [ 105.547791][ T5866] CPU: 0 UID: 0 PID: 5866 Comm: syz.0.23 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 105.547815][ T5866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 105.547831][ T5866] Call Trace: [ 105.547838][ T5866] [ 105.547845][ T5866] dump_stack_lvl+0xe8/0x150 [ 105.547875][ T5866] print_address_description+0x55/0x1e0 [ 105.547898][ T5866] ? f_midi2_create_usb_configs+0x25ac/0x4380 [ 105.547923][ T5866] print_report+0x58/0x70 [ 105.547943][ T5866] kasan_report+0x117/0x150 [ 105.547961][ T5866] ? krealloc_node_align_noprof+0x235/0x390 [ 105.547980][ T5866] ? f_midi2_create_usb_configs+0x25ac/0x4380 [ 105.548023][ T5866] f_midi2_create_usb_configs+0x25ac/0x4380 [ 105.548058][ T5866] f_midi2_bind+0x2690/0x2c40 [ 105.548087][ T5866] ? __pfx_f_midi2_bind+0x10/0x10 [ 105.548123][ T5866] ? usb_assign_descriptors+0x133/0x290 [ 105.548142][ T5866] ? ecm_bind+0x7ae/0xa30 [ 105.548161][ T5866] usb_add_function+0x290/0x930 [ 105.548179][ T5866] configfs_composite_bind+0xde0/0x1410 [ 105.548203][ T5866] ? __pfx_configfs_composite_bind+0x10/0x10 [ 105.548218][ T5866] gadget_bind_driver+0x2ca/0x9e0 [ 105.548244][ T5866] ? __pfx_gadget_bind_driver+0x10/0x10 [ 105.548265][ T5866] really_probe+0x254/0xae0 [ 105.548289][ T5866] __driver_probe_device+0x1e8/0x360 [ 105.548311][ T5866] driver_probe_device+0x4f/0x240 [ 105.548332][ T5866] __driver_attach+0x339/0x600 [ 105.548351][ T5866] bus_for_each_dev+0x23e/0x2c0 [ 105.548365][ T5866] ? __pfx___driver_attach+0x10/0x10 [ 105.548384][ T5866] ? __pfx_bus_for_each_dev+0x10/0x10 [ 105.548402][ T5866] ? rt_spin_unlock+0x163/0x200 [ 105.548419][ T5866] bus_add_driver+0x348/0x670 [ 105.548439][ T5866] driver_register+0x23a/0x320 [ 105.548463][ T5866] usb_gadget_register_driver_owner+0xf9/0x270 [ 105.548486][ T5866] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 105.548509][ T5866] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 105.548533][ T5866] configfs_write_iter+0x33a/0x430 [ 105.548554][ T5866] vfs_write+0x61e/0xbb0 [ 105.548577][ T5866] ? __pfx_vfs_write+0x10/0x10 [ 105.548605][ T5866] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 105.548626][ T5866] ? lockdep_hardirqs_on+0x7a/0x110 [ 105.548647][ T5866] ? mutex_lock_nested+0x152/0x1d0 [ 105.548668][ T5866] ? fdget_pos+0x252/0x320 [ 105.548688][ T5866] ksys_write+0x156/0x270 [ 105.548706][ T5866] ? __pfx_ksys_write+0x10/0x10 [ 105.548728][ T5866] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.548746][ T5866] do_syscall_64+0x174/0x580 [ 105.548766][ T5866] ? clear_bhb_loop+0x70/0xc0 [ 105.548782][ T5866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.548798][ T5866] RIP: 0033:0x7fe6d00ee0d9 [ 105.548822][ T5866] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.548838][ T5866] RSP: 002b:00007fe6ce346028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 105.548862][ T5866] RAX: ffffffffffffffda RBX: 00007fe6d0375fa0 RCX: 00007fe6d00ee0d9 [ 105.548875][ T5866] RDX: 000000000000000b RSI: 0000200000000440 RDI: 0000000000000005 [ 105.548886][ T5866] RBP: 00007fe6d0185024 R08: 0000000000000000 R09: 0000000000000000 [ 105.548897][ T5866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.548908][ T5866] R13: 00007fe6d0376038 R14: 00007fe6d0375fa0 R15: 00007fffb51db038 [ 105.548928][ T5866] [ 105.548935][ T5866] [ 105.548939][ T5866] The buggy address belongs to stack of task syz.0.23/5866 [ 105.548949][ T5866] and is located at offset 376 in frame: [ 105.548957][ T5866] f_midi2_bind+0x0/0x2c40 [ 105.548984][ T5866] [ 105.548989][ T5866] This frame has 6 objects: [ 105.548998][ T5866] [32, 40) 'card.i' [ 105.549008][ T5866] [64, 72) 'ump.i' [ 105.549020][ T5866] [96, 100) 'sw.i' [ 105.549030][ T5866] [112, 376) 'config' [ 105.549041][ T5866] [448, 464) 'string_fn' [ 105.549053][ T5866] [480, 496) 'strings2' [ 105.549062][ T5866] [ 105.549068][ T5866] The buggy address belongs to a 8-page vmalloc region starting at 0xffffc90005fa0000 allocated at copy_process+0x820/0x4390 [ 105.549107][ T5866] The buggy address belongs to the physical page: [ 105.549128][ T5866] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x65117 [ 105.549145][ T5866] memcg:ffff88802a50c482 [ 105.549152][ T5866] flags: 0x80000000000000(node=0|zone=1) [ 105.549178][ T5866] raw: 0080000000000000 ffffea00019445c8 ffffea00019445c8 0000000000000000 [ 105.549195][ T5866] raw: 0000000000000000 0000000000000000 00000001ffffffff ffff88802a50c482 [ 105.549205][ T5866] page dumped because: kasan: bad access detected [ 105.549218][ T5866] page_owner tracks the page as allocated [ 105.549225][ T5866] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 5863, tgid 5863 (syz.0.23), ts 103121590076, free_ts 0 [ 105.549256][ T5866] post_alloc_hook+0x1f9/0x250 [ 105.549283][ T5866] get_page_from_freelist+0x262a/0x26a0 [ 105.549301][ T5866] __alloc_frozen_pages_noprof+0x18d/0x380 [ 105.549320][ T5866] alloc_pages_mpol+0xce/0x280 [ 105.549337][ T5866] alloc_pages_noprof+0xd2/0x2f0 [ 105.549353][ T5866] __vmalloc_node_range_noprof+0x795/0x1730 [ 105.549379][ T5866] __vmalloc_node_noprof+0xc2/0x100 [ 105.549403][ T5866] dup_task_struct+0x2a0/0x8f0 [ 105.549423][ T5866] copy_process+0x820/0x4390 [ 105.549439][ T5866] kernel_clone+0x2d2/0x8d0 [ 105.549456][ T5866] __se_sys_clone3+0x33c/0x360 [ 105.549476][ T5866] do_syscall_64+0x174/0x580 [ 105.549497][ T5866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.549513][ T5866] page_owner free stack trace missing [ 105.549520][ T5866] [ 105.549525][ T5866] Memory state around the buggy address: [ 105.549535][ T5866] ffffc90005fa7580: f1 f1 f1 f1 f8 f2 f2 f2 f8 f2 f2 f2 f8 f2 00 00 [ 105.549548][ T5866] ffffc90005fa7600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 105.549560][ T5866] >ffffc90005fa7680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f2 [ 105.549570][ T5866] ^ [ 105.549581][ T5866] ffffc90005fa7700: f2 f2 f2 f2 f2 f2 f2 f2 00 00 f2 f2 00 00 f3 f3 [ 105.549594][ T5866] ffffc90005fa7780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 105.549613][ T5866] ================================================================== [ 105.549820][ T5866] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 105.549835][ T5866] CPU: 0 UID: 0 PID: 5866 Comm: syz.0.23 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 105.549857][ T5866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 105.549869][ T5866] Call Trace: [ 105.549876][ T5866] [ 105.549883][ T5866] vpanic+0x56c/0xa60 [ 105.549912][ T5866] ? rcu_is_watching+0x15/0xb0 [ 105.549934][ T5866] ? __pfx_vpanic+0x10/0x10 [ 105.549966][ T5866] panic+0xc5/0xd0 [ 105.549990][ T5866] ? __pfx_panic+0x10/0x10 [ 105.550014][ T5866] ? preempt_schedule_thunk+0x16/0x40 [ 105.550035][ T5866] ? preempt_schedule_thunk+0x16/0x40 [ 105.550056][ T5866] ? f_midi2_create_usb_configs+0x25ac/0x4380 [ 105.550085][ T5866] check_panic_on_warn+0x89/0xb0 [ 105.550110][ T5866] ? f_midi2_create_usb_configs+0x25ac/0x4380 [ 105.550137][ T5866] end_report+0x73/0x170 [ 105.550157][ T5866] ? f_midi2_create_usb_configs+0x25ac/0x4380 [ 105.550184][ T5866] kasan_report+0x128/0x150 [ 105.550202][ T5866] ? krealloc_node_align_noprof+0x235/0x390 [ 105.550222][ T5866] ? f_midi2_create_usb_configs+0x25ac/0x4380 [ 105.550252][ T5866] f_midi2_create_usb_configs+0x25ac/0x4380 [ 105.550287][ T5866] f_midi2_bind+0x2690/0x2c40 [ 105.550319][ T5866] ? __pfx_f_midi2_bind+0x10/0x10 [ 105.550357][ T5866] ? usb_assign_descriptors+0x133/0x290 [ 105.550377][ T5866] ? ecm_bind+0x7ae/0xa30 [ 105.550403][ T5866] usb_add_function+0x290/0x930 [ 105.550425][ T5866] configfs_composite_bind+0xde0/0x1410 [ 105.550450][ T5866] ? __pfx_configfs_composite_bind+0x10/0x10 [ 105.550469][ T5866] gadget_bind_driver+0x2ca/0x9e0 [ 105.550495][ T5866] ? __pfx_gadget_bind_driver+0x10/0x10 [ 105.550517][ T5866] really_probe+0x254/0xae0 [ 105.550544][ T5866] __driver_probe_device+0x1e8/0x360 [ 105.550568][ T5866] driver_probe_device+0x4f/0x240 [ 105.550591][ T5866] __driver_attach+0x339/0x600 [ 105.550622][ T5866] bus_for_each_dev+0x23e/0x2c0 [ 105.550638][ T5866] ? __pfx___driver_attach+0x10/0x10 [ 105.550658][ T5866] ? __pfx_bus_for_each_dev+0x10/0x10 [ 105.550676][ T5866] ? rt_spin_unlock+0x163/0x200 [ 105.550692][ T5866] bus_add_driver+0x348/0x670 [ 105.550710][ T5866] driver_register+0x23a/0x320 [ 105.550733][ T5866] usb_gadget_register_driver_owner+0xf9/0x270 [ 105.550758][ T5866] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 105.550780][ T5866] ? __pfx_gadget_dev_desc_UDC_store+0x10/0x10 [ 105.550803][ T5866] configfs_write_iter+0x33a/0x430 [ 105.550827][ T5866] vfs_write+0x61e/0xbb0 [ 105.550851][ T5866] ? __pfx_vfs_write+0x10/0x10 [ 105.550872][ T5866] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 105.550892][ T5866] ? lockdep_hardirqs_on+0x7a/0x110 [ 105.550912][ T5866] ? mutex_lock_nested+0x152/0x1d0 [ 105.550934][ T5866] ? fdget_pos+0x252/0x320 [ 105.550954][ T5866] ksys_write+0x156/0x270 [ 105.550973][ T5866] ? __pfx_ksys_write+0x10/0x10 [ 105.550996][ T5866] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.551013][ T5866] do_syscall_64+0x174/0x580 [ 105.551034][ T5866] ? clear_bhb_loop+0x70/0xc0 [ 105.551053][ T5866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.551071][ T5866] RIP: 0033:0x7fe6d00ee0d9 [ 105.551087][ T5866] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.551100][ T5866] RSP: 002b:00007fe6ce346028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 105.551120][ T5866] RAX: ffffffffffffffda RBX: 00007fe6d0375fa0 RCX: 00007fe6d00ee0d9 [ 105.551133][ T5866] RDX: 000000000000000b RSI: 0000200000000440 RDI: 0000000000000005 [ 105.551145][ T5866] RBP: 00007fe6d0185024 R08: 0000000000000000 R09: 0000000000000000 [ 105.551156][ T5866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.551167][ T5866] R13: 00007fe6d0376038 R14: 00007fe6d0375fa0 R15: 00007fffb51db038 [ 105.551188][ T5866] [ 105.551441][ T5866] Kernel Offset: disabled