last executing test programs: 6.659893938s ago: executing program 1 (id=20): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000040)={0xb, {'syz0\x00', 'syz0\x00', 'syz1\x00', 0x5f, 0x3, 0x46d, 0xc548, 0x0, 0x0, "0600ff0901a101851075089506150026ff000901810009019100c00600ff0902a101851175089513150026ff000902810009029100c00600ff0904a10185207508950e150026ff0009418100094191008521951f150026ff000942810009429100c0"}}, 0x177) nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "110141040200"/20}}, 0x1a) nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x14, "110100"/20}}, 0x1a) 6.05634487s ago: executing program 1 (id=23): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1ff) ftruncate(r0, 0x8000000) 6.056159896s ago: executing program 1 (id=24): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd_mnt\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd_mnt/versions\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='-2 -3 +4\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd_mnt/portlist\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd_mnt/threads\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1\n', 0x2) close(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r3, &(0x7f0000000200)={0x2, 0x801, @loopback}, 0x10) sendto$inet(r3, &(0x7f0000000240)="80000028112233440000000000000002000186a300000004000000000000000700"/44, 0x2c, 0x0, 0x0, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd_mnt/threads\x00', 0x1, 0x0) write(r4, &(0x7f00000001c0)='0\n', 0x2) close(r4) 5.938570839s ago: executing program 0 (id=28): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mproc\x00', 0x1ff) mount(&(0x7f0000000040), &(0x7f0000000080)='./mproc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000140), &(0x7f0000000180)='./nfsd\x00', &(0x7f00000001c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./mproc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000260)='./nfsd/versions\x00', 0x2, 0x0) write(r1, &(0x7f0000000270)='-2 -3 +4\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='tcp 2049\n', 0x9) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./nfsd/threads\x00', 0x2, 0x0) write(r3, &(0x7f0000000380)='1\n', 0x2) close(r3) nanosleep(&(0x7f00000003c0)={0x0, 0x5f5e100}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r4, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10) write(r4, &(0x7f0000000500)="80000034000000010000000000000002000186a3000000040000000100"/56, 0x38) read(r4, &(0x7f0000000600)=""/128, 0x80) nanosleep(&(0x7f00000003c0)={0x0, 0x5f5e100}, 0x0) 4.550001229s ago: executing program 1 (id=32): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='-2 -3 -4\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='tcp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='1\n', 0x2) close(r2) 3.178327824s ago: executing program 0 (id=38): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='./file0\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/portlist\x00', 0x0, 0x0) read(r0, &(0x7f0000000100)=""/100, 0x64) close(r0) 3.11898308s ago: executing program 0 (id=41): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='-2 -3 +4\n', 0x9) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='tcp 2049\n', 0x9) write(r1, &(0x7f0000000180)='udp 2049\n', 0x9) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1\n', 0x2) close(r2) r3 = socket$inet(0x2, 0x2, 0x0) sendto$inet(r3, &(0x7f0000000300)="000000010000000000000002000186a30000000400000000000000010000001400"/60, 0x3c, 0x0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10) r4 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r4, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10) write(r4, &(0x7f0000000500)="8000003c000000010000000000000002000186a30000000400000000000000010000001400"/64, 0x40) nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0) 2.937963009s ago: executing program 3 (id=44): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x0, 0x0, {0x7, r2}, [@MDBA_SET_ENTRY={0x20, 0x1, {r3, 0x1, 0x0, 0x0, {@in6_addr=@dev={0xfe, 0x80, '\x00', 0x2b}, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@RTM_DELMDB={0x38, 0x55, 0x1, 0x0, 0x0, {0x7, r2}, [@MDBA_SET_ENTRY={0x20, 0x1, {r3, 0x1, 0x0, 0x0, {@in6_addr=@dev={0xfe, 0x80, '\x00', 0x2b}, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x0) nanosleep(&(0x7f0000000340)={0x0, 0xbebc200}, 0x0) 2.818388621s ago: executing program 1 (id=46): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='nfsd\x00', &(0x7f0000000180)='./nfsd\x00', &(0x7f00000001c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000240)='-2 -3 +4 +4.1 +4.2\n', 0x14) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r1, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r2, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000003c0)='localhost /tmp 2147483647 136208 0 0 ', 0x25) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r4, &(0x7f0000000440)='localhost 1 \\x00000000 2147483647 /tmp\n', 0x27) r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r5, &(0x7f00000004c0)='1\n', 0x2) 2.818240445s ago: executing program 2 (id=47): syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040f0400000000"], 0x7) nanosleep(&(0x7f0000000100)={0x0, 0x1ad27480}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1ad27480}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1ad27480}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1ad27480}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1ad27480}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1ad27480}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1ad27480}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1ad27480}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1ad27480}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1ad27480}, 0x0) 2.68999877s ago: executing program 3 (id=48): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000407d1ed43000010000000109022400010100a032090400000103000000092111010001222200090581030800000000"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="00222200000005010902a1010901a10005091901290315002501750195038102750595018101c0c0"], 0x0}, &(0x7f0000000280)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x1, 0x2}, 0x0}) nanosleep(&(0x7f0000000300)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff) mount(&(0x7f0000000440), &(0x7f0000000400)='./sys\x00', &(0x7f0000000480)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/arvo/roccatarvo0/mode_key\x00', 0x2, 0x0) write(r1, &(0x7f0000000600)='invalid\x00', 0x8) 2.288946313s ago: executing program 2 (id=49): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NET_DM_CMD_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)={0x14, 0x14, 0x1, 0x0, 0x0, {0x1, 0x1}}, 0x18}}, 0x0) 2.288842246s ago: executing program 2 (id=50): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='-2 -3 +4\n', 0x9) close(r0) 1.437945985s ago: executing program 0 (id=51): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1ff) ftruncate(r0, 0x4000000) r1 = syz_open_dev$loop(&(0x7f0000000200), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) r2 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) ftruncate(r2, 0x4000000) r3 = syz_open_dev$loop(0x0, 0x1, 0x2) ioctl$LOOP_SET_FD(r3, 0x4c00, r2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r4, 0xc138fd03, 0x0) write(r0, &(0x7f0000000138)="0000000000000000008000000000000000000000000000007468696e2d706f6f6c00000000000000373a3020373a31203132382030", 0x35) ioctl(r4, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000006e01000038010000010000000000000000000000000000000000000000000000000000006d") 1.210016276s ago: executing program 1 (id=52): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source\x00', &(0x7f0000000080)='0.0.0.0:0:/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000000c0)='ms_mode\x00', &(0x7f0000000100)='crc\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='mount_timeout\x00', &(0x7f0000000180)='60\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) 1.209893262s ago: executing program 2 (id=53): syz_80211_inject_frame(&(0x7f0000000080)=@device_b, &(0x7f0000000000)=ANY=[@ANYBLOB="80000000ffffffffffff02000000000002000000000000000000000000000000640001000006020202020202010882848b960c12182403010147120100105302010055030101000006020202020202"], 0x4d) 1.209642503s ago: executing program 0 (id=54): mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000840)='./config\x00', &(0x7f0000000880)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./img\x00', 0x42, 0x1ff) ftruncate(r0, 0x1000000) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x2, 0x0) write(r1, &(0x7f0000000980)='1\n\x00', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f00000009c0)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x2, 0x0) write(r2, &(0x7f0000000a40)='./img\n\x00', 0x6) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x2, 0x0) write(r3, &(0x7f0000000ac0)='1\n\x00', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/nvmet/subsystems/testsubsys/namespaces/1/resv_enable\x00', 0x2, 0x0) write(r4, &(0x7f0000000b40)='1\n\x00', 0x2) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000b80)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x2, 0x0) write(r5, &(0x7f0000000bc0)='1\n\x00', 0x2) close(r5) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/nvmet/ports/1\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000c40)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r6, &(0x7f0000000c80)='loop\n\x00', 0x5) close(r6) symlinkat(&(0x7f0000000cc0)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000d00)='./config/nvmet/ports/1/subsystems/testsubsys\x00') r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000d40), 0x2, 0x0) write(r7, &(0x7f0000000d80)='transport=loop,nqn=testsubsys\x00', 0x1e) close(r7) nanosleep(&(0x7f0000000dc0)={0x0, 0xee6b280}, 0x0) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000e00)='/proc/diskstats\x00', 0x0, 0x0) read(r8, &(0x7f0000000e40)=""/2000, 0x7d0) close(r8) 819.813012ms ago: executing program 0 (id=55): syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040f0400000000"], 0x7) nanosleep(&(0x7f0000000100)={0x0, 0x29b92700}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x29b92700}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x29b92700}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x29b92700}, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x29b92700}, 0x0) 629.219884ms ago: executing program 2 (id=56): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='auxv\x00') read(r0, &(0x7f0000000000)=""/4096, 0x1000) 629.070572ms ago: executing program 2 (id=57): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0xfa, 0x41b}}}, 0x7) nanosleep(&(0x7f0000000140)={0x0, 0xbebc200}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./debug/bluetooth/hci0/force_devcoredump\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)="02000000000000000102030405060708", 0x10) nanosleep(&(0x7f0000000400)={0x0, 0x11e1a300}, 0x0) 348.566484ms ago: executing program 3 (id=58): mkdir(&(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv4/neigh\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000200)=""/1024, 0x400) openat(r0, &(0x7f0000000243), 0x0, 0x0) 348.39196ms ago: executing program 3 (id=59): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/sctp/intl_enable\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='1\x00', 0x1) close(r0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000100)=0x2, 0x4) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e20, @loopback}, 0x10) listen(r1, 0x5) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f00000001c0)=0x2, 0x4) setsockopt(r2, 0x84, 0x7d, &(0x7f0000000200)="0000000001000000", 0x8) setsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000240)=@assoc_value={0x0, 0x200}, 0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000280)={0x0, 0x1}, 0x10) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(r2, &(0x7f0000000300)='\x00'/4096, 0x1000, 0x0, 0x0, 0x0) 218.552985ms ago: executing program 3 (id=60): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='nfsd\x00', &(0x7f0000000180)='./nfsd\x00', &(0x7f00000001c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000240)='-2 -3 +4 +4.1 +4.2\n', 0x14) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r1, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r2, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f00000003c0)='localhost /tmp 2147483647 136208 0 0', 0x24) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0) write(r4, &(0x7f0000000440)='localhost 1 \\x00000000 2147483647 /tmp\n', 0x27) r5 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./nfsd/threads\x00', 0x2, 0x0) write(r5, &(0x7f00000004c0)='1\n', 0x2) 0s ago: executing program 3 (id=61): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pages=64\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='naa.6001405c935d7912\n', 0x16) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000480)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0/virtual_scsi_port\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='1\n', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000680)='dummy_udc.0\n', 0xc) close(r4) nanosleep(&(0x7f00000006c0)={0x0, 0x5f5e100}, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000700), 0x1, 0x2) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) r6 = syz_open_dev$sg(&(0x7f0000000700), 0x0, 0x2) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) kernel console output (not intermixed with test programs): [ 38.103331][ T43] audit: type=1400 audit(1790053187.873:136): avc: denied { rlimitinh } for pid=5704 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 38.103488][ T43] audit: type=1400 audit(1790053187.873:137): avc: denied { siginh } for pid=5704 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '[localhost]:43895' (ED25519) to the list of known hosts. [ 40.637403][ T43] audit: type=1400 audit(1790053190.413:138): avc: denied { name_bind } for pid=5713 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 40.664269][ T43] audit: type=1400 audit(1790053190.433:139): avc: denied { execute } for pid=5714 comm="sh" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 40.666357][ T43] audit: type=1400 audit(1790053190.433:140): avc: denied { execute_no_trans } for pid=5714 comm="sh" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 43.639799][ T43] audit: type=1400 audit(1790053193.413:141): avc: denied { mounton } for pid=5714 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 43.641409][ T43] audit: type=1400 audit(1790053193.413:142): avc: denied { mount } for pid=5714 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 43.643952][ T5714] cgroup: Unknown subsys name 'net' [ 43.645117][ T43] audit: type=1400 audit(1790053193.413:143): avc: denied { unmount } for pid=5714 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 43.821253][ T5714] cgroup: Unknown subsys name 'cpuset' [ 43.824156][ T5714] cgroup: Unknown subsys name 'rlimit' [ 43.992885][ T43] audit: type=1400 audit(1790053193.763:144): avc: denied { setattr } for pid=5714 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=848 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 43.993446][ T43] audit: type=1400 audit(1790053193.763:145): avc: denied { create } for pid=5714 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 43.993798][ T43] audit: type=1400 audit(1790053193.763:146): avc: denied { write } for pid=5714 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 43.994203][ T43] audit: type=1400 audit(1790053193.763:147): avc: denied { read } for pid=5714 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 44.007540][ T43] audit: type=1400 audit(1790053193.783:148): avc: denied { mounton } for pid=5714 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 44.007905][ T43] audit: type=1400 audit(1790053193.783:149): avc: denied { mount } for pid=5714 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 44.029946][ T43] audit: type=1400 audit(1790053193.803:150): avc: denied { read } for pid=5440 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 44.070727][ T5718] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 45.131763][ T5714] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 49.150660][ T43] kauditd_printk_skb: 7 callbacks suppressed [ 49.150677][ T43] audit: type=1400 audit(1790053198.923:158): avc: denied { execmem } for pid=5721 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 49.330498][ T43] audit: type=1400 audit(1790053199.103:159): avc: denied { create } for pid=5725 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 49.330902][ T43] audit: type=1400 audit(1790053199.103:160): avc: denied { read write } for pid=5725 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 49.331295][ T43] audit: type=1400 audit(1790053199.103:161): avc: denied { open } for pid=5725 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 49.349417][ T43] audit: type=1400 audit(1790053199.123:162): avc: denied { ioctl } for pid=5725 comm="syz-executor" path="socket:[7139]" dev="sockfs" ino=7139 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 49.373068][ T5727] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 49.380109][ T5737] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 49.381662][ T5737] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 49.381939][ T5737] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 49.383251][ T5737] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 49.383433][ T5737] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 49.383540][ T5737] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 49.383808][ T5737] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 49.384999][ T5737] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 49.385121][ T5737] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 49.385365][ T5737] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 49.386171][ T5737] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 49.387770][ T5737] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 49.388257][ T5737] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 49.388451][ T5737] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 49.389627][ T5737] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 49.389674][ T5737] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 49.389714][ T5737] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 49.394361][ T5739] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 49.396732][ T43] audit: type=1400 audit(1790053199.173:163): avc: denied { read } for pid=5729 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 49.398410][ T43] audit: type=1400 audit(1790053199.173:164): avc: denied { open } for pid=5729 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 49.404031][ T5738] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 49.406567][ T43] audit: type=1400 audit(1790053199.173:165): avc: denied { mounton } for pid=5730 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 49.413388][ T43] audit: type=1400 audit(1790053199.183:166): avc: denied { module_request } for pid=5725 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 49.435064][ T43] audit: type=1400 audit(1790053199.203:167): avc: denied { sys_module } for pid=5733 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 50.221780][ T5725] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.221865][ T5725] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.221962][ T5725] bridge_slave_0: entered allmulticast mode [ 50.224773][ T5725] bridge_slave_0: entered promiscuous mode [ 50.235400][ T5733] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.235484][ T5733] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.235760][ T5733] bridge_slave_0: entered allmulticast mode [ 50.237228][ T5733] bridge_slave_0: entered promiscuous mode [ 50.248281][ T5725] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.248389][ T5725] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.248682][ T5725] bridge_slave_1: entered allmulticast mode [ 50.250053][ T5725] bridge_slave_1: entered promiscuous mode [ 50.268680][ T5733] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.268933][ T5733] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.269168][ T5733] bridge_slave_1: entered allmulticast mode [ 50.270370][ T5733] bridge_slave_1: entered promiscuous mode [ 50.327682][ T5725] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 50.348984][ T5733] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 50.358607][ T5725] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 50.358768][ T5730] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.358890][ T5730] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.358995][ T5730] bridge_slave_0: entered allmulticast mode [ 50.360300][ T5730] bridge_slave_0: entered promiscuous mode [ 50.377077][ T5733] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 50.377186][ T5729] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.377263][ T5729] bridge0: port 1(bridge_slave_0) entered disabled state [ 50.377363][ T5729] bridge_slave_0: entered allmulticast mode [ 50.378739][ T5729] bridge_slave_0: entered promiscuous mode [ 50.390930][ T5730] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.391009][ T5730] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.391098][ T5730] bridge_slave_1: entered allmulticast mode [ 50.392489][ T5730] bridge_slave_1: entered promiscuous mode [ 50.407452][ T5729] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.407495][ T5729] bridge0: port 2(bridge_slave_1) entered disabled state [ 50.407640][ T5729] bridge_slave_1: entered allmulticast mode [ 50.408936][ T5729] bridge_slave_1: entered promiscuous mode [ 50.423480][ T5733] team0: Port device team_slave_0 added [ 50.441932][ T5725] team0: Port device team_slave_0 added [ 50.443650][ T5733] team0: Port device team_slave_1 added [ 50.454457][ T5730] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 50.456166][ T5725] team0: Port device team_slave_1 added [ 50.458018][ T5730] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 50.471113][ T5729] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 50.506097][ T5729] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 50.506885][ T5725] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 50.506897][ T5725] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 50.506915][ T5725] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 50.526066][ T5733] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 50.526077][ T5733] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 50.526090][ T5733] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 50.527001][ T5725] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 50.527013][ T5725] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 50.527032][ T5725] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 50.527873][ T5733] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 50.527881][ T5733] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 50.527893][ T5733] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 50.544556][ T5730] team0: Port device team_slave_0 added [ 50.559324][ T5729] team0: Port device team_slave_0 added [ 50.560922][ T5730] team0: Port device team_slave_1 added [ 50.571237][ T5725] hsr_slave_0: entered promiscuous mode [ 50.571930][ T5725] hsr_slave_1: entered promiscuous mode [ 50.574476][ T5729] team0: Port device team_slave_1 added [ 50.615309][ T5729] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 50.615322][ T5729] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 50.615334][ T5729] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 50.615896][ T5730] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 50.615905][ T5730] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 50.615917][ T5730] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 50.616463][ T5729] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 50.616471][ T5729] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 50.616483][ T5729] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 50.616949][ T5730] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 50.616956][ T5730] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 50.616968][ T5730] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 50.622577][ T5733] hsr_slave_0: entered promiscuous mode [ 50.625254][ T5733] hsr_slave_1: entered promiscuous mode [ 50.625786][ T5733] debugfs: 'hsr0' already exists in 'hsr' [ 50.625853][ T5733] Cannot create hsr debugfs directory [ 50.736724][ T5730] hsr_slave_0: entered promiscuous mode [ 50.737497][ T5730] hsr_slave_1: entered promiscuous mode [ 50.738048][ T5730] debugfs: 'hsr0' already exists in 'hsr' [ 50.738066][ T5730] Cannot create hsr debugfs directory [ 50.741402][ T5729] hsr_slave_0: entered promiscuous mode [ 50.741830][ T5729] hsr_slave_1: entered promiscuous mode [ 50.742246][ T5729] debugfs: 'hsr0' already exists in 'hsr' [ 50.742257][ T5729] Cannot create hsr debugfs directory [ 50.990426][ T5725] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 50.996830][ T5725] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 50.997687][ T5725] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 51.004136][ T5725] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 51.004616][ T5725] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 51.008027][ T5725] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 51.011028][ T5725] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 51.015216][ T5725] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 51.062364][ T5733] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 51.066756][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 51.067129][ T5733] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 51.070624][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 51.078316][ T5733] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 51.080901][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 51.081553][ T5733] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 51.083867][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 51.142310][ T5729] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 51.144457][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 51.144807][ T5729] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 51.148770][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 51.156416][ T5729] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 51.159093][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 51.159459][ T5729] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 51.164099][ T5729] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 51.195297][ T5725] 8021q: adding VLAN 0 to HW filter on device bond0 [ 51.222299][ T5730] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 51.224123][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 51.235623][ T5730] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 51.238104][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 51.238520][ T5730] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 51.243283][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 51.246520][ T5725] 8021q: adding VLAN 0 to HW filter on device team0 [ 51.251326][ T5730] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 51.258495][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 51.263110][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.263214][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.274546][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.274592][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.279858][ T5733] 8021q: adding VLAN 0 to HW filter on device bond0 [ 51.309649][ T5733] 8021q: adding VLAN 0 to HW filter on device team0 [ 51.331361][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.331451][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.350847][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.350894][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.357539][ T5729] 8021q: adding VLAN 0 to HW filter on device bond0 [ 51.402648][ T5729] 8021q: adding VLAN 0 to HW filter on device team0 [ 51.412111][ T152] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.412158][ T152] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.427457][ T1161] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.427535][ T1161] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.453297][ T5730] 8021q: adding VLAN 0 to HW filter on device bond0 [ 51.476800][ T65] Bluetooth: hci1: command tx timeout [ 51.487232][ T65] Bluetooth: hci2: command tx timeout [ 51.487496][ T65] Bluetooth: hci3: command tx timeout [ 51.487578][ T65] Bluetooth: hci0: command tx timeout [ 51.491166][ T5730] 8021q: adding VLAN 0 to HW filter on device team0 [ 51.510930][ T152] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.511083][ T152] bridge0: port 1(bridge_slave_0) entered forwarding state [ 51.522364][ T152] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.522449][ T152] bridge0: port 2(bridge_slave_1) entered forwarding state [ 51.687754][ T5725] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 51.735893][ T5725] veth0_vlan: entered promiscuous mode [ 51.741966][ T5725] veth1_vlan: entered promiscuous mode [ 51.762039][ T5725] veth0_macvtap: entered promiscuous mode [ 51.767198][ T5725] veth1_macvtap: entered promiscuous mode [ 51.788061][ T5725] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 51.794030][ T5733] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 51.798673][ T5725] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.845524][ T5729] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 51.869502][ T5730] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 51.892987][ T5733] veth0_vlan: entered promiscuous mode [ 51.899006][ T152] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.899021][ T152] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.929365][ T5733] veth1_vlan: entered promiscuous mode [ 51.940538][ T152] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.940551][ T152] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.943300][ T5729] veth0_vlan: entered promiscuous mode [ 51.967482][ T5729] veth1_vlan: entered promiscuous mode [ 51.972232][ T5730] veth0_vlan: entered promiscuous mode [ 51.987124][ T5730] veth1_vlan: entered promiscuous mode [ 52.004553][ T5733] veth0_macvtap: entered promiscuous mode [ 52.005051][ T5725] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 52.010507][ T5733] veth1_macvtap: entered promiscuous mode [ 52.025638][ T5729] veth0_macvtap: entered promiscuous mode [ 52.032690][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 52.038336][ T5729] veth1_macvtap: entered promiscuous mode [ 52.048193][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 52.064791][ T5730] veth0_macvtap: entered promiscuous mode [ 52.071863][ T5729] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 52.074046][ T5729] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 52.079768][ T5730] veth1_macvtap: entered promiscuous mode [ 52.112534][ T5878] device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(3) [ 52.138010][ T5730] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 52.151376][ T5730] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 52.171143][ T5805] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.172556][ T1161] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 52.172573][ T1161] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 52.216860][ T1161] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 52.216877][ T1161] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 52.236800][ T5775] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.241955][ T1161] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 52.241966][ T1161] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 52.270444][ T1161] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 52.270457][ T1161] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 52.289538][ T1164] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 52.289554][ T1164] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 52.302579][ T1161] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 52.302592][ T1161] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 52.316859][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.316886][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.316904][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.316921][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.316938][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.316955][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.316972][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.316989][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.317006][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.317023][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.317041][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.317062][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.317079][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.317096][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 52.380178][ T5883] [U] 18446744071840344000 [ 52.523860][ T5901] nvmet_tcp: enabling port 1 (127.0.0.1:4420) [ 52.537853][ T5905] netlink: 116 bytes leftover after parsing attributes in process `syz.2.14'. [ 52.612335][ T5910] udc dummy_udc.0: failed to start g1: -19 [ 52.613625][ T5910] UDC core: g1: couldn't find an available UDC or it's busy [ 52.666574][ T5912] nvmet: adding nsid 1 to subsystem testsubsys [ 52.672498][ T5912] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 52.849264][ T851] logitech-djreceiver 0003:046D:C548.0002: unbalanced collection at end of report description [ 52.849981][ T851] logitech-djreceiver 0003:046D:C548.0002: logi_dj_probe: parse failed [ 52.850035][ T851] logitech-djreceiver 0003:046D:C548.0002: probe with driver logitech-djreceiver failed with error -22 [ 53.119325][ T5924] svc: failed to register lockdv1 RPC service (errno 111). [ 53.119426][ T5924] lockd_up: makesock failed, error=-111 [ 53.425466][ T5924] svc: failed to register nfsdv3 RPC service (errno 111). [ 53.427030][ T5924] svc: failed to register nfsaclv3 RPC service (errno 111). [ 53.427046][ T5924] failed to unregister tcp with rpcbind [ 53.427470][ T5924] svc: failed to register nfsdv3 RPC service (errno 97). [ 53.427486][ T5924] svc: failed to register nfsaclv3 RPC service (errno 97). [ 53.427498][ T5924] failed to unregister tcp with rpcbind [ 53.476449][ T5822] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 53.512804][ T5934] udc dummy_udc.0: failed to start g1: -19 [ 53.513246][ T5934] UDC core: g1: couldn't find an available UDC or it's busy [ 53.551715][ T5938] netlink: 12 bytes leftover after parsing attributes in process `syz.0.27'. [ 53.566827][ T5739] Bluetooth: hci0: command tx timeout [ 53.566847][ T5739] Bluetooth: hci3: command tx timeout [ 53.566860][ T5739] Bluetooth: hci2: command tx timeout [ 53.566871][ T5739] Bluetooth: hci1: command tx timeout [ 53.627547][ T5822] usb 8-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.01 [ 53.629619][ T5822] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 53.629646][ T5822] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 53.629673][ T5822] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 53.637185][ T5822] usb 8-1: config 0 descriptor?? [ 54.080273][ T5953] pimreg: entered allmulticast mode [ 54.090997][ T5952] pimreg: left allmulticast mode [ 54.186533][ T5957] loop0: detected capacity change from 0 to 131072 [ 54.656228][ T5932] NFSD: Unable to initialize client recovery tracking! (-110) [ 54.656247][ T5932] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 54.656256][ T5932] NFSD: starting 90-second grace period (net f0000499) [ 55.045553][ T5822] usbhid 8-1:0.0: can't add hid device: -71 [ 55.045607][ T5822] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 55.053902][ T5822] usb 8-1: USB disconnect, device number 2 [ 55.617108][ T43] kauditd_printk_skb: 92 callbacks suppressed [ 55.617126][ T43] audit: type=1400 audit(1790053205.393:260): avc: denied { read write } for pid=5968 comm="syz.2.34" name="nullb0" dev="devtmpfs" ino=705 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 55.617167][ T43] audit: type=1400 audit(1790053205.393:261): avc: denied { open } for pid=5968 comm="syz.2.34" path="/dev/nullb0" dev="devtmpfs" ino=705 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 55.636384][ T65] Bluetooth: hci1: command tx timeout [ 55.636417][ T65] Bluetooth: hci3: command tx timeout [ 55.636435][ T65] Bluetooth: hci0: command tx timeout [ 55.639333][ T5971] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 55.882991][ T43] audit: type=1400 audit(1790053205.653:262): avc: denied { create } for pid=5977 comm="syz.3.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 55.883585][ T43] audit: type=1400 audit(1790053205.653:263): avc: denied { bind } for pid=5977 comm="syz.3.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 55.883933][ T43] audit: type=1400 audit(1790053205.653:264): avc: denied { listen } for pid=5977 comm="syz.3.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 55.884299][ T43] audit: type=1400 audit(1790053205.653:265): avc: denied { connect } for pid=5977 comm="syz.3.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 55.890572][ T43] audit: type=1400 audit(1790053205.663:266): avc: denied { accept } for pid=5977 comm="syz.3.36" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 55.890814][ T43] audit: type=1400 audit(1790053205.663:267): avc: denied { write } for pid=5977 comm="syz.3.36" path="socket:[10404]" dev="sockfs" ino=10404 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 55.891591][ T43] audit: type=1400 audit(1790053205.663:268): avc: denied { read } for pid=5977 comm="syz.3.36" path="socket:[10408]" dev="sockfs" ino=10408 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 56.036486][ T5949] NFSD: Unable to initialize client recovery tracking! (-110) [ 56.036507][ T5949] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 56.036516][ T5949] NFSD: starting 90-second grace period (net f00004c2) [ 56.298387][ T43] audit: type=1400 audit(1790053206.073:269): avc: denied { unmount } for pid=5729 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 56.355704][ T5988] svc: failed to register lockdv1 RPC service (errno 111). [ 56.629686][ T5988] svc: failed to register nfsdv3 RPC service (errno 111). [ 56.630250][ T5988] svc: failed to register nfsaclv3 RPC service (errno 111). [ 56.630261][ T5988] failed to unregister tcp with rpcbind [ 56.630352][ T5988] svc: failed to register nfsdv3 RPC service (errno 97). [ 56.630360][ T5988] svc: failed to register nfsaclv3 RPC service (errno 97). [ 56.630367][ T5988] failed to unregister tcp with rpcbind [ 57.046762][ T42] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 57.196642][ T42] usb 8-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 1.00 [ 57.197492][ T42] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 57.197513][ T42] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.716589][ T65] Bluetooth: hci0: command tx timeout [ 57.716618][ T5727] Bluetooth: hci3: command tx timeout [ 57.716639][ T5727] Bluetooth: hci1: command tx timeout [ 57.786101][ T6004] NFSD: Unable to initialize client recovery tracking! (-110) [ 57.786115][ T6004] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING. [ 57.786121][ T6004] NFSD: starting 90-second grace period (net f00004c2) [ 58.033182][ T6008] NFSD: Failed to start, no listeners configured. [ 58.275121][ T6029] loop0: detected capacity change from 0 to 131072 [ 58.279954][ T65] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 58.279987][ T65] Bluetooth: hci2: Injecting HCI hardware error event [ 58.280563][ T5731] Bluetooth: hci2: hardware error 0x00 [ 58.316872][ T6033] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 58.331174][ T5814] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 58.331216][ T6037] nvmet: disable ns before setting buffered_io value. [ 58.332070][ T6037] nvmet: the ns:1 is already enabled. [ 58.333095][ T6037] nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store [ 58.385077][ T1169] nvmet: connect request for invalid subsystem testsubsys! [ 58.386697][ T6037] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 58.587601][ T5473] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 58.608597][ T851] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 58.612114][ T42] usbhid 8-1:1.0: can't add hid device: -71 [ 58.612164][ T42] usbhid 8-1:1.0: probe with driver usbhid failed with error -71 [ 58.614537][ T42] usb 8-1: USB disconnect, device number 3 [ 58.776201][ T851] usb 6-1: Using ep0 maxpacket: 16 [ 58.776922][ T851] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 58.777817][ T851] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 58.777839][ T851] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 58.777871][ T851] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 58.781683][ T851] usb 6-1: config 0 descriptor?? [ 58.901012][ T5739] Bluetooth: hci2: unexpected event for opcode 0x041b [ 59.097494][ T42] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 59.285605][ T6058] NFSD: Failed to start, no listeners configured. [ 59.521034][ T6060] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 59.523712][ T6060] [ 59.528164][ T6060] ====================================================== [ 59.531178][ T6060] WARNING: possible circular locking dependency detected [ 59.534283][ T6060] syzkaller #0 Not tainted [ 59.536211][ T6060] ------------------------------------------------------ [ 59.539097][ T6060] syz.3.61/6060 is trying to acquire lock: [ 59.541606][ T6060] ffff8880204b5b80 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_depend_item_unlocked+0xf3/0x6a0 [ 59.546580][ T6060] [ 59.546580][ T6060] but task is already holding lock: [ 59.549743][ T6060] ffffffff90480000 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x10b/0x610 [ 59.553733][ T6060] [ 59.553733][ T6060] which lock already depends on the new lock. [ 59.553733][ T6060] [ 59.558033][ T6060] [ 59.558033][ T6060] the existing dependency chain (in reverse order) is: [ 59.561908][ T6060] [ 59.561908][ T6060] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 59.565349][ T6060] lock_acquire+0x1d1/0x380 [ 59.567510][ T6060] __mutex_lock+0x1a4/0x1bd0 [ 59.569703][ T6060] tcm_alloc+0x20/0x440 [ 59.571754][ T6060] usb_get_function+0x5e/0xd0 [ 59.574040][ T6060] config_usb_cfg_link+0x1ed/0x3a0 [ 59.576451][ T6061] udc dummy_udc.0: failed to start g1: -19 [ 59.576758][ T6061] UDC core: g1: couldn't find an available UDC or it's busy [ 59.582896][ T6060] configfs_symlink+0x695/0x1340 [ 59.585273][ T6060] vfs_symlink+0x178/0x4d0 [ 59.587422][ T6060] filename_symlinkat+0x2a6/0x560 [ 59.589796][ T6060] __x64_sys_symlinkat+0x9c/0xe0 [ 59.592171][ T6060] do_syscall_64+0x123/0x790 [ 59.594294][ T6060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.596967][ T6060] [ 59.596967][ T6060] -> #1 (&gi->lock){+.+.}-{4:4}: [ 59.600017][ T6060] lock_acquire+0x1d1/0x380 [ 59.602204][ T6060] __mutex_lock+0x1a4/0x1bd0 [ 59.604477][ T6060] config_usb_cfg_link+0x57/0x3a0 [ 59.606856][ T6060] configfs_symlink+0x695/0x1340 [ 59.609210][ T6060] vfs_symlink+0x178/0x4d0 [ 59.611345][ T6060] filename_symlinkat+0x2a6/0x560 [ 59.613736][ T6060] __x64_sys_symlinkat+0x9c/0xe0 [ 59.616096][ T6060] do_syscall_64+0x123/0x790 [ 59.618340][ T6060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.621152][ T6060] [ 59.621152][ T6060] -> #0 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 59.624960][ T6060] check_prev_add+0xeb/0xe60 [ 59.627184][ T6060] __lock_acquire+0x1528/0x1f40 [ 59.629466][ T6060] lock_acquire+0x1d1/0x380 [ 59.631675][ T6060] down_write+0x8b/0x1f0 [ 59.633862][ T6060] configfs_depend_item_unlocked+0xf3/0x6a0 [ 59.636640][ T6060] usbg_make_tpg+0x251/0x610 [ 59.639021][ T6060] target_fabric_make_tpg+0xab/0x8c0 [ 59.641764][ T6060] configfs_mkdir+0x525/0xd40 [ 59.644012][ T6060] vfs_mkdir+0x364/0x850 [ 59.646135][ T6060] filename_mkdirat+0x48b/0x5e0 [ 59.648448][ T6060] __x64_sys_mkdirat+0x89/0xc0 [ 59.650741][ T6060] do_syscall_64+0x123/0x790 [ 59.653000][ T6060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.655684][ T6060] [ 59.655684][ T6060] other info that might help us debug this: [ 59.655684][ T6060] [ 59.660054][ T6060] Chain exists of: [ 59.660054][ T6060] &sb->s_type->i_mutex_key#24 --> &gi->lock --> tpg_instances_lock [ 59.660054][ T6060] [ 59.665915][ T6060] Possible unsafe locking scenario: [ 59.665915][ T6060] [ 59.669120][ T6060] CPU0 CPU1 [ 59.671391][ T6060] ---- ---- [ 59.673770][ T6060] lock(tpg_instances_lock); [ 59.675841][ T6060] lock(&gi->lock); [ 59.678555][ T6060] lock(tpg_instances_lock); [ 59.681656][ T6060] lock(&sb->s_type->i_mutex_key#24); [ 59.683967][ T6060] [ 59.683967][ T6060] *** DEADLOCK *** [ 59.683967][ T6060] [ 59.687319][ T6060] locks held by syz.3.61/6060: 4, last CPU#1: [ 59.689938][ T6060] #0: ffff88802382e460 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 59.694186][ T6060] #1: ffff8880581d4880 (&sb->s_type->i_mutex_key#7/1){+.+.}-{4:4}, at: filename_create+0x1c0/0x400 [ 59.698718][ T6060] #2: ffffffff8ffb2e68 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_mkdir+0x4c0/0xd40 [ 59.702901][ T6060] #3: ffffffff90480000 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x10b/0x610 [ 59.706906][ T6060] [ 59.706906][ T6060] stack backtrace: [ 59.709393][ T6060] CPU: 1 UID: 0 PID: 6060 Comm: syz.3.61 Not tainted syzkaller #0 PREEMPT(full) [ 59.713199][ T6060] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 59.717410][ T6060] Call Trace: [ 59.718861][ T6060] [ 59.720182][ T6060] dump_stack_lvl+0x100/0x190 [ 59.722205][ T6060] print_circular_bug.cold+0x178/0x1be [ 59.724544][ T6060] check_noncircular+0x146/0x160 [ 59.726608][ T6060] check_prev_add+0xeb/0xe60 [ 59.728619][ T6060] __lock_acquire+0x1528/0x1f40 [ 59.730725][ T6060] ? rcu_is_watching+0x13/0xc0 [ 59.732824][ T6060] lock_acquire+0x1d1/0x380 [ 59.734763][ T6060] ? configfs_depend_item_unlocked+0xf3/0x6a0 [ 59.737299][ T6060] ? __pfx___might_resched+0x10/0x10 [ 59.739469][ T6060] down_write+0x8b/0x1f0 [ 59.741298][ T6060] ? configfs_depend_item_unlocked+0xf3/0x6a0 [ 59.743849][ T6060] ? __pfx_down_write+0x10/0x10 [ 59.745972][ T6060] ? kstrtou16+0xde/0x130 [ 59.747823][ T6060] configfs_depend_item_unlocked+0xf3/0x6a0 [ 59.750367][ T6060] usbg_make_tpg+0x251/0x610 [ 59.752354][ T6060] ? __pfx_usbg_make_tpg+0x10/0x10 [ 59.754584][ T6060] ? find_held_lock+0x2b/0x80 [ 59.756618][ T6060] ? __pfx_usbg_make_tpg+0x10/0x10 [ 59.758794][ T6060] ? __pfx_target_fabric_make_tpg+0x10/0x10 [ 59.761346][ T6060] target_fabric_make_tpg+0xab/0x8c0 [ 59.763701][ T6060] ? __pfx_target_fabric_make_tpg+0x10/0x10 [ 59.766219][ T6060] configfs_mkdir+0x525/0xd40 [ 59.768269][ T6060] ? may_create+0x285/0x440 [ 59.770232][ T6060] ? __pfx_configfs_mkdir+0x10/0x10 [ 59.772471][ T6060] vfs_mkdir+0x364/0x850 [ 59.774235][ T6060] filename_mkdirat+0x48b/0x5e0 [ 59.776265][ T6060] ? __pfx_filename_mkdirat+0x10/0x10 [ 59.778693][ T6060] ? strncpy_from_user+0x19d/0x2d0 [ 59.780877][ T6060] ? do_getname+0x191/0x390 [ 59.782878][ T6060] __x64_sys_mkdirat+0x89/0xc0 [ 59.784940][ T6060] do_syscall_64+0x123/0x790 [ 59.786944][ T6060] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.789483][ T6060] RIP: 0033:0x7fb33519e159 [ 59.791388][ T6060] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 59.799389][ T6060] RSP: 002b:00007fb335f83028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 59.802863][ T6060] RAX: ffffffffffffffda RBX: 00007fb335425fa0 RCX: 00007fb33519e159 [ 59.806063][ T5739] Bluetooth: hci0: command 0x0406 tx timeout [ 59.808625][ T6060] RDX: 00000000000001ff RSI: 0000200000000380 RDI: ffffffffffffff9c [ 59.811972][ T6060] RBP: 00007fb33523506b R08: 0000000000000000 R09: 0000000000000000 [ 59.815318][ T6060] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 59.818660][ T6060] R13: 00007fb335426038 R14: 00007fb335425fa0 R15: 00007ffc0f5c55d8 [ 59.822050][ T6060] [ 60.356056][ T5731] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 60.597266][ T42] libceph: mon0 (2)0.0.0.0:6789 socket error on write [ 61.302986][ T6031] ceph: No mds server is up or the cluster is laggy [ 61.316281][ T851] usbhid 6-1:0.0: can't add hid device: -71 [ 61.316347][ T851] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 61.317366][ T851] usb 6-1: USB disconnect, device number 2 [ 62.686109][ T5731] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 62.686138][ T5731] Bluetooth: hci1: Injecting HCI hardware error event [ 62.686199][ T5731] Bluetooth: hci1: hardware error 0x00 [ 64.758198][ T5731] Bluetooth: hci1: Opcode 0x0c03 failed: -110