last executing test programs: 2.266359496s ago: executing program 2 (id=1986): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x1, 0x0) write(r0, &(0x7f0000001500)='1\n', 0x2) 2.149616939s ago: executing program 2 (id=1989): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x20000080) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) syz_open_dev$usbfs(0x0, 0x8000000000000009, 0x8c0002) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=ANY=[], &(0x7f0000000180), 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x0) 1.481409725s ago: executing program 0 (id=2001): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@gettfilter={0x24, 0x2e, 0x301, 0x0, 0x0, {0x0, 0x0, 0x0, r1}}, 0x24}}, 0x0) 1.432410076s ago: executing program 0 (id=2004): write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb3b0000ce220000000004000000e3"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200000000"], 0x0}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1100}, 0x48) 1.358424058s ago: executing program 0 (id=2005): r0 = socket$kcm(0x23, 0x5, 0x0) listen(r0, 0x800) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r4, 0x29, 0x2, 0x0, &(0x7f0000000340)) recvmmsg(r2, &(0x7f0000000480), 0x400034f, 0x2, 0x0) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x5, &(0x7f0000000140)=0x1, 0x4) waitid(0x1, 0x0, 0x0, 0x8, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000240)='./file0\x00', 0x20081e, &(0x7f00000001c0)={[{@nodelalloc}, {@nombcache}, {@auto_da_alloc}]}, 0x1, 0x4ef, &(0x7f0000000940)="$eJzs3U1vW1kZAODXzpeTyUwywywAAVOGgYKqOonbRlUXUFYIoUqILkFqQ+JGUew4ip3ShC7S/4BEJVaw5Aew7oo9GwQ7NmWBxEcEaiqxMLrXN6mb2k1oEjuKn0e6uvfcY/s9J849x36d+AQwsC5FxE5EjEbE/YiYys7nsi1ut7bkdi92Hy/u7T5ezEWzefefubQ+ORdt90m8lz1mISJ+9L2In+bejFvf2l5dqFTKG63i+Eyjuj5T39q+ulJdWC4vl9dKpfm5+dmb126UTq2vn1RHs6MvP//Dzrd+njRrMjvT3o/T1Or6yEGcxHBE/OAsgvXBUNaf0X43hHeSj4iPIuLT9PqfiqH02QQALrJmcyqaU+1lAOCiy6c5sFy+mOUCJiOfLxZbObyPYyJfqdUbVx7UNteWWrmy6RjJP1iplGezXOF0jOSS8lx6/KpcOlS+FhEfRsQvxsbTcnGxVlnq5wsfABhg7x2a//8z1pr/AYALrtDvBgAAPWf+B4DBY/4HgMFj/geAwWP+B4DBY/4HgMFj/geAgfLDO3eSrbmXff/10sOtzdXaw6tL5fpqsbq5WFysbawXl2u15fQ7e6pHPV6lVlufux6bj6a/vV5vzNS3tu9Va5trjXvp93rfK4/0pFcAwNt8+MmzP+ciYufWeLpF21oO5mq42PL9bgDQN0P9bgDQN1b7gsF1gvf40gNwQXRYovc1hYgYP3yy2Ww2z65JwBm7/AX5fxhUbfl/fwUMA0b+HwaX/D8MrmYzd9w1/+O4NwQAzjc5fqDL5/8fZfvfZh8O/GTp8C2enmWrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4HzbX/+3mK0FPhn5fLEY8X5ETMdI7sFKpTwbER9ExJ/GRsaS8lyf2wwAnFT+b7ls/a/LU59NHq4dzb0cS/cR8bNf3f3lo4VGY+OPyfl/HZxvPM3Ol/rRfgDgKPvzdLpveyP/Yvfx4v7Wy/b8/bsRUWjF39sdjb2D+MMxnO4LMRIRE//OZeWWXFvu4iR2nkTE5zv1PxeTaQ6ktfLp4fhJ7Pd7Gj//Wvx8WtfaJz+Lz51CW2DQPEvGn9udrr98XEr3na//QjpCnVw2/iUPtbiXjoGv4u+Pf0Ndxr9Lx41x/fffbx2Nv1n3JOKLwxH7sffaxp/9+Lku8T87Zvy/fOkrn3ara/464nJ0jt8ea6ZRXZ+pb21fXakuLJeXy2ul0vzc/OzNazdKM2mOeqb7bPCPW1c+6FaX9H+iS/zCEf3/+jH7/5v/3v/xV98S/5tf6xQ/Hx+/JX4yJ37jmPEXJn5X6FaXxF/q0v+jnv8rx4z//K/bbywbDgD0T31re3WhUilv9PJg/4VET4M6uAAHyW/NOWhGx4Pv9CrWaPxf92o23ylWtxHjNLJuwHlwcNFHxMt+NwYAAAAAAAAAAAAAAOioF/+x1O8+AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcHH9LwAA//89fM7W") r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0xc41, 0x20) truncate(&(0x7f0000000900)='./file1\x00', 0x3000000) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000040)={0x5, 0x6576, 0x109}) mmap(&(0x7f00003e9000/0x4000)=nil, 0x4000, 0x4, 0x11, r6, 0x100000000) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) open(&(0x7f00000000c0)='./file1\x00', 0x66842, 0x21) fallocate(r5, 0x20, 0x4000, 0x3000000) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x0, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000000)={'ip6_vti0\x00', 0x0, 0x0, 0x95, 0x7, 0x80000000, 0x8, @mcast2, @local, 0x7f90, 0x7, 0x5, 0x1}}) 1.27583544s ago: executing program 2 (id=2007): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/target/core/rd_mcp_0/ramdisk_0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000b00)='rd_pages=8\n', 0xb) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/target/core/rd_mcp_0/ramdisk_0/enable\x00', 0x1, 0x0) write(r1, &(0x7f0000000d00), 0x0) close(r1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/target/usb_gadget/naa.1234567890123456\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000001200)='./config/target/core/rd_mcp_0/ramdisk_0\x00', 0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0/d0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x1, 0x0) write(r2, &(0x7f0000001500)='1\n', 0x2) close(r2) 888.619959ms ago: executing program 3 (id=2009): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='usbip-vudc.0', 0xc) write(r0, &(0x7f00000004c0)='\n', 0x1) 859.09101ms ago: executing program 2 (id=2010): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='0', 0x1) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') write(0xffffffffffffffff, &(0x7f0000000480)='usbip-vudc.0', 0xc) write(0xffffffffffffffff, &(0x7f00000004c0)='\n', 0x1) 776.660721ms ago: executing program 2 (id=2013): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x1, 0x0) write(r0, &(0x7f0000001500)='1\n', 0x2) 760.950742ms ago: executing program 3 (id=2014): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/eem.usb0\x00', 0x1ff) 701.645303ms ago: executing program 2 (id=2017): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x20000080) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) syz_open_dev$usbfs(0x0, 0x8000000000000009, 0x8c0002) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=ANY=[], &(0x7f0000000180), 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x0) 674.233154ms ago: executing program 1 (id=2019): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) socket$rds(0x15, 0x5, 0x0) socket$inet6(0xa, 0x3, 0x4) socket$inet6_mptcp(0xa, 0x1, 0x106) syz_io_uring_setup(0x156d, &(0x7f0000008740)={0x0, 0xb179, 0x2, 0x3, 0x13b}, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, 0x0, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x40, 0x1000000, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x200, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1, 0x800}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x4, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x52) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d05c164a534308", 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x4051}, 0x20008001) recvmsg$can_raw(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000340)=""/197, 0xc5}], 0x1}, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 673.989874ms ago: executing program 3 (id=2020): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x18, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x4}]}, 0x18}}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101"], 0x40}, 0xfffe) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) write$tun(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0x72) 244.622234ms ago: executing program 4 (id=2021): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/target/core/rd_mcp_0/ramdisk_0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000b00)='rd_pages=8\n', 0xb) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/target/core/rd_mcp_0/ramdisk_0/enable\x00', 0x1, 0x0) write(r1, &(0x7f0000000d00), 0x0) close(r1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/target/usb_gadget/naa.1234567890123456\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000001200)='./config/target/core/rd_mcp_0/ramdisk_0\x00', 0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0/d0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x1, 0x0) write(r2, &(0x7f0000001500)='1\n', 0x2) close(r2) 220.926574ms ago: executing program 0 (id=2022): r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000200), 0x1, 0x4bc, &(0x7f0000000a40)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") quotactl$Q_GETNEXTQUOTA(0xffffffff80000901, 0x0, 0x0, 0xffffffffffffffff) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) syz_emit_ethernet(0x94, &(0x7f0000000200)={@local, @empty, @void, {@ipv6={0x86dd, @gre_packet={0x1, 0x6, "bc4a06", 0x5e, 0x2f, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x1}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8100, [0xdb05]}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x46], "7223374a16b788baf5ffbb319ab09112ff0dcf379c79"}, {0xa888, 0x88be, 0x3, {{0xc, 0x1, 0x8, 0x1, 0x1, 0x0, 0x4, 0x14}, 0x1, {0x9}}}, {0x8, 0x22eb, 0x2, {{0x3, 0x2, 0x2, 0x3, 0x0, 0x0, 0x1, 0x9}, 0x2, {0x20000003, 0xeb, 0x0, 0xd, 0x1, 0x1, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x3}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, @fallback=0x22}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x801a01, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r2, 0xc008561c, &(0x7f0000000040)={0xf0f028, 0x1}) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000280)) sendto$packet(r4, 0x0, 0x0, 0xb01, 0x0, 0x0) listen(r3, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) ioctl$PPPIOCSMRU1(r1, 0x40047452, 0x0) 208.569905ms ago: executing program 4 (id=2023): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000100000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DEL_VIF(r3, 0x0, 0xcb, &(0x7f0000000840)={0xfffc, 0x0, 0x1d, 0xe51, @vifc_lcl_addr=@multicast1, @multicast2}, 0x10) 184.404426ms ago: executing program 1 (id=2024): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='0', 0x1) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') write(0xffffffffffffffff, &(0x7f0000000480)='usbip-vudc.0', 0xc) write(0xffffffffffffffff, &(0x7f00000004c0)='\n', 0x1) 184.173275ms ago: executing program 1 (id=2025): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000380)='0', 0x1) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='usbip-vudc.0', 0xc) write(r0, &(0x7f00000004c0)='\n', 0x1) 161.107336ms ago: executing program 4 (id=2026): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r0, &(0x7f0000000080)="cf0df04c73b3", 0x6) 108.452507ms ago: executing program 4 (id=2027): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x1, 0x0) write(r0, &(0x7f0000001500)='1\n', 0x2) 108.048957ms ago: executing program 3 (id=2028): write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb3b0000ce220000000004000000e3"], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000"], 0x0}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1100}, 0x48) 92.944828ms ago: executing program 1 (id=2029): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$unix(0x1, 0x2, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010028bd7000fddbdf250700000008000300", @ANYRES32=r3, @ANYBLOB="0c009900ff070000070000001400040073797a6b616c6c6572300000000000000800050006"], 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x40, 0x0) close(r4) socket$inet_sctp(0x2, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendto$packet(0xffffffffffffffff, &(0x7f0000000800)="000a18000ce0ff0000eb55000000000100aa34745a1945da911324df073fcb7a85a47d87c24ede12c488758814f2a966", 0x30, 0x4000000, &(0x7f0000000380)={0x11, 0x1, r6, 0x1, 0xd8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x40}}, 0x14) 72.648798ms ago: executing program 4 (id=2030): r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@gettfilter={0x24, 0x2e, 0x301, 0x0, 0x0, {0x0, 0x0, 0x0, r1}}, 0x24}}, 0x0) 72.194538ms ago: executing program 0 (id=2031): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='0', 0x1) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r1, &(0x7f0000000480)='usbip-vudc.0', 0xc) write(r1, &(0x7f00000004c0)='\n', 0x1) 24.604179ms ago: executing program 3 (id=2032): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g1/functions/eem.usb0\x00', 0x1ff) 24.450249ms ago: executing program 1 (id=2033): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/target/core/rd_mcp_0/ramdisk_0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/target/core/rd_mcp_0/ramdisk_0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000b00)='rd_pages=8\n', 0xb) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/target/core/rd_mcp_0/ramdisk_0/enable\x00', 0x1, 0x0) write(r1, &(0x7f0000000d00), 0x0) close(r1) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000f00)='./config/target/usb_gadget/naa.1234567890123456\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000001100)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000001200)='./config/target/core/rd_mcp_0/ramdisk_0\x00', 0xffffffffffffff9c, &(0x7f0000001300)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0/d0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./config/target/usb_gadget/naa.1234567890123456/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x1, 0x0) write(r2, &(0x7f0000001500)='1\n', 0x2) close(r2) 23.429509ms ago: executing program 4 (id=2034): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) socket$rds(0x15, 0x5, 0x0) socket$inet6(0xa, 0x3, 0x4) socket$inet6_mptcp(0xa, 0x1, 0x106) syz_io_uring_setup(0x156d, &(0x7f0000008740)={0x0, 0xb179, 0x2, 0x3, 0x13b}, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, 0x0, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x40, 0x1000000, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x200, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1, 0x800}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x4, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x52) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d05c164a534308", 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x4051}, 0x20008001) recvmsg$can_raw(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000340)=""/197, 0xc5}], 0x1}, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 18.852479ms ago: executing program 0 (id=2035): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./my_configfs\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1/functions/obex.usb0\x00', 0x1ff) symlinkat(&(0x7f00000001c0)='./my_configfs/usb_gadget/g1/functions/obex.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/configs/c.1/obex.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000280)='dummy_udc.0', 0xb) 13.1087ms ago: executing program 3 (id=2036): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000010000000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DEL_VIF(r3, 0x0, 0xcb, &(0x7f0000000840)={0xfffc, 0x0, 0x1d, 0xe51, @vifc_lcl_addr=@multicast1, @multicast2}, 0x10) 0s ago: executing program 1 (id=2037): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='0', 0x1) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') write(0xffffffffffffffff, &(0x7f0000000480)='usbip-vudc.0', 0xc) write(0xffffffffffffffff, &(0x7f00000004c0)='\n', 0x1) kernel console output (not intermixed with test programs): mmand 0x0409 tx timeout [ 32.017354][ T4337] Bluetooth: hci1: command 0x0409 tx timeout [ 32.018332][ T4337] Bluetooth: hci3: command 0x0409 tx timeout [ 32.024398][ T4341] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 32.085939][ T4341] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 32.127129][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.129208][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.131693][ T4329] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.132953][ T4341] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 32.187837][ T4341] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 32.236959][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.239398][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.241228][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.242463][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.245813][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 32.252172][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.256622][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.258517][ T1354] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.259743][ T1354] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.261065][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 32.273585][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 32.275417][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 32.277158][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 32.278862][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 32.282367][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 32.284667][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 32.295533][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.297255][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.304795][ T4328] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.311146][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.312789][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.316077][ T4329] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 32.328822][ T4328] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.335228][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.336765][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.342154][ T4338] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.346541][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.348343][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.349953][ T1616] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.351213][ T1616] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.356153][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 32.361526][ T4338] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.367282][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.369366][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.370924][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.372051][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.373489][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.376491][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.377956][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 32.379772][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 32.381453][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 32.385244][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 32.387072][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 32.399748][ T4333] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.401171][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.402825][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.407234][ T1616] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.408468][ T1616] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.410572][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 32.418294][ T4341] 8021q: adding VLAN 0 to HW filter on device bond0 [ 32.420371][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 32.422249][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 32.426387][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.428113][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.430009][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.431207][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.433080][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.435288][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.440911][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 32.442741][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.447164][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.452761][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 32.458758][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 32.460144][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 32.461443][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 32.463209][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 32.468657][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 32.471533][ T4329] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.472844][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 32.474999][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.477001][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.481370][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 32.483009][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 32.486452][ T4341] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.488366][ T4333] 8021q: adding VLAN 0 to HW filter on device team0 [ 32.492512][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 32.495792][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 32.501006][ T4338] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 32.502668][ T4338] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 32.513191][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.515178][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.516808][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.518307][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.519784][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.522036][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.524641][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.525941][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.527449][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 32.529104][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 32.530697][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 32.531988][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 32.534150][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.536051][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.537625][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.538866][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.540395][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 32.542017][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 32.544202][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.545414][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.546881][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 32.548508][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 32.550068][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 32.557094][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 32.558744][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 32.560449][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 32.591072][ T4333] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 32.592923][ T4333] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 32.596723][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 32.598882][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.600533][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.602143][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 32.606560][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.609006][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 32.610922][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 32.612702][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 32.615377][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 32.617029][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.618540][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.620194][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.621777][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.623410][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.625518][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.627068][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 32.628598][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 32.633070][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 32.635438][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 32.637157][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 32.638858][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 32.647166][ T4328] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.652269][ T4329] device veth0_vlan entered promiscuous mode [ 32.655045][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 32.656717][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 32.658035][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 32.661959][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 32.663847][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 32.666544][ T4329] device veth1_vlan entered promiscuous mode [ 32.670350][ T4341] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 32.672540][ T4341] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 32.676252][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 32.677805][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 32.679349][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 32.681036][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 32.700312][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.702147][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.704111][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 32.705653][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 32.710016][ T4338] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.727465][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 32.729326][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.730948][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 32.732486][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.735726][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.739194][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.755811][ T4329] device veth0_macvtap entered promiscuous mode [ 32.757835][ T4328] device veth0_vlan entered promiscuous mode [ 32.759208][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 32.760810][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.762465][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.775308][ T4329] device veth1_macvtap entered promiscuous mode [ 32.777576][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 32.779242][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 32.780857][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 32.789450][ T4328] device veth1_vlan entered promiscuous mode [ 32.797607][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 32.799332][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 32.800931][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 32.802324][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 32.816282][ T4338] device veth0_vlan entered promiscuous mode [ 32.817976][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 32.819371][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 32.821901][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 32.824796][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.827596][ T4328] device veth0_macvtap entered promiscuous mode [ 32.831035][ T4341] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.836533][ T4329] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.839714][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 32.841307][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 32.842975][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.850331][ T4329] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.852333][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 32.853664][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 32.855011][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.856693][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 32.859787][ T4329] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.861720][ T4329] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.863200][ T4329] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.865680][ T4329] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.869159][ T4328] device veth1_macvtap entered promiscuous mode [ 32.871428][ T4338] device veth1_vlan entered promiscuous mode [ 32.883142][ T4333] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.904557][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 32.906461][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.909036][ T4328] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.912233][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 32.913986][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 32.915575][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 32.917232][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 32.918849][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 32.939469][ T4338] device veth0_macvtap entered promiscuous mode [ 32.942053][ T4338] device veth1_macvtap entered promiscuous mode [ 32.946695][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 32.948430][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 32.950063][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 32.951615][ T4328] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 32.956469][ T4328] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.958979][ T4328] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.965582][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 32.967212][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 32.969051][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 32.971013][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 32.972646][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 32.991087][ T4328] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.992617][ T4328] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.994950][ T4328] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.996385][ T4328] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.001273][ T1616] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.002555][ T1616] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.010500][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 33.012034][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.015272][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.017079][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.018673][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.023304][ T4338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.026528][ T4338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.028213][ T4338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.029878][ T4338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.032304][ T4338] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.039835][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.041634][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.043311][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 33.046028][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 33.048984][ T4338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.050862][ T4338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.052554][ T4338] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.056457][ T4338] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.058897][ T4338] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.061609][ T4333] device veth0_vlan entered promiscuous mode [ 33.063499][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.065508][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.069274][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.070642][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.076849][ T4341] device veth0_vlan entered promiscuous mode [ 33.081691][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 33.083319][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 33.085454][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.087736][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.090755][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.102642][ T4333] device veth1_vlan entered promiscuous mode [ 33.109609][ T4338] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.111121][ T4338] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.112623][ T4338] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.116209][ T4338] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.149849][ T4341] device veth1_vlan entered promiscuous mode [ 33.166574][ T1354] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.167884][ T1354] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.168653][ T4333] device veth0_macvtap entered promiscuous mode [ 33.178584][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 33.180362][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 33.181978][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 33.184424][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 33.186052][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 33.187699][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.189462][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.194067][ T4333] device veth1_macvtap entered promiscuous mode [ 33.198272][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.199927][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.539801][ T4341] device veth0_macvtap entered promiscuous mode [ 33.544672][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.546449][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.548165][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.558206][ T4333] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.560186][ T4333] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.561953][ T4333] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.564633][ T4333] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.566615][ T4333] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.568440][ T4333] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.571312][ T4333] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.575654][ T4341] device veth1_macvtap entered promiscuous mode [ 33.578962][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.580661][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.581273][ T4390] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.582365][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.583507][ T4390] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.587826][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 33.592363][ T4390] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.594699][ T4390] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.600642][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 33.610924][ T4333] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.612929][ T4333] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.615582][ T4333] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.617413][ T4333] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.619357][ T4333] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.621149][ T4333] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.625854][ T4333] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.630353][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.632272][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.636365][ T4333] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.637888][ T4333] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.639438][ T4333] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.640875][ T4333] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.643305][ T1616] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.650362][ T1616] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.655176][ T4341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.657074][ T4341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.658808][ T4341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.660604][ T4341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.662290][ T4341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.667009][ T4341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.669019][ T4341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.670919][ T4341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.673484][ T4341] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.676937][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 33.678692][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.680475][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.683396][ T4341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.688238][ T4341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.690277][ T4341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.694524][ T4341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.696109][ T4341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.697893][ T4341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.699555][ T4341] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.701444][ T4341] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.705792][ T4341] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.718679][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 33.720557][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 33.731475][ T4341] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.733091][ T4341] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.735003][ T4341] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.736559][ T4341] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.829175][ T4390] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.830769][ T4390] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.832213][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 33.848809][ T1616] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.850250][ T1616] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.861954][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 33.882339][ T1616] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.883908][ T1616] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.885294][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 33.895574][ T4390] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.897031][ T4390] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.898310][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.093926][ T4337] Bluetooth: hci3: command 0x041b tx timeout [ 34.095092][ T4337] Bluetooth: hci1: command 0x041b tx timeout [ 34.096152][ T4337] Bluetooth: hci0: command 0x041b tx timeout [ 34.097077][ T4337] Bluetooth: hci4: command 0x041b tx timeout [ 34.499883][ T4448] netlink: 'syz.3.14': attribute type 10 has an invalid length. [ 34.503181][ T4448] bridge0: port 2(bridge_slave_1) entered disabled state [ 34.504742][ T4448] bridge0: port 1(bridge_slave_0) entered disabled state [ 34.516624][ T4448] bridge0: port 2(bridge_slave_1) entered blocking state [ 34.518052][ T4448] bridge0: port 2(bridge_slave_1) entered forwarding state [ 34.519361][ T4448] bridge0: port 1(bridge_slave_0) entered blocking state [ 34.520772][ T4448] bridge0: port 1(bridge_slave_0) entered forwarding state [ 34.524415][ T4448] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 34.530345][ T4447] batman_adv: batadv0: Adding interface: dummy0 [ 34.531629][ T4447] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 34.536866][ T4447] batman_adv: batadv0: Interface activated: dummy0 [ 34.622428][ T4441] netlink: 24 bytes leftover after parsing attributes in process `syz.3.14'. [ 34.628719][ T4441] device vlan0 entered promiscuous mode [ 34.678965][ T4449] batadv0: mtu less than device minimum [ 34.685848][ T4449] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 34.689143][ T4449] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 34.692268][ T4449] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 34.695436][ T4449] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 34.698501][ T4449] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 34.701593][ T4449] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 34.704719][ T4449] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 34.707770][ T4449] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 34.710831][ T4449] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 34.757283][ T4451] typec_fusb302 0-0022: I2C/SMBus block functionality not supported! [ 34.764612][ T4451] i2c i2c-0: new_device: Instantiated device typec_fusb302 at 0x22 [ 34.967678][ T4458] usb usb1: usbfs: interface 0 claimed by hub while 'syz.3.20' sets config #0 [ 34.967822][ T4458] usb usb1: usbfs: interface 0 claimed by hub while 'syz.3.20' sets config #1 [ 35.093083][ T4463] input: syz1 as /devices/virtual/input/input2 [ 35.486745][ T4481] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 35.581765][ T4480] netlink: 'syz.1.28': attribute type 10 has an invalid length. [ 35.593146][ T4480] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.594760][ T4480] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.899375][ T4480] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.900726][ T4480] bridge0: port 2(bridge_slave_1) entered forwarding state [ 35.902492][ T4480] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.903752][ T4480] bridge0: port 1(bridge_slave_0) entered forwarding state [ 35.914183][ T4480] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 35.981280][ T4488] loop1: detected capacity change from 0 to 256 [ 35.997086][ T4488] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 36.095231][ T4334] Bluetooth: hci2: command 0x040f tx timeout [ 36.698642][ T48] Bluetooth: hci1: command 0x040f tx timeout [ 36.699946][ T4337] Bluetooth: hci4: command 0x040f tx timeout [ 36.700094][ T4334] Bluetooth: hci0: command 0x040f tx timeout [ 36.702468][ T4334] Bluetooth: hci3: command 0x040f tx timeout [ 36.780512][ T4504] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 37.978216][ T4521] usbip-vudc usbip-vudc.0: gadget not bound [ 38.223986][ T4330] Bluetooth: hci2: command 0x0419 tx timeout [ 38.734975][ T4330] Bluetooth: hci1: command 0x0419 tx timeout [ 38.736499][ T48] Bluetooth: hci4: command 0x0419 tx timeout [ 38.737659][ T4337] Bluetooth: hci3: command 0x0419 tx timeout [ 38.738897][ T4334] Bluetooth: hci0: command 0x0419 tx timeout [ 38.818012][ T4528] netlink: 'syz.4.41': attribute type 10 has an invalid length. [ 38.822260][ T4528] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.823890][ T4528] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.845254][ T4528] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.846669][ T4528] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.847990][ T4528] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.849140][ T4528] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.860412][ T4528] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 39.030434][ T4534] loop3: detected capacity change from 0 to 128 [ 39.053458][ T4534] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 39.414872][ T4333] EXT4-fs (loop3): unmounting filesystem. [ 39.993369][ T4502] net_ratelimit: 12 callbacks suppressed [ 39.993383][ T4502] Set syz1 is full, maxelem 65536 reached [ 40.072895][ T48] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 40.075434][ T48] CPU: 0 PID: 48 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 40.076848][ T48] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 40.078604][ T48] Workqueue: hci4 hci_rx_work [ 40.079464][ T48] Call trace: [ 40.080059][ T48] dump_backtrace+0x1c4/0x1f0 [ 40.080945][ T48] show_stack+0x2c/0x3c [ 40.081729][ T48] __dump_stack+0x30/0x40 [ 40.082548][ T48] dump_stack_lvl+0xf4/0x15c [ 40.083396][ T48] dump_stack+0x1c/0x5c [ 40.084107][ T48] sysfs_create_dir_ns+0x244/0x264 [ 40.084950][ T48] kobject_add_internal+0x5a8/0xb18 [ 40.085830][ T48] kobject_add+0x144/0x20c [ 40.086594][ T48] device_add+0x3dc/0xe4c [ 40.087311][ T48] hci_conn_add_sysfs+0xb8/0x1bc [ 40.088140][ T48] le_conn_complete_evt+0xd3c/0x1300 [ 40.089014][ T48] hci_le_conn_complete_evt+0x114/0x3b8 [ 40.089989][ T48] hci_le_meta_evt+0x2c0/0x4a8 [ 40.090801][ T48] hci_event_packet+0x64c/0xe60 [ 40.091652][ T48] hci_rx_work+0x320/0xa94 [ 40.092392][ T48] process_one_work+0x7e4/0x13bc [ 40.093255][ T48] worker_thread+0x8cc/0xfe8 [ 40.094050][ T48] kthread+0x254/0x2e0 [ 40.094779][ T48] ret_from_fork+0x10/0x20 [ 40.097267][ T48] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 40.099944][ T48] Bluetooth: hci4: failed to register connection device [ 40.141977][ T4557] netlink: 'syz.2.49': attribute type 4 has an invalid length. [ 40.267232][ T4563] netlink: 'syz.4.52': attribute type 10 has an invalid length. [ 40.269215][ T4563] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.270635][ T4563] bridge0: port 1(bridge_slave_0) entered disabled state [ 40.550540][ T27] audit: type=1326 audit(40.310:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4556 comm="syz.1.50" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffbcf77fe8 code=0x0 [ 40.662146][ T4570] netlink: 12 bytes leftover after parsing attributes in process `syz.4.54'. [ 40.770833][ T4513] Set syz1 is full, maxelem 65536 reached [ 40.874906][ T4579] binder: 4576:4579 tried to acquire reference to desc 0, got 1 instead [ 41.334008][ T4585] Zero length message leads to an empty skb [ 41.702581][ T4374] binder: release 4576:4579 transaction 5 out, still active [ 41.704115][ T4374] binder: undelivered TRANSACTION_COMPLETE [ 41.705161][ T4374] binder: send failed reply for transaction 12 to 4576:4579 [ 41.706628][ T4374] binder: undelivered TRANSACTION_COMPLETE [ 41.707623][ T4374] binder: undelivered TRANSACTION_ERROR: 29189 [ 41.708736][ T4374] binder: send failed reply for transaction 5, target dead [ 41.723332][ T4596] batman_adv: batadv0: Adding interface: dummy0 [ 41.725959][ T4596] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 41.731609][ T4596] batman_adv: batadv0: Interface activated: dummy0 [ 41.741034][ T4600] netlink: 'syz.0.65': attribute type 10 has an invalid length. [ 41.742787][ T4600] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.744376][ T4600] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.755184][ T4600] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.756581][ T4600] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.757895][ T4600] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.759126][ T4600] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.762129][ T4600] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 41.798489][ T4602] batadv0: mtu less than device minimum [ 41.802848][ T4602] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 41.806245][ T4602] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 41.809345][ T4602] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 41.812381][ T4602] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 41.815594][ T4602] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 41.818694][ T4602] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 41.821800][ T4602] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 41.938205][ T4612] netlink: 12 bytes leftover after parsing attributes in process `syz.0.69'. [ 42.192709][ T4620] process 'syz.2.73' launched './file1' with NULL argv: empty string added [ 43.501170][ T4630] loop2: detected capacity change from 0 to 512 [ 44.113525][ C0] sched: RT throttling activated [ 44.131779][ T4635] netlink: 'syz.4.77': attribute type 10 has an invalid length. [ 44.145017][ T4630] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 44.501887][ T4329] EXT4-fs (loop2): unmounting filesystem. [ 44.762833][ T4660] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.765089][ T4660] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.812081][ T4664] netlink: 'syz.4.91': attribute type 10 has an invalid length. [ 44.855033][ T4668] netlink: 'syz.1.93': attribute type 4 has an invalid length. [ 44.888436][ T4673] batman_adv: batadv0: Adding interface: dummy0 [ 44.891069][ T4673] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 44.897467][ T4673] batman_adv: batadv0: Interface activated: dummy0 [ 45.001168][ T4680] net_ratelimit: 12 callbacks suppressed [ 45.001180][ T4680] batadv0: mtu less than device minimum [ 45.005068][ T4680] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 45.008254][ T4680] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 45.011302][ T4680] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 45.014451][ T4680] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 45.017529][ T4680] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 45.020659][ T4680] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 45.023866][ T4680] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 45.026915][ T4680] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 45.029965][ T4680] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 45.199326][ T4334] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 45.201247][ T4334] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 45.202875][ T4334] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 45.205074][ T4334] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 45.206640][ T4334] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 45.208250][ T4334] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 45.385668][ T39] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.430855][ T4695] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.435137][ T4695] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.441799][ T4695] loop4: detected capacity change from 0 to 512 [ 45.467430][ T39] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.479744][ T4695] EXT2-fs (loop4): warning: feature flags set on rev 0 fs, running e2fsck is recommended [ 45.574824][ T39] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.580073][ T4690] chnl_net:caif_netlink_parms(): no params data found [ 45.666725][ T39] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.674849][ T4690] bridge0: port 1(bridge_slave_0) entered blocking state [ 45.676309][ T4690] bridge0: port 1(bridge_slave_0) entered disabled state [ 45.678093][ T4690] device bridge_slave_0 entered promiscuous mode [ 45.682122][ T4690] bridge0: port 2(bridge_slave_1) entered blocking state [ 45.687645][ T4690] bridge0: port 2(bridge_slave_1) entered disabled state [ 45.689810][ T4690] device bridge_slave_1 entered promiscuous mode [ 45.699881][ T4690] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 45.714311][ T4690] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 45.805629][ T4690] team0: Port device team_slave_0 added [ 45.807765][ T4690] team0: Port device team_slave_1 added [ 45.817830][ T4690] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 45.819138][ T4690] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 45.823990][ T4690] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 45.826729][ T4690] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 45.828032][ T4690] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 45.832448][ T4690] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 45.884861][ T4690] device hsr_slave_0 entered promiscuous mode [ 45.954216][ T4690] device hsr_slave_1 entered promiscuous mode [ 45.993729][ T4690] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 45.995262][ T4690] Cannot create hsr debugfs directory [ 46.207849][ T4745] netlink: 'syz.3.122': attribute type 4 has an invalid length. [ 46.509617][ T4761] batman_adv: batadv0: Adding interface: dummy0 [ 46.510850][ T4761] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 46.518103][ T4761] batman_adv: batadv0: Interface activated: dummy0 [ 47.313790][ T4334] Bluetooth: hci0: command 0x0409 tx timeout [ 47.626099][ T4805] netlink: 'syz.2.135': attribute type 4 has an invalid length. [ 47.678807][ T4690] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 47.714696][ T4690] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 47.859860][ T4810] device bond1 entered promiscuous mode [ 47.861035][ T4810] 8021q: adding VLAN 0 to HW filter on device bond1 [ 47.875288][ T4690] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 47.930854][ T4820] binder: 4819:4820 tried to acquire reference to desc 0, got 1 instead [ 47.934363][ T4820] binder: 4819:4820 got reply transaction with bad transaction stack, transaction 17 has target 4819:0 [ 47.936603][ T4820] binder: 4819:4820 transaction reply to 0:0 failed 25/29201/-71, size 0-0 line 2978 [ 47.947098][ T4410] binder: release 4819:4820 transaction 17 out, still active [ 47.949017][ T4410] binder: undelivered TRANSACTION_COMPLETE [ 47.950240][ T4410] binder: undelivered TRANSACTION_ERROR: 29201 [ 47.951469][ T4410] binder: send failed reply for transaction 24 to 4819:4820 [ 47.952951][ T4410] binder: undelivered TRANSACTION_COMPLETE [ 47.954958][ T4410] binder: undelivered TRANSACTION_ERROR: 29189 [ 47.958648][ T4410] binder: send failed reply for transaction 17, target dead [ 47.969569][ T4826] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 47.971414][ T4826] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.200890][ T4811] bond1: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 48.202996][ T4811] bond1: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 48.205513][ T4811] bond1: (slave ipvlan2): Error -95 calling set_mac_address [ 48.209303][ T4690] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 48.236752][ T4832] 9pnet_fd: Insufficient options for proto=fd [ 48.365553][ T4835] netlink: 'syz.3.148': attribute type 4 has an invalid length. [ 48.377815][ T4690] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.383232][ T4391] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 48.385709][ T4391] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.390068][ T4690] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.467971][ T4844] netlink: 'syz.3.152': attribute type 10 has an invalid length. [ 48.475238][ T4844] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.476591][ T4844] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.660107][ T4851] binder: 4850:4851 tried to acquire reference to desc 0, got 1 instead [ 48.663231][ T4851] binder: 4850:4851 got reply transaction with bad transaction stack, transaction 30 has target 4850:0 [ 48.669416][ T4851] binder: 4850:4851 transaction reply to 0:0 failed 38/29201/-71, size 0-0 line 2978 [ 48.679375][ T14] binder: release 4850:4851 transaction 30 out, still active [ 49.373644][ T48] Bluetooth: hci0: command 0x041b tx timeout [ 49.443092][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 49.445053][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 49.446618][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.447862][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.449238][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 49.451336][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 49.457959][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.459325][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.460989][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 49.462950][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 49.466049][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 49.467996][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 49.470530][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 49.480089][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 49.485220][ T4391] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 49.487001][ T4391] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 49.491278][ T4690] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 49.493086][ T4690] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 49.544374][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 49.546219][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 49.548121][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 49.549745][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 49.551756][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 49.589356][ T39] device hsr_slave_0 left promiscuous mode [ 49.660935][ T4877] 9pnet_fd: Insufficient options for proto=fd [ 49.668202][ T39] device hsr_slave_1 left promiscuous mode [ 49.746325][ T39] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 49.747823][ T39] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 49.749808][ T39] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 49.751029][ T39] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 49.754977][ T39] device bridge_slave_1 left promiscuous mode [ 49.756683][ T39] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.797669][ T39] device bridge_slave_0 left promiscuous mode [ 49.798919][ T39] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.966759][ T39] device veth1_macvtap left promiscuous mode [ 49.968033][ T39] device veth0_macvtap left promiscuous mode [ 49.969111][ T39] device veth1_vlan left promiscuous mode [ 49.970173][ T39] device veth0_vlan left promiscuous mode [ 51.191244][ T4917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.197880][ T4917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.453665][ T48] Bluetooth: hci0: command 0x040f tx timeout [ 52.306428][ T39] team0 (unregistering): Port device team_slave_1 removed [ 52.494460][ T39] team0 (unregistering): Port device team_slave_0 removed [ 52.716969][ T39] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 52.935830][ T39] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 53.696569][ T48] Bluetooth: hci0: command 0x0419 tx timeout [ 54.884958][ T39] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 54.934308][ T39] bond0 (unregistering): Released all slaves [ 55.248032][ T4500] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 55.249550][ T4500] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 55.277083][ T4690] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 55.283818][ T5015] device syzkaller0 entered promiscuous mode [ 55.501832][ T4500] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 55.509829][ T4500] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 55.656789][ T4690] device veth0_vlan entered promiscuous mode [ 55.659863][ T4514] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 55.661735][ T4514] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 55.663494][ T4514] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 55.677179][ T4514] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 55.818755][ T4690] device veth1_vlan entered promiscuous mode [ 55.830372][ T4475] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 55.832133][ T4475] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 55.837768][ T4475] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 55.839680][ T4475] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 55.844432][ T4690] device veth0_macvtap entered promiscuous mode [ 55.847808][ T4690] device veth1_macvtap entered promiscuous mode [ 55.857298][ T4690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.859259][ T4690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.860929][ T4690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.862715][ T4690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.866230][ T4690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.868851][ T4690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.870554][ T4690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 55.872422][ T4690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.886679][ T4690] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 55.888679][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 55.890652][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 55.892407][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 55.898596][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 55.901969][ T4690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.932371][ T4690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.947666][ T4690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.953234][ T4690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.962710][ T4690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.967109][ T4690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.970210][ T4690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 55.978519][ T4690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 55.989030][ T4690] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 55.993106][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 55.997403][ T1616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 56.018736][ T4690] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.022653][ T4690] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.026186][ T4690] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.030922][ T4690] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 56.125367][ T1616] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.127022][ T1616] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.129444][ T4500] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 56.130842][ T4500] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 56.132792][ T4500] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 56.138043][ T4500] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 56.249038][ T27] audit: type=1326 audit(56.180:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5032 comm="syz.2.227" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffb2177fe8 code=0x0 [ 56.504229][ T5050] netlink: 'syz.1.232': attribute type 1 has an invalid length. [ 56.514561][ T5050] device bond1 entered promiscuous mode [ 56.515780][ T5050] 8021q: adding VLAN 0 to HW filter on device bond1 [ 56.537700][ T5050] bond1: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 56.552889][ T5050] bond1: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 56.582008][ T5050] bond1: (slave ipvlan2): Error -95 calling set_mac_address [ 56.602054][ T5055] binder: 5054:5055 tried to acquire reference to desc 0, got 1 instead [ 56.618625][ T5053] device syzkaller0 entered promiscuous mode [ 56.621324][ T5055] binder: 5054:5055 got reply transaction with bad transaction stack, transaction 43 has target 5054:0 [ 56.623387][ T5055] binder_debug: 6 callbacks suppressed [ 56.623399][ T5055] binder: 5054:5055 transaction reply to 0:0 failed 51/29201/-71, size 0-0 line 2978 [ 56.672562][ T24] binder: release 5054:5055 transaction 43 out, still active [ 56.676088][ T24] binder: undelivered TRANSACTION_COMPLETE [ 56.677251][ T24] binder: undelivered TRANSACTION_ERROR: 29201 [ 56.678381][ T24] binder: send failed reply for transaction 50 to 5054:5055 [ 56.679913][ T24] binder: undelivered TRANSACTION_COMPLETE [ 56.680977][ T24] binder: undelivered TRANSACTION_ERROR: 29189 [ 56.683112][ T24] binder: send failed reply for transaction 43, target dead [ 57.255495][ T5077] netlink: 'syz.2.243': attribute type 4 has an invalid length. [ 58.078180][ T5093] binder: 5092:5093 tried to acquire reference to desc 0, got 1 instead [ 58.085992][ T5093] binder: 5092:5093 got reply transaction with bad transaction stack, transaction 56 has target 5092:0 [ 58.088097][ T5093] binder: 5092:5093 transaction reply to 0:0 failed 64/29201/-71, size 0-0 line 2978 [ 58.096634][ T4410] binder: release 5092:5093 transaction 56 out, still active [ 58.276828][ T5110] netlink: 'syz.4.255': attribute type 4 has an invalid length. [ 58.302880][ T5114] net_ratelimit: 30 callbacks suppressed [ 58.302892][ T5114] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: c0:00:00:00:b2:be [ 58.327842][ T5116] binder: 5115:5116 tried to acquire reference to desc 0, got 1 instead [ 58.331854][ T5116] binder: 5115:5116 got reply transaction with bad transaction stack, transaction 69 has target 5115:0 [ 59.247308][ T5156] netlink: 'syz.0.271': attribute type 1 has an invalid length. [ 59.251307][ T5157] binder: 5154:5157 tried to acquire reference to desc 0, got 1 instead [ 59.262950][ T5157] binder: 5154:5157 got reply transaction with bad transaction stack, transaction 82 has target 5154:0 [ 59.272412][ T5156] bridge0: port 3(ipvlan2) entered blocking state [ 59.274027][ T5156] bridge0: port 3(ipvlan2) entered disabled state [ 60.161931][ T5183] device syzkaller0 entered promiscuous mode [ 60.206449][ T5187] binder: 5185:5187 tried to acquire reference to desc 0, got 1 instead [ 60.241032][ T5187] binder: 5185:5187 got reply transaction with bad transaction stack, transaction 95 has target 5185:0 [ 61.079458][ T5204] netlink: 'syz.1.289': attribute type 4 has an invalid length. [ 62.297695][ T5252] binder_user_error: 2 callbacks suppressed [ 62.297704][ T5252] binder: 5250:5252 tried to acquire reference to desc 0, got 1 instead [ 62.313509][ T5252] binder: 5250:5252 got reply transaction with bad transaction stack, transaction 121 has target 5250:0 [ 62.316480][ T5252] binder_debug: 38 callbacks suppressed [ 62.316494][ T5252] binder: 5250:5252 transaction reply to 0:0 failed 129/29201/-71, size 0-0 line 2978 [ 62.345550][ T4497] binder: release 5250:5252 transaction 128 out, still active [ 62.348151][ T4497] binder: undelivered TRANSACTION_COMPLETE [ 62.349666][ T4497] binder: send failed reply for transaction 121 to 5250:5252 [ 62.351247][ T4497] binder: undelivered TRANSACTION_COMPLETE [ 62.352413][ T4497] binder: undelivered TRANSACTION_ERROR: 29201 [ 62.355962][ T4497] binder: undelivered TRANSACTION_ERROR: 29189 [ 62.357255][ T4497] binder: send failed reply for transaction 128, target dead [ 62.382312][ T5259] tipc: Started in network mode [ 62.386092][ T5259] tipc: Node identity ac141441, cluster identity 4711 [ 62.396686][ T5259] tipc: Enabled bearer , priority 10 [ 63.626530][ T4497] tipc: Node number set to 2886997057 [ 63.705797][ T5292] binder: 5291:5292 tried to acquire reference to desc 0, got 1 instead [ 63.724442][ T5292] binder: 5291:5292 got reply transaction with bad transaction stack, transaction 134 has target 5291:0 [ 63.733720][ T5292] binder: 5291:5292 transaction reply to 0:0 failed 142/29201/-71, size 0-0 line 2978 [ 63.751913][ T4376] binder: release 5291:5292 transaction 134 out, still active [ 63.796797][ T5302] syz.1.328 uses obsolete (PF_INET,SOCK_PACKET) [ 63.853109][ T4376] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 63.860066][ T4376] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 64.414600][ T5323] netlink: 'syz.0.336': attribute type 4 has an invalid length. [ 64.545107][ T2065] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.548048][ T2065] ieee802154 phy1 wpan1: encryption failed: -22 [ 64.828213][ T5341] device syzkaller0 entered promiscuous mode [ 65.716704][ T5358] device syzkaller0 entered promiscuous mode [ 65.852792][ T5364] netlink: 'syz.2.352': attribute type 4 has an invalid length. [ 66.105359][ T5388] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: c0:00:00:00:b2:be [ 66.207547][ T5394] netlink: 'syz.4.366': attribute type 4 has an invalid length. [ 66.336182][ T5402] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 66.393361][ T5403] netlink: 4 bytes leftover after parsing attributes in process `syz.0.364'. [ 66.395430][ T5403] netlink: 4 bytes leftover after parsing attributes in process `syz.0.364'. [ 66.397117][ T5403] netlink: 4 bytes leftover after parsing attributes in process `syz.0.364'. [ 66.398823][ T5403] netlink: 4 bytes leftover after parsing attributes in process `syz.0.364'. [ 66.400638][ T5403] netlink: 4 bytes leftover after parsing attributes in process `syz.0.364'. [ 66.402341][ T5403] netlink: 4 bytes leftover after parsing attributes in process `syz.0.364'. [ 66.403888][ T5403] netlink: 4 bytes leftover after parsing attributes in process `syz.0.364'. [ 66.405660][ T5403] netlink: 4 bytes leftover after parsing attributes in process `syz.0.364'. [ 66.407280][ T5403] netlink: 4 bytes leftover after parsing attributes in process `syz.0.364'. [ 66.409053][ T5403] netlink: 4 bytes leftover after parsing attributes in process `syz.0.364'. [ 66.507444][ T5406] device syzkaller0 entered promiscuous mode [ 66.900044][ T5426] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: c0:00:00:00:b2:be [ 67.002123][ T5430] 9pnet_fd: Insufficient options for proto=fd [ 67.057446][ T5435] UDC core: g1: couldn't find an available UDC or it's busy [ 67.648771][ T5455] device syzkaller0 entered promiscuous mode [ 67.931913][ T5465] batman_adv: batadv0: Adding interface: dummy0 [ 67.933128][ T5465] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.957816][ T5465] batman_adv: batadv0: Interface activated: dummy0 [ 67.975497][ T5465] batadv0: mtu less than device minimum [ 67.978485][ T5465] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 67.981749][ T5465] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 67.984909][ T5465] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 67.988100][ T5465] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 67.991153][ T5465] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 67.994295][ T5465] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 67.999561][ T5470] UDC core: g1: couldn't find an available UDC or it's busy [ 68.233196][ T5479] 9pnet_fd: Insufficient options for proto=fd [ 68.403344][ T5485] device syzkaller0 entered promiscuous mode [ 69.061247][ T5500] UDC core: g1: couldn't find an available UDC or it's busy [ 69.201895][ T5516] device syzkaller0 entered promiscuous mode [ 69.438774][ T5527] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 69.440654][ T5527] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 69.442810][ T5527] udc dummy_udc.0: failed to start g1: -22 [ 69.444714][ T5527] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 69.448088][ T5527] UDC core: g1: couldn't find an available UDC or it's busy [ 69.615289][ T1516] cfg80211: failed to load regulatory.db [ 69.836556][ T5547] UDC core: g1: couldn't find an available UDC or it's busy [ 70.011687][ T5554] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 70.013007][ T5554] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 70.027349][ T5554] udc dummy_udc.0: failed to start g1: -22 [ 70.028384][ T5554] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 70.041912][ T5554] UDC core: g1: couldn't find an available UDC or it's busy [ 70.121770][ T5556] device syzkaller0 entered promiscuous mode [ 71.075040][ T5582] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 71.076521][ T5582] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 71.078236][ T5582] udc dummy_udc.0: failed to start g1: -22 [ 71.079654][ T5582] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 71.081378][ T5582] UDC core: g1: couldn't find an available UDC or it's busy [ 71.257780][ T5592] UDC core: g1: couldn't find an available UDC or it's busy [ 71.303884][ T1516] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 71.332421][ T1516] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz0 [ 71.386134][ T5596] fido_id[5596]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 71.523287][ T5615] netlink: 'syz.3.456': attribute type 10 has an invalid length. [ 71.607704][ T5618] UDC core: g1: couldn't find an available UDC or it's busy [ 71.756084][ T14] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 71.758529][ T14] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 72.268833][ T5647] UDC core: g1: couldn't find an available UDC or it's busy [ 72.575596][ T1516] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 72.577541][ T1516] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 72.616665][ T5665] fido_id[5665]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 72.706891][ T5675] UDC core: g1: couldn't find an available UDC or it's busy [ 72.752557][ T5679] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 72.755158][ T5679] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 72.756784][ T5679] udc dummy_udc.0: failed to start g1: -22 [ 72.757871][ T5679] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 72.760831][ T5679] UDC core: g1: couldn't find an available UDC or it's busy [ 73.632976][ T4497] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 73.635778][ T4497] hid-generic 0000:0000:0000.0005: hidraw0: HID v0.00 Device [syz1] on syz0 [ 73.720031][ T5702] tmpfs: Unknown parameter 'usrquota' [ 73.767424][ T5707] UDC core: g1: couldn't find an available UDC or it's busy [ 73.785436][ T5709] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 73.786907][ T5709] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 73.789641][ T5709] udc dummy_udc.0: failed to start g1: -22 [ 73.790762][ T5709] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 73.797147][ T5709] UDC core: g1: couldn't find an available UDC or it's busy [ 74.260253][ T14] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 74.263477][ T14] hid-generic 0000:0000:0000.0006: hidraw0: HID v0.00 Device [syz1] on syz0 [ 74.344588][ T5742] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 74.346270][ T5742] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 74.348249][ T5742] udc dummy_udc.0: failed to start g1: -22 [ 74.349764][ T5742] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 74.357045][ T5740] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 74.359227][ T5742] UDC core: g1: couldn't find an available UDC or it's busy [ 74.362329][ T5740] batman_adv: batadv0: Interface deactivated: dummy0 [ 74.368704][ T5740] batman_adv: batadv0: Removing interface: dummy0 [ 74.376641][ T5740] IPv6: ADDRCONF(NETDEV_CHANGE): dummy0: link becomes ready [ 74.382822][ T5740] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 74.389413][ T5740] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 74.391575][ T5740] device bridge_slave_0 left promiscuous mode [ 74.393232][ T5740] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.399913][ T5744] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 74.401348][ T5744] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 74.402948][ T5744] udc dummy_udc.0: failed to start g1: -22 [ 74.406294][ T5744] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 74.408003][ T5744] UDC core: g1: couldn't find an available UDC or it's busy [ 74.445423][ T5740] device bridge_slave_1 left promiscuous mode [ 74.446744][ T5740] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.525970][ T5740] bond0: (slave bond_slave_0): Releasing backup interface [ 74.865010][ T5740] bond0: (slave bond_slave_1): Releasing backup interface [ 75.024398][ T5740] team0: Port device team_slave_0 removed [ 75.039952][ T5740] team0: Port device team_slave_1 removed [ 75.044704][ T5740] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 75.049314][ T5740] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 75.053417][ T5740] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 75.059231][ T5740] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 75.071080][ T5745] netlink: 'syz.2.503': attribute type 10 has an invalid length. [ 75.425613][ T5745] team0: Port device netdevsim0 added [ 75.475993][ T5770] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 75.478473][ T5770] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 75.489650][ T5770] udc dummy_udc.0: failed to start g1: -22 [ 75.533879][ T5770] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 75.538747][ T5770] UDC core: g1: couldn't find an available UDC or it's busy [ 75.592313][ T5777] UDC core: g1: couldn't find an available UDC or it's busy [ 77.043032][ T5807] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 77.385647][ T5807] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 77.387949][ T5807] udc dummy_udc.0: failed to start g1: -22 [ 77.390555][ T5807] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 77.398538][ T5807] UDC core: g1: couldn't find an available UDC or it's busy [ 77.655569][ T5793] net_ratelimit: 13 callbacks suppressed [ 77.655581][ T5793] Set syz1 is full, maxelem 65536 reached [ 78.406220][ T5829] netlink: 'syz.3.534': attribute type 5 has an invalid length. [ 78.531826][ T5833] device syzkaller0 entered promiscuous mode [ 79.042145][ T5848] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 79.043469][ T5848] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 79.045036][ T5848] udc dummy_udc.0: failed to start g1: -22 [ 79.045962][ T5848] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 79.048678][ T5848] UDC core: g1: couldn't find an available UDC or it's busy [ 79.451552][ T4864] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 79.454761][ T4864] hid-generic 0000:0000:0000.0007: hidraw0: HID v0.00 Device [syz1] on syz0 [ 79.525798][ T5857] __nla_validate_parse: 97 callbacks suppressed [ 79.525812][ T5857] netlink: 4 bytes leftover after parsing attributes in process `syz.0.544'. [ 79.528584][ T5857] netlink: 4 bytes leftover after parsing attributes in process `syz.0.544'. [ 79.530047][ T5857] netlink: 4 bytes leftover after parsing attributes in process `syz.0.544'. [ 79.531538][ T5857] netlink: 4 bytes leftover after parsing attributes in process `syz.0.544'. [ 79.532976][ T5857] netlink: 4 bytes leftover after parsing attributes in process `syz.0.544'. [ 79.534714][ T5857] netlink: 4 bytes leftover after parsing attributes in process `syz.0.544'. [ 79.536383][ T5857] netlink: 4 bytes leftover after parsing attributes in process `syz.0.544'. [ 79.537815][ T5857] netlink: 4 bytes leftover after parsing attributes in process `syz.0.544'. [ 79.539329][ T5857] netlink: 4 bytes leftover after parsing attributes in process `syz.0.544'. [ 79.540790][ T5857] netlink: 4 bytes leftover after parsing attributes in process `syz.0.544'. [ 79.558984][ T5868] fido_id[5868]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 79.626045][ T5865] device syzkaller0 entered promiscuous mode [ 80.055769][ T5886] device syzkaller0 entered promiscuous mode [ 80.747978][ T5904] netlink: 'syz.0.558': attribute type 10 has an invalid length. [ 80.751897][ T5904] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.753926][ T5904] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.755511][ T5906] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 80.778951][ T5904] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.780401][ T5904] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.782298][ T5904] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.783471][ T5904] bridge0: port 1(bridge_slave_0) entered forwarding state [ 80.797528][ T5904] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 80.894607][ T5916] device syzkaller0 entered promiscuous mode [ 81.327359][ T5925] device syzkaller0 entered promiscuous mode [ 81.522262][ T5937] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 81.621298][ T5939] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 81.735885][ T5941] netlink: 'syz.0.572': attribute type 10 has an invalid length. [ 81.738771][ T5941] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.740167][ T5941] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.431840][ T5956] device syzkaller0 entered promiscuous mode [ 82.513996][ T5962] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 82.571974][ T5966] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 83.506484][ T5994] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 83.534562][ T5996] device syzkaller0 entered promiscuous mode [ 83.677240][ T6002] device syzkaller0 entered promiscuous mode [ 83.857273][ T6010] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 83.991579][ T6015] device syzkaller0 entered promiscuous mode [ 84.287382][ T6028] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 84.649772][ T6032] device syzkaller0 entered promiscuous mode [ 84.698898][ T6035] __nla_validate_parse: 44 callbacks suppressed [ 84.698917][ T6035] netlink: 28 bytes leftover after parsing attributes in process `syz.2.608'. [ 84.820220][ T6041] device syzkaller0 entered promiscuous mode [ 85.029471][ T6044] netlink: 36 bytes leftover after parsing attributes in process `syz.2.612'. [ 85.920243][ T6064] device syzkaller0 entered promiscuous mode [ 85.996722][ T6068] batman_adv: batadv0: Local translation table size (128) exceeds maximum packet size (-320); Ignoring new local tt entry: c0:00:00:00:b2:be [ 86.089123][ T6072] device syzkaller0 entered promiscuous mode [ 86.254961][ T6081] netlink: 'syz.0.626': attribute type 10 has an invalid length. [ 86.439764][ T6092] device syzkaller0 entered promiscuous mode [ 86.491871][ T6097] batman_adv: batadv0: Local translation table size (116) exceeds maximum packet size (-320); Ignoring new local tt entry: c0:00:00:00:b2:be [ 87.315809][ T6121] device syzkaller0 entered promiscuous mode [ 87.507755][ T6124] netlink: 'syz.1.642': attribute type 10 has an invalid length. [ 87.509731][ T6124] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.511268][ T6124] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.682472][ T6134] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 88.490443][ T6151] device syzkaller0 entered promiscuous mode [ 88.736084][ T6155] netlink: 'syz.0.654': attribute type 10 has an invalid length. [ 88.753155][ T6155] team0: Port device netdevsim0 added [ 88.757100][ T6154] bond0: (slave bridge0): Releasing backup interface [ 88.786541][ T6154] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 88.788348][ T6154] batman_adv: batadv0: Interface deactivated: dummy0 [ 88.794931][ T6154] batman_adv: batadv0: Removing interface: dummy0 [ 88.800396][ T6154] IPv6: ADDRCONF(NETDEV_CHANGE): dummy0: link becomes ready [ 88.802340][ T6154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 88.806087][ T6154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 88.811029][ T3901] hid-generic 0000:0000:0000.0008: unknown main item tag 0x0 [ 88.815123][ T3901] hid-generic 0000:0000:0000.0008: hidraw0: HID v0.00 Device [syz1] on syz0 [ 88.819839][ T6154] device bridge_slave_0 left promiscuous mode [ 88.834287][ T6154] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.850095][ T6161] fido_id[6161]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 88.895235][ T6154] device bridge_slave_1 left promiscuous mode [ 88.896415][ T6154] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.950632][ T6154] bond0: (slave bond_slave_0): Releasing backup interface [ 88.993266][ T6154] bond0: (slave bond_slave_1): Releasing backup interface [ 89.068107][ T6154] team0: Port device team_slave_0 removed [ 89.093163][ T6154] team0: Port device team_slave_1 removed [ 89.101054][ T6154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 89.109930][ T6154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 89.116894][ T6154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 89.122874][ T6154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 89.159349][ T6154] team0: Port device netdevsim0 removed [ 89.215931][ T6163] device syzkaller0 entered promiscuous mode [ 89.520462][ T6182] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 89.926591][ T6193] using random self ethernet address [ 89.927566][ T6193] using random host ethernet address [ 89.951572][ T6194] netlink: 'syz.2.665': attribute type 4 has an invalid length. [ 89.965884][ T6196] device syzkaller0 entered promiscuous mode [ 89.989772][ T4497] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 89.992786][ T4497] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.00 Device [syz1] on syz0 [ 90.020942][ T6203] fido_id[6203]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 90.185139][ T6209] device syzkaller0 entered promiscuous mode [ 90.231901][ T6217] file system registered [ 90.249670][ T6217] read descriptors [ 90.271385][ T6221] netlink: 'syz.4.675': attribute type 10 has an invalid length. [ 90.273026][ T4329] ffs_data_put(): freeing [ 91.336835][ T6259] device syzkaller0 entered promiscuous mode [ 91.351472][ T6255] device syzkaller0 entered promiscuous mode [ 91.590957][ T6267] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 91.646481][ T6265] netlink: 'syz.1.690': attribute type 10 has an invalid length. [ 92.632603][ T6300] device syzkaller0 entered promiscuous mode [ 92.768442][ T6305] netlink: 4 bytes leftover after parsing attributes in process `syz.3.703'. [ 92.770130][ T6305] netlink: 4 bytes leftover after parsing attributes in process `syz.3.703'. [ 92.771854][ T6305] netlink: 4 bytes leftover after parsing attributes in process `syz.3.703'. [ 92.773452][ T6305] netlink: 4 bytes leftover after parsing attributes in process `syz.3.703'. [ 92.775161][ T6305] netlink: 4 bytes leftover after parsing attributes in process `syz.3.703'. [ 92.776622][ T6305] netlink: 4 bytes leftover after parsing attributes in process `syz.3.703'. [ 92.778062][ T6305] netlink: 4 bytes leftover after parsing attributes in process `syz.3.703'. [ 92.779427][ T6305] netlink: 4 bytes leftover after parsing attributes in process `syz.3.703'. [ 92.780792][ T6305] netlink: 4 bytes leftover after parsing attributes in process `syz.3.703'. [ 92.782180][ T6305] netlink: 4 bytes leftover after parsing attributes in process `syz.3.703'. [ 92.790059][ T6307] device syzkaller0 entered promiscuous mode [ 93.831054][ T6336] device syzkaller0 entered promiscuous mode [ 93.957711][ T6343] device syzkaller0 entered promiscuous mode [ 95.101834][ T6377] device syzkaller0 entered promiscuous mode [ 95.109341][ T6379] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 95.316436][ T6392] netlink: 'syz.0.741': attribute type 10 has an invalid length. [ 95.330436][ T6392] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 95.342472][ T6395] device syzkaller0 entered promiscuous mode [ 96.099109][ T6424] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 96.409161][ T6434] device syzkaller0 entered promiscuous mode [ 97.633312][ T6468] netlink: 'syz.4.770': attribute type 4 has an invalid length. [ 98.331483][ T6491] device syzkaller0 entered promiscuous mode [ 99.152825][ T6504] netlink: 'syz.2.782': attribute type 4 has an invalid length. [ 99.748926][ T6532] device syzkaller0 entered promiscuous mode [ 111.322936][ T6538] __nla_validate_parse: 44 callbacks suppressed [ 111.322953][ T6538] netlink: 24 bytes leftover after parsing attributes in process `syz.3.796'. [ 111.333898][ T6550] netlink: 4 bytes leftover after parsing attributes in process `syz.2.800'. [ 111.335431][ T6550] netlink: 4 bytes leftover after parsing attributes in process `syz.2.800'. [ 111.336863][ T6550] netlink: 4 bytes leftover after parsing attributes in process `syz.2.800'. [ 111.338396][ T6550] netlink: 4 bytes leftover after parsing attributes in process `syz.2.800'. [ 111.339931][ T6550] netlink: 4 bytes leftover after parsing attributes in process `syz.2.800'. [ 111.341362][ T6550] netlink: 4 bytes leftover after parsing attributes in process `syz.2.800'. [ 111.342795][ T6550] netlink: 4 bytes leftover after parsing attributes in process `syz.2.800'. [ 111.344413][ T6550] netlink: 4 bytes leftover after parsing attributes in process `syz.2.800'. [ 111.345822][ T6550] netlink: 4 bytes leftover after parsing attributes in process `syz.2.800'. [ 111.347878][ T6561] netlink: 'syz.0.803': attribute type 4 has an invalid length. [ 111.507866][ T6605] netlink: 'syz.1.812': attribute type 10 has an invalid length. [ 111.897579][ T6612] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 111.926477][ T6617] netlink: 'syz.2.817': attribute type 4 has an invalid length. [ 112.384916][ T6628] device syzkaller0 entered promiscuous mode [ 112.727544][ T6636] i2c i2c-0: new_device: Missing parameters [ 112.769009][ T6639] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 114.039573][ T6658] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 123.789488][ T6643] device syzkaller0 entered promiscuous mode [ 123.827844][ T6649] netlink: 'syz.3.828': attribute type 10 has an invalid length. [ 123.935686][ T6670] i2c i2c-0: new_device: Missing parameters [ 124.322924][ T6680] netlink: 'syz.1.839': attribute type 4 has an invalid length. [ 124.324682][ T6678] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 124.359708][ T6685] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 124.762751][ T6691] netlink: 'syz.3.843': attribute type 1 has an invalid length. [ 124.772053][ T6691] device bond1 entered promiscuous mode [ 124.773336][ T6691] 8021q: adding VLAN 0 to HW filter on device bond1 [ 124.804200][ T6694] device syzkaller0 entered promiscuous mode [ 125.786538][ T6719] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 125.822397][ T6721] i2c i2c-0: Invalid 7-bit I2C address 0x00 [ 125.934759][ T2065] ieee802154 phy0 wpan0: encryption failed: -22 [ 125.936014][ T2065] ieee802154 phy1 wpan1: encryption failed: -22 [ 126.260777][ T6727] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 136.180052][ T6746] netlink: 'syz.0.860': attribute type 10 has an invalid length. [ 136.287263][ T6755] i2c i2c-0: Invalid 7-bit I2C address 0x00 [ 136.297884][ T6758] netlink: 'syz.3.865': attribute type 1 has an invalid length. [ 136.304147][ T6756] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 136.314488][ T6758] device bond2 entered promiscuous mode [ 136.316129][ T6758] 8021q: adding VLAN 0 to HW filter on device bond2 [ 136.639134][ T6766] __nla_validate_parse: 97 callbacks suppressed [ 136.639144][ T6766] netlink: 36 bytes leftover after parsing attributes in process `syz.2.867'. [ 136.740441][ T6783] netlink: 'syz.3.875': attribute type 10 has an invalid length. [ 136.778164][ T6785] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 136.779904][ T6787] batman_adv: batadv0: Interface deactivated: dummy0 [ 136.781209][ T6787] batman_adv: batadv0: Removing interface: dummy0 [ 136.818101][ T6790] syz.0.878 sent an empty control message without MSG_MORE. [ 136.851349][ T6793] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 136.882691][ T6798] netlink: 'syz.0.882': attribute type 1 has an invalid length. [ 136.891209][ T6798] device bond1 entered promiscuous mode [ 136.892921][ T6798] 8021q: adding VLAN 0 to HW filter on device bond1 [ 136.980519][ T6812] netlink: 'syz.3.888': attribute type 10 has an invalid length. [ 136.993430][ T6816] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 137.132299][ T6824] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 137.156452][ T6829] netlink: 'syz.2.896': attribute type 1 has an invalid length. [ 137.161908][ T6829] device bond1 entered promiscuous mode [ 137.166797][ T6829] 8021q: adding VLAN 0 to HW filter on device bond1 [ 137.296138][ T6846] i2c i2c-0: Failed to register i2c client typec_fusb302 at 0x22 (-16) [ 137.312622][ T6848] netlink: 'syz.3.904': attribute type 10 has an invalid length. [ 137.959066][ T3901] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0 [ 137.963685][ T3901] hid-generic 0000:0000:0000.000A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 137.996602][ T6870] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 138.012039][ T6871] fido_id[6871]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 138.160514][ T6884] netlink: 'syz.0.918': attribute type 10 has an invalid length. [ 138.396315][ T6903] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 139.361204][ T6919] netlink: 'syz.1.932': attribute type 10 has an invalid length. [ 139.926063][ T6925] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 140.099597][ T6941] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 140.500523][ T6955] netlink: 'syz.1.945': attribute type 10 has an invalid length. [ 140.555191][ T6959] batman_adv: batadv0: Interface deactivated: dummy0 [ 140.556788][ T6959] batman_adv: batadv0: Removing interface: dummy0 [ 141.134551][ T6976] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 142.080702][ T7008] udevd[7008]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 142.397154][ T4475] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 142.514156][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 142.516452][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 142.517974][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 142.519797][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 142.521564][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 142.522823][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 142.527927][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 142.529333][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 142.530857][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 142.532481][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 142.534468][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 142.535789][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 142.598461][ T4475] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 142.704667][ T4475] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 142.805626][ T4475] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 142.822007][ T7032] netlink: 'syz.1.976': attribute type 4 has an invalid length. [ 142.887460][ T7015] chnl_net:caif_netlink_parms(): no params data found [ 143.000349][ T7015] bridge0: port 1(bridge_slave_0) entered blocking state [ 143.001649][ T7015] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.003206][ T7015] device bridge_slave_0 entered promiscuous mode [ 143.009475][ T7015] bridge0: port 2(bridge_slave_1) entered blocking state [ 143.010671][ T7015] bridge0: port 2(bridge_slave_1) entered disabled state [ 143.021474][ T7015] device bridge_slave_1 entered promiscuous mode [ 143.090768][ T7015] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 143.114228][ T7015] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 143.139799][ T7015] team0: Port device team_slave_0 added [ 143.151276][ T7015] team0: Port device team_slave_1 added [ 143.171280][ T4475] tipc: Disabling bearer [ 143.173151][ T4475] tipc: Left network mode [ 143.177203][ T7015] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 143.178393][ T7015] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 143.190762][ T7015] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 143.202138][ T7015] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 143.203318][ T7015] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 143.373815][ T7015] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 143.575582][ T7015] device hsr_slave_0 entered promiscuous mode [ 143.613959][ T7015] device hsr_slave_1 entered promiscuous mode [ 143.653770][ T7015] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 143.655885][ T7015] Cannot create hsr debugfs directory [ 143.840671][ T7089] netlink: 'syz.2.989': attribute type 4 has an invalid length. [ 144.230186][ T7128] netlink: 'syz.3.1001': attribute type 4 has an invalid length. [ 145.037526][ T7015] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 145.065425][ T7015] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 145.299799][ T7015] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 145.326112][ T7192] netlink: 'syz.3.1015': attribute type 4 has an invalid length. [ 145.358537][ T7015] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 146.067141][ T7015] 8021q: adding VLAN 0 to HW filter on device bond0 [ 146.132819][ T4500] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 146.134669][ T4500] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 146.138867][ T4475] device hsr_slave_0 left promiscuous mode [ 146.164132][ T4475] device hsr_slave_1 left promiscuous mode [ 146.313827][ T4475] device veth1_macvtap left promiscuous mode [ 146.315140][ T4475] device veth0_macvtap left promiscuous mode [ 146.316189][ T4475] device veth1_vlan left promiscuous mode [ 146.317190][ T4475] device veth0_vlan left promiscuous mode [ 147.164713][ T4475] bond1 (unregistering): Released all slaves [ 151.715460][ T4475] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 151.784500][ T4475] bond0 (unregistering): Released all slaves [ 152.077914][ T7015] 8021q: adding VLAN 0 to HW filter on device team0 [ 152.083890][ T7264] netlink: 'syz.2.1033': attribute type 4 has an invalid length. [ 152.091642][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 152.093420][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 152.095703][ T1354] bridge0: port 1(bridge_slave_0) entered blocking state [ 152.096970][ T1354] bridge0: port 1(bridge_slave_0) entered forwarding state [ 152.100198][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 152.105566][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 152.108330][ T1354] bridge0: port 2(bridge_slave_1) entered blocking state [ 152.109596][ T1354] bridge0: port 2(bridge_slave_1) entered forwarding state [ 152.121202][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 152.126456][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 152.140662][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 152.151889][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 152.217545][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 152.219280][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 152.220905][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 152.222601][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 152.242092][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 152.248848][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 152.253949][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 152.257579][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 152.264572][ T7015] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 152.836287][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 152.839441][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 152.847278][ T7015] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 153.185377][ T4500] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 153.187348][ T4500] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 153.219639][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 153.221693][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 153.223459][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 153.229080][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 153.240938][ T7015] device veth0_vlan entered promiscuous mode [ 153.248091][ T7015] device veth1_vlan entered promiscuous mode [ 153.287399][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 153.290394][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 153.302510][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 153.309648][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 153.314616][ T7015] device veth0_macvtap entered promiscuous mode [ 153.323770][ T7015] device veth1_macvtap entered promiscuous mode [ 153.344048][ T7015] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 153.345901][ T7015] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 153.361816][ T7015] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 153.367201][ T7015] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 153.368995][ T7015] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 153.370622][ T7015] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 153.373394][ T7015] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 153.378848][ T7015] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 153.380676][ T7015] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 153.382233][ T7015] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 153.385349][ T7015] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 153.387678][ T7015] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 153.389492][ T7015] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 153.397063][ T7015] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 153.398431][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 153.400271][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 153.401954][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 153.404162][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 153.407207][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 153.411304][ T1354] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 153.413705][ T7361] device syzkaller0 entered promiscuous mode [ 153.428134][ T7015] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 153.432543][ T7015] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 153.434998][ T7015] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 153.436532][ T7015] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 153.550187][ T7367] netlink: 'syz.1.1062': attribute type 4 has an invalid length. [ 153.570197][ T4500] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 153.571551][ T4500] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 153.582332][ T4581] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 153.610636][ T4581] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 153.612702][ T4500] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 153.614137][ T4334] Bluetooth: hci1: command 0x0406 tx timeout [ 153.615142][ T4334] Bluetooth: hci2: command 0x0406 tx timeout [ 153.616339][ T48] Bluetooth: hci3: command 0x0406 tx timeout [ 153.617431][ T4330] Bluetooth: hci4: command 0x0406 tx timeout [ 153.619287][ T4500] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 154.285181][ T7397] netlink: 'syz.2.1072': attribute type 1 has an invalid length. [ 154.290845][ T7397] device bond2 entered promiscuous mode [ 154.292247][ T7397] 8021q: adding VLAN 0 to HW filter on device bond2 [ 154.299963][ T7397] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1072'. [ 154.500806][ T7402] netlink: 'syz.3.1074': attribute type 4 has an invalid length. [ 154.529240][ T7404] device syzkaller0 entered promiscuous mode [ 154.806629][ T7420] device syzkaller0 entered promiscuous mode [ 155.108835][ T7429] netlink: 'syz.4.1086': attribute type 4 has an invalid length. [ 156.042578][ T7452] udevd[7452]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 157.205667][ T7460] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 157.206880][ T7460] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 157.210236][ T7460] Bluetooth: hci1: Suspend notifier action (1) failed: -4 [ 157.211495][ T7460] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 157.212551][ T7460] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 157.215167][ T7460] Bluetooth: hci2: Suspend notifier action (1) failed: -4 [ 157.216552][ T7460] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 157.217625][ T7460] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 157.219054][ T7460] Bluetooth: hci3: Suspend notifier action (1) failed: -4 [ 157.220356][ T7460] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 157.221366][ T7460] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 157.224108][ T7460] Bluetooth: hci4: Suspend notifier action (1) failed: -4 [ 157.990813][ T7499] device syzkaller0 entered promiscuous mode [ 158.096476][ T7501] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 159.239499][ T7531] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 159.293608][ T4334] Bluetooth: hci4: command 0x0c1a tx timeout [ 159.294889][ T48] Bluetooth: hci3: command 0x0c1a tx timeout [ 159.295914][ T48] Bluetooth: hci2: command 0x0c1a tx timeout [ 159.314666][ T4330] Bluetooth: hci1: command 0x0c1a tx timeout [ 159.528971][ T7549] device syzkaller0 entered promiscuous mode [ 160.959244][ T7577] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 161.383743][ T4330] Bluetooth: hci2: command 0x0406 tx timeout [ 161.385065][ T4334] Bluetooth: hci1: command 0x0406 tx timeout [ 161.386332][ T4330] Bluetooth: hci4: command 0x0406 tx timeout [ 161.387516][ T4334] Bluetooth: hci3: command 0x0406 tx timeout [ 163.362013][ T7607] device syzkaller0 entered promiscuous mode [ 163.614231][ T7627] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 166.827139][ T7667] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 169.324663][ T7720] read descriptors [ 169.342801][ T4329] ffs_data_put(): freeing [ 169.607609][ T7735] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1186'. [ 169.609584][ T7735] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 169.610961][ T7735] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 169.622050][ T7735] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 169.623418][ T7735] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 173.108182][ T7810] netlink: 'syz.1.1209': attribute type 10 has an invalid length. [ 173.138589][ T7812] netlink: 'syz.3.1210': attribute type 1 has an invalid length. [ 173.146103][ T7812] device bond3 entered promiscuous mode [ 173.147461][ T7812] 8021q: adding VLAN 0 to HW filter on device bond3 [ 173.152992][ T7812] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1210'. [ 175.347823][ T7863] netlink: 'syz.3.1222': attribute type 1 has an invalid length. [ 175.353249][ T7863] device bond4 entered promiscuous mode [ 175.357140][ T7863] 8021q: adding VLAN 0 to HW filter on device bond4 [ 175.361339][ T7863] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1222'. [ 176.536106][ T7876] netlink: 'syz.3.1228': attribute type 10 has an invalid length. [ 177.925236][ T7380] udevd[7380]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 178.755221][ T7913] netlink: 'syz.2.1234': attribute type 4 has an invalid length. [ 178.919057][ T7920] No source specified [ 179.869981][ T7928] device syzkaller0 entered promiscuous mode [ 180.791948][ T7953] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 183.449986][ T8007] netlink: 'syz.1.1259': attribute type 10 has an invalid length. [ 183.551579][ T8010] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 183.983762][ T8028] device syzkaller0 entered promiscuous mode [ 185.417656][ T8047] netlink: 'syz.0.1268': attribute type 4 has an invalid length. [ 185.431783][ T8052] netlink: 'syz.2.1271': attribute type 1 has an invalid length. [ 185.439533][ T8052] device bond3 entered promiscuous mode [ 185.445645][ T8052] 8021q: adding VLAN 0 to HW filter on device bond3 [ 185.828693][ T8065] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 187.379590][ T2065] ieee802154 phy0 wpan0: encryption failed: -22 [ 187.386108][ T2065] ieee802154 phy1 wpan1: encryption failed: -22 [ 187.984585][ T8102] netlink: 'syz.4.1283': attribute type 4 has an invalid length. [ 188.005209][ T8105] netlink: 'syz.4.1284': attribute type 1 has an invalid length. [ 188.011040][ T8105] device bond2 entered promiscuous mode [ 188.012272][ T8105] 8021q: adding VLAN 0 to HW filter on device bond2 [ 188.118945][ T8114] netlink: 'syz.3.1287': attribute type 10 has an invalid length. [ 190.613746][ T8149] netlink: 'syz.3.1296': attribute type 1 has an invalid length. [ 190.620254][ T8149] device bond5 entered promiscuous mode [ 190.621562][ T8149] 8021q: adding VLAN 0 to HW filter on device bond5 [ 190.626576][ T8148] netlink: 'syz.2.1295': attribute type 4 has an invalid length. [ 190.647373][ T8153] device syzkaller0 entered promiscuous mode [ 190.920836][ T8160] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 192.194443][ T8189] netlink: 'syz.3.1308': attribute type 1 has an invalid length. [ 192.298268][ T8189] device bond6 entered promiscuous mode [ 192.299414][ T8189] 8021q: adding VLAN 0 to HW filter on device bond6 [ 192.301200][ T8195] netlink: 'syz.1.1309': attribute type 4 has an invalid length. [ 192.314221][ T8196] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1308'. [ 193.016869][ T8203] device syzkaller0 entered promiscuous mode [ 193.525508][ T8217] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 193.686140][ T8222] binder: 8221:8222 unknown command 1074553619 [ 193.687242][ T8222] binder: 8221:8222 ioctl c0306201 20000040 returned -22 [ 193.689750][ T8222] binder: 8221:8222 unknown command 1074553620 [ 193.697185][ T8222] binder: 8221:8222 ioctl c0306201 20000640 returned -22 [ 193.760699][ T8222] binder: 8221:8222 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 193.764300][ T8222] binder: 8222 RLIMIT_NICE not set [ 193.765372][ T8222] binder: 8221:8222 ioctl c0306201 200001c0 returned -11 [ 195.431360][ T8260] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 195.518010][ T8264] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 196.884454][ T8300] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 196.919773][ T8305] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 198.564511][ T8335] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 200.303727][ T8363] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 200.482389][ T8370] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1366'. [ 201.960012][ T8415] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 202.038474][ T8421] gadgetfs: bound to dummy_udc driver [ 202.064402][ T4333] ffs_data_put(): freeing [ 202.306235][ T8443] netlink: 'syz.3.1393': attribute type 4 has an invalid length. [ 202.975344][ T7015] ffs_data_put(): freeing [ 203.031195][ T8467] gadgetfs: bound to dummy_udc driver [ 204.095869][ T8492] configfs-gadget.g1 gadget.1: uvc: uvc_function_bind() [ 204.259905][ T4329] ffs_data_put(): freeing [ 204.377647][ T8499] configfs-gadget.g1 gadget.1: uvc: uvc_function_unbind() [ 205.002571][ T7380] udevd[7380]: inotify_add_watch(7, /dev/loop0, 10) failed: No such file or directory [ 207.551910][ T8591] se_dev->se_dev_ptr already set for storage object [ 207.584770][ T8593] se_dev->se_dev_ptr already set for storage object [ 207.617960][ T8595] se_dev->se_dev_ptr already set for storage object [ 207.642279][ T8597] netlink: 'syz.0.1436': attribute type 10 has an invalid length. [ 207.645426][ T8597] bridge0: port 2(bridge_slave_1) entered disabled state [ 207.646857][ T8597] bridge0: port 1(bridge_slave_0) entered disabled state [ 207.660021][ T8597] bridge0: port 2(bridge_slave_1) entered blocking state [ 207.661439][ T8597] bridge0: port 2(bridge_slave_1) entered forwarding state [ 207.662727][ T8597] bridge0: port 1(bridge_slave_0) entered blocking state [ 207.664023][ T8597] bridge0: port 1(bridge_slave_0) entered forwarding state [ 207.666892][ T8597] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 207.748456][ T8605] se_dev->se_dev_ptr already set for storage object [ 207.782043][ T8609] se_dev->se_dev_ptr already set for storage object [ 208.319728][ T8630] se_dev->se_dev_ptr already set for storage object [ 208.341618][ T8632] se_dev->se_dev_ptr already set for storage object [ 208.383306][ T8634] se_dev->se_dev_ptr already set for storage object [ 208.422837][ T8637] netlink: 'syz.1.1449': attribute type 10 has an invalid length. [ 208.504992][ T8639] se_dev->se_dev_ptr already set for storage object [ 208.553931][ T8641] se_dev->se_dev_ptr already set for storage object [ 210.277293][ T8680] netlink: 'syz.3.1461': attribute type 10 has an invalid length. [ 211.952374][ T8726] netlink: 'syz.0.1475': attribute type 10 has an invalid length. [ 211.958732][ T8726] bridge0: port 2(bridge_slave_1) entered disabled state [ 211.960346][ T8726] bridge0: port 1(bridge_slave_0) entered disabled state [ 214.033886][ T8761] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 214.440897][ T8786] read descriptors [ 214.460229][ T4341] ffs_data_put(): freeing [ 216.281920][ T8823] se_dev->se_dev_ptr already set for storage object [ 216.302982][ T8826] read descriptors [ 216.321408][ T4338] ffs_data_put(): freeing [ 216.357105][ T8830] se_dev->se_dev_ptr already set for storage object [ 216.431123][ T8839] binder: 8838:8839 unknown command 1074553619 [ 216.432371][ T8839] binder: 8838:8839 ioctl c0306201 20000040 returned -22 [ 217.389142][ T8853] read descriptors [ 217.408263][ T4338] ffs_data_put(): freeing [ 217.641843][ T8858] se_dev->se_dev_ptr already set for storage object [ 217.759247][ T8871] se_dev->se_dev_ptr already set for storage object [ 218.104247][ T8879] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1524'. [ 219.122023][ T8890] se_dev->se_dev_ptr already set for storage object [ 219.158057][ T8894] se_dev->se_dev_ptr already set for storage object [ 219.386114][ T8908] se_dev->se_dev_ptr already set for storage object [ 221.890407][ T8932] se_dev->se_dev_ptr already set for storage object [ 221.940485][ T8934] se_dev->se_dev_ptr already set for storage object [ 222.076422][ T8952] device syzkaller0 entered promiscuous mode [ 223.205275][ T8966] se_dev->se_dev_ptr already set for storage object [ 223.475555][ T8969] se_dev->se_dev_ptr already set for storage object [ 223.502772][ T8971] se_dev->se_dev_ptr already set for storage object [ 224.611317][ T9005] se_dev->se_dev_ptr already set for storage object [ 224.615059][ T9004] se_dev->se_dev_ptr already set for storage object [ 225.110046][ T9011] se_dev->se_dev_ptr already set for storage object [ 226.187351][ T9022] se_dev->se_dev_ptr already set for storage object [ 226.191319][ T9024] device syzkaller0 entered promiscuous mode [ 226.691713][ T9038] bridge0: port 3(syz_tun) entered blocking state [ 226.700848][ T9038] bridge0: port 3(syz_tun) entered disabled state [ 226.710870][ T9038] device syz_tun entered promiscuous mode [ 226.722634][ T9039] se_dev->se_dev_ptr already set for storage object [ 227.316316][ T9049] se_dev->se_dev_ptr already set for storage object [ 227.520459][ T9057] se_dev->se_dev_ptr already set for storage object [ 227.564529][ T9060] se_dev->se_dev_ptr already set for storage object [ 227.652028][ T9068] se_dev->se_dev_ptr already set for storage object [ 228.506789][ T9077] se_dev->se_dev_ptr already set for storage object [ 229.182411][ T9093] se_dev->se_dev_ptr already set for storage object [ 229.620114][ T9111] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1604'. [ 229.776074][ T9118] se_dev->se_dev_ptr already set for storage object [ 230.043394][ T9116] se_dev->se_dev_ptr already set for storage object [ 230.059558][ T9121] se_dev->se_dev_ptr already set for storage object [ 230.088923][ T9123] se_dev->se_dev_ptr already set for storage object [ 230.190946][ T9129] se_dev->se_dev_ptr already set for storage object [ 231.045030][ T9139] se_dev->se_dev_ptr already set for storage object [ 231.188204][ T9148] se_dev->se_dev_ptr already set for storage object [ 231.301021][ T9150] se_dev->se_dev_ptr already set for storage object [ 231.425190][ T9164] device syzkaller0 entered promiscuous mode [ 231.763398][ T9171] se_dev->se_dev_ptr already set for storage object [ 231.816136][ T9179] binder: 9178:9179 unknown command 1074553619 [ 231.817291][ T9179] binder: 9178:9179 ioctl c0306201 20000040 returned -22 [ 231.869608][ T9187] se_dev->se_dev_ptr already set for storage object [ 231.898206][ T9189] bridge0: port 1(syz_tun) entered blocking state [ 231.899466][ T9189] bridge0: port 1(syz_tun) entered disabled state [ 231.902038][ T9189] device syz_tun entered promiscuous mode [ 231.908270][ T9189] bridge0: port 1(syz_tun) entered blocking state [ 231.909752][ T9189] bridge0: port 1(syz_tun) entered forwarding state [ 233.096107][ T9219] se_dev->se_dev_ptr already set for storage object [ 233.157972][ T9222] device syzkaller0 entered promiscuous mode [ 233.685147][ T9240] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 233.760925][ T9249] se_dev->se_dev_ptr already set for storage object [ 234.560381][ T9257] se_dev->se_dev_ptr already set for storage object [ 234.670216][ T9263] device syzkaller0 entered promiscuous mode [ 234.960747][ T9283] se_dev->se_dev_ptr already set for storage object [ 235.826216][ T9297] se_dev->se_dev_ptr already set for storage object [ 235.864099][ T9299] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 236.924489][ T9321] device syzkaller0 entered promiscuous mode [ 236.927871][ T9323] netlink: 'syz.2.1688': attribute type 4 has an invalid length. [ 236.977938][ T9327] binder: 9325:9327 ioctl c0306201 0 returned -14 [ 237.011819][ T9328] se_dev->se_dev_ptr already set for storage object [ 237.100057][ T9330] bond0: (slave bridge0): Releasing backup interface [ 237.201515][ T9330] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 237.446162][ T9330] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 237.447513][ T9330] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 237.449382][ T9330] device bridge_slave_0 left promiscuous mode [ 237.450407][ T9330] bridge0: port 1(bridge_slave_0) entered disabled state [ 237.475199][ T9330] device bridge_slave_1 left promiscuous mode [ 237.476418][ T9330] bridge0: port 2(bridge_slave_1) entered disabled state [ 237.496161][ T9345] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 237.516270][ T9330] bond0: (slave bond_slave_0): Releasing backup interface [ 237.548213][ T9330] bond0: (slave bond_slave_1): Releasing backup interface [ 237.647445][ T9330] team0: Port device team_slave_0 removed [ 237.653757][ T9330] team0: Port device team_slave_1 removed [ 237.656599][ T9330] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 237.658260][ T9330] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 237.660137][ T9330] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 237.661408][ T9330] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 237.664789][ T9330] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 237.666587][ T9330] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 237.678998][ T9342] bond1: (slave ip6gretap1): making interface the new active one [ 237.688118][ T9342] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 237.718706][ T9364] binder: 9363:9364 ioctl c0306201 0 returned -14 [ 237.839778][ T9373] device syzkaller0 entered promiscuous mode [ 238.821823][ T9386] se_dev->se_dev_ptr already set for storage object [ 238.898510][ T9390] binder: 9389:9390 ioctl c0306201 0 returned -14 [ 239.354473][ T9409] device syzkaller0 entered promiscuous mode [ 240.319964][ T9421] se_dev->se_dev_ptr already set for storage object [ 240.600865][ T9440] se_dev->se_dev_ptr already set for storage object [ 240.697169][ T9452] device syzkaller0 entered promiscuous mode [ 240.967594][ T9468] se_dev->se_dev_ptr already set for storage object [ 242.463919][ T9476] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 242.465104][ T9476] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 242.466135][ T9476] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 242.467224][ T9476] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 242.468884][ T9476] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 243.208851][ T9476] Bluetooth: hci4: Suspend notifier action (1) failed: -4 [ 243.446214][ T9510] device syzkaller0 entered promiscuous mode [ 244.503697][ T48] Bluetooth: hci1: command 0x0c1a tx timeout [ 244.504996][ T4330] Bluetooth: hci4: command 0x0c1a tx timeout [ 244.506009][ T4337] Bluetooth: hci2: command 0x0c1a tx timeout [ 244.507198][ T4334] Bluetooth: hci3: command 0x0c1a tx timeout [ 245.985920][ T9537] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 245.987757][ T9537] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 245.988879][ T9537] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 245.990003][ T9537] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 246.159605][ T9554] device syzkaller0 entered promiscuous mode [ 246.215862][ T9564] device syzkaller0 entered promiscuous mode [ 247.445617][ T9598] device syzkaller0 entered promiscuous mode [ 248.013693][ T48] Bluetooth: hci4: command 0x0c1a tx timeout [ 248.014928][ T48] Bluetooth: hci3: command 0x0c1a tx timeout [ 248.016011][ T48] Bluetooth: hci2: command 0x0c1a tx timeout [ 248.017322][ T4336] Bluetooth: hci1: command 0x0c1a tx timeout [ 248.827078][ T2065] ieee802154 phy0 wpan0: encryption failed: -22 [ 248.832653][ T2065] ieee802154 phy1 wpan1: encryption failed: -22 [ 249.202552][ T9659] se_dev->se_dev_ptr already set for storage object [ 249.529454][ T9678] se_dev->se_dev_ptr already set for storage object [ 250.085872][ T9691] se_dev->se_dev_ptr already set for storage object [ 251.233306][ T9712] se_dev->se_dev_ptr already set for storage object [ 251.395134][ T9720] device syzkaller0 entered promiscuous mode [ 251.436370][ T9722] se_dev->se_dev_ptr already set for storage object [ 251.534478][ T9724] se_dev->se_dev_ptr already set for storage object [ 252.444392][ T9745] se_dev->se_dev_ptr already set for storage object [ 252.494729][ T9752] se_dev->se_dev_ptr already set for storage object [ 252.516746][ T9755] se_dev->se_dev_ptr already set for storage object [ 252.634692][ T9763] device syzkaller0 entered promiscuous mode [ 253.261214][ T9784] se_dev->se_dev_ptr already set for storage object [ 253.675244][ T9808] device syzkaller0 entered promiscuous mode [ 253.809707][ T9816] se_dev->se_dev_ptr already set for storage object [ 254.422560][ T9828] configfs-gadget.g1 gadget.1: uvc: uvc_function_bind() [ 254.456291][ T9831] device syzkaller0 entered promiscuous mode [ 254.489553][ T9828] configfs-gadget.g1 gadget.1: uvc: uvc_function_unbind() [ 254.871087][ T9864] se_dev->se_dev_ptr already set for storage object [ 265.496182][ T9893] netlink: 'syz.1.1911': attribute type 4 has an invalid length. [ 265.523167][ T9898] se_dev->se_dev_ptr already set for storage object [ 265.841443][ T9916] infiniband syz2: set down [ 265.842461][ T9916] infiniband syz2: added ipvlan0 [ 266.150912][ T9916] RDS/IB: syz2: added [ 266.152707][ T9916] smc: adding ib device syz2 with port count 1 [ 266.153923][ T9916] smc: ib device syz2 port 1 has pnetid [ 267.152534][ T9912] device syzkaller0 entered promiscuous mode [ 267.434947][ T9947] se_dev->se_dev_ptr already set for storage object [ 278.100435][ T9942] netlink: 'syz.1.1928': attribute type 4 has an invalid length. [ 278.249333][ T9975] configfs-gadget.g1 gadget.1: uvc: uvc_function_bind() [ 278.286051][ T9975] configfs-gadget.g1 gadget.1: uvc: uvc_function_unbind() [ 278.401312][ T9978] udevd[9978]: error opening ATTR{/sys/devices/platform/usbip-vudc.0/gadget.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 279.049548][T10000] using random self ethernet address [ 279.050681][T10000] using random host ethernet address [ 279.227172][T10011] se_dev->se_dev_ptr already set for storage object [ 279.556054][T10019] device syzkaller0 entered promiscuous mode [ 279.583228][T10019] tipc: Started in network mode [ 279.584739][T10019] tipc: Node identity 4e3d16f44c4d, cluster identity 4711 [ 279.586162][T10019] tipc: Enabled bearer , priority 0 [ 280.495379][T10062] se_dev->se_dev_ptr already set for storage object [ 290.833882][T10025] tipc: Resetting bearer [ 290.836867][T10018] tipc: Resetting bearer [ 290.874581][T10018] tipc: Disabling bearer [ 290.925618][ T4378] tipc: Node number set to 40900340 [ 290.991894][T10087] configfs-gadget.g1 gadget.1: uvc: uvc_function_bind() [ 292.884959][T10087] usb0: HOST MAC 86:93:de:f0:ce:e3 [ 292.884995][T10087] usb0: MAC f2:a3:43:ba:d5:90 [ 293.141636][T10097] wlan0 speed is unknown, defaulting to 1000 [ 293.141682][T10097] wlan0 speed is unknown, defaulting to 1000 [ 293.142215][T10097] wlan0 speed is unknown, defaulting to 1000 [ 293.143385][T10097] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 293.145151][T10097] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 293.153616][T10097] wlan0 speed is unknown, defaulting to 1000 [ 293.155097][T10097] wlan0 speed is unknown, defaulting to 1000 [ 293.156436][T10097] wlan0 speed is unknown, defaulting to 1000 [ 293.157529][T10097] wlan0 speed is unknown, defaulting to 1000 [ 293.158518][T10097] wlan0 speed is unknown, defaulting to 1000 [ 293.222604][T10097] smc: removing ib device syz2 [ 293.325061][T10096] udevd[10096]: setting owner of /dev/dsp3 to uid=0, gid=29 failed: No such file or directory [ 293.341144][T10095] configfs-gadget.g1 gadget.1: uvc: uvc_function_unbind() [ 293.518184][T10101] udevd[10101]: error opening ATTR{/sys/devices/platform/usbip-vudc.0/gadget.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 293.712281][T10132] configfs-gadget.g1 gadget.1: uvc: uvc_function_bind() [ 293.785671][T10136] configfs-gadget.g1 gadget.1: uvc: uvc_function_unbind() [ 294.165823][T10158] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 294.188034][T10102] udevd[10102]: error opening ATTR{/sys/devices/platform/usbip-vudc.0/gadget.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 294.242897][T10165] configfs-gadget.g1 gadget.1: uvc: uvc_function_bind() [ 294.287502][T10165] configfs-gadget.g1 gadget.1: uvc: uvc_function_unbind() [ 294.356646][T10100] udevd[10100]: error opening ATTR{/sys/devices/platform/usbip-vudc.0/gadget.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 294.453965][T10189] configfs-gadget.g1 gadget.1: uvc: uvc_function_bind() [ 294.482081][T10189] configfs-gadget.g1 gadget.1: uvc: uvc_function_unbind() [ 294.517346][T10104] udevd[10104]: error opening ATTR{/sys/devices/platform/usbip-vudc.0/gadget.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 295.037268][T10216] configfs-gadget.g1 gadget.1: uvc: uvc_function_bind() [ 295.089980][T10216] configfs-gadget.g1 gadget.1: uvc: uvc_function_unbind() [ 295.142148][T10096] udevd[10096]: error opening ATTR{/sys/devices/platform/usbip-vudc.0/gadget.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 295.716850][T10259] configfs-gadget.g1 gadget.1: uvc: uvc_function_bind() [ 295.719287][T10257] ip6_tunnel: non-ECT from fe80:0000:0000:0000:0000:0000:0000:00bb with DS=0x1b [ 295.747158][T10259] configfs-gadget.g1 gadget.1: uvc: uvc_function_unbind() [ 295.765917][T10096] udevd[10096]: error opening ATTR{/sys/devices/platform/usbip-vudc.0/gadget.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 295.899996][T10282] configfs-gadget.g1 gadget.0: uvc: uvc_function_bind() [ 295.903947][T10282] configfs-gadget.g1 gadget.0: uvc: Unable to allocate streaming EP [ 295.907700][T10282] ================================================================== [ 295.909133][T10282] BUG: KASAN: slab-out-of-bounds in dummy_free_request+0x44/0x84 [ 295.910629][T10282] Read of size 8 at addr ffff0000d7c465f0 by task syz.0.2035/10282 [ 295.912157][T10282] [ 295.912642][T10282] CPU: 1 PID: 10282 Comm: syz.0.2035 Not tainted syzkaller #0 [ 295.913977][T10282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 295.915745][T10282] Call trace: [ 295.916314][T10282] dump_backtrace+0x1c4/0x1f0 [ 295.917110][T10282] show_stack+0x2c/0x3c [ 295.917793][T10282] __dump_stack+0x30/0x40 [ 295.918549][T10282] dump_stack_lvl+0xf4/0x15c [ 295.919505][T10282] print_address_description+0x88/0x218 [ 295.920688][T10282] print_report+0x50/0x68 [ 295.921609][T10282] kasan_report+0xa8/0xfc [ 295.922507][T10282] __asan_report_load8_noabort+0x2c/0x38 [ 295.923649][T10282] dummy_free_request+0x44/0x84 [ 295.924553][T10282] usb_ep_free_request+0x138/0x34c [ 295.925503][T10282] uvc_function_bind+0x8b0/0xfe8 [ 295.926403][T10282] usb_add_function+0x234/0x7a8 [ 295.927283][T10282] configfs_composite_bind+0x7e0/0xce4 [ 295.928328][T10282] gadget_bind_driver+0x26c/0x684 [ 295.929190][T10282] really_probe+0x3a0/0xac4 [ 295.930032][T10282] __driver_probe_device+0x1c8/0x368 [ 295.930948][T10282] driver_probe_device+0x78/0x324 [ 295.931783][T10282] __driver_attach+0x3bc/0x614 [ 295.932590][T10282] bus_for_each_dev+0x148/0x1d0 [ 295.933436][T10282] driver_attach+0x50/0x60 [ 295.934153][T10282] bus_add_driver+0x2c0/0x518 [ 295.934897][T10282] driver_register+0x200/0x37c [ 295.935682][T10282] usb_gadget_register_driver_owner+0xf0/0x25c [ 295.936716][T10282] gadget_dev_desc_UDC_store+0x168/0x268 [ 295.937657][T10282] configfs_write_iter+0x260/0x338 [ 295.938534][T10282] vfs_write+0x3c8/0x7c8 [ 295.939235][T10282] ksys_write+0x12c/0x228 [ 295.939984][T10282] __arm64_sys_write+0x7c/0x90 [ 295.940808][T10282] invoke_syscall+0x98/0x290 [ 295.941587][T10282] el0_svc_common+0x13c/0x258 [ 295.942392][T10282] do_el0_svc+0x5c/0x134 [ 295.943105][T10282] el0_svc+0x58/0x128 [ 295.943790][T10282] el0t_64_sync_handler+0x84/0xf0 [ 295.944658][T10282] el0t_64_sync+0x18c/0x190 [ 295.945427][T10282] [ 295.945823][T10282] Allocated by task 10259: [ 295.946564][T10282] kasan_set_track+0x4c/0x80 [ 295.947350][T10282] kasan_save_alloc_info+0x24/0x30 [ 295.948199][T10282] __kasan_kmalloc+0xa0/0xb8 [ 295.948975][T10282] __kmalloc+0xd8/0x180 [ 295.949685][T10282] usb_gstrings_attach+0xb8/0x694 [ 295.950569][T10282] configfs_composite_bind+0x350/0xce4 [ 295.951503][T10282] gadget_bind_driver+0x26c/0x684 [ 295.952361][T10282] really_probe+0x3a0/0xac4 [ 295.953114][T10282] __driver_probe_device+0x1c8/0x368 [ 295.954028][T10282] driver_probe_device+0x78/0x324 [ 295.954864][T10282] __driver_attach+0x3bc/0x614 [ 295.955692][T10282] bus_for_each_dev+0x148/0x1d0 [ 295.956546][T10282] driver_attach+0x50/0x60 [ 295.957316][T10282] bus_add_driver+0x2c0/0x518 [ 295.958107][T10282] driver_register+0x200/0x37c [ 295.958952][T10282] usb_gadget_register_driver_owner+0xf0/0x25c [ 295.959992][T10282] gadget_dev_desc_UDC_store+0x168/0x268 [ 295.960948][T10282] configfs_write_iter+0x260/0x338 [ 295.961844][T10282] vfs_write+0x3c8/0x7c8 [ 295.962588][T10282] ksys_write+0x12c/0x228 [ 295.963339][T10282] __arm64_sys_write+0x7c/0x90 [ 295.964125][T10282] invoke_syscall+0x98/0x290 [ 295.964918][T10282] el0_svc_common+0x13c/0x258 [ 295.965744][T10282] do_el0_svc+0x5c/0x134 [ 295.966463][T10282] el0_svc+0x58/0x128 [ 295.967147][T10282] el0t_64_sync_handler+0x84/0xf0 [ 295.968002][T10282] el0t_64_sync+0x18c/0x190 [ 295.968754][T10282] [ 295.969148][T10282] Freed by task 10259: [ 295.969838][T10282] kasan_set_track+0x4c/0x80 [ 295.970660][T10282] kasan_save_free_info+0x38/0x5c [ 295.971523][T10282] ____kasan_slab_free+0x148/0x1b0 [ 295.972347][T10282] __kasan_slab_free+0x18/0x28 [ 295.973111][T10282] slab_free_freelist_hook+0x16c/0x1e8 [ 295.974009][T10282] __kmem_cache_free+0xbc/0x21c [ 295.974816][T10282] kfree+0xd0/0x1a8 [ 295.975427][T10282] composite_dev_cleanup+0x120/0x564 [ 295.976283][T10282] configfs_composite_unbind+0xa4/0x198 [ 295.977189][T10282] gadget_unbind_driver+0x188/0x35c [ 295.978052][T10282] device_release_driver_internal+0x3d4/0x6e4 [ 295.979003][T10282] driver_detach+0x1e8/0x2ac [ 295.979803][T10282] bus_remove_driver+0x120/0x240 [ 295.980618][T10282] driver_unregister+0x78/0xac [ 295.981406][T10282] usb_gadget_unregister_driver+0x50/0x78 [ 295.982360][T10282] gadget_dev_desc_UDC_store+0x124/0x268 [ 295.983306][T10282] configfs_write_iter+0x260/0x338 [ 295.984164][T10282] vfs_write+0x3c8/0x7c8 [ 295.984862][T10282] ksys_write+0x12c/0x228 [ 295.985599][T10282] __arm64_sys_write+0x7c/0x90 [ 295.986417][T10282] invoke_syscall+0x98/0x290 [ 295.987219][T10282] el0_svc_common+0x13c/0x258 [ 295.988033][T10282] do_el0_svc+0x5c/0x134 [ 295.988794][T10282] el0_svc+0x58/0x128 [ 295.989516][T10282] el0t_64_sync_handler+0x84/0xf0 [ 295.990413][T10282] el0t_64_sync+0x18c/0x190 [ 295.991230][T10282] [ 295.991643][T10282] Last potentially related work creation: [ 295.992593][T10282] kasan_save_stack+0x40/0x70 [ 295.993385][T10282] __kasan_record_aux_stack+0xc0/0xdc [ 295.994293][T10282] kasan_record_aux_stack_noalloc+0x14/0x20 [ 295.995257][T10282] kvfree_call_rcu+0xb4/0x6f0 [ 295.996001][T10282] kernfs_unlink_open_file+0x370/0x41c [ 295.996875][T10282] kernfs_fop_release+0x128/0x194 [ 295.997665][T10282] __fput+0x1b4/0x7b0 [ 295.998358][T10282] ____fput+0x20/0x30 [ 295.999059][T10282] task_work_run+0x1f4/0x280 [ 295.999839][T10282] do_notify_resume+0x20f8/0x2c84 [ 296.000704][T10282] el0_svc+0x98/0x128 [ 296.001478][T10282] el0t_64_sync_handler+0x84/0xf0 [ 296.002347][T10282] el0t_64_sync+0x18c/0x190 [ 296.003127][T10282] [ 296.003506][T10282] Second to last potentially related work creation: [ 296.004608][T10282] kasan_save_stack+0x40/0x70 [ 296.005391][T10282] __kasan_record_aux_stack+0xc0/0xdc [ 296.006280][T10282] kasan_record_aux_stack_noalloc+0x14/0x20 [ 296.007305][T10282] kvfree_call_rcu+0xb4/0x6f0 [ 296.008065][T10282] dev_addr_flush+0x144/0x1e0 [ 296.008861][T10282] free_netdev+0x1b0/0x428 [ 296.009621][T10282] netdev_run_todo+0xbac/0xd60 [ 296.010441][T10282] rtnl_unlock+0x14/0x20 [ 296.011167][T10282] tun_chr_close+0x148/0x1f4 [ 296.011938][T10282] __fput+0x1b4/0x7b0 [ 296.012595][T10282] ____fput+0x20/0x30 [ 296.013226][T10282] task_work_run+0x1f4/0x280 [ 296.013941][T10282] do_notify_resume+0x20f8/0x2c84 [ 296.014789][T10282] el0_svc+0x98/0x128 [ 296.015473][T10282] el0t_64_sync_handler+0x84/0xf0 [ 296.016331][T10282] el0t_64_sync+0x18c/0x190 [ 296.017062][T10282] [ 296.017452][T10282] The buggy address belongs to the object at ffff0000d7c46500 [ 296.017452][T10282] which belongs to the cache kmalloc-128 of size 128 [ 296.019781][T10282] The buggy address is located 112 bytes to the right of [ 296.019781][T10282] 128-byte region [ffff0000d7c46500, ffff0000d7c46580) [ 296.021994][T10282] [ 296.022408][T10282] The buggy address belongs to the physical page: [ 296.023415][T10282] page:000000008a8d84fd refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117c46 [ 296.025092][T10282] flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff) [ 296.026437][T10282] raw: 05ffc00000000200 0000000000000000 dead000000000001 ffff0000c0002300 [ 296.027788][T10282] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 296.029200][T10282] page dumped because: kasan: bad access detected [ 296.030209][T10282] [ 296.030587][T10282] Memory state around the buggy address: [ 296.031539][T10282] ffff0000d7c46480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 296.032790][T10282] ffff0000d7c46500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 296.034056][T10282] >ffff0000d7c46580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 296.035328][T10282] ^ [ 296.036619][T10282] ffff0000d7c46600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 296.038007][T10282] ffff0000d7c46680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 296.039378][T10282] ================================================================== [ 296.057124][T10282] Disabling lock debugging due to kernel taint [ 296.058541][T10282] ------------[ cut here ]------------ [ 296.059441][T10282] WARNING: CPU: 1 PID: 10282 at drivers/usb/gadget/udc/dummy_hcd.c:690 dummy_free_request+0x7c/0x84 [ 296.061230][T10282] Modules linked in: [ 296.061898][T10282] CPU: 1 PID: 10282 Comm: syz.0.2035 Tainted: G B syzkaller #0 [ 296.063450][T10282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 [ 296.065218][T10282] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 296.066567][T10282] pc : dummy_free_request+0x7c/0x84 [ 296.067500][T10282] lr : dummy_free_request+0x7c/0x84 [ 296.068393][T10282] sp : ffff8000219474d0 [ 296.069168][T10282] x29: ffff8000219474d0 x28: ffff0000dc56b4a0 x27: 1fffe0001b8ad694 [ 296.070529][T10282] x26: ffff0000d3ad6150 x25: dfff800000000000 x24: 0000000000000003 [ 296.071988][T10282] x23: dfff800000000000 x22: ffff80001537d160 x21: ffff800013110c00 [ 296.073603][T10282] x20: ffff0000d1f48068 x19: ffff0000d7c465f0 x18: 1fffe00033e7697e [ 296.074974][T10282] x17: 0000000000000000 x16: ffff800008043b30 x15: 0000000000000002 [ 296.076349][T10282] x14: 0000000000000001 x13: 1ffff00002ff016c x12: 0000000000080000 [ 296.077710][T10282] x11: 00000000000481cc x10: ffff8000225eb000 x9 : ffff80000dcedfc0 [ 296.079074][T10282] x8 : 00000000000481cd x7 : 0000000000000001 x6 : 0000000000000001 [ 296.080422][T10282] x5 : ffff800021946eb8 x4 : ffff800015464e80 x3 : ffff800008195a38 [ 296.081836][T10282] x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000001 [ 296.083340][T10282] Call trace: [ 296.083900][T10282] dummy_free_request+0x7c/0x84 [ 296.084723][T10282] usb_ep_free_request+0x138/0x34c [ 296.085642][T10282] uvc_function_bind+0x8b0/0xfe8 [ 296.086496][T10282] usb_add_function+0x234/0x7a8 [ 296.087324][T10282] configfs_composite_bind+0x7e0/0xce4 [ 296.088396][T10282] gadget_bind_driver+0x26c/0x684 [ 296.089284][T10282] really_probe+0x3a0/0xac4 [ 296.090022][T10282] __driver_probe_device+0x1c8/0x368 [ 296.091043][T10282] driver_probe_device+0x78/0x324 [ 296.092023][T10282] __driver_attach+0x3bc/0x614 [ 296.092955][T10282] bus_for_each_dev+0x148/0x1d0 [ 296.093860][T10282] driver_attach+0x50/0x60 [ 296.094645][T10282] bus_add_driver+0x2c0/0x518 [ 296.095457][T10282] driver_register+0x200/0x37c [ 296.096290][T10282] usb_gadget_register_driver_owner+0xf0/0x25c [ 296.097316][T10282] gadget_dev_desc_UDC_store+0x168/0x268 [ 296.098216][T10282] configfs_write_iter+0x260/0x338 [ 296.099100][T10282] vfs_write+0x3c8/0x7c8 [ 296.099791][T10282] ksys_write+0x12c/0x228 [ 296.100505][T10282] __arm64_sys_write+0x7c/0x90 [ 296.101442][T10282] invoke_syscall+0x98/0x290 [ 296.102375][T10282] el0_svc_common+0x13c/0x258 [ 296.103319][T10282] do_el0_svc+0x5c/0x134 [ 296.104097][T10282] el0_svc+0x58/0x128 [ 296.104870][T10282] el0t_64_sync_handler+0x84/0xf0 [ 296.105835][T10282] el0t_64_sync+0x18c/0x190 [ 296.106599][T10282] irq event stamp: 1135 [ 296.107324][T10282] hardirqs last enabled at (1135): [] finish_lock_switch+0xb0/0x1c8 [ 296.108967][T10282] hardirqs last disabled at (1134): [] __schedule+0x294/0x1a6c [ 296.110548][T10282] softirqs last enabled at (754): [] local_bh_enable+0x10/0x34 [ 296.112105][T10282] softirqs last disabled at (752): [] local_bh_disable+0x10/0x34 [ 296.113693][T10282] ---[ end trace 0000000000000000 ]--- [ 296.114963][T10282] udc dummy_udc.0: failed to start g1: -22 [ 296.116057][T10282] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 296.117644][T10282] UDC core: g1: couldn't find an available UDC or it's busy