last executing test programs: 3.537422367s ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/netdevsim/del_device\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='1\n\x00', 0x2) 2.959594242s ago: executing program 1 (id=7): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="5300000002000000"], 0x8) write$bt_hci(r0, &(0x7f0000000120)=ANY=[@ANYBLOB="5300010002000000"], 0x8) write$bt_hci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="5300020002000000"], 0x8) write$bt_hci(r0, &(0x7f0000000160)=ANY=[@ANYBLOB="5300030002000000"], 0x8) nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0) 2.426029334s ago: executing program 1 (id=11): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0\x00', 0x4) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./img\x00', 0x42, 0x1b6) ftruncate(r1, 0x2000000) pwrite64(r1, &(0x7f0000000280)="6269746d04000000001000000500000000000000", 0x14, 0x1000) r2 = syz_open_dev$loop(&(0x7f00000002c0), 0x0, 0x2) ioctl$LOOP_SET_FD(r2, 0x4c00, r1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r3, 0x40480923, &(0x7f0000000400)="000000000000000000000000000000000100000000040000010000000100000000000000010000000000000000000000010000000100"/72) ioctl(r3, 0x40140921, &(0x7f0000000500)="0000000007000000000000000000000006000000") r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/dev-loop0/offset\x00', 0x0, 0x0) read(r4, &(0x7f0000000900)=""/32, 0x20) r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/block/md0/md/dev-loop0/size\x00', 0x0, 0x0) read(r5, &(0x7f0000000920)=""/32, 0x20) r6 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./sys/block/md0/md/dev-loop0/slot\x00', 0x0, 0x0) read(r6, &(0x7f0000000940)=""/32, 0x20) r7 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./sys/block/md0/md/dev-loop0/state\x00', 0x0, 0x0) read(r7, &(0x7f0000000960)=""/32, 0x20) 2.249655801s ago: executing program 1 (id=12): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e0c0400c9000000000000000000"], 0xf) nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0) syz_emit_vhci(&(0x7f0000000200)=ANY=[@ANYBLOB="02c9000b000700060001030001100707"], 0x10) nanosleep(&(0x7f0000000540)={0x0, 0x5f5e100}, 0x0) syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="02c9001500110006000300"/26], 0x1a) nanosleep(&(0x7f0000000580)={0x0, 0x5f5e100}, 0x0) write(r0, &(0x7f0000000400)="1c0000000700aaaaaaaaaa1101", 0xd) write(r0, &(0x7f0000000440)="1c0001000700aaaaaaaaaa1101", 0xd) write(r0, &(0x7f0000000480)="1c00ffff0700aaaaaaaaaa1101", 0xd) write(r0, &(0x7f00000004c0)="1c0000000700aaaaaaaaaa1102", 0xd) nanosleep(&(0x7f00000005c0)={0x0, 0x5f5e100}, 0x0) syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="02c9001500110006000300"/26], 0x1a) nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0) 1.512252847s ago: executing program 0 (id=14): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000090)={&(0x7f0000000300)=@newtclass={0x40, 0x28, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1, 0x1}, {0x0, 0x1}}, [@tclass_kind_options=@c_qfq={{0x8}, {0x14, 0x2, [@TCA_QFQ_WEIGHT={0x8, 0x1, 0x1}, @TCA_QFQ_LMAX={0x8, 0x2, 0x5dc}]}}]}, 0x40}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000001400)={0x0, 0x0, &(0x7f00000000a0)={&(0x7f0000000400)=@newtclass={0x40, 0x28, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x2, 0x1}, {0x0, 0x1}}, [@tclass_kind_options=@c_qfq={{0x8}, {0x14, 0x2, [@TCA_QFQ_WEIGHT={0x8, 0x1, 0x64}, @TCA_QFQ_LMAX={0x8, 0x2, 0x5dc}]}}]}, 0x40}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000001500)={0x0, 0x0, &(0x7f00000000b0)={&(0x7f0000000500)=@setlink={0x20, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x41, 0x1}}, 0x20}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) bind$packet(r3, &(0x7f0000000700)={0x11, 0x300, r2}, 0x14) setsockopt$sock_int(r3, 0x1, 0xc, &(0x7f00000005c0)=0x10001, 0x4) write(r3, &(0x7f0000000600)='\x00'/1000, 0x3e8) write(r3, &(0x7f0000000600)='\x00'/1000, 0x3e8) setsockopt$sock_int(r3, 0x1, 0xc, &(0x7f00000005c0)=0x10002, 0x4) write(r3, &(0x7f0000000600)='\x00'/1000, 0x3e8) write(r3, &(0x7f0000000600)='\x00'/1000, 0x3e8) read(r0, &(0x7f0000000800)=""/2000, 0x7d0) read(r0, &(0x7f0000000800)=""/2000, 0x7d0) read(r0, &(0x7f0000000800)=""/2000, 0x7d0) read(r0, &(0x7f0000000800)=""/2000, 0x7d0) 1.446316266s ago: executing program 3 (id=16): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000200)="05000000010000", 0x7) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) write(r0, &(0x7f0000000400)="110000001000"/22, 0x16) 1.414274207s ago: executing program 1 (id=17): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x78, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x2}, @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_HE_BSS_COLOR]}, 0x78}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300), &(0x7f0000000400)=ANY=[@ANYBLOB="80000000ffffffffffff0802110000010802110000010000000000000000000064000100000474657374010882848b960c121824030101ff0723000000050000"], 0x40) nanosleep(&(0x7f0000000500)={0x1}, 0x0) 1.253107267s ago: executing program 3 (id=18): r0 = socket(0xa, 0x3, 0x3a) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt$MRT6_INIT(r0, 0x29, 0xc8, &(0x7f0000000000), 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syz_tun\x00', 0x0}) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f00000000c0)={0x0, 0x0, 0x1, r2}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="33330000000100112233445586dd6000000000003b4020010db8000000000000000000000001ff0e0000000000000000000000000001"], 0x0) 1.251266092s ago: executing program 3 (id=19): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000020)) r1 = syz_open_pts(r0, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl(r1, 0x400455c8, 0x0) nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0) write(r0, &(0x7f0000000100)="040e0401030c01040e0401031001", 0xe) nanosleep(&(0x7f0000000200)={0x0, 0x2faf080}, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x400448c9, 0x0) ioctl$sock_bt_hci(r2, 0x400448ca, 0x0) 424.657737ms ago: executing program 2 (id=22): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000000)=0x1, 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000000040)={0x0, 0x4, 0x1, 0x0, @vifc_lcl_addr=@empty, @empty}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'pimreg\x00', 0x0}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="240000002000010401000000000000008000000000000007000000000800060001000000"], 0x24}}, 0x0) sendto$packet(r2, &(0x7f0000000200)="45000028000100004011000001010101e000000100000000001400"/36, 0x28, 0x0, &(0x7f0000000300)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 272.410279ms ago: executing program 2 (id=23): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000000)={0x50, 0x2, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}]}, 0x50}}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x6c, 0x9, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x44, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}]}]}, 0x6c}}, 0x0) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)={0x6c, 0xb, 0x6, 0x1, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x44, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}, @IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x5000}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x6}]}]}, 0x6c}}, 0x0) 208.202193ms ago: executing program 2 (id=24): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) listen(r0, 0x5) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x60, 0x12, 0x301, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, {}, 0xffffffff}, [@INET_DIAG_REQ_BYTECODE={0x14, 0x1, "0710100002180000ffffffff00000000"}]}, 0x60}}, 0x0) 199.504136ms ago: executing program 0 (id=25): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000018000506010000000000000002000000fc00000600000000060015000200000024001680200008801c000180060001000100000005000200010000000800030001020304"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001a00010302000000000000000200"/28], 0x1c}}, 0x0) 194.42097ms ago: executing program 2 (id=26): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/usb_gadget\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.5001405000000001/tpgt_0\x00', 0x1ed) 143.758946ms ago: executing program 0 (id=27): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000200100000c0002800800010001000000180003800400010008000200050000000800040010000000"], 0x38}}, 0x0) 141.033116ms ago: executing program 2 (id=28): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a5f74756e"], 0x38}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000300)={@random="ffffffffffff", @random="aabbccddeeff", @void, {@generic={0x88ca, "5b500028003a00000000000001000001000012670000000000000000000000001122334411223344"}}}, 0x0) nanosleep(&(0x7f0000000400)={0x0, 0x3b9aca00}, 0x0) 89.252734ms ago: executing program 0 (id=29): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/nvmet/subsystems/testnqn\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nvmet/subsystems/testnqn/attr_allow_any_host\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='1', 0x1) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/ports/1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='tcp', 0x3) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/ports/1/addr_adrfam\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='ipv4', 0x4) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/ports/1/addr_traddr\x00', 0x2, 0x0) write(r3, &(0x7f00000002c0)='127.0.0.1', 0x9) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x2, 0x0) write(r4, &(0x7f0000000340)='4420', 0x4) close(r4) symlinkat(&(0x7f0000000380)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/subsystems/testnqn\x00') r5 = socket(0x2, 0x1, 0x0) connect(r5, &(0x7f0000000400), 0x10) close(r5) 79.107784ms ago: executing program 2 (id=30): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="4400000013000500010000000000000007000000", @ANYRES32=r1, @ANYBLOB="000000000000000024001a80200004801c000180080001000100000008000200", @ANYRES32=r1, @ANYBLOB="08000300", @ANYRES32=r2], 0x44}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="3c00000013000500020000000000000007000000", @ANYRES32=r1, @ANYBLOB="00000000000000001c001a80180004801400058008000100010000000800020003000000"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="5400000013000500030000000000000007000000", @ANYRES32=r1, @ANYBLOB="000000000000000034001a80300004802c000680080001000100000008000200e803000008000300030000000800040000e1f5050800050000000000"], 0x54}}, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) 50.451331ms ago: executing program 0 (id=31): r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x8) bind$llc(r0, &(0x7f0000000000)={0x1a, 0x1, 0x0, 0x0, 0x0, 0xc}, 0x10) syz_emit_ethernet(0x11, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000000030c0c03"], 0x0) 37.180158ms ago: executing program 1 (id=32): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./debug\x00', 0x1ff) mount(&(0x7f0000000440)=@filename='none\x00', &(0x7f0000000400)='./debug\x00', &(0x7f0000000480)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/ieee80211/phy0/netdev:wlan0/mesh_config\x00', 0x0, 0x0) 1.369548ms ago: executing program 0 (id=33): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pages=64\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='naa.6001405c935d7912\n', 0x16) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000480)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0/virtual_scsi_port\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='1\n', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r4, &(0x7f0000000680)='dummy_udc.0\n', 0xc) close(r4) nanosleep(&(0x7f00000006c0)={0x0, 0x5f5e100}, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000700), 0x1, 0x2) ioctl$SG_IO(r5, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) r6 = syz_open_dev$sg(&(0x7f0000000700), 0x0, 0x2) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) 0s ago: executing program 1 (id=34): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0\x00', 0x4) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./img\x00', 0x42, 0x1b6) ftruncate(r1, 0x2000000) pwrite64(r1, &(0x7f0000000280)="6269746d04000000001000000500000000000000", 0x14, 0x1000) r2 = syz_open_dev$loop(&(0x7f00000002c0), 0x0, 0x2) ioctl$LOOP_SET_FD(r2, 0x4c00, r1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0) ioctl(r3, 0x40480923, &(0x7f0000000400)="000000000000000000000000000000000100000000040000010000000100000000000000010000000000000000000000010000000100"/72) ioctl(r3, 0x40140921, &(0x7f0000000500)="0000000007000000000000000000000006000000") ioctl(r3, 0x400c0930, &(0x7f0000000700)='\x00'/12) r4 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/bitmap/location\x00', 0x2, 0x0) write(r4, &(0x7f0000000640)='none\x00', 0x5) close(r4) kernel console output (not intermixed with test programs): [ 37.929131][ T43] audit: type=1400 audit(1790053244.118:136): avc: denied { rlimitinh } for pid=5707 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 37.929204][ T43] audit: type=1400 audit(1790053244.118:137): avc: denied { siginh } for pid=5707 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '[localhost]:51412' (ED25519) to the list of known hosts. [ 39.721411][ T43] audit: type=1400 audit(1790053245.908:138): avc: denied { name_bind } for pid=5714 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 39.750666][ T43] audit: type=1400 audit(1790053245.938:139): avc: denied { execute } for pid=5715 comm="sh" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 39.751288][ T43] audit: type=1400 audit(1790053245.938:140): avc: denied { execute_no_trans } for pid=5715 comm="sh" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 41.992117][ T43] audit: type=1400 audit(1790053248.178:141): avc: denied { mounton } for pid=5715 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 41.993594][ T43] audit: type=1400 audit(1790053248.178:142): avc: denied { mount } for pid=5715 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 41.995535][ T5715] cgroup: Unknown subsys name 'net' [ 42.120662][ T5715] cgroup: Unknown subsys name 'cpuset' [ 42.123301][ T5715] cgroup: Unknown subsys name 'rlimit' [ 42.366589][ T5720] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 43.028393][ T5715] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 46.825876][ T43] kauditd_printk_skb: 15 callbacks suppressed [ 46.825888][ T43] audit: type=1400 audit(1790053253.008:158): avc: denied { execmem } for pid=5722 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 47.043805][ T43] audit: type=1400 audit(1790053253.228:159): avc: denied { create } for pid=5726 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 47.044160][ T43] audit: type=1400 audit(1790053253.228:160): avc: denied { read write } for pid=5726 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 47.044566][ T43] audit: type=1400 audit(1790053253.228:161): avc: denied { open } for pid=5726 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 47.056408][ T43] audit: type=1400 audit(1790053253.238:162): avc: denied { ioctl } for pid=5726 comm="syz-executor" path="socket:[2688]" dev="sockfs" ino=2688 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 47.070376][ T5727] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 47.072149][ T5727] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 47.072360][ T5727] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 47.072711][ T5727] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 47.072992][ T5727] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 47.076248][ T5733] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 47.078840][ T43] audit: type=1400 audit(1790053253.268:163): avc: denied { read } for pid=5726 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 47.079191][ T43] audit: type=1400 audit(1790053253.268:164): avc: denied { open } for pid=5726 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 47.079971][ T43] audit: type=1400 audit(1790053253.268:165): avc: denied { mounton } for pid=5726 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 47.084101][ T43] audit: type=1400 audit(1790053253.268:166): avc: denied { module_request } for pid=5726 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 47.089865][ T5733] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 47.099553][ T66] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 47.099823][ T66] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 47.101971][ T5736] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 47.102070][ T5736] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 47.102210][ T5736] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 47.103416][ T5736] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 47.104661][ T5736] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 47.104991][ T5736] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 47.105097][ T5736] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 47.105235][ T5736] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 47.107144][ T5736] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 47.107876][ T5736] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 47.108919][ T5086] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 47.122876][ T43] audit: type=1400 audit(1790053253.308:167): avc: denied { sys_module } for pid=5726 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 47.723910][ T5730] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.724042][ T5730] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.724105][ T5730] bridge_slave_0: entered allmulticast mode [ 47.724919][ T5730] bridge_slave_0: entered promiscuous mode [ 47.757283][ T5730] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.757451][ T5730] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.757532][ T5730] bridge_slave_1: entered allmulticast mode [ 47.758575][ T5730] bridge_slave_1: entered promiscuous mode [ 47.817118][ T5730] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.829994][ T5730] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.863995][ T5731] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.864062][ T5731] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.864145][ T5731] bridge_slave_0: entered allmulticast mode [ 47.865337][ T5731] bridge_slave_0: entered promiscuous mode [ 47.886001][ T5730] team0: Port device team_slave_0 added [ 47.892274][ T5731] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.892419][ T5731] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.892485][ T5731] bridge_slave_1: entered allmulticast mode [ 47.893232][ T5731] bridge_slave_1: entered promiscuous mode [ 47.895938][ T5730] team0: Port device team_slave_1 added [ 47.945493][ T5730] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.945505][ T5730] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.945517][ T5730] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.958688][ T5726] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.958840][ T5726] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.958938][ T5726] bridge_slave_0: entered allmulticast mode [ 47.960262][ T5726] bridge_slave_0: entered promiscuous mode [ 47.963009][ T5731] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.963095][ T5726] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.963165][ T5726] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.963574][ T5726] bridge_slave_1: entered allmulticast mode [ 47.964731][ T5726] bridge_slave_1: entered promiscuous mode [ 47.965728][ T5730] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.965769][ T5730] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.965783][ T5730] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.978738][ T5731] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.019887][ T5726] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.051731][ T5726] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.058962][ T5731] team0: Port device team_slave_0 added [ 48.059059][ T5732] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.059101][ T5732] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.059158][ T5732] bridge_slave_0: entered allmulticast mode [ 48.060036][ T5732] bridge_slave_0: entered promiscuous mode [ 48.086997][ T5731] team0: Port device team_slave_1 added [ 48.087099][ T5732] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.087157][ T5732] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.087210][ T5732] bridge_slave_1: entered allmulticast mode [ 48.088039][ T5732] bridge_slave_1: entered promiscuous mode [ 48.101266][ T5730] hsr_slave_0: entered promiscuous mode [ 48.102273][ T5730] hsr_slave_1: entered promiscuous mode [ 48.106995][ T5726] team0: Port device team_slave_0 added [ 48.139253][ T5726] team0: Port device team_slave_1 added [ 48.155132][ T5732] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.156675][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.156687][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.156707][ T5731] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.176300][ T5732] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.176633][ T5726] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.176641][ T5726] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.176654][ T5726] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.177638][ T5731] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.177650][ T5731] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.177670][ T5731] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.201790][ T5726] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.201805][ T5726] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.201825][ T5726] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.231932][ T5732] team0: Port device team_slave_0 added [ 48.240923][ T5732] team0: Port device team_slave_1 added [ 48.284140][ T5731] hsr_slave_0: entered promiscuous mode [ 48.284584][ T5731] hsr_slave_1: entered promiscuous mode [ 48.284892][ T5731] debugfs: 'hsr0' already exists in 'hsr' [ 48.284950][ T5731] Cannot create hsr debugfs directory [ 48.285624][ T5732] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.285638][ T5732] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.285658][ T5732] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.304588][ T5726] hsr_slave_0: entered promiscuous mode [ 48.305401][ T5726] hsr_slave_1: entered promiscuous mode [ 48.306001][ T5726] debugfs: 'hsr0' already exists in 'hsr' [ 48.306018][ T5726] Cannot create hsr debugfs directory [ 48.314599][ T5732] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.314613][ T5732] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.314634][ T5732] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.437892][ T5732] hsr_slave_0: entered promiscuous mode [ 48.438724][ T5732] hsr_slave_1: entered promiscuous mode [ 48.439225][ T5732] debugfs: 'hsr0' already exists in 'hsr' [ 48.439239][ T5732] Cannot create hsr debugfs directory [ 48.582001][ T5730] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 48.587955][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.604127][ T5730] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 48.606259][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.616405][ T5730] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 48.619178][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.632244][ T5730] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 48.635220][ T5730] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.674808][ T5726] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 48.680193][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.680843][ T5726] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 48.684535][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.686332][ T5726] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 48.688482][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.688862][ T5726] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 48.694002][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.768340][ T5731] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 48.771962][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.781133][ T5731] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 48.785513][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.785871][ T5731] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 48.788093][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.794556][ T5731] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 48.802345][ T5731] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.876001][ T5732] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 48.880086][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.882311][ T5732] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 48.885965][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.888849][ T5730] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.892178][ T5732] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 48.896791][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.905678][ T5732] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 48.909467][ T5732] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.938348][ T5730] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.969834][ T1165] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.969946][ T1165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.975801][ T5726] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.990436][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.990516][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.031068][ T5726] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.035811][ T5731] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.058324][ T1165] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.058412][ T1165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.071720][ T1165] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.071805][ T1165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.093587][ T5731] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.117983][ T5742] Bluetooth: hci2: command tx timeout [ 49.118006][ T5086] Bluetooth: hci0: command tx timeout [ 49.118304][ T66] Bluetooth: hci1: command tx timeout [ 49.118374][ T5732] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.124179][ T235] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.124265][ T235] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.140465][ T235] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.140562][ T235] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.175677][ T5732] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.199244][ T66] Bluetooth: hci3: command tx timeout [ 49.203240][ T74] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.203353][ T74] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.214942][ T5731] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 49.218610][ T74] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.218654][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.495662][ T5726] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.499232][ T5730] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.550315][ T5726] veth0_vlan: entered promiscuous mode [ 49.553187][ T5731] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.563483][ T5726] veth1_vlan: entered promiscuous mode [ 49.567223][ T5732] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.587261][ T5730] veth0_vlan: entered promiscuous mode [ 49.596167][ T5730] veth1_vlan: entered promiscuous mode [ 49.609411][ T5726] veth0_macvtap: entered promiscuous mode [ 49.621983][ T5726] veth1_macvtap: entered promiscuous mode [ 49.652686][ T5731] veth0_vlan: entered promiscuous mode [ 49.656630][ T5726] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.663532][ T5732] veth0_vlan: entered promiscuous mode [ 49.667535][ T5726] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.670461][ T5731] veth1_vlan: entered promiscuous mode [ 49.684670][ T5730] veth0_macvtap: entered promiscuous mode [ 49.690799][ T5732] veth1_vlan: entered promiscuous mode [ 49.692827][ T5730] veth1_macvtap: entered promiscuous mode [ 49.713058][ T5730] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.723500][ T5730] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.744915][ T5731] veth0_macvtap: entered promiscuous mode [ 49.757148][ T5732] veth0_macvtap: entered promiscuous mode [ 49.771625][ T5732] veth1_macvtap: entered promiscuous mode [ 49.784989][ T5731] veth1_macvtap: entered promiscuous mode [ 49.788342][ T5824] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.791074][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.791085][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.809313][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.825156][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.825169][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.827428][ T5731] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.828756][ T5732] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.854655][ T5732] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.856154][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.856166][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.869201][ T5726] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 49.887590][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.911476][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.911491][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.959853][ T221] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.959872][ T221] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.991391][ T1165] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.991408][ T1165] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.035986][ T1165] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.036006][ T1165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.056542][ T1165] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.056555][ T1165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.088088][ T5775] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.115913][ T5876] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.147644][ T5775] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.147849][ T5824] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.207771][ T5775] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.208197][ T5775] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.208229][ T5775] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.208259][ T5775] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.208290][ T5775] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.208320][ T5775] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.208351][ T5775] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.208381][ T5775] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.208412][ T5775] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.208442][ T5775] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.208472][ T5775] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.216240][ T5879] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 50.227254][ T5882] Zero length message leads to an empty skb [ 50.244021][ T5876] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.261004][ T2412] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01) [ 50.261026][ T2412] wlan1: send auth to 08:02:11:00:00:00 (try 1/3) [ 50.271070][ T1165] wlan1: authenticated [ 50.272324][ T5879] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 50.278696][ T1165] wlan1: associate with 08:02:11:00:00:00 (try 1/3) [ 50.308293][ T5881] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 50.314539][ T5884] netlink: 'syz.1.6': attribute type 21 has an invalid length. [ 50.316264][ T5876] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.324535][ T5884] netlink: 'syz.1.6': attribute type 2 has an invalid length. [ 50.325478][ T5884] netlink: 'syz.1.6': attribute type 21 has an invalid length. [ 50.326113][ T235] wlan1: RX AssocResp from 08:02:11:00:00:00 (capab=0x1 status=0 aid=1) [ 50.326268][ T235] wlan1: associated [ 50.326388][ T5879] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 50.329999][ T5884] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6'. [ 50.330021][ T5884] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6'. [ 50.330036][ T5884] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6'. [ 50.362559][ T5881] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 50.415047][ T5881] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 50.467226][ T5881] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 50.486486][ T5881] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 50.506240][ T5881] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 50.526645][ T5881] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 50.547641][ T5881] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 50.568649][ T5881] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 50.592085][ T5889] Bluetooth: MGMT ver 1.23 [ 50.593162][ T5889] Bluetooth: MGMT ver 1.23 [ 50.594173][ T5889] Bluetooth: MGMT ver 1.23 [ 50.594549][ T5889] Bluetooth: MGMT ver 1.23 [ 50.808633][ T5876] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.145041][ T5898] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 51.153377][ T5898] loop0: detected capacity change from 0 to 65536 [ 51.197690][ T66] Bluetooth: hci2: command tx timeout [ 51.207543][ T66] Bluetooth: hci1: command tx timeout [ 51.207554][ T5086] Bluetooth: hci0: command tx timeout [ 51.323149][ T5906] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 51.378525][ T5908] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 51.431903][ T5906] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 51.484299][ T5906] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 51.970449][ T43] kauditd_printk_skb: 34 callbacks suppressed [ 51.970461][ T43] audit: type=1400 audit(1790053258.158:202): avc: denied { unmount } for pid=5732 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 52.006624][ T43] audit: type=1400 audit(1790053258.188:203): avc: denied { create } for pid=5910 comm="syz.0.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 52.008497][ T43] audit: type=1400 audit(1790053258.198:204): avc: denied { bind } for pid=5910 comm="syz.0.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 52.014624][ T43] audit: type=1400 audit(1790053258.198:205): avc: denied { setopt } for pid=5910 comm="syz.0.14" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 52.015342][ T43] audit: type=1400 audit(1790053258.198:206): avc: denied { write } for pid=5910 comm="syz.0.14" path="socket:[10379]" dev="sockfs" ino=10379 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 52.078409][ T43] audit: type=1400 audit(1790053258.258:207): avc: denied { connect } for pid=5912 comm="syz.2.15" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 52.149536][ T5918] netlink: 16 bytes leftover after parsing attributes in process `syz.1.17'. [ 52.153224][ T5918] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 52.237152][ T43] audit: type=1400 audit(1790053258.418:208): avc: denied { create } for pid=5920 comm="syz.3.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 52.240226][ T43] audit: type=1400 audit(1790053258.428:209): avc: denied { setopt } for pid=5920 comm="syz.3.18" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 52.240749][ T5921] syz_tun: entered allmulticast mode [ 52.242781][ T5920] syz_tun: left allmulticast mode [ 52.355672][ T5742] Bluetooth: hci4: status 0x01 [ 52.356125][ T5742] Bluetooth: hci4: unexpected event for opcode 0x0c03 [ 52.356208][ T5742] Bluetooth: hci4: unexpected cc 0x1003 length: 1 < 9 [ 52.356342][ T66] Bluetooth: hci4: Opcode 0x1003 failed: -38 [ 53.082696][ T5930] ip_tables: iptables: counters copy to user failed while replacing table [ 53.083553][ T43] audit: type=1400 audit(1790053259.268:210): avc: denied { name_bind } for pid=5929 comm="syz.2.21" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 53.083745][ T43] audit: type=1400 audit(1790053259.268:211): avc: denied { node_bind } for pid=5929 comm="syz.2.21" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 53.127980][ T66] Bluetooth: hci3: command tx timeout [ 53.150776][ T5932] pimreg: entered allmulticast mode [ 53.161356][ T5931] pimreg: left allmulticast mode [ 53.277518][ T66] Bluetooth: hci1: command tx timeout [ 53.277548][ T66] Bluetooth: hci0: command tx timeout [ 53.277565][ T66] Bluetooth: hci2: command tx timeout [ 53.421276][ T5944] tipc: Started in network mode [ 53.421295][ T5944] tipc: Node identity 4, cluster identity 4711 [ 53.421305][ T5944] tipc: Node number set to 4 [ 53.423803][ T5944] tipc: Enabled bearer , priority 0 [ 53.453426][ T5946] nvmet_tcp: enabling port 1 (127.0.0.1:4420) [ 53.567466][ T5955] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 53.573806][ T5957] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 53.585359][ T5955] [ 53.586408][ T5955] ====================================================== [ 53.588327][ T5957] md: array md0 already has disks! [ 53.591658][ T5955] WARNING: possible circular locking dependency detected [ 53.594538][ T5955] syzkaller #0 Not tainted [ 53.596416][ T5955] ------------------------------------------------------ [ 53.599256][ T5955] syz.0.33/5955 is trying to acquire lock: [ 53.601631][ T5955] ffffffff90480000 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x20/0x440 [ 53.605135][ T5955] [ 53.605135][ T5955] but task is already holding lock: [ 53.608076][ T5955] ffff888036b28390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 53.611614][ T5955] [ 53.611614][ T5955] which lock already depends on the new lock. [ 53.611614][ T5955] [ 53.615666][ T5955] [ 53.615666][ T5955] the existing dependency chain (in reverse order) is: [ 53.619156][ T5955] [ 53.619156][ T5955] -> #2 (&gi->lock){+.+.}-{4:4}: [ 53.622788][ T5955] lock_acquire+0x1d1/0x380 [ 53.624850][ T5955] __mutex_lock+0x1a4/0x1bd0 [ 53.626897][ T5955] config_usb_cfg_link+0x57/0x3a0 [ 53.629103][ T5955] configfs_symlink+0x695/0x1340 [ 53.631278][ T5955] vfs_symlink+0x178/0x4d0 [ 53.633273][ T5955] filename_symlinkat+0x2a6/0x560 [ 53.635513][ T5955] __x64_sys_symlinkat+0x9c/0xe0 [ 53.637678][ T5955] do_syscall_64+0x123/0x790 [ 53.639733][ T5955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 53.642265][ T5955] [ 53.642265][ T5955] -> #1 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 53.645706][ T5955] lock_acquire+0x1d1/0x380 [ 53.647661][ T5955] down_write+0x8b/0x1f0 [ 53.649535][ T5955] configfs_depend_item_unlocked+0xf3/0x6a0 [ 53.652068][ T5955] usbg_make_tpg+0x251/0x610 [ 53.654129][ T5955] target_fabric_make_tpg+0xab/0x8c0 [ 53.656466][ T5955] configfs_mkdir+0x525/0xd40 [ 53.658542][ T5955] vfs_mkdir+0x364/0x850 [ 53.660476][ T5955] filename_mkdirat+0x48b/0x5e0 [ 53.662613][ T5955] __x64_sys_mkdirat+0x89/0xc0 [ 53.664759][ T5955] do_syscall_64+0x123/0x790 [ 53.666789][ T5955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 53.669326][ T5955] [ 53.669326][ T5955] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 53.672473][ T5955] check_prev_add+0xeb/0xe60 [ 53.674532][ T5955] __lock_acquire+0x1528/0x1f40 [ 53.676666][ T5955] lock_acquire+0x1d1/0x380 [ 53.678744][ T5955] __mutex_lock+0x1a4/0x1bd0 [ 53.680820][ T5955] tcm_alloc+0x20/0x440 [ 53.682716][ T5955] usb_get_function+0x5e/0xd0 [ 53.684827][ T5955] config_usb_cfg_link+0x1ed/0x3a0 [ 53.687059][ T5955] configfs_symlink+0x695/0x1340 [ 53.689259][ T5955] vfs_symlink+0x178/0x4d0 [ 53.691231][ T5955] filename_symlinkat+0x2a6/0x560 [ 53.693445][ T5955] __x64_sys_symlinkat+0x9c/0xe0 [ 53.695630][ T5955] do_syscall_64+0x123/0x790 [ 53.697659][ T5955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 53.700196][ T5955] [ 53.700196][ T5955] other info that might help us debug this: [ 53.700196][ T5955] [ 53.704202][ T5955] Chain exists of: [ 53.704202][ T5955] tpg_instances_lock --> &sb->s_type->i_mutex_key#24 --> &gi->lock [ 53.704202][ T5955] [ 53.709328][ T5955] Possible unsafe locking scenario: [ 53.709328][ T5955] [ 53.711646][ T5955] CPU0 CPU1 [ 53.713320][ T5955] ---- ---- [ 53.715056][ T5955] lock(&gi->lock); [ 53.716303][ T5955] lock(&sb->s_type->i_mutex_key#24); [ 53.718759][ T5955] lock(&gi->lock); [ 53.721010][ T5955] lock(tpg_instances_lock); [ 53.722498][ T5955] [ 53.722498][ T5955] *** DEADLOCK *** [ 53.722498][ T5955] [ 53.725100][ T5955] locks held by syz.0.33/5955: 3, last CPU#2: [ 53.726991][ T5955] #0: ffff888024360460 (sb_writers#13){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 53.729989][ T5955] #1: ffff888056053580 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 53.733354][ T5955] #2: ffff888036b28390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 53.736299][ T5955] [ 53.736299][ T5955] stack backtrace: [ 53.738133][ T5955] CPU: 2 UID: 0 PID: 5955 Comm: syz.0.33 Not tainted syzkaller #0 PREEMPT(full) [ 53.740967][ T5955] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 53.744239][ T5955] Call Trace: [ 53.745668][ T5955] [ 53.746917][ T5955] dump_stack_lvl+0x100/0x190 [ 53.748629][ T5955] print_circular_bug.cold+0x178/0x1be [ 53.750586][ T5955] check_noncircular+0x146/0x160 [ 53.752166][ T5955] check_prev_add+0xeb/0xe60 [ 53.753619][ T5955] __lock_acquire+0x1528/0x1f40 [ 53.755459][ T5955] lock_acquire+0x1d1/0x380 [ 53.757387][ T5955] ? tcm_alloc+0x20/0x440 [ 53.759123][ T5955] ? __pfx___might_resched+0x10/0x10 [ 53.760789][ T5955] ? config_usb_cfg_link+0x57/0x3a0 [ 53.762443][ T5955] __mutex_lock+0x1a4/0x1bd0 [ 53.763949][ T5955] ? tcm_alloc+0x20/0x440 [ 53.765407][ T5955] ? tcm_alloc+0x20/0x440 [ 53.766764][ T5955] ? __mutex_lock+0x26c/0x1bd0 [ 53.768285][ T5955] ? config_usb_cfg_link+0x57/0x3a0 [ 53.769979][ T5955] ? __pfx___mutex_lock+0x10/0x10 [ 53.771574][ T5955] ? __pfx_selinux_inode_permission+0x10/0x10 [ 53.773475][ T5955] ? tcm_alloc+0x20/0x440 [ 53.774899][ T5955] tcm_alloc+0x20/0x440 [ 53.776223][ T5955] usb_get_function+0x5e/0xd0 [ 53.777750][ T5955] config_usb_cfg_link+0x1ed/0x3a0 [ 53.779396][ T5955] ? mntput_no_expire+0xe7/0x220 [ 53.781136][ T5955] configfs_symlink+0x695/0x1340 [ 53.782928][ T5955] ? __pfx_configfs_symlink+0x10/0x10 [ 53.784747][ T5955] vfs_symlink+0x178/0x4d0 [ 53.786528][ T5955] filename_symlinkat+0x2a6/0x560 [ 53.788566][ T5955] ? __pfx_filename_symlinkat+0x10/0x10 [ 53.790748][ T5955] ? strncpy_from_user+0x19d/0x2d0 [ 53.792817][ T5955] ? do_getname+0x191/0x390 [ 53.794638][ T5955] __x64_sys_symlinkat+0x9c/0xe0 [ 53.796652][ T5955] do_syscall_64+0x123/0x790 [ 53.798530][ T5955] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 53.800874][ T5955] RIP: 0033:0x7fd157d9e159 [ 53.802664][ T5955] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 53.808677][ T5955] RSP: 002b:00007fd158c7a028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 53.811272][ T5955] RAX: ffffffffffffffda RBX: 00007fd158025fa0 RCX: 00007fd157d9e159 [ 53.813749][ T5955] RDX: 0000200000000600 RSI: ffffffffffffff9c RDI: 00002000000005c0 [ 53.816246][ T5955] RBP: 00007fd157e3506b R08: 0000000000000000 R09: 0000000000000000 [ 53.818699][ T5955] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 53.821170][ T5955] R13: 00007fd158026038 R14: 00007fd158025fa0 R15: 00007ffd601de078 [ 53.823636][ T5955] [ 53.829882][ T5960] md/raid1:md0: active with 1 out of 1 mirrors [ 53.829965][ T5959] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.830134][ T5960] md0: detected capacity change from 0 to 2048 [ 53.831308][ T5957] md: could not open device unknown-block(7,0). [ 53.831329][ T5957] md: md_import_device returned -16 [ 53.870963][ T5959] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.912380][ T5959] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 53.953178][ T5959] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 54.017572][ T5824] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.087439][ T50] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 54.167627][ T5086] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 54.169755][ T5923] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 54.238168][ T50] usb 5-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 7.03 [ 54.238692][ T50] usb 5-1: Dual-Role OTG device on HNP port [ 54.238926][ T50] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.240419][ T5804] Using the BOT protocol [ 54.245013][ T5804] Using the UAS protocol [ 54.247814][ T50] scsi host6: uas [ 54.253072][ T74] scsi 6:0:0:0: Direct-Access LIO-ORG RAMDISK-MCP 4.0 PQ: 0 ANSI: 6 [ 54.261803][ T74] sd 6:0:0:0: Attached scsi generic sg2 type 0 [ 54.265501][ T235] sd 6:0:0:0: [sdb] 512 512-byte logical blocks: (262 kB/256 KiB) [ 54.266427][ T235] sd 6:0:0:0: [sdb] Write Protect is off [ 54.266458][ T235] sd 6:0:0:0: [sdb] Mode Sense: 43 00 00 08 [ 54.268454][ T235] sd 6:0:0:0: [sdb] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA [ 54.333201][ T235] sd 6:0:0:0: [sdb] Attached SCSI disk [ 55.207683][ T5086] Bluetooth: hci3: command tx timeout [ 55.357525][ T5086] Bluetooth: hci2: command tx timeout [ 55.357553][ T5086] Bluetooth: hci1: command tx timeout