last executing test programs: 8.656343773s ago: executing program 0 (id=243): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000640)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x24, r1, 0x1, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_BSS_CTS_PROT={0x5, 0x1c, 0x7}]}, 0x24}, 0x1, 0x0, 0x0, 0x40011}, 0x4) 7.217236452s ago: executing program 0 (id=247): socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x8dc3, 0x900) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r2, 0xc0045520, &(0x7f0000000080)=0xffffbf7b) 6.42948921s ago: executing program 1 (id=250): set_mempolicy(0x3, &(0x7f0000000100)=0xfffffffffffffff7, 0x9) r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e000000180002"], 0x48}}, 0x0) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) 6.196886073s ago: executing program 1 (id=251): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000020000300", @ANYRES32=r3, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x28000) 5.510412233s ago: executing program 1 (id=252): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000002040)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000640)={0x1c, &(0x7f0000000580)={0x40, 0x15}, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000b00)={0x24, &(0x7f0000000880)={0x20, 0x5}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000700)={0x2c, &(0x7f00000003c0)={0x20, 0x14}, 0x0, 0x0, 0x0, 0x0}) 5.379969097s ago: executing program 1 (id=253): r0 = eventfd2(0x0, 0x1) ppoll(&(0x7f0000000200)=[{r0, 0x1}], 0x1, 0x0, 0x0, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x16}) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000100)="569534ab1bbe0e03", 0x8}], 0x1) 4.758584831s ago: executing program 1 (id=254): r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000840)={0x34, &(0x7f0000000480)={0x20, 0x10, 0x6, "f62ab830d3e0"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000007c0)={0x2c, &(0x7f00000005c0)={0x20, 0xe, 0x16, "64d7633d17800767d1feaa3018c534bd81450b36d026"}, 0x0, 0x0, 0x0, 0x0}) 4.567558457s ago: executing program 1 (id=255): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x149002, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) write$P9_RSTATu(r3, &(0x7f00000004c0)=ANY=[@ANYBLOB="930200007d00000005f0000000000000050000000000000000000000000000000000000000000000000000000000000000001f00046e6f6465767b6376666f7892ffffff8102000000000031ffcebc920000003800704a86cec602007dfa673effeb09b5351f5bde05f7"], 0x232) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) capget(&(0x7f0000000180)={0x20071026, r0}, &(0x7f0000000280)={0x3ff, 0x7, 0x4, 0xffffff7f, 0x8001, 0xe}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000100), 0x208e24b) 4.298889372s ago: executing program 0 (id=256): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x1a}, 0x28) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r1, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x54, 0x24, 0xf0b, 0x70bd2c, 0x0, {0x0, 0x0, 0x12, r2, {0x0, 0xf}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0x2, 0x5, 0x3401, 0x0, 0x6, 0x5}}, {0x4}}]}]}, 0x54}}, 0x4048000) 4.159393094s ago: executing program 0 (id=257): r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000100)=0x5, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xb, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, 0x0, 0x0) socket(0x40000000015, 0x5, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x100, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x24000040) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000800)='./file0\x00', &(0x7f00000000c0)='system.posix_acl_default\x00', &(0x7f0000000e40)={{}, {0x1, 0x1}, [], {}, [], {0x10, 0x6}, {0x20, 0x6}}, 0x24, 0x3) 306.811981ms ago: executing program 0 (id=258): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x802, 0x0) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) r1 = openat(0xffffffffffffff9c, 0x0, 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x8e000) r2 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x0, 0x40055}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) io_uring_enter(r2, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) read$FUSE(r1, 0x0, 0x0) 0s ago: executing program 0 (id=259): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_open_dev$tty1(0xc, 0x4, 0x4) r4 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'vxcan1\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000000)={0x1d, r5, 0x3}, 0x18) syz_usb_connect(0x4, 0x0, 0x0, 0x0) ioctl$TIOCL_SETSEL(r3, 0x541c, &(0x7f0000000000)={0x2, {0xc, 0x24, 0xfffb, 0x508, 0xfc}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsmount(r6, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:10653' (ED25519) to the list of known hosts. syzkaller login: [ 91.499940][ T3370] cgroup: Unknown subsys name 'net' [ 91.798585][ T3370] cgroup: Unknown subsys name 'cpuset' [ 91.838761][ T3370] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 92.371329][ T3370] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 103.971335][ T3376] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.990190][ T3376] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 104.216278][ T3375] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 104.234628][ T3375] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 105.192824][ T3376] hsr_slave_0: entered promiscuous mode [ 105.201191][ T3376] hsr_slave_1: entered promiscuous mode [ 105.488108][ T3375] hsr_slave_0: entered promiscuous mode [ 105.492767][ T3375] hsr_slave_1: entered promiscuous mode [ 105.498751][ T3375] debugfs: 'hsr0' already exists in 'hsr' [ 105.499345][ T3375] Cannot create hsr debugfs directory [ 106.662834][ T3376] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 106.699803][ T3376] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.704809][ T3376] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 106.724834][ T3376] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.781907][ T3376] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 106.794653][ T3376] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.852300][ T3376] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 106.883489][ T3376] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.962272][ T3375] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 106.981028][ T3375] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.034090][ T3375] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 107.059987][ T3375] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.066325][ T3375] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 107.097920][ T3375] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.101586][ T3375] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 107.144770][ T3375] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 108.373882][ T3376] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.518001][ T3375] 8021q: adding VLAN 0 to HW filter on device bond0 [ 112.760159][ T3375] veth0_vlan: entered promiscuous mode [ 112.893900][ T3375] veth1_vlan: entered promiscuous mode [ 112.991024][ T3376] veth0_vlan: entered promiscuous mode [ 113.070582][ T3376] veth1_vlan: entered promiscuous mode [ 113.154280][ T3375] veth0_macvtap: entered promiscuous mode [ 113.187452][ T3375] veth1_macvtap: entered promiscuous mode [ 113.473979][ T29] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.476177][ T29] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.477499][ T29] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.478051][ T29] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.610898][ T3376] veth0_macvtap: entered promiscuous mode [ 113.701913][ T3376] veth1_macvtap: entered promiscuous mode [ 114.106592][ T52] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.107089][ T52] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.108206][ T52] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.108721][ T52] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.203343][ T3375] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 114.988847][ T3525] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1'. [ 115.582738][ T3530] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.615148][ T3530] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 116.046874][ T11] usb 1-1: new low-speed USB device number 2 using dummy_hcd [ 116.261167][ T3535] FAULT_INJECTION: forcing a failure. [ 116.261167][ T3535] name failslab, interval 1, probability 0, space 0, times 1 [ 116.262053][ T3535] CPU: 1 UID: 0 PID: 3535 Comm: syz.1.5 Not tainted syzkaller #0 PREEMPT [ 116.264145][ T3535] Hardware name: linux,dummy-virt (DT) [ 116.264437][ T3535] Call trace: [ 116.264769][ T3535] show_stack+0x18/0x24 (C) [ 116.266742][ T3535] dump_stack_lvl+0x60/0x80 [ 116.266818][ T3535] dump_stack+0x18/0x24 [ 116.266881][ T3535] should_fail_ex+0x1e0/0x238 [ 116.266956][ T3535] should_failslab+0x54/0x80 [ 116.267031][ T3535] kmem_cache_alloc_lru_noprof+0x5c/0x440 [ 116.267099][ T3535] sock_alloc_inode+0x24/0x94 [ 116.267175][ T3535] alloc_inode+0x28/0xdc [ 116.267251][ T3535] sock_alloc+0x20/0xa0 [ 116.267319][ T3535] __sock_create+0xa4/0x260 [ 116.267385][ T3535] __sys_socket+0xa0/0x140 [ 116.267454][ T3535] __arm64_sys_socket+0x1c/0x38 [ 116.267526][ T3535] invoke_syscall+0x54/0x10c [ 116.267594][ T3535] el0_svc_common.constprop.0+0x40/0xe0 [ 116.267690][ T3535] do_el0_svc+0x1c/0x34 [ 116.267765][ T3535] el0_svc+0x38/0x1fc [ 116.267841][ T3535] el0t_64_sync_handler+0xa0/0xe4 [ 116.267912][ T3535] el0t_64_sync+0x1a4/0x1a8 [ 116.287989][ T3535] socket: no more sockets [ 116.318937][ T11] usb 1-1: New USB device found, idVendor=1ae7, idProduct=9001, bcdDevice= 0.40 [ 116.343238][ T11] usb 1-1: config 1 interface 0 altsetting 2 endpoint 0x81 has invalid maxpacket 64, setting to 8 [ 116.344878][ T11] usb 1-1: config 1 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 116.347895][ T11] usb 1-1: config 1 interface 0 has no altsetting 0 [ 121.450288][ T11] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.452695][ T11] usb 1-1: Product: ခ [ 121.454064][ T11] usb 1-1: Manufacturer: 馄﮺隝﫳쬚稲徬轜濽﫩䥬但殺㟦홯ᯖ鬿म흫톫蝸郞笡Ê軫分ꌯ铞䄩Ă㵴奶ቘ痛ද깆隚㻘觥䔻梍蜞琳淵鑭ᅜ팍魝筩혢̠接ૂⵢᐃꔥળ㥭ﲰ볽㾺ᓈ캥縒聤䖞⎕ꦭ勆孜ᠨ풼够貕愡딒猴鴗粩虭⟣￧矆蘅闒阥ۯ໗㱾碌㫆뇳헋㓼랼楕껺㹭띓왷 [ 121.467163][ T11] usb 1-1: SerialNumber: syz [ 122.111019][ T3532] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 122.345767][ T3532] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 122.347985][ T3532] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 123.114479][ T11] usbhid 1-1:1.0: can't add hid device: -71 [ 123.116246][ T11] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 123.128226][ T11] usb 1-1: USB disconnect, device number 2 [ 123.361932][ T3558] FAULT_INJECTION: forcing a failure. [ 123.361932][ T3558] name failslab, interval 1, probability 0, space 0, times 0 [ 123.362225][ T3558] CPU: 1 UID: 0 PID: 3558 Comm: syz.0.12 Not tainted syzkaller #0 PREEMPT [ 123.362314][ T3558] Hardware name: linux,dummy-virt (DT) [ 123.362355][ T3558] Call trace: [ 123.362387][ T3558] show_stack+0x18/0x24 (C) [ 123.362507][ T3558] dump_stack_lvl+0x60/0x80 [ 123.362580][ T3558] dump_stack+0x18/0x24 [ 123.362660][ T3558] should_fail_ex+0x1e0/0x238 [ 123.362732][ T3558] should_failslab+0x54/0x80 [ 123.362802][ T3558] __kmalloc_cache_noprof+0x58/0x460 [ 123.362869][ T3558] __arm64_sys_memfd_create+0x80/0x1e0 [ 123.362942][ T3558] invoke_syscall+0x54/0x10c [ 123.363007][ T3558] el0_svc_common.constprop.0+0x40/0xe0 [ 123.363075][ T3558] do_el0_svc+0x1c/0x34 [ 123.363140][ T3558] el0_svc+0x38/0x1fc [ 123.363208][ T3558] el0t_64_sync_handler+0xa0/0xe4 [ 123.363272][ T3558] el0t_64_sync+0x1a4/0x1a8 [ 129.410501][ T3584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.426518][ T3584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 146.660055][ T3634] syzkaller0: entered promiscuous mode [ 146.660678][ T3634] syzkaller0: entered allmulticast mode [ 147.965658][ T3641] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.967293][ T3641] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 158.436041][ T800] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 158.619588][ T800] usb 1-1: New USB device found, idVendor=0506, idProduct=4601, bcdDevice= 1.00 [ 158.665792][ T800] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 158.666405][ T800] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 158.666664][ T800] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 159.910646][ T800] pegasus 1-1:1.0: probe with driver pegasus failed with error -71 [ 159.937174][ T800] usb 1-1: USB disconnect, device number 3 [ 165.431314][ T46] block nbd0: Receive control failed (result -32) [ 165.443531][ T3742] block nbd0: shutting down sockets [ 168.686854][ T3761] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 168.688681][ T3761] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 168.792901][ T3763] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 168.794363][ T3763] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 171.689814][ T3785] netlink: 28 bytes leftover after parsing attributes in process `syz.0.90'. [ 172.029320][ T3785] netlink: 8 bytes leftover after parsing attributes in process `syz.0.90'. [ 172.031355][ T3785] veth0: entered promiscuous mode [ 172.036080][ T3785] veth0: entered allmulticast mode [ 174.811027][ T3772] nci: __nci_request: wait_for_completion_interruptible_timeout failed 0 [ 175.447544][ T3796] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 175.457055][ T3796] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 176.308499][ T1251] nci: nci_rsp_packet: unsupported rsp opcode 0xf00 [ 180.866000][ T3805] nci: __nci_request: wait_for_completion_interruptible_timeout failed 0 [ 181.386831][ T3823] syz_tun: entered allmulticast mode [ 181.441786][ T3822] syz_tun: left allmulticast mode [ 181.926047][ T11] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 182.028039][ T3832] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 182.032255][ T3832] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 182.091762][ T11] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 182.138351][ T11] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 182.138694][ T11] usb 1-1: Product: syz [ 182.143487][ T11] usb 1-1: Manufacturer: syz [ 182.143904][ T11] usb 1-1: SerialNumber: syz [ 182.173237][ T11] usb 1-1: config 0 descriptor?? [ 192.443222][ T801] usb 1-1: USB disconnect, device number 4 [ 192.939635][ T3866] netlink: 52 bytes leftover after parsing attributes in process `syz.0.112'. [ 193.096244][ T3868] tun0: tun_chr_ioctl cmd 2147767507 [ 198.638437][ T3891] dummy0: entered promiscuous mode [ 198.641235][ T3891] dummy0: entered allmulticast mode [ 199.645497][ T3463] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 199.819880][ T3463] usb 1-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 199.853059][ T3463] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 199.892133][ T3463] usb 1-1: config 0 descriptor?? [ 207.423154][ T28] audit: type=1326 audit(207.250:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3915 comm="syz.1.131" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff84779228 code=0x7ffc0000 [ 207.423824][ T28] audit: type=1326 audit(207.250:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3915 comm="syz.1.131" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff84779228 code=0x7ffc0000 [ 207.439921][ T28] audit: type=1326 audit(207.280:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3915 comm="syz.1.131" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff84779228 code=0x7ffc0000 [ 207.443971][ T28] audit: type=1326 audit(207.280:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3915 comm="syz.1.131" exe="/syz-executor" sig=0 arch=c00000b7 syscall=198 compat=0 ip=0xffff8477b218 code=0x7ffc0000 [ 207.450943][ T28] audit: type=1326 audit(207.280:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3915 comm="syz.1.131" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff84779228 code=0x7ffc0000 [ 207.453612][ T28] audit: type=1326 audit(207.280:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3915 comm="syz.1.131" exe="/syz-executor" sig=0 arch=c00000b7 syscall=206 compat=0 ip=0xffff8475c0ec code=0x7ffc0000 [ 207.460118][ T28] audit: type=1326 audit(207.300:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3915 comm="syz.1.131" exe="/syz-executor" sig=0 arch=c00000b7 syscall=207 compat=0 ip=0xffff8475c0ec code=0x7ffc0000 [ 207.476536][ T28] audit: type=1326 audit(207.310:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3915 comm="syz.1.131" exe="/syz-executor" sig=0 arch=c00000b7 syscall=222 compat=0 ip=0xffff84778f20 code=0x7ffc0000 [ 207.477044][ T28] audit: type=1326 audit(207.310:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3915 comm="syz.1.131" exe="/syz-executor" sig=0 arch=c00000b7 syscall=215 compat=0 ip=0xffff84778fcc code=0x7ffc0000 [ 207.477235][ T28] audit: type=1326 audit(207.310:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=3915 comm="syz.1.131" exe="/syz-executor" sig=0 arch=c00000b7 syscall=215 compat=0 ip=0xffff84778fcc code=0x7ffc0000 [ 210.288521][ T3296] usb 1-1: USB disconnect, device number 5 [ 210.826317][ T3932] netlink: 32 bytes leftover after parsing attributes in process `syz.0.137'. [ 211.196394][ T3938] netlink: 8 bytes leftover after parsing attributes in process `syz.0.140'. [ 211.283715][ T3940] Zero length message leads to an empty skb [ 211.608569][ T3943] syzkaller1: entered promiscuous mode [ 211.608906][ T3943] syzkaller1: entered allmulticast mode [ 211.864478][ T3947] netlink: 12 bytes leftover after parsing attributes in process `syz.1.144'. [ 211.868489][ T3947] netlink: 12 bytes leftover after parsing attributes in process `syz.1.144'. [ 213.968236][ T3978] ip_tables: iptables: counters copy to user failed while replacing table [ 216.048557][ T3995] input: syz0 as /devices/virtual/input/input1 [ 229.384889][ T4058] syzkaller0: entered promiscuous mode [ 229.385163][ T4058] syzkaller0: entered allmulticast mode [ 229.582522][ T4058] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 229.707425][ T1549] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 233.736920][ T11] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 233.981226][ T11] usb 1-1: Using ep0 maxpacket: 8 [ 233.988558][ T11] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 234.012176][ T11] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 234.012577][ T11] usb 1-1: config 0 has no interface number 0 [ 234.012913][ T11] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 234.013392][ T11] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 234.013594][ T11] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 234.019983][ T11] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 234.021731][ T11] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 234.042375][ T11] usb 1-1: config 0 descriptor?? [ 234.120016][ T11] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 234.591776][ T3478] usb 1-1: USB disconnect, device number 6 [ 234.623462][ T3478] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 234.888205][ T4096] netlink: 'syz.0.199': attribute type 4 has an invalid length. [ 237.759641][ T4119] process 'syz.1.206' launched './file2' with NULL argv: empty string added [ 243.191583][ T4136] can0: slcan on ttyS3. [ 243.306394][ T4136] can0 (unregistered): slcan off ttyS3. [ 243.317395][ T4138] syz.0.213 uses obsolete (PF_INET,SOCK_PACKET) [ 243.370889][ T4138] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40 [ 246.194823][ T28] kauditd_printk_skb: 5 callbacks suppressed [ 246.195270][ T28] audit: type=1326 audit(246.021:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4158 comm="syz.1.221" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff84779228 code=0x7ffc0000 [ 246.214228][ T28] audit: type=1326 audit(246.041:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4158 comm="syz.1.221" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff84779228 code=0x7ffc0000 [ 246.217236][ T28] audit: type=1326 audit(246.041:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4158 comm="syz.1.221" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff84779228 code=0x7ffc0000 [ 246.221510][ T28] audit: type=1326 audit(246.041:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4158 comm="syz.1.221" exe="/syz-executor" sig=0 arch=c00000b7 syscall=133 compat=0 ip=0xffff84779228 code=0x7ffc0000 [ 246.225190][ T28] audit: type=1326 audit(246.041:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4158 comm="syz.1.221" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff84779228 code=0x7ffc0000 [ 246.227917][ T28] audit: type=1326 audit(246.041:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4158 comm="syz.1.221" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff84779228 code=0x7ffc0000 [ 246.238580][ T28] audit: type=1326 audit(246.041:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4158 comm="syz.1.221" exe="/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff84779228 code=0x7ffc0000 [ 246.241685][ T28] audit: type=1326 audit(246.041:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4158 comm="syz.1.221" exe="/syz-executor" sig=0 arch=c00000b7 syscall=436 compat=0 ip=0xffff84779228 code=0x7ffc0000 [ 246.245556][ T28] audit: type=1326 audit(246.041:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=4158 comm="syz.1.221" exe="/syz-executor" sig=0 arch=c00000b7 syscall=94 compat=0 ip=0xffff84779228 code=0x7ffc0000 [ 246.442376][ T4161] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 246.455924][ T4161] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 247.027925][ T23] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 247.047717][ T23] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 249.428510][ T4176] bond0: (slave bond_slave_0): Releasing backup interface [ 249.482440][ T4176] bond0: (slave bond_slave_1): Releasing backup interface [ 249.562541][ T4176] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 251.148210][ T4193] nvmet_tcp: malformed ip/port passed: : [ 254.630006][ T4206] netlink: 'syz.1.237': attribute type 1 has an invalid length. [ 256.624411][ T4195] nci: __nci_request: wait_for_completion_interruptible_timeout failed 0 [ 257.050051][ T4216] Illegal XDP return value 4294967274 on prog (id 10) dev syz_tun, expect packet loss! [ 257.591256][ T4219] netlink: 104 bytes leftover after parsing attributes in process `syz.0.240'. [ 261.444567][ T4233] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 262.302757][ T4242] netlink: 20 bytes leftover after parsing attributes in process `syz.1.250'. [ 262.377040][ T1534] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 262.394606][ T1534] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 262.395362][ T1534] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 262.395543][ T1534] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 263.175944][ T4249] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.179130][ T4249] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.976860][ T4254] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.981694][ T4254] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 265.968007][ T4265] capability: warning: `syz.1.255' uses deprecated v2 capabilities in a way that may be insecure [ 268.417859][ T4267] gadgetfs: bound to dummy_udc driver [ 268.659148][ T11] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 268.660276][ C0] gadgetfs: connected [ 268.661653][ T11] gadgetfs: disconnected [ 268.700888][ T3375] ================================================================== [ 268.705400][ T3375] BUG: KASAN: slab-use-after-free in mutex_lock_interruptible+0x10/0x70 [ 268.707850][ T3375] Write at addr faf00000079e3f00 by task syz-executor/3375 [ 268.708335][ T3375] Pointer tag: [fa], memory tag: [fe] [ 268.708456][ T3375] [ 268.709531][ T3375] CPU: 0 UID: 0 PID: 3375 Comm: syz-executor Tainted: G L syzkaller #0 PREEMPT [ 268.709999][ T3375] Tainted: [L]=SOFTLOCKUP [ 268.710079][ T3375] Hardware name: linux,dummy-virt (DT) [ 268.710349][ T3375] Call trace: [ 268.710637][ T3375] show_stack+0x18/0x24 (C) [ 268.710987][ T3375] dump_stack_lvl+0x60/0x80 [ 268.711074][ T3375] print_report+0x1c4/0x4b0 [ 268.711124][ T3375] kasan_report+0x84/0xac [ 268.711172][ T3375] __do_kernel_fault+0x1b4/0x220 [ 268.711215][ T3375] do_bad_area+0x68/0x80 [ 268.711257][ T3375] do_tag_check_fault+0x34/0x44 [ 268.711303][ T3375] do_mem_abort+0x40/0x90 [ 268.711352][ T3375] el1_abort+0x44/0x64 [ 268.711475][ T3375] el1h_64_sync_handler+0x50/0xac [ 268.711528][ T3375] el1h_64_sync+0x6c/0x70 [ 268.711765][ T3375] mutex_lock_interruptible+0x10/0x70 (P) [ 268.711848][ T3375] do_dentry_open+0x128/0x4fc [ 268.711907][ T3375] vfs_open+0x2c/0xe8 [ 268.711959][ T3375] path_openat+0x5b4/0x960 [ 268.712016][ T3375] do_file_open+0xb0/0x168 [ 268.712076][ T3375] do_sys_openat2+0x84/0x104 [ 268.712127][ T3375] __arm64_sys_openat+0x64/0xc0 [ 268.712176][ T3375] invoke_syscall+0x54/0x10c [ 268.712226][ T3375] el0_svc_common.constprop.0+0x40/0xe0 [ 268.712276][ T3375] do_el0_svc+0x1c/0x34 [ 268.712327][ T3375] el0_svc+0x38/0x1fc [ 268.712378][ T3375] el0t_64_sync_handler+0xa0/0xe4 [ 268.712425][ T3375] el0t_64_sync+0x1a4/0x1a8 [ 268.712721][ T3375] [ 268.712840][ T3375] Allocated by task 4267: [ 268.713077][ T3375] kasan_save_stack+0x3c/0x64 [ 268.713278][ T3375] save_stack_info+0x40/0x160 [ 268.713318][ T3375] kasan_save_alloc_info+0x14/0x20 [ 268.713356][ T3375] __kasan_kmalloc+0xf8/0x120 [ 268.713392][ T3375] __kmalloc_cache_noprof+0x1c0/0x460 [ 268.713434][ T3375] gadgetfs_bind+0xd0/0x3c0 [ 268.713480][ T3375] gadget_bind_driver+0x90/0x284 [ 268.713519][ T3375] really_probe+0xbc/0x2bc [ 268.713562][ T3375] __driver_probe_device+0x11c/0x184 [ 268.713601][ T3375] driver_probe_device+0x3c/0x114 [ 268.713674][ T3375] __driver_attach+0x90/0x180 [ 268.713751][ T3375] bus_for_each_dev+0x7c/0xdc [ 268.713805][ T3375] driver_attach+0x24/0x30 [ 268.713858][ T3375] bus_add_driver+0xe4/0x208 [ 268.713902][ T3375] driver_register+0x68/0x130 [ 268.713942][ T3375] usb_gadget_register_driver_owner+0x54/0xfc [ 268.713988][ T3375] dev_config+0x214/0x484 [ 268.714027][ T3375] vfs_write+0xd4/0x36c [ 268.714066][ T3375] ksys_write+0x70/0x108 [ 268.714104][ T3375] __arm64_sys_write+0x18/0x24 [ 268.714142][ T3375] invoke_syscall+0x54/0x10c [ 268.714178][ T3375] el0_svc_common.constprop.0+0x40/0xe0 [ 268.714214][ T3375] do_el0_svc+0x1c/0x34 [ 268.714253][ T3375] el0_svc+0x38/0x1fc [ 268.714292][ T3375] el0t_64_sync_handler+0xa0/0xe4 [ 268.714327][ T3375] el0t_64_sync+0x1a4/0x1a8 [ 268.714437][ T3375] [ 268.714481][ T3375] Freed by task 3478: [ 268.714519][ T3375] kasan_save_stack+0x3c/0x64 [ 268.714564][ T3375] save_stack_info+0x40/0x160 [ 268.714601][ T3375] kasan_save_free_info+0x18/0x40 [ 268.714635][ T3375] __kasan_slab_free+0xe8/0x160 [ 268.714669][ T3375] kfree+0x150/0x41c [ 268.714713][ T3375] put_ep.part.0+0x44/0x60 [ 268.714752][ T3375] destroy_ep_files+0x104/0x170 [ 268.714794][ T3375] gadgetfs_unbind+0x7c/0xc0 [ 268.714842][ T3375] gadget_unbind_driver+0x7c/0x118 [ 268.714885][ T3375] device_remove+0x4c/0x80 [ 268.714925][ T3375] device_release_driver_internal+0x1cc/0x224 [ 268.714963][ T3375] driver_detach+0x4c/0xb0 [ 268.715004][ T3375] bus_remove_driver+0x6c/0xbc [ 268.715043][ T3375] driver_unregister+0x30/0x60 [ 268.715083][ T3375] usb_gadget_unregister_driver+0x20/0x40 [ 268.715128][ T3375] dev_release+0x68/0x80 [ 268.715169][ T3375] __fput+0xcc/0x2f8 [ 268.715210][ T3375] delayed_fput+0x50/0x6c [ 268.715283][ T3375] process_one_work+0x180/0x2d0 [ 268.715342][ T3375] worker_thread+0x18c/0x300 [ 268.715385][ T3375] kthread+0x118/0x130 [ 268.715428][ T3375] ret_from_fork+0x10/0x20 [ 268.715490][ T3375] [ 268.715531][ T3375] The buggy address belongs to the object at fff00000079e3f00 [ 268.715531][ T3375] which belongs to the cache kmalloc-192 of size 192 [ 268.715619][ T3375] The buggy address is located 0 bytes inside of [ 268.715619][ T3375] 192-byte region [fff00000079e3f00, fff00000079e3fc0) [ 268.715711][ T3375] [ 268.715919][ T3375] The buggy address belongs to the physical page: [ 268.716436][ T3375] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x479e3 [ 268.716865][ T3375] flags: 0x1ffc00000000000(node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) [ 268.717369][ T3375] page_type: f5(slab) [ 268.718009][ T3375] raw: 01ffc00000000000 f9f0000003401300 dead000000000122 0000000000000000 [ 268.718108][ T3375] raw: 0000000000000000 0000000800150015 00000000f5000000 0000000000000000 [ 268.718253][ T3375] page dumped because: kasan: bad access detected [ 268.718313][ T3375] [ 268.718349][ T3375] Memory state around the buggy address: [ 268.718608][ T3375] fff00000079e3d00: f9 f9 f9 f9 f9 f9 f9 f9 fb fb fb fb fb fb fb fb [ 268.718722][ T3375] fff00000079e3e00: fb fb fb fb fe fe fe fe fe fe fe fe fe fe fe fe [ 268.718781][ T3375] >fff00000079e3f00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 268.718846][ T3375] ^ [ 268.718975][ T3375] fff00000079e4000: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 268.719013][ T3375] fff00000079e4100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 268.719095][ T3375] ================================================================== [ 268.721231][ T3375] Disabling lock debugging due to kernel taint SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 269.483681][ T1549] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.672158][ T1549] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.946211][ T1549] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.068837][ T1549] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.869551][ T1549] bond0 (unregistering): Released all slaves [ 270.960677][ T1549] hsr_slave_0: left promiscuous mode [ 270.969653][ T1549] hsr_slave_1: left promiscuous mode [ 270.981025][ T1549] veth1_macvtap: left promiscuous mode [ 270.982943][ T1549] veth0_macvtap: left promiscuous mode [ 270.985794][ T1549] veth1_vlan: left promiscuous mode [ 270.987894][ T1549] veth0_vlan: left promiscuous mode [ 272.676488][ T1549] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 272.677070][ T1549] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 272.821141][ T1549] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 272.824129][ T1549] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 272.997786][ T1549] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 272.997990][ T1549] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 273.099334][ T1549] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 273.100567][ T1549] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 273.768383][ T1549] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 273.827058][ T1549] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 273.869744][ T1549] bond0 (unregistering): Released all slaves [ 273.937839][ T3219] 8021q: adding VLAN 0 to HW filter on device eth1 [ 274.066114][ T1549] hsr_slave_0: left promiscuous mode [ 274.069289][ T1549] hsr_slave_1: left promiscuous mode [ 274.078281][ T1549] veth1_macvtap: left promiscuous mode [ 274.080183][ T1549] veth0_macvtap: left promiscuous mode [ 274.083253][ T1549] veth1_vlan: left promiscuous mode [ 274.085774][ T1549] veth0_vlan: left promiscuous mode [ 276.211048][ T3219] 8021q: adding VLAN 0 to HW filter on device eth3 [ 277.277086][ T3219] 8021q: adding VLAN 0 to HW filter on device eth2 [ 278.634551][ T3219] 8021q: adding VLAN 0 to HW filter on device eth4 [ 279.730053][ T3219] 8021q: adding VLAN 0 to HW filter on device eth5 [ 280.762748][ T3219] 8021q: adding VLAN 0 to HW filter on device eth6 [ 282.192780][ T3219] 8021q: adding VLAN 0 to HW filter on device eth7 [ 283.349448][ T3219] 8021q: adding VLAN 0 to HW filter on device eth8 VM DIAGNOSIS: 17:13:10 Registers: info registers vcpu 0 CPU#0 PC=ffff8000817df374 X00=fbf0000005ce1198 X01=f9f000000626ddc0 X02=fbf0000005ce1198 X03=f1f00000046ce600 X04=f9f000000626ddc0 X05=fbf0000005ce1158 X06=0000000000000002 X07=00000000fffffffa X08=f5f0000007b87718 X09=0000000000000078 X10=f5f0000007b876e2 X11=00000000000000c0 X12=000000000000005a X13=ffff8000832abb58 X14=000000000000009d X15=ffff8000832abb4d X16=ffff800082f38000 X17=fff07ffffcd47000 X18=00000000ffffffff X19=ffff800082b7d368 X20=ffff800082f3bb60 X21=0000000000000001 X22=fbf0000005ce1000 X23=f9f0000007aaf900 X24=0000000000000000 X25=0000000000000000 X26=0000000000000000 X27=0000000000000001 X28=fbf0000004b61000 X29=ffff800082f3bb00 X30=489f8000817dffd0 SP=ffff800082f3ba20 PSTATE=60402009 -ZC- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000000000000000 P01=0000000000000000 P02=0000000000000000 P03=0000000000000000 P04=0000000000000000 P05=0000000000000000 P06=0000000000000000 P07=0000000000000000 P08=0000000000000000 P09=0000000000000000 P10=0000000000000000 P11=0000000000000000 P12=0000000000000000 P13=0000000000000000 P14=0000000000000000 P15=0000000000000000 FFR=0000000000000000 Z00=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:2525252525252525:2525252525252525 Z01=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:746f687370616e53:000000756c6c252e Z02=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:f0f0ffffffff0000 Z03=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:ffffff000000ff00 Z04=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:00000000fff000f0 Z05=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:00524f5252450040:0000000000000000 Z06=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z07=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z08=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z16=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z17=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z18=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:bb448243222c92da:e3914ed4e87380b0 Z23=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:43788d6f07084f17:4508b00c6052a10f Z24=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:b20fae707afde253:388e9c6c4fa85ca0 Z25=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:8e9f894b2581e79e:20c883c9819d5c97 Z26=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:57c93d417f4d0394:89cd11f6992873d1 Z27=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:6b69be1163cb6500:a4ac85c293540e63 Z28=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:6edc4d3a2914b135:d8e9c869e2695c88 Z29=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0009000700030001 Z30=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0030ffff847485b4 Z31=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 info registers vcpu 1 CPU#1 PC=ffff800081ca34c4 X00=ffff800081ca34c0 X01=f9f000000625d500 X02=fff07ffffcd47000 X03=000000000000000f X04=0000000000000004 X05=0000000000000000 X06=0000000000000000 X07=fff000007f8c2f00 X08=0000001d31cf0337 X09=0000000000155cc0 X10=0000000000155cc0 X11=0000000000000001 X12=000000004d5159c6 X13=0000000000000117 X14=000000000000023c X15=0000000000000000 X16=f8f000000348dac0 X17=0000000000000000 X18=0000000000000001 X19=0000000000000000 X20=ffff800082cb1348 X21=ffff800082cb1340 X22=0000000000000004 X23=ffff800082cb1348 X24=0000000000000028 X25=ffff800082ba2108 X26=0000000000000001 X27=fff000007f8c3a70 X28=0000000000000000 X29=ffff800082f43c40 X30=ffff8000801b98f8 SP=ffff800082f43c40 PSTATE=404020c9 -Z-- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000000000000000 P01=0000000000000000 P02=0000000000000000 P03=0000000000000000 P04=0000000000000000 P05=0000000000000000 P06=0000000000000000 P07=0000000000000000 P08=0000000000000000 P09=0000000000000000 P10=0000000000000000 P11=0000000000000000 P12=0000000000000000 P13=0000000000000000 P14=0000000000000000 P15=0000000000000000 FFR=0000000000000000 Z00=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0a0a0a0a0a0a0a0a:0a0a0a0a0a0a0a0a Z01=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:72206373696d0000:6572756365736e69 Z02=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:7461687420796177:2061206e69207365 Z03=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:000000000000ffff:0000000000000000 Z04=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:000000ff00000000 Z05=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:7065642073657375:20273535322e312e Z06=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:7461636572706564:2073657375202735 Z07=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:6974696c69626170:6163203276206465 Z08=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z16=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000ffffdf3076c0:0000ffffdf3076c0 Z17=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:ffffff80ffffffd8:0000ffffdf307690 Z18=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z24=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z26=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z28=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z30=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000