last executing test programs: 7.287202948s ago: executing program 1 (id=23): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0x6611, 0x0) 6.662389509s ago: executing program 1 (id=29): ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0x3, 0x4002004c2, 0x7ff, 0x9, 0x6, 0x400, 0x80, 0x89, 0x0, 0x3, 0x8d], 0x100000, 0x2c08c6}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 6.468726543s ago: executing program 1 (id=31): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x122, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000440)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000480)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000004c0)={'syzkaller0\x00', 0x1}) r2 = socket$inet_sctp(0x2, 0x5, 0x84) bind(r2, &(0x7f0000000500)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10) listen(r2, 0x5) write$tun(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="00000800010000000000140008004500003c000000004084ca2502020202ac14000104d2321000000000000000000100001c1122334400080000000500050000000500090008"], 0x4a) 6.292193447s ago: executing program 0 (id=34): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='net/snmp6\x00') read$FUSE(r2, &(0x7f0000000380)={0x2020}, 0x2020) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000040)={[0x100000000005, 0x4, 0xe9b, 0x22, 0x20000008, 0x7, 0x911d, 0x7, 0x8, 0x10009c2, 0x5, 0x1006, 0xc, 0x8, 0x8000, 0xffffffffffffffff], 0x1000, 0xc2302}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0x7, 0x8, 0x0, 0x9, 0x8, 0x97, 0xaf, 0xc6, 0x81, 0xfe, 0xc, 0x0, 0x5, 0x27f7, 0x0, 0x7, 0x8, 0xff, '\x00', 0x61, 0x10000000000001}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 6.241311619s ago: executing program 1 (id=35): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mount$bind(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='\x00', 0x9801) move_mount(r0, &(0x7f0000000200)='.\x00', 0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000280)='./file0/../file0\x00', &(0x7f00000002c0)='./file0/file0\x00', 0x0, 0x8b100a, 0x0) mount$bind(0x0, &(0x7f0000000300)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='./file0\x00', 0x0, 0x2125099, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f00000003c0)='\x00', 0x89901) move_mount(r1, &(0x7f0000000400)='.\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) 6.213898525s ago: executing program 3 (id=36): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING(r1, 0x4068aea3, &(0x7f0000000280)={0xc0, 0x0, 0x8000}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000300)={0x1ff, 0x1, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f00000003c0)=0x4) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000004c0)={"db4c1421593cb4d3f8fe6094dc821bbbe06520701fc6de7b0349f34b0f8c556a9e9aff1355aab8d6da26d74608530f150f127f9e3f0a2f1fff0be9770080000000000000f78616596487bf50017c56b15385ab264cba5b168c62d971e67e6f3e73d60b5a8adbaaf2af8610c6a91c0a116f619adce4aa91d5a78faf8ee98693d32d8d8244381b5720ef596600e39491d216c22d0725904bab7d90fa8afb8fa04b707410ae300ef098609b4fa6dd77b1b7c321b1fc6356564ce3f90826be3a9a5be186ffc48eb13824e9dae77ed212a0f802074ff4f1725c4ad88cf5bbd36e3406bc59d96e82047631d8be9462ee7e54e5b2897c3fff38eabf67e1e160c2b5e18be06457844d89c9a606b7d25fbde713f4759da0bee1fabe3f71dcca63540f113a2b5edc4b327d1f9610377b97265d4aa875b4bc3c44bf811005001bca1fe54794a0aa52dfc80df1caf7d812b4f1cdba1a6836b45ea2180d08439d411ce8e0755868cc839eaeac73e5d28f9f1990584038cf5fa6bee0c479df1d198c7b59519bf2a9bf1fedf54cc2dc6aea6c42c32de40c291e5f422f5cf792a08926af160fb379576dd81bac746232fb246817fc3248097914b75e83cc5eb518ce8fb643b34ca69c3b61f0d94e7db62dd480198d41e0862f1ec4429ab637569884a5bf446a0b09edfd986a2b3e15ee35bbd18610dad6271681ed240b0ffabb199b541013c0aadc36486da57511896c147f6a41602aa1426edfbb828897d9c218b7936a0572840ebbc796e888a439b24e640324b511deb6ed0b2ce2f7567447826944b4f34101e492e8d20a2deda950e96e78f86d6d4c976f0c99041c94944309e6ce08d84a7c96677d570d9a57ec0506a4321d9e049b55be883ca3648c27772fc5dbaea5e6c2ded2ce72fb68989ae381fe1394cf6966ab04285d5ff8256bc2e85462b8d89aeeebd5432157c945b5dc1960d9282c6cc007fe029325d6078ad694d4954f956c71bcdf846f41392ebe0d3b289438d24ec4bc073617459a6b232445dd636a9f21140e14b162dd5ef1d626b0ff84884fd63d22cc1b05befb77ea937f3045cc15b125479b262c1e32fca75a5468423288c5776efee744b1fccb5e6d661d9d287cfa8582c96ea34a3304bbc29c0035650f9b2b04fe5e981d5be5ee123e431fd793ea179a0fc77aaee66d87307716cb32008026b36d0e27d14217ad1131cace3bae4ef82dfbc790e78de53a9bfbdb468bf0eb3ff134073b380858965de2d108862daf3fc6b49ad46f20832238aeaa5d010cf08e37938f0bb7bbeaa970c39ce9327a16fe07565708266c0cf0639bfa08538693b456228aa1c370d64ef9795b7cc208a2c528d381a042d149ed5c7f34ed26a7d5a4401b86434f054389e5dac7a4ee896e406d7b27240d925d478e0eb2202797832d8377b0d6ae9b97034f9400"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 6.113061229s ago: executing program 1 (id=37): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000600)={0x84, &(0x7f0000000940)=ANY=[@ANYBLOB="400f01"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f00000013c0)={0x1c, &(0x7f0000000840)=ANY=[], 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000340)={0x2c, &(0x7f0000000140)={0x20, 0xa}, 0x0, 0x0, 0x0, 0x0}) 6.107926548s ago: executing program 0 (id=38): pipe(&(0x7f0000000f80)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000fc0)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f0000001000)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) fchdir(r2) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001040), 0x20402, 0x0) r4 = open(&(0x7f0000001080)='.\x00', 0x0, 0x244) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r3, 0xc0189378, &(0x7f00000010c0)={{0x1, 0x1, 0x18, r4, {0x4}}, './file1\x00'}) 6.028387845s ago: executing program 3 (id=39): r0 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="120100004898b610c2154500201f0102030109021b0001000500ea09040002018c78fd00090582f3c6"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$printer(0x2, 0x2d, &(0x7f00000001c0)={{0x12, 0x1, 0x110, 0x7, 0x1, 0x3, 0x40, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xfb, 0xb0, 0xc, "", [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, "", {{{0x9, 0x5, 0x1, 0x2, 0x20}}}}}]}}]}}, 0x0) syz_usb_control_io$printer(r1, &(0x7f0000000200)={0x14, 0x0, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x100a}}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) write$char_usb(r2, &(0x7f0000000380)="0bcde56ca9a62cbf", 0x8) syz_usb_control_io$printer(r1, 0x0, 0x0) 6.009372882s ago: executing program 0 (id=40): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @loopback}, 0x10) listen(r0, 0x5) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e22, @loopback}, 0x10) r2 = accept(r0, 0x0, 0x0) setsockopt$inet_tcp_buf(r2, 0x6, 0x1f, &(0x7f0000000080)='espintcp', 0x8) write(r1, &(0x7f00000000c0)='\x00\n\x00\x00\x00\x00\x00\x00\x00\x00', 0xa) read(r2, &(0x7f0000000140)=""/2, 0x2) 5.943228649s ago: executing program 0 (id=41): r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000340)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000400)={0x14, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000480)={0x24, 0x0, &(0x7f00000004c0)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000500)={0x24, 0x0, &(0x7f0000000540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x18, &(0x7f00000005c0)=ANY=[@ANYBLOB='@\b\b'], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000600)={0x84, &(0x7f00000006c0)={0x20, 0x6, 0x4, "348b35e5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) close(0x3) writev(r1, &(0x7f0000000a40)=[{&(0x7f0000000a80)='*', 0x1}], 0x1) 5.778697445s ago: executing program 1 (id=42): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x3, 0x4, @mcast1, 0x2}}}, &(0x7f0000000380)=0x84) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000180)="f7790066baa00066b86b42460f22c7d466ba420000b8e20066ef0f29902cbb0000c4e2b1ba8c88d90000006666f6440f386b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x4b}], 0x0, 0x58, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, 0x0}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x10, 0xfe, 0x80, '\x00', 0x8}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 5.669030968s ago: executing program 32 (id=42): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x3, 0x4, @mcast1, 0x2}}}, &(0x7f0000000380)=0x84) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000180)="f7790066baa00066b86b42460f22c7d466ba420000b8e20066ef0f29902cbb0000c4e2b1ba8c88d90000006666f6440f386b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x4b}], 0x0, 0x58, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, 0x0}], 0x1, 0x21, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x10, 0xfe, 0x80, '\x00', 0x8}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.139735699s ago: executing program 2 (id=45): openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x2, 0x300) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) socket(0x10, 0x803, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$key(0xf, 0x3, 0x2) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r0, @ANYBLOB='\a'], 0x0) 2.871096185s ago: executing program 0 (id=46): socket$nl_generic(0x10, 0x3, 0x10) sendmsg$inet(0xffffffffffffffff, 0x0, 0x4044885) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee2, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000003c0), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000400), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x40, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) 2.426082884s ago: executing program 3 (id=47): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='27', 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000380)="549c", 0x2}], 0x1}}], 0x1, 0x8800) 2.216857834s ago: executing program 3 (id=48): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x129240, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f00000003c0)={0x48, 0x2, r2, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_HWPT_ALLOC$TEST(r1, 0x3b89, &(0x7f00000001c0)={0x28, 0x0, r3, r4, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000180)}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000600)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r1, 0x3ba0, &(0x7f0000000640)={0x48, 0xa, r5, 0x0, r6}) 1.851819242s ago: executing program 3 (id=49): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000406a053b030000000000010902"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fd7000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000003680)=@vmx={0x0, 0x0, 0x2080, {0x0, 0x0, {}, 0x0, 0x2}}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000040)="660f388084000072baf80c66b860b4498c66efbafc0c66b80e0000002ebe660f38049f9e0064f30fc7b000101f20f30fc7b1030066b9800000c00f326635000400000f30d2bc0a000f23c80f21f86635040040000f08b8f4008ee0", 0x5b}], 0x1, 0x48, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.708155041s ago: executing program 2 (id=50): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(0xffffffffffffffff, 0x660c) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f00000000c0)=0x4000005, 0x4) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 1.350982654s ago: executing program 0 (id=51): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, 0x0}], 0x1, 0x69, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0xcd}]}) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000005c0)={"b46474f815e8d5535f0887c44335cc824dc6121bc72a77f532ff5dad4d643a9cab29d2310e04be14eb26c0af4985fe45e3b3b0680b3ec92725d74b9716e0f7c3119a2c9a0ae65ff4772e2e12733cb013c4308fe40863480747c0a7ddb9361b1578015ca1bb2c1677ebae096f08345476f567443842946ed946434c75916d1db83fe305920de65bfaf9bd940672216846cb16b8ae67cd3affc61375381f91b3b9f1cc5e38cafe5239aee71dcd481fbe1ecd2547ffbaad4469a74697c28fb9beefa6a5d736712a55eb9110c2cf7964062ba8cbc1c038e84f0f5db7fc7053118bf5221e3efa6fc3edb5d0ca3cde7054dd0751a332520aa8478b1775d552c5cc24d3c2df9eb333e5ca3aa06c1c2cf8526714f5caff2f55b41976fc20b64f1fc61d5b44f50953582a1825d32130a31abfeafd1987317879e29ac51b93c9659e023fff3ddb5e39dd19cc3ef1d883c78b9e073d08a9197fb3717df238b9831831214b186693be9dd2568bb77272e80df5dfed03e8c467627bedfbd93359a9f79a3aa37e873dc1357b37b43d813ea85267b0dc8b1c4cc51bd985328833beb2679b7fb762555bbea2da936b36f8f1673fd5f606b2b6eb23b72bf947206e8dbfeb40ca6f265a3485c8446e0f0da652860b88328073d2282c14b48a7774e62754a968b60e92205e8fafcdd70a55c3c4d1a4821ff44e6e3681f15ae091262e3a3290a24d8ceae30ebbf9d24287bb8a5d73c608d47d287f9e716cf02b4796a83fb0c05e45b89de9ef8bce834e6d7a0be6e30d2c66cb6e640cb01898454ad361bc0701d8fe56113335ae6adec59300db04691cc4a689034272a8e086e92ce7061b4f79fa8afbb48a6ce4b62bdc44af013d78980457e1fa61eb9204818606f4c3b03c0f33cd2a841ac9bc2b73151a96e31ab99e6ec969b5f2c3edd5f9abc69845e487af992758ba445368da93dae1d44360d52a534a88276b8aaf349841d8a4788c60408618437c442308dbf70efeda2e54e9b9e4fe5f76997c9dcb945a26bd75748c85d19ca8b99264dce50580e8d4dbda401dad7df31e9a7a6a3a83bfbdfb5394abd581ac0824fbcd75d2f5205c0b7c9188e6f26bfd97734d9a20433f6cdba9d14a5f32a4d97a57f4603b21146fd1aebf082e863d463c224ad623c17d8043d3bf083f0322408dd6ead6915ac6a4222ab51480eb6e11a8913348219515170d9df90d72d7363bbda3e327d19f98c0a856f98076380e788e602e8a2ae0a1930786874dc21a2e99abda15f35457cf1dcb440c4b41350d0eda352aad7f57a0adc8a6914da06460635ed21c4c11cd1a8ec778064c9f62efba2927828b23f94b16619a5520731c2c40ab8583c9f2e73233d74b84f4877ce6b35bb1180300"}) syz_usb_connect(0x5, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff"], 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 618.520344ms ago: executing program 2 (id=52): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x9, 0x0, 0x2004cb, 0xffffffffffffffff, 0xa1d, 0x68ff, 0xa, 0x0, 0x3, 0xa], 0x41000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 306.363544ms ago: executing program 2 (id=53): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x20000004) ioctl$KVM_RUN(r2, 0xae80, 0x0) 129.18548ms ago: executing program 2 (id=54): openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x141042, 0x15) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.memory_pressure\x00', 0x275a, 0x0) fallocate(r0, 0x10, 0x0, 0x8d) 49.810086ms ago: executing program 2 (id=55): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) write(r0, &(0x7f0000000300)='1', 0x1) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x10000000}) 0s ago: executing program 3 (id=56): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x180) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x81c0, 0x80000001) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000140), 0x8, &(0x7f00000003c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@index_on}]}) linkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0/file0\x00', 0x400) chdir(&(0x7f0000000240)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0x8042, 0x34) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000f40)='.\x00', 0x101000, 0x108) getdents64(r0, &(0x7f0000000f80)=""/4096, 0x1000) kernel console output (not intermixed with test programs): no interfaces have a carrier [ 45.359798][ T5273] 8021q: adding VLAN 0 to HW filter on device bond0 [ 45.366790][ T5273] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: OK Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.94' (ED25519) to the list of known hosts. syzkaller login: [ 71.113260][ T5595] cgroup: Unknown subsys name 'net' [ 71.227405][ T5595] cgroup: Unknown subsys name 'cpuset' [ 71.236581][ T5595] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 71.566210][ T1316] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.566280][ T1316] ieee802154 phy1 wpan1: encryption failed: -22 [ 72.518184][ T5595] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 74.612116][ T5606] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 74.614211][ T5606] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 74.630786][ T5606] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 74.633125][ T5606] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 74.633745][ T5606] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 74.678420][ T4928] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 74.681782][ T4928] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 74.682220][ T4928] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 74.708266][ T4928] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 74.709231][ T4928] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 74.821178][ T54] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 74.822244][ T5619] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 74.822815][ T5619] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 74.823216][ T5619] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 74.823676][ T54] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 74.839397][ T54] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 74.839667][ T54] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 74.848081][ T54] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 74.848301][ T54] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 74.854473][ T5619] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 75.429768][ T5609] rxe_eth0 speed is unknown, defaulting to 1000 [ 75.441825][ T5617] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 75.450311][ T5609] rxe_eth0 speed is unknown, defaulting to 1000 [ 75.463090][ T5609] rxe_eth0 speed is unknown, defaulting to 1000 [ 75.568414][ T5605] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 75.628091][ T5615] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 75.850994][ T5609] infiniband rxe0: set active [ 75.852538][ T5609] infiniband rxe0: added rxe_eth0 [ 75.883410][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 75.914342][ T5609] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 75.914375][ T5609] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 75.914409][ T5609] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 75.982887][ T5609] RDS/IB: rxe0: added [ 75.983308][ T5609] smc: adding ib device rxe0 with port count 1 [ 75.983389][ T5609] smc: ib device rxe0 port 1 has no pnetid [ 76.041119][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 76.076933][ T5609] rxe_eth0 speed is unknown, defaulting to 1000 [ 76.380030][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 76.514679][ T10] rxe_eth0 speed is unknown, defaulting to 1000 [ 76.537606][ T5609] rxe_eth0 speed is unknown, defaulting to 1000 [ 76.650405][ T5617] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.651170][ T5617] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.651415][ T5617] bridge_slave_0: entered allmulticast mode [ 76.653234][ T5617] bridge_slave_0: entered promiscuous mode [ 76.685143][ T4928] Bluetooth: hci0: command tx timeout [ 76.686522][ T5617] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.686662][ T5617] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.686784][ T5617] bridge_slave_1: entered allmulticast mode [ 76.688300][ T5617] bridge_slave_1: entered promiscuous mode [ 76.764689][ T4928] Bluetooth: hci1: command tx timeout [ 76.807675][ T5609] rxe_eth0 speed is unknown, defaulting to 1000 [ 76.820835][ T5605] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.820935][ T5605] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.821359][ T5605] bridge_slave_0: entered allmulticast mode [ 76.823084][ T5605] bridge_slave_0: entered promiscuous mode [ 76.826855][ T5605] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.826960][ T5605] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.827100][ T5605] bridge_slave_1: entered allmulticast mode [ 76.831737][ T5605] bridge_slave_1: entered promiscuous mode [ 76.923701][ T5617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 76.924428][ T4928] Bluetooth: hci3: command tx timeout [ 76.924437][ T5606] Bluetooth: hci2: command tx timeout [ 76.963368][ T5605] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 76.978191][ T5617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 76.978388][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.978479][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.978594][ T5615] bridge_slave_0: entered allmulticast mode [ 76.980434][ T5615] bridge_slave_0: entered promiscuous mode [ 77.021995][ T5605] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.040510][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.040604][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.040778][ T5615] bridge_slave_1: entered allmulticast mode [ 77.042418][ T5615] bridge_slave_1: entered promiscuous mode [ 77.127467][ T5617] team0: Port device team_slave_0 added [ 77.136095][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.137196][ T5609] rxe_eth0 speed is unknown, defaulting to 1000 [ 77.142483][ T5605] team0: Port device team_slave_0 added [ 77.148233][ T5617] team0: Port device team_slave_1 added [ 77.176430][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.178906][ T5605] team0: Port device team_slave_1 added [ 77.228258][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.228275][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.228304][ T5617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.288737][ T5617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.288755][ T5617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.288785][ T5617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.310907][ T5615] team0: Port device team_slave_0 added [ 77.317999][ T5615] team0: Port device team_slave_1 added [ 77.318617][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.318628][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.318664][ T5605] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.397400][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.397416][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.397438][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.398426][ T5605] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.398438][ T5605] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.398461][ T5605] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.399728][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.399740][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.399763][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.503893][ T5617] hsr_slave_0: entered promiscuous mode [ 77.508720][ T5617] hsr_slave_1: entered promiscuous mode [ 77.591250][ T5615] hsr_slave_0: entered promiscuous mode [ 77.591890][ T5615] hsr_slave_1: entered promiscuous mode [ 77.592313][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 77.592376][ T5615] Cannot create hsr debugfs directory [ 77.599850][ T5605] hsr_slave_0: entered promiscuous mode [ 77.600885][ T5605] hsr_slave_1: entered promiscuous mode [ 77.601602][ T5605] debugfs: 'hsr0' already exists in 'hsr' [ 77.601620][ T5605] Cannot create hsr debugfs directory [ 78.058096][ T5617] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.063313][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 78.065056][ T5617] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.073813][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 78.103546][ T5617] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.112962][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 78.132303][ T5617] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 78.136153][ T5617] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 78.190509][ T5609] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.190604][ T5609] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.190952][ T5609] bridge_slave_0: entered allmulticast mode [ 78.192240][ T5609] bridge_slave_0: entered promiscuous mode [ 78.195106][ T5609] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.195211][ T5609] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.195341][ T5609] bridge_slave_1: entered allmulticast mode [ 78.196922][ T5609] bridge_slave_1: entered promiscuous mode [ 78.255188][ T5609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.262567][ T5609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.296589][ T5605] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 78.300747][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 78.312905][ T5609] team0: Port device team_slave_0 added [ 78.313752][ T5605] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 78.327653][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 78.328640][ T5605] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 78.338712][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 78.367998][ T5609] team0: Port device team_slave_1 added [ 78.368461][ T5605] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 78.371460][ T5605] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 78.418961][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.418976][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.418998][ T5609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.430916][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.430931][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 78.430953][ T5609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.485699][ T5615] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 78.507728][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 78.508593][ T5615] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 78.529273][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 78.546088][ T5615] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 78.548700][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 78.569491][ T5615] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 78.573076][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 78.591060][ T5609] hsr_slave_0: entered promiscuous mode [ 78.591696][ T5609] hsr_slave_1: entered promiscuous mode [ 78.592111][ T5609] debugfs: 'hsr0' already exists in 'hsr' [ 78.592124][ T5609] Cannot create hsr debugfs directory [ 78.764539][ T5606] Bluetooth: hci0: command tx timeout [ 78.779075][ T5617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.844502][ T5606] Bluetooth: hci1: command tx timeout [ 78.867362][ T5617] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.883388][ T1114] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.883500][ T1114] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.889301][ T5609] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 78.897105][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 78.897955][ T5609] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 78.909207][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 78.913494][ T5609] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 78.930622][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 78.949881][ T257] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.949952][ T257] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.952127][ T5605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.952364][ T5609] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 78.958410][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 79.004919][ T4928] Bluetooth: hci2: command tx timeout [ 79.005003][ T5606] Bluetooth: hci3: command tx timeout [ 79.049287][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.059223][ T5605] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.082759][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.083102][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.105559][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.122879][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.122979][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.142551][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.142642][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.177869][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.177932][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.288660][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.366056][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.383567][ T1114] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.383658][ T1114] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.416173][ T1114] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.416270][ T1114] bridge0: port 2(bridge_slave_1) entered forwarding state [ 80.025145][ T5617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.175333][ T5617] veth0_vlan: entered promiscuous mode [ 80.193635][ T5617] veth1_vlan: entered promiscuous mode [ 80.242543][ T5605] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.273365][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.322617][ T5617] veth0_macvtap: entered promiscuous mode [ 80.350989][ T5617] veth1_macvtap: entered promiscuous mode [ 80.387187][ T5605] veth0_vlan: entered promiscuous mode [ 80.402355][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.422894][ T5605] veth1_vlan: entered promiscuous mode [ 80.431624][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.452969][ T5617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.472763][ T5615] veth0_vlan: entered promiscuous mode [ 80.500912][ T5615] veth1_vlan: entered promiscuous mode [ 80.537755][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.538631][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.538816][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.557721][ T5605] veth0_macvtap: entered promiscuous mode [ 80.562395][ T5605] veth1_macvtap: entered promiscuous mode [ 80.597007][ T1114] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.600381][ T5609] veth0_vlan: entered promiscuous mode [ 80.648789][ T5609] veth1_vlan: entered promiscuous mode [ 80.665729][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.690405][ T5605] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.721433][ T232] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.721457][ T232] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.752671][ T5615] veth0_macvtap: entered promiscuous mode [ 80.764607][ T257] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.785776][ T1114] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.785843][ T1114] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.788350][ T5615] veth1_macvtap: entered promiscuous mode [ 80.821481][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.821502][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.844326][ T5606] Bluetooth: hci0: command tx timeout [ 80.880094][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.881761][ T5609] veth0_macvtap: entered promiscuous mode [ 80.891346][ T5609] veth1_macvtap: entered promiscuous mode [ 80.904380][ T1114] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.922377][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.931023][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.931226][ T5606] Bluetooth: hci1: command tx timeout [ 80.945676][ T1114] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.946015][ T1114] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.946324][ T1114] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.963624][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.993776][ T5617] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 81.045664][ T257] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.045683][ T257] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.055691][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.055733][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.055763][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.055794][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.055823][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.089447][ T4928] Bluetooth: hci2: command tx timeout [ 81.089531][ T5606] Bluetooth: hci3: command tx timeout [ 81.188146][ T5776] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 81.189782][ T257] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.189801][ T257] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.288945][ T257] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.288966][ T257] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.343877][ T5776] kvm: emulating exchange as write [ 81.357071][ T1853] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.357092][ T1853] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.454560][ T3345] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.454580][ T3345] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.524489][ T257] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.524510][ T257] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.000467][ T33] audit: type=1800 audit(1792096367.044:2): pid=5793 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.5" name="file2" dev="sda1" ino=2043 res=0 errno=-22 [ 82.160474][ T5799] __find_get_block_slow() failed. block=72057594037927937, b_blocknr=1, b_state=0x00626019, b_size=4096, device sda1 blocksize: 4096 [ 82.160506][ T5799] grow_buffers: requested out-of-range block 72057594037927937 for device sda1 [ 82.160522][ T5799] EXT4-fs warning (device sda1): ext4_resize_fs:2021: can't read last block, resize aborted [ 82.189938][ T992] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 82.372180][ T992] usb 2-1: New USB device found: idVendor=0644, idProduct=8047, bcdDevice=1.00 [ 82.387927][ T992] usb 2-1: config 1 has an invalid interface number: 3 but max is 0 [ 82.387952][ T992] usb 2-1: config 1 has no interface number 0 [ 82.394622][ T992] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.394648][ T992] usb 2-1: Product: syz [ 82.394662][ T992] usb 2-1: Manufacturer: syz [ 82.394675][ T992] usb 2-1: SerialNumber: syz [ 82.485638][ T992] usb 2-1: 3:0 : does not exist [ 82.485661][ T992] usb 2-1: 3:0 : does not exist [ 82.810841][ T992] usb 2-1: USB disconnect, device number 2 [ 82.917187][ T33] audit: type=1800 audit(1792096367.954:3): pid=5817 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.9" name="file2" dev="sda1" ino=2043 res=0 errno=-22 [ 82.924728][ T5606] Bluetooth: hci0: command tx timeout [ 83.005490][ T5606] Bluetooth: hci1: command tx timeout [ 83.144686][ T5698] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 83.165132][ T4928] Bluetooth: hci2: command tx timeout [ 83.165180][ T5606] Bluetooth: hci3: command tx timeout [ 83.296603][ T5698] usb 3-1: New USB device found: idVendor=0572, idProduct=cafe, bcdDevice=1.00 [ 83.297887][ T5698] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.420585][ T5834] mmap: syz.0.13 (5834) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 83.563676][ T5815] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 83.572602][ T5815] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 83.759571][ T5847] FAULT_INJECTION: forcing a failure. [ 83.759571][ T5847] name failslab, interval 1, probability 0, space 0, times 1 [ 83.759611][ T5847] CPU: 1 UID: 0 PID: 5847 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) [ 83.759635][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 83.759660][ T5847] Call Trace: [ 83.759672][ T5847] [ 83.759681][ T5847] dump_stack_lvl+0xe8/0x150 [ 83.759712][ T5847] should_fail_ex+0x3eb/0x540 [ 83.759753][ T5847] should_failslab+0xa8/0x100 [ 83.759773][ T5847] ? dst_alloc+0x105/0x170 [ 83.759802][ T5847] kmem_cache_alloc_noprof+0x9c/0x600 [ 83.759830][ T5847] ? dst_alloc+0x105/0x170 [ 83.759863][ T5847] dst_alloc+0x105/0x170 [ 83.759890][ T5847] ? ip_check_mc_rcu+0x68a/0x7c0 [ 83.759922][ T5847] ip_route_output_key_hash_rcu+0x14ac/0x2720 [ 83.759952][ T5847] ? ip_route_output_key_hash+0xd8/0x2a0 [ 83.759976][ T5847] ip_route_output_key_hash+0x18d/0x2a0 [ 83.759998][ T5847] ? register_lock_class+0x31/0x2e0 [ 83.760042][ T5847] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 83.760066][ T5847] ? lock_acquire+0x115/0x350 [ 83.760090][ T5847] ip_route_output_flow+0x2a/0x150 [ 83.760108][ T5847] ? security_sk_classify_flow+0x6d/0x150 [ 83.760131][ T5847] udp_sendmsg+0x144a/0x2140 [ 83.760171][ T5847] ? __pfx_udp_sendmsg+0x10/0x10 [ 83.760201][ T5847] ? trace_hrtimer_start+0x82/0x200 [ 83.760232][ T5847] ? hrtimer_start_range_ns_common+0x7cd/0xb60 [ 83.760269][ T5847] ? finish_task_switch+0x40e/0xc60 [ 83.760289][ T5847] ? lockdep_hardirqs_on+0x7b/0x110 [ 83.760311][ T5847] ? rcu_is_watching+0x16/0xb0 [ 83.760333][ T5847] ? trace_sched_exit_tp+0x3a/0x130 [ 83.760351][ T5847] ? begin_current_label_crit_section+0x299/0x830 [ 83.760388][ T5847] udpv6_sendmsg+0x915/0x2610 [ 83.760427][ T5847] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 83.760486][ T5847] ? __pfx_current_check_autobind_udp_socket+0x10/0x10 [ 83.760527][ T5847] ? inet_send_prepare+0x5b/0x260 [ 83.760552][ T5847] ? inet6_sendmsg+0xe4/0x120 [ 83.760574][ T5847] ? __pfx_inet6_sendmsg+0x10/0x10 [ 83.760594][ T5847] sock_sendmsg_nosec+0x90/0x190 [ 83.760625][ T5847] sock_write_iter+0x2de/0x3e0 [ 83.760654][ T5847] ? __pfx_sock_write_iter+0x10/0x10 [ 83.760686][ T5847] ? bpf_lsm_file_permission+0x9/0x20 [ 83.760703][ T5847] ? security_file_permission+0x75/0x260 [ 83.760740][ T5847] vfs_write+0x612/0xba0 [ 83.760777][ T5847] ? __pfx_vfs_write+0x10/0x10 [ 83.760807][ T5847] ? __fget_files+0x3a2/0x420 [ 83.760832][ T5847] ? __fget_files+0x2a/0x420 [ 83.760860][ T5847] ? fdget+0x1ac/0x250 [ 83.760892][ T5847] ksys_write+0x150/0x270 [ 83.760922][ T5847] ? __pfx_ksys_write+0x10/0x10 [ 83.760959][ T5847] do_syscall_64+0x166/0x520 [ 83.760980][ T5847] ? trace_irq_disable+0x3b/0x140 [ 83.760998][ T5847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.761017][ T5847] ? clear_bhb_loop+0x70/0xc0 [ 83.761039][ T5847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.761057][ T5847] RIP: 0033:0x7fe236d9e559 [ 83.761082][ T5847] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 83.761097][ T5847] RSP: 002b:00007fe237bd4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 83.761123][ T5847] RAX: ffffffffffffffda RBX: 00007fe237025fa0 RCX: 00007fe236d9e559 [ 83.761137][ T5847] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 83.761148][ T5847] RBP: 00007fe236e358b0 R08: 0000000000000000 R09: 0000000000000000 [ 83.761159][ T5847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 83.761169][ T5847] R13: 00007fe237026038 R14: 00007fe237025fa0 R15: 00007fff03df81e8 [ 83.761199][ T5847] [ 84.039495][ T5698] cxacru 3-1:1.0: wrong cm 0xa0 in response to cm 0x91 [ 84.039559][ T5698] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -5 [ 84.039571][ T5698] ATM dev 0: usbatm_atm_init: atm_start failed: -5! [ 84.183461][ T5698] cxacru 3-1:1.0: probe with driver cxacru failed with error -5 [ 84.199700][ T5698] usb 3-1: USB disconnect, device number 2 [ 84.362902][ T33] audit: type=1800 audit(1792096369.404:4): pid=5859 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.22" name="file2" dev="sda1" ino=2043 res=0 errno=-22 [ 84.689288][ T5868] FAULT_INJECTION: forcing a failure. [ 84.689288][ T5868] name failslab, interval 1, probability 0, space 0, times 0 [ 84.689319][ T5868] CPU: 1 UID: 0 PID: 5868 Comm: syz.2.25 Not tainted syzkaller #0 PREEMPT(full) [ 84.689340][ T5868] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 84.689350][ T5868] Call Trace: [ 84.689356][ T5868] [ 84.689364][ T5868] dump_stack_lvl+0xe8/0x150 [ 84.689393][ T5868] should_fail_ex+0x3eb/0x540 [ 84.689423][ T5868] should_failslab+0xa8/0x100 [ 84.689441][ T5868] ? __kernfs_new_node+0xe6/0x980 [ 84.689461][ T5868] kmem_cache_alloc_noprof+0x9c/0x600 [ 84.689483][ T5868] ? kstrdup+0x81/0x100 [ 84.689506][ T5868] ? __kernfs_new_node+0xe6/0x980 [ 84.689531][ T5868] __kernfs_new_node+0xe6/0x980 [ 84.689559][ T5868] ? __pfx___kernfs_new_node+0x10/0x10 [ 84.689577][ T5868] ? kernfs_root+0x1c/0x230 [ 84.689601][ T5868] ? kernfs_root+0x1c/0x230 [ 84.689621][ T5868] ? kernfs_root+0x1c/0x230 [ 84.689645][ T5868] kernfs_new_node+0xeb/0x140 [ 84.689669][ T5868] __kernfs_create_file+0x4b/0x2e0 [ 84.689696][ T5868] cgroup_addrm_files+0x8f4/0xd50 [ 84.689734][ T5868] ? __pfx_cgroup_addrm_files+0x10/0x10 [ 84.689782][ T5868] ? css_next_descendant_pre+0x17d/0x260 [ 84.689808][ T5868] css_populate_dir+0x2ba/0x3d0 [ 84.689829][ T5868] cgroup_mkdir+0x11fd/0x14b0 [ 84.689861][ T5868] ? __pfx_cgroup_mkdir+0x10/0x10 [ 84.689885][ T5868] kernfs_iop_mkdir+0x213/0x360 [ 84.689910][ T5868] vfs_mkdir+0x40e/0x630 [ 84.689938][ T5868] filename_mkdirat+0x285/0x510 [ 84.689957][ T5868] ? __might_fault+0xaf/0x130 [ 84.689983][ T5868] ? __pfx_filename_mkdirat+0x10/0x10 [ 84.690007][ T5868] ? do_getname+0x151/0x250 [ 84.690033][ T5868] __se_sys_mkdirat+0x35/0x150 [ 84.690056][ T5868] do_syscall_64+0x166/0x520 [ 84.690078][ T5868] ? trace_irq_disable+0x3b/0x140 [ 84.690096][ T5868] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.690114][ T5868] ? clear_bhb_loop+0x70/0xc0 [ 84.690137][ T5868] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.690156][ T5868] RIP: 0033:0x7f9d2179e559 [ 84.690173][ T5868] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 84.690187][ T5868] RSP: 002b:00007f9d1f9f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 84.690208][ T5868] RAX: ffffffffffffffda RBX: 00007f9d21a25fa0 RCX: 00007f9d2179e559 [ 84.690222][ T5868] RDX: 00000000000001ff RSI: 0000200000000300 RDI: ffffffffffffff9c [ 84.690234][ T5868] RBP: 00007f9d218358b0 R08: 0000000000000000 R09: 0000000000000000 [ 84.690244][ T5868] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 84.690255][ T5868] R13: 00007f9d21a26038 R14: 00007f9d21a25fa0 R15: 00007ffee2cbea38 [ 84.690292][ T5868] [ 84.690398][ T5868] cgroup: cgroup_addrm_files: failed to add cgroup.max.descendants, err=-12 [ 85.011081][ T5874] gadgetfs: bound to dummy_udc driver [ 85.073262][ T5876] netlink: 132 bytes leftover after parsing attributes in process `syz.3.28'. [ 85.091703][ T5876] syz.3.28 uses obsolete (PF_INET,SOCK_PACKET) [ 85.254031][ T5698] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 85.254283][ C1] gadgetfs: connected [ 85.255235][ T5698] gadgetfs: disconnected [ 85.400798][ T5889] netlink: 'syz.3.33': attribute type 4 has an invalid length. [ 85.430295][ T5889] netlink: 'syz.3.33': attribute type 4 has an invalid length. [ 85.448723][ T5889] lo: entered allmulticast mode [ 85.572501][ T5895] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 85.910115][ T3345] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.988397][ T5723] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 86.020267][ T3345] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.109283][ T3345] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.143441][ T5619] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 86.145520][ T5619] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 86.146573][ T5619] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 86.147918][ T5619] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 86.148450][ T5619] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 86.151305][ T5723] usb 4-1: Using ep0 maxpacket: 16 [ 86.161604][ T5723] usb 4-1: New USB device found: idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 86.200854][ T5723] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 86.200885][ T5723] usb 4-1: config 0 interface 0 has no altsetting 0 [ 86.215468][ T5723] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.215493][ T5723] usb 4-1: Product: syz [ 86.215505][ T5723] usb 4-1: Manufacturer: syz [ 86.215518][ T5723] usb 4-1: SerialNumber: syz [ 86.236658][ T3345] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.256946][ T5698] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 86.260017][ T5723] usb 4-1: config 0 descriptor?? [ 86.404743][ T5698] usb 1-1: Using ep0 maxpacket: 32 [ 86.413320][ T5698] usb 1-1: unable to get BOS descriptor or descriptor too short [ 86.413368][ T5698] usb 1-1: New USB device found: idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 86.439140][ T5698] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 86.439186][ T5698] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 86.439203][ T5698] usb 1-1: config 14 has no interface number 0 [ 86.439215][ T5698] usb 1-1: config 14 has no interface number 1 [ 86.439265][ T5698] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 86.439283][ T5698] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 86.439320][ T5698] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 86.439338][ T5698] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 86.439359][ T5698] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 86.439379][ T5698] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 86.439401][ T5698] usb 1-1: config 14 interface 57 has no altsetting 0 [ 86.439416][ T5698] usb 1-1: config 14 interface 228 has no altsetting 0 [ 86.443867][ T3345] bridge_slave_1: left allmulticast mode [ 86.454797][ T3345] bridge_slave_1: left promiscuous mode [ 86.455504][ T3345] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.461432][ T5698] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.461456][ T5698] usb 1-1: Product: syz [ 86.461468][ T5698] usb 1-1: Manufacturer: syz [ 86.461480][ T5698] usb 1-1: SerialNumber: syz [ 86.487774][ T3345] bridge_slave_0: left allmulticast mode [ 86.487797][ T3345] bridge_slave_0: left promiscuous mode [ 86.488000][ T3345] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.627624][ C1] imon 4-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 86.633587][ T5723] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input5 [ 86.675623][ T5723] imon:send_packet: packet tx failed (-71) [ 86.694022][ T5723] imon 4-1:0.0: panel buttons/knobs setup failed [ 86.776778][ T5723] rc_core: IR keymap rc-imon-pad not found [ 86.776797][ T5723] Registered IR keymap rc-empty [ 86.777092][ T5723] imon 4-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 86.777110][ T5723] imon 4-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 86.780017][ T5723] imon:send_packet: packet tx failed (-71) [ 86.806001][ T5723] imon 4-1:0.0: remote input dev register failed [ 86.806536][ T5723] imon 4-1:0.0: imon_init_intf0: rc device setup failed [ 86.906180][ T5723] imon 4-1:0.0: unable to initialize intf0, err 0 [ 86.942742][ T5723] usb 4-1: USB disconnect, device number 2 [ 86.952505][ T9] cfg80211: failed to load regulatory.db [ 87.065439][ T5698] legousbtower 1-1:14.57: interrupt endpoints not found [ 87.083122][ T3345] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 87.097754][ T3345] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 87.100091][ T3345] bond0 (unregistering): Released all slaves [ 87.264945][ T5723] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 87.341506][ T5907] rxe_eth0 speed is unknown, defaulting to 1000 [ 87.386290][ T5273] 8021q: adding VLAN 0 to HW filter on device eth1 [ 87.404165][ T4928] Bluetooth: hci4: command 0x1003 tx timeout [ 87.404370][ T5606] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 87.433156][ T5723] usb 4-1: New USB device found: idVendor=15c2, idProduct=0045, bcdDevice=1f.20 [ 87.444380][ T5723] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 87.444413][ T5723] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid maxpacket 198, setting to 64 [ 87.444459][ T5723] usb 4-1: config 0 interface 0 has no altsetting 0 [ 87.483173][ T5723] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.483219][ T5723] usb 4-1: Product: syz [ 87.483232][ T5723] usb 4-1: Manufacturer: syz [ 87.483244][ T5723] usb 4-1: SerialNumber: syz [ 87.505789][ T5698] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 0.0 build 0 [ 87.528101][ T5698] legousbtower 1-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 87.529263][ T5723] usb 4-1: config 0 descriptor?? [ 87.529977][ T5902] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 87.768666][ C1] imon 4-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 87.782126][ T5723] input: iMON Panel, Knob and Mouse(15c2:0045) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input7 [ 88.088029][ T5723] rc_core: IR keymap rc-imon-pad not found [ 88.088047][ T5723] Registered IR keymap rc-empty [ 88.088116][ T5723] imon 4-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 88.088132][ T5723] imon 4-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 88.142715][ T992] usb 1-1: USB disconnect, device number 3 [ 88.142819][ C0] usb 1-1: tower_interrupt_in_callback: usb_submit_urb failed (-19) [ 88.161559][ T5947] usb 1-1: Couldn't submit interrupt_out_urb -19 [ 88.195821][ T5723] rc rc0: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 88.203227][ T992] legousbtower 1-1:14.228: LEGO USB Tower #-160 now disconnected [ 88.204461][ T5606] Bluetooth: hci1: command tx timeout [ 88.213651][ T5723] input: iMON Remote (15c2:0045) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input8 [ 88.241998][ T5723] imon 4-1:0.0: iMON device (15c2:0045) on usb<4:3> initialized [ 88.253181][ T3345] hsr_slave_0: left promiscuous mode [ 88.261537][ T3345] hsr_slave_1: left promiscuous mode [ 88.262433][ T3345] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 88.262466][ T3345] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 88.288941][ T3345] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 88.289054][ T3345] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 88.318159][ T3345] veth1_macvtap: left promiscuous mode [ 88.318218][ T3345] veth0_macvtap: left promiscuous mode [ 88.318352][ T3345] veth1_vlan: left promiscuous mode [ 88.318428][ T3345] veth0_vlan: left promiscuous mode [ 88.665783][ T5723] usb 4-1: USB disconnect, device number 3 [ 88.795860][ T3345] team0 (unregistering): Port device team_slave_1 removed [ 88.802258][ T3345] team0 (unregistering): Port device team_slave_0 removed [ 88.874695][ T992] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 89.024933][ T992] usb 3-1: Using ep0 maxpacket: 16 [ 89.025252][ T5273] 8021q: adding VLAN 0 to HW filter on device eth2 [ 89.025627][ T992] usb 3-1: New USB device found: idVendor=1d6b, idProduct=0101, bcdDevice=0.40 [ 89.027007][ T992] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 89.027028][ T992] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 89.034610][ T992] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.034633][ T992] usb 3-1: Product: syz [ 89.034645][ T992] usb 3-1: Manufacturer: syz [ 89.034657][ T992] usb 3-1: SerialNumber: syz [ 89.071600][ T992] usb 3-1: 0:2 : does not exist [ 89.088423][ T5723] rxe_eth0 speed is unknown, defaulting to 1000 [ 89.321389][ T992] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 89.529018][ T992] usb 3-1: USB disconnect, device number 3 [ 89.577073][ T5975] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 89.655091][ T5975] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 89.680113][ T5612] udevd[5612]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 89.765081][ T5907] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.767209][ T5907] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.767372][ T5907] bridge_slave_0: entered allmulticast mode [ 89.771360][ T5907] bridge_slave_0: entered promiscuous mode [ 89.783185][ T5907] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.787528][ T5907] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.787695][ T5907] bridge_slave_1: entered allmulticast mode [ 89.791397][ T5907] bridge_slave_1: entered promiscuous mode [ 89.919451][ T5907] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.936892][ T5907] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.058843][ T5907] team0: Port device team_slave_0 added [ 90.068939][ T5907] team0: Port device team_slave_1 added [ 90.149785][ T5907] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.149802][ T5907] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.149826][ T5907] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.156510][ T5907] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.156525][ T5907] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.156548][ T5907] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.247576][ T5708] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 90.284043][ T5606] Bluetooth: hci1: command tx timeout [ 90.290337][ T5907] hsr_slave_0: entered promiscuous mode [ 90.291243][ T5907] hsr_slave_1: entered promiscuous mode [ 90.291888][ T5907] debugfs: 'hsr0' already exists in 'hsr' [ 90.291905][ T5907] Cannot create hsr debugfs directory [ 90.404778][ T5708] usb 4-1: New USB device found: idVendor=056a, idProduct=033b, bcdDevice=0.00 [ 90.405316][ T5708] usb 4-1: config 0 has no interfaces? [ 90.405345][ T5708] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.414709][ T5708] usb 4-1: config 0 descriptor?? [ 90.568069][ T5995] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 90.757851][ T5907] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 90.773154][ T5907] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 90.779349][ T5907] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 90.797597][ T5907] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 90.801117][ T5907] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 90.804161][ T992] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 90.815450][ T5907] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 90.817544][ T5907] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 90.832096][ T5907] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 90.957018][ T992] usb 1-1: New USB device found: idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 90.964387][ T992] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 90.964439][ T992] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 255 [ 90.964459][ T992] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 90.969341][ T992] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 90.969368][ T992] usb 1-1: Product: syz [ 90.969380][ T992] usb 1-1: Manufacturer: syz [ 90.969391][ T992] usb 1-1: SerialNumber: syz [ 90.976900][ T992] usb 1-1: config 0 descriptor?? [ 90.985882][ T5995] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 90.989652][ T992] usb 1-1: ucan: probing device on interface #0 [ 90.989677][ T992] usb 1-1: ucan: invalid EP count (1) [ 90.989690][ T992] usb 1-1: ucan: probe failed; try to update the device firmware [ 91.122201][ T5770] usb 4-1: USB disconnect, device number 4 [ 91.167093][ T5907] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.215361][ T5907] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.236159][ T3345] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.236314][ T3345] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.256726][ T32] usb 1-1: USB disconnect, device number 4 [ 91.273317][ T232] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.273414][ T232] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.421771][ T5273] 8021q: adding VLAN 0 to HW filter on device eth3 [ 91.832881][ T6041] [ 91.835244][ T6041] ====================================================== [ 91.842268][ T6041] WARNING: possible circular locking dependency detected [ 91.849304][ T6041] syzkaller #0 Not tainted [ 91.853726][ T6041] ------------------------------------------------------ [ 91.860778][ T6041] syz.3.56/6041 is trying to acquire lock: [ 91.866588][ T6041] ffff88802af694d0 (&type->i_mutex_dir_key#5){++++}-{4:4}, at: lookup_slow+0x46/0x80 [ 91.876100][ T6041] [ 91.876100][ T6041] but task is already holding lock: [ 91.883510][ T6041] ffff88807db5be40 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}, at: __d_alloc_parallel+0x39e/0x1700 [ 91.893373][ T6041] [ 91.893373][ T6041] which lock already depends on the new lock. [ 91.893373][ T6041] [ 91.903794][ T6041] [ 91.903794][ T6041] the existing dependency chain (in reverse order) is: [ 91.912994][ T6041] [ 91.912994][ T6041] -> #1 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}: [ 91.920862][ T6041] __d_alloc_parallel+0xc32/0x1700 [ 91.926515][ T6041] __lookup_slow+0x82/0x2f0 [ 91.931571][ T6041] lookup_slow+0x59/0x80 [ 91.936352][ T6041] link_path_walk+0xd22/0x1910 [ 91.941751][ T6041] path_openat+0x1b7/0x20f0 [ 91.946789][ T6041] do_file_open+0x23e/0x4a0 [ 91.951844][ T6041] do_sys_openat2+0x115/0x200 [ 91.957077][ T6041] __x64_sys_openat+0x138/0x170 [ 91.962465][ T6041] do_syscall_64+0x166/0x520 [ 91.967596][ T6041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.974034][ T6041] [ 91.974034][ T6041] -> #0 (&type->i_mutex_dir_key#5){++++}-{4:4}: [ 91.982485][ T6041] __lock_acquire+0x164c/0x2de0 [ 91.987879][ T6041] lock_acquire+0x115/0x350 [ 91.992918][ T6041] down_read+0x45/0x320 [ 91.997628][ T6041] lookup_slow+0x46/0x80 [ 92.002416][ T6041] ovl_lookup_single+0x323/0xe90 [ 92.007982][ T6041] ovl_lookup_layer+0x377/0x440 [ 92.013376][ T6041] ovl_lookup+0x5e5/0x1c80 [ 92.018333][ T6041] lookup_open+0x94b/0x1970 [ 92.023372][ T6041] path_openat+0x70c/0x20f0 [ 92.028413][ T6041] do_file_open+0x23e/0x4a0 [ 92.033690][ T6041] do_sys_openat2+0x115/0x200 [ 92.038922][ T6041] __x64_sys_openat+0x138/0x170 [ 92.044410][ T6041] do_syscall_64+0x166/0x520 [ 92.049753][ T6041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.056199][ T6041] [ 92.056199][ T6041] other info that might help us debug this: [ 92.056199][ T6041] [ 92.066432][ T6041] Possible unsafe locking scenario: [ 92.066432][ T6041] [ 92.073891][ T6041] CPU0 CPU1 [ 92.079296][ T6041] ---- ---- [ 92.084681][ T6041] lock(DCACHE_PAR_LOOKUP); [ 92.089290][ T6041] lock(&type->i_mutex_dir_key#5); [ 92.097046][ T6041] lock(DCACHE_PAR_LOOKUP); [ 92.104172][ T6041] rlock(&type->i_mutex_dir_key#5); [ 92.109484][ T6041] [ 92.109484][ T6041] *** DEADLOCK *** [ 92.109484][ T6041] [ 92.117638][ T6041] locks held by syz.3.56/6041: 3, last CPU#1: [ 92.123718][ T6041] #0: ffff888033496460 (sb_writers#14){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 92.133007][ T6041] #1: ffff88805917a230 (&ovl_i_mutex_dir_key[depth]){+.+.}-{4:4}, at: lookup_open+0x246/0x1970 [ 92.143500][ T6041] #2: ffff88807db5be40 (DCACHE_PAR_LOOKUP){+.+.}-{0:0}, at: __d_alloc_parallel+0x39e/0x1700 [ 92.153795][ T6041] [ 92.153795][ T6041] stack backtrace: [ 92.159704][ T6041] CPU: 1 UID: 0 PID: 6041 Comm: syz.3.56 Not tainted syzkaller #0 PREEMPT(full) [ 92.168822][ T6041] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.178887][ T6041] Call Trace: [ 92.182183][ T6041] [ 92.185133][ T6041] dump_stack_lvl+0xe8/0x150 [ 92.186598][ T5273] 8021q: adding VLAN 0 to HW filter on device eth4 [ 92.196226][ T6041] print_circular_bug+0x2e2/0x300 [ 92.201287][ T6041] check_noncircular+0x12f/0x150 [ 92.206251][ T6041] __lock_acquire+0x164c/0x2de0 [ 92.211228][ T6041] ? lock_acquire+0x115/0x350 [ 92.215911][ T6041] lock_acquire+0x115/0x350 [ 92.220409][ T6041] ? lookup_slow+0x46/0x80 [ 92.224827][ T6041] down_read+0x45/0x320 [ 92.228977][ T6041] ? lookup_slow+0x46/0x80 [ 92.233418][ T6041] ? d_lookup+0x8a/0xa0 [ 92.237571][ T6041] lookup_slow+0x46/0x80 [ 92.241826][ T6041] ovl_lookup_single+0x323/0xe90 [ 92.247026][ T6041] ? __pfx_ovl_lookup_single+0x10/0x10 [ 92.252501][ T6041] ? tomoyo_path_number_perm+0x219/0x5f0 [ 92.258141][ T6041] ? hook_capable+0x1c3/0x5e0 [ 92.262822][ T6041] ? tomoyo_path_number_perm+0x574/0x5f0 [ 92.268624][ T6041] ovl_lookup_layer+0x377/0x440 [ 92.273500][ T6041] ovl_lookup+0x5e5/0x1c80 [ 92.277909][ T6041] ? apparmor_capable+0x126/0x170 [ 92.282935][ T6041] ? generic_permission+0x32e/0x660 [ 92.288173][ T6041] ? __pfx_ovl_lookup+0x10/0x10 [ 92.293031][ T6041] ? __pfx_ovl_permission+0x10/0x10 [ 92.298234][ T6041] ? __pfx_tomoyo_path_mknod+0x10/0x10 [ 92.303716][ T6041] ? from_kgid+0x1c6/0x660 [ 92.308129][ T6041] ? bpf_lsm_inode_create+0x9/0x20 [ 92.313235][ T6041] ? security_inode_create+0xc3/0x340 [ 92.318599][ T6041] lookup_open+0x94b/0x1970 [ 92.323181][ T6041] path_openat+0x70c/0x20f0 [ 92.327764][ T6041] do_file_open+0x23e/0x4a0 [ 92.332254][ T6041] ? __pfx_do_file_open+0x10/0x10 [ 92.337286][ T6041] ? _raw_spin_unlock+0x28/0x50 [ 92.342593][ T6041] ? alloc_fd+0x6af/0x760 [ 92.346949][ T6041] do_sys_openat2+0x115/0x200 [ 92.351657][ T6041] ? __se_sys_futex+0x3a8/0x450 [ 92.356530][ T6041] ? __pfx_do_sys_openat2+0x10/0x10 [ 92.361741][ T6041] ? rcu_is_watching+0x16/0xb0 [ 92.366516][ T6041] __x64_sys_openat+0x138/0x170 [ 92.371379][ T6041] do_syscall_64+0x166/0x520 [ 92.375970][ T6041] ? trace_irq_disable+0x3b/0x140 [ 92.380991][ T6041] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.387060][ T6041] ? clear_bhb_loop+0x70/0xc0 [ 92.391733][ T6041] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.397619][ T6041] RIP: 0033:0x7fe3d359e559 [ 92.402027][ T6041] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.421631][ T6041] RSP: 002b:00007fe3d43cb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 92.430047][ T6041] RAX: ffffffffffffffda RBX: 00007fe3d3825fa0 RCX: 00007fe3d359e559 [ 92.438016][ T6041] RDX: 0000000000008042 RSI: 0000200000000280 RDI: ffffffffffffff9c [ 92.446093][ T6041] RBP: 00007fe3d36358b0 R08: 0000000000000000 R09: 0000000000000000 [ 92.454080][ T6041] R10: 0000000000000034 R11: 0000000000000246 R12: 0000000000000000 [ 92.462059][ T6041] R13: 00007fe3d3826038 R14: 00007fe3d3825fa0 R15: 00007ffd663d0758 [ 92.470049][ T6041] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 92.480211][ T5606] Bluetooth: hci1: command tx timeout [ 92.887640][ T3345] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 92.978828][ T3345] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.030238][ T3345] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.079816][ T3345] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 93.148484][ T3345] bridge_slave_1: left allmulticast mode [ 93.148507][ T3345] bridge_slave_1: left promiscuous mode [ 93.148642][ T3345] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.152062][ T3345] bridge_slave_0: left allmulticast mode [ 93.152083][ T3345] bridge_slave_0: left promiscuous mode [ 93.152221][ T3345] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.244711][ T3345] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 93.246241][ T3345] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 93.247235][ T3345] bond0 (unregistering): Released all slaves [ 93.479269][ T3345] hsr_slave_0: left promiscuous mode [ 93.479692][ T3345] hsr_slave_1: left promiscuous mode [ 93.480171][ T3345] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 93.480185][ T3345] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 93.480620][ T3345] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 93.480633][ T3345] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 93.483323][ T3345] veth1_macvtap: left promiscuous mode [ 93.483348][ T3345] veth0_macvtap: left promiscuous mode [ 93.483403][ T3345] veth1_vlan: left promiscuous mode [ 93.483441][ T3345] veth0_vlan: left promiscuous mode [ 93.644992][ T3345] team0 (unregistering): Port device team_slave_1 removed [ 93.647635][ T3345] team0 (unregistering): Port device team_slave_0 removed [ 93.694848][ T5273] 8021q: adding VLAN 0 to HW filter on device eth5 [ 93.945665][ T5273] 8021q: adding VLAN 0 to HW filter on device eth6 [ 94.148092][ T5273] 8021q: adding VLAN 0 to HW filter on device eth7 [ 94.280382][ T3345] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.303701][ T3345] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.344221][ T3345] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.390103][ T3345] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.463705][ T3345] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.475732][ T5273] 8021q: adding VLAN 0 to HW filter on device eth8 [ 94.490876][ T3345] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.534592][ T3345] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.580614][ T3345] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.660004][ T3345] bridge_slave_1: left allmulticast mode [ 94.660028][ T3345] bridge_slave_1: left promiscuous mode [ 94.660160][ T3345] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.686119][ T3345] bridge_slave_0: left allmulticast mode [ 94.686141][ T3345] bridge_slave_0: left promiscuous mode [ 94.686277][ T3345] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.715465][ T3345] bridge_slave_1: left allmulticast mode [ 94.715488][ T3345] bridge_slave_1: left promiscuous mode [ 94.715613][ T3345] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.716979][ T3345] bridge_slave_0: left allmulticast mode [ 94.716999][ T3345] bridge_slave_0: left promiscuous mode [ 94.717148][ T3345] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.755126][ T3345] bridge_slave_1: left allmulticast mode [ 94.755150][ T3345] bridge_slave_1: left promiscuous mode [ 94.755299][ T3345] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.767651][ T3345] bridge_slave_0: left allmulticast mode [ 94.767672][ T3345] bridge_slave_0: left promiscuous mode [ 94.767795][ T3345] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.857257][ T3345] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 94.858485][ T3345] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 94.859092][ T3345] bond0 (unregistering): Released all slaves [ 94.904162][ T3345] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 94.905224][ T3345] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 94.905859][ T3345] bond0 (unregistering): Released all slaves [ 94.943208][ T3345] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 94.953850][ T3345] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 94.965410][ T3345] bond0 (unregistering): Released all slaves [ 94.968478][ T5273] 8021q: adding VLAN 0 to HW filter on device eth9 [ 95.227335][ T5273] 8021q: adding VLAN 0 to HW filter on device eth10 [ 95.563104][ T5273] 8021q: adding VLAN 0 to HW filter on device eth11 [ 95.573684][ T3345] hsr_slave_0: left promiscuous mode [ 95.583231][ T3345] hsr_slave_1: left promiscuous mode [ 95.583810][ T3345] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 95.584925][ T3345] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 95.607222][ T3345] hsr_slave_0: left promiscuous mode [ 95.607628][ T3345] hsr_slave_1: left promiscuous mode [ 95.608119][ T3345] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 95.608133][ T3345] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 95.608700][ T3345] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 95.608714][ T3345] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 95.611176][ T3345] hsr_slave_0: left promiscuous mode [ 95.611448][ T3345] hsr_slave_1: left promiscuous mode [ 95.611739][ T3345] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 95.611749][ T3345] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 95.612050][ T3345] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 95.612063][ T3345] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 95.632275][ T3345] veth1_macvtap: left promiscuous mode [ 95.632300][ T3345] veth0_macvtap: left promiscuous mode [ 95.632370][ T3345] veth1_vlan: left promiscuous mode [ 95.632408][ T3345] veth0_vlan: left promiscuous mode [ 95.660314][ T3345] veth1_macvtap: left promiscuous mode [ 95.660339][ T3345] veth0_macvtap: left promiscuous mode [ 95.660402][ T3345] veth1_vlan: left promiscuous mode [ 95.660454][ T3345] veth0_vlan: left promiscuous mode [ 95.819543][ T3345] team0 (unregistering): Port device team_slave_1 removed [ 95.822256][ T3345] team0 (unregistering): Port device team_slave_0 removed [ 95.903769][ T3345] team0 (unregistering): Port device team_slave_1 removed [ 95.916260][ T3345] team0 (unregistering): Port device team_slave_0 removed [ 95.998820][ T3345] team0 (unregistering): Port device team_slave_1 removed [ 96.001421][ T3345] team0 (unregistering): Port device team_slave_0 removed [ 96.285545][ T5273] 8021q: adding VLAN 0 to HW filter on device eth12 [ 96.539466][ T5273] 8021q: adding VLAN 0 to HW filter on device eth13 [ 96.750213][ T5273] 8021q: adding VLAN 0 to HW filter on device eth14 [ 96.945057][ T5273] 8021q: adding VLAN 0 to HW filter on device eth15 [ 97.154019][ T5273] 8021q: adding VLAN 0 to HW filter on device eth16 [ 97.347540][ T5273] 8021q: adding VLAN 0 to HW filter on device eth18 [ 97.542587][ T5273] 8021q: adding VLAN 0 to HW filter on device eth17 [ 97.733598][ T5273] 8021q: adding VLAN 0 to HW filter on device eth19 [ 97.923681][ T5273] 8021q: adding VLAN 0 to HW filter on device eth20