last executing test programs: 1.861698249s ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000240)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/configs/c.1/acm.usb0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/MaxPower\x00', 0x1, 0x0) write(r0, &(0x7f00000003c0)='500', 0x3) 1.581135785s ago: executing program 3 (id=5): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000), 0x6) syz_emit_vhci(&(0x7f0000001000)=ANY=[@ANYBLOB="040e0401030c00"], 0x7) syz_emit_vhci(&(0x7f0000001100)=ANY=[@ANYBLOB="040e0c010310000000004000000000"], 0xf) syz_emit_vhci(&(0x7f0000001200)=ANY=[@ANYBLOB="040e0c010110000000000000000000"], 0xf) syz_emit_vhci(&(0x7f0000001300)=ANY=[@ANYBLOB="040e0a01091000001122334455"], 0xd) syz_emit_vhci(&(0x7f0000001400)=ANY=[@ANYBLOB="040e0c010320004000000000000000"], 0xf) syz_emit_vhci(&(0x7f0000001500)=ANY=[@ANYBLOB="040e44010210000000000000000000000000000000000000000000000000000000000000000000000000000000000400"/73], 0x47) nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0) 930.193267ms ago: executing program 3 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/ffs.usb0\x00', 0x1ff) rmdir(&(0x7f0000000180)='./config/usb_gadget/g1/functions/ffs.usb0\x00') 554.478234ms ago: executing program 3 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1/bmAttributes\x00', 0x1, 0x0) write(r0, &(0x7f0000000340)='0x80', 0x4) 459.985197ms ago: executing program 3 (id=8): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r0, &(0x7f0000000380)='0\n', 0x2) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') 379.688749ms ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./debug\x00', &(0x7f00000001c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./debug/x86/pat_memtype_list\x00', 0x0, 0x0) read(r0, 0x0, 0x0) read(r0, &(0x7f0000007000)=""/4096, 0x1000) 128.277884ms ago: executing program 1 (id=2): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000180)=[@textreal={0x8, &(0x7f0000000100)="0fc76b000f0666b9030100c066b81153000066ba000000000f30660f1ac8260f01c466b95003000066b80700000066ba000000000f30f3670f4f846d1238a5960f08660f2e6b00d991d88a", 0x4b}], 0x1, 0x48, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f0000000040)={0x47, 0x0, [{0x40000118, 0x0, 0x27}]}) 1.785305ms ago: executing program 2 (id=9): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/target/dbroot\x00', 0x1, 0x0) write(r0, &(0x7f0000000400)='./my_dbroot', 0xb) close(r0) mkdir(&(0x7f0000000500)='./my_dbroot/alua\x00', 0x1ff) mkdir(&(0x7f0000000600)='./my_dbroot/alua/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000700)='./my_dbroot/alua/usb_gadget/naa.1234567890abcdef+1\x00', 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000900)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000a00)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000b00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) mkdir(&(0x7f0000000c00)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdir(&(0x7f0000000d00)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000001800)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/alua_tg_pt_offline\x00', 0x1, 0x0) write(r1, &(0x7f0000001900)='1', 0x1) 0s ago: executing program 3 (id=10): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='usbip-vudc.0\n', 0xd) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.56' (ED25519) to the list of known hosts. [ 86.865952][ T5576] cgroup: Unknown subsys name 'net' [ 87.133850][ T5576] cgroup: Unknown subsys name 'cpuset' [ 87.188410][ T5576] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 89.144467][ T5576] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 91.735532][ T5589] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 91.752621][ T5589] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 91.758282][ T5589] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 91.781912][ T5589] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 91.787227][ T5589] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 91.886596][ T5597] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 91.914488][ T5601] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 91.925880][ T5605] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 91.936258][ T5605] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 91.943281][ T5601] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 91.951008][ T5601] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 91.953793][ T5601] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 91.974669][ T5605] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 91.975965][ T5605] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 92.011921][ T5602] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 92.013320][ T5602] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 92.021178][ T5602] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 92.063230][ T5602] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 92.064903][ T5602] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 92.066231][ T5602] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 92.255721][ T199] cfg80211: failed to load regulatory.db [ 93.940168][ T5589] Bluetooth: hci0: command tx timeout [ 94.098691][ T5589] Bluetooth: hci1: command tx timeout [ 94.257693][ T5589] Bluetooth: hci3: command tx timeout [ 94.257839][ T4904] Bluetooth: hci2: command tx timeout [ 94.389073][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.390499][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.390734][ T5594] bridge_slave_0: entered allmulticast mode [ 94.393829][ T5594] bridge_slave_0: entered promiscuous mode [ 94.474639][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.474918][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.475347][ T5594] bridge_slave_1: entered allmulticast mode [ 94.478647][ T5594] bridge_slave_1: entered promiscuous mode [ 94.481164][ T5592] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.481470][ T5592] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.482001][ T5592] bridge_slave_0: entered allmulticast mode [ 94.497381][ T5592] bridge_slave_0: entered promiscuous mode [ 94.552715][ T5593] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.552986][ T5593] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.553187][ T5593] bridge_slave_0: entered allmulticast mode [ 94.555744][ T5593] bridge_slave_0: entered promiscuous mode [ 94.604544][ T5592] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.604787][ T5592] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.604968][ T5592] bridge_slave_1: entered allmulticast mode [ 94.614753][ T5592] bridge_slave_1: entered promiscuous mode [ 94.647071][ T5593] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.647428][ T5593] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.649311][ T5593] bridge_slave_1: entered allmulticast mode [ 94.666163][ T5593] bridge_slave_1: entered promiscuous mode [ 94.712005][ T5588] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.712323][ T5588] bridge0: port 1(bridge_slave_0) entered disabled state [ 94.712528][ T5588] bridge_slave_0: entered allmulticast mode [ 94.715014][ T5588] bridge_slave_0: entered promiscuous mode [ 94.770385][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.795209][ T5588] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.795547][ T5588] bridge0: port 2(bridge_slave_1) entered disabled state [ 94.796110][ T5588] bridge_slave_1: entered allmulticast mode [ 94.807856][ T5588] bridge_slave_1: entered promiscuous mode [ 94.860361][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.866827][ T5592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.909517][ T5593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 94.939629][ T5592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 94.970590][ T5593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.021124][ T5588] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.051309][ T5594] team0: Port device team_slave_0 added [ 95.082147][ T5588] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.125339][ T5594] team0: Port device team_slave_1 added [ 95.149751][ T5592] team0: Port device team_slave_0 added [ 95.187092][ T5593] team0: Port device team_slave_0 added [ 95.216883][ T5592] team0: Port device team_slave_1 added [ 95.245776][ T5593] team0: Port device team_slave_1 added [ 95.288839][ T5588] team0: Port device team_slave_0 added [ 95.314234][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.314251][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.314270][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.371326][ T5588] team0: Port device team_slave_1 added [ 95.396887][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.396899][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.396919][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.403888][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.403928][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.403988][ T5592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.498899][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.498912][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.498931][ T5593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.501389][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.501400][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.501420][ T5592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.613819][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.613831][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.613850][ T5593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.671338][ T5588] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.671351][ T5588] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.671371][ T5588] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.735722][ T5588] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.735735][ T5588] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 95.735755][ T5588] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.898768][ T5594] hsr_slave_0: entered promiscuous mode [ 95.900817][ T5594] hsr_slave_1: entered promiscuous mode [ 96.017719][ T4904] Bluetooth: hci0: command tx timeout [ 96.174453][ T5592] hsr_slave_0: entered promiscuous mode [ 96.176225][ T5592] hsr_slave_1: entered promiscuous mode [ 96.179501][ T4904] Bluetooth: hci1: command tx timeout [ 96.180157][ T5592] debugfs: 'hsr0' already exists in 'hsr' [ 96.180318][ T5592] Cannot create hsr debugfs directory [ 96.262108][ T5593] hsr_slave_0: entered promiscuous mode [ 96.263915][ T5593] hsr_slave_1: entered promiscuous mode [ 96.265599][ T5593] debugfs: 'hsr0' already exists in 'hsr' [ 96.265623][ T5593] Cannot create hsr debugfs directory [ 96.334416][ T5588] hsr_slave_0: entered promiscuous mode [ 96.336160][ T5588] hsr_slave_1: entered promiscuous mode [ 96.337815][ T4904] Bluetooth: hci2: command tx timeout [ 96.338646][ T4904] Bluetooth: hci3: command tx timeout [ 96.340113][ T5588] debugfs: 'hsr0' already exists in 'hsr' [ 96.340165][ T5588] Cannot create hsr debugfs directory [ 97.181657][ T5594] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 97.234586][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.250999][ T5594] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 97.285285][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.295704][ T5594] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 97.344219][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.374671][ T5594] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 97.412742][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.551024][ T5592] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 97.592209][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.595549][ T5592] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 97.634861][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.653764][ T5592] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 97.672140][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 97.699757][ T5592] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 97.733620][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 97.882705][ T5593] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 97.912448][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 97.933358][ T5593] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 97.974072][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 97.989301][ T5593] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 98.033614][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 98.070841][ T5593] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 98.097971][ T4904] Bluetooth: hci0: command tx timeout [ 98.119642][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 98.257700][ T4904] Bluetooth: hci1: command tx timeout [ 98.258392][ T5588] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 98.305808][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 98.330277][ T5588] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 98.373278][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 98.380715][ T5588] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 98.417987][ T4904] Bluetooth: hci3: command tx timeout [ 98.418023][ T4904] Bluetooth: hci2: command tx timeout [ 98.436124][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 98.454340][ T5588] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 98.483255][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 98.573910][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.703694][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.770808][ T124] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.771444][ T124] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.837088][ T5592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.850008][ T1220] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.850190][ T1220] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.979568][ T5592] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.037394][ T5593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.058399][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.062106][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.138399][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.138543][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.233834][ T5593] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.276152][ T5588] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.324315][ T1220] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.324491][ T1220] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.434058][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.434242][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.534171][ T5588] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.599721][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.599954][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.654399][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.654555][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.181140][ T4904] Bluetooth: hci0: command tx timeout [ 100.342205][ T4904] Bluetooth: hci1: command tx timeout [ 100.498786][ T4904] Bluetooth: hci2: command tx timeout [ 100.498798][ T5589] Bluetooth: hci3: command tx timeout [ 100.516439][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.017233][ T5594] veth0_vlan: entered promiscuous mode [ 101.098455][ T5592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.106215][ T5593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.146047][ T5594] veth1_vlan: entered promiscuous mode [ 101.262085][ T5588] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 101.442588][ T5594] veth0_macvtap: entered promiscuous mode [ 101.494066][ T5594] veth1_macvtap: entered promiscuous mode [ 101.512402][ T5592] veth0_vlan: entered promiscuous mode [ 101.546441][ T5593] veth0_vlan: entered promiscuous mode [ 101.603063][ T5592] veth1_vlan: entered promiscuous mode [ 101.628742][ T5588] veth0_vlan: entered promiscuous mode [ 101.630767][ T5593] veth1_vlan: entered promiscuous mode [ 101.669033][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.713208][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.727350][ T5588] veth1_vlan: entered promiscuous mode [ 101.773202][ T1220] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.798202][ T1220] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.818467][ T1220] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.824522][ T1220] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.904912][ T5592] veth0_macvtap: entered promiscuous mode [ 102.009893][ T5593] veth0_macvtap: entered promiscuous mode [ 102.031277][ T5592] veth1_macvtap: entered promiscuous mode [ 102.203453][ T5593] veth1_macvtap: entered promiscuous mode [ 102.256914][ T5588] veth0_macvtap: entered promiscuous mode [ 102.323324][ T5588] veth1_macvtap: entered promiscuous mode [ 102.350183][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.352382][ T1220] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.352401][ T1220] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.415227][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.437132][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.486364][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.522946][ T67] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.528207][ T67] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.533581][ T2170] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.533598][ T2170] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.563110][ T5588] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.592445][ T1220] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.632802][ T1220] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.637029][ T1220] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.659700][ T1220] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.679092][ T5588] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.705145][ T2170] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.788565][ T2170] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.050474][ T1424] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.087348][ T1424] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.108957][ T2170] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.222143][ T2170] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.812480][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.812499][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.342241][ T1424] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.342259][ T1424] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.460498][ T1220] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.460520][ T1220] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.564414][ T5748] file system registered [ 104.590936][ T5748] unloading [ 104.721664][ T1220] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.721683][ T1220] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.935981][ T1424] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.935999][ T1424] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.316005][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.316026][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.505928][ T5757] db_root: cannot open: ./my_dbroot [ 105.526924][ T5757] [ 105.526937][ T5757] ====================================================== [ 105.526946][ T5757] WARNING: possible circular locking dependency detected [ 105.526965][ T5757] syzkaller #0 Not tainted [ 105.526976][ T5757] ------------------------------------------------------ SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 105.526984][ T5757] syz.2.9/5757 is trying to acquire lock: [ 105.526996][ T5757] ffff88802310dd60 (&sb->s_type->i_mutex_key#23){++++}-{4:4}, at: configfs_depend_item_unlocked+0x153/0x420 [ 105.527068][ T5757] [ 105.527068][ T5757] but task is already holding lock: [ 105.527076][ T5757] ffff888032ce1510 (&opts->dep_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x147/0x590 [ 105.527136][ T5757] [ 105.527136][ T5757] which lock already depends on the new lock. [ 105.527136][ T5757] [ 105.527143][ T5757] [ 105.527143][ T5757] the existing dependency chain (in reverse order) is: [ 105.527152][ T5757] [ 105.527152][ T5757] -> #2 (&opts->dep_lock){+.+.}-{4:4}: [ 105.527181][ T5757] mutex_lock_nested+0x5a/0x1d0 [ 105.527209][ T5757] tcm_set_name+0x2b/0xd0 [ 105.527227][ T5757] function_make+0x1a8/0x360 [ 105.527247][ T5757] configfs_mkdir+0x4f6/0x9e0 [ 105.527271][ T5757] vfs_mkdir+0x408/0x620 [ 105.527298][ T5757] filename_mkdirat+0x289/0x520 [ 105.527324][ T5757] __se_sys_mkdir+0x34/0x150 [ 105.527350][ T5757] do_syscall_64+0x17b/0x530 [ 105.527369][ T5757] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.527390][ T5757] [ 105.527390][ T5757] -> #1 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 105.527421][ T5757] mutex_lock_nested+0x5a/0x1d0 [ 105.527446][ T5757] configfs_rmdir+0x5f0/0x950 [ 105.527476][ T5757] vfs_rmdir+0x3e9/0x6b0 [ 105.527506][ T5757] filename_rmdir+0x292/0x520 [ 105.527532][ T5757] __se_sys_rmdir+0x2e/0x140 [ 105.527559][ T5757] do_syscall_64+0x17b/0x530 [ 105.527578][ T5757] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.527599][ T5757] [ 105.527599][ T5757] -> #0 (&sb->s_type->i_mutex_key#23){++++}-{4:4}: [ 105.527635][ T5757] __lock_acquire+0x15ff/0x2e40 [ 105.527653][ T5757] lock_acquire+0x115/0x350 [ 105.527684][ T5757] down_write+0x3a/0x50 [ 105.527703][ T5757] configfs_depend_item_unlocked+0x153/0x420 [ 105.527729][ T5757] usbg_make_tpg+0x1f6/0x590 [ 105.527760][ T5757] target_fabric_make_tpg+0xa8/0x6d0 [ 105.527780][ T5757] configfs_mkdir+0x4f6/0x9e0 [ 105.527803][ T5757] vfs_mkdir+0x408/0x620 [ 105.527829][ T5757] filename_mkdirat+0x289/0x520 [ 105.527856][ T5757] __se_sys_mkdir+0x34/0x150 [ 105.527882][ T5757] do_syscall_64+0x17b/0x530 [ 105.527912][ T5757] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.527932][ T5757] [ 105.527932][ T5757] other info that might help us debug this: [ 105.527932][ T5757] [ 105.527940][ T5757] Chain exists of: [ 105.527940][ T5757] &sb->s_type->i_mutex_key#23 --> gadget_subsys.su_mutex --> &opts->dep_lock [ 105.527940][ T5757] [ 105.527983][ T5757] Possible unsafe locking scenario: [ 105.527983][ T5757] [ 105.527990][ T5757] CPU0 CPU1 [ 105.527998][ T5757] ---- ---- [ 105.528004][ T5757] lock(&opts->dep_lock); [ 105.528018][ T5757] lock(gadget_subsys.su_mutex); [ 105.528034][ T5757] lock(&opts->dep_lock); [ 105.528050][ T5757] lock(&sb->s_type->i_mutex_key#23); [ 105.528069][ T5757] [ 105.528069][ T5757] *** DEADLOCK *** [ 105.528069][ T5757] [ 105.528074][ T5757] locks held by syz.2.9/5757: 5, last CPU#1: [ 105.528091][ T5757] #0: ffff88801e7e0510 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 105.528155][ T5757] #1: ffff88805ef41c80 (&sb->s_type->i_mutex_key#7/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 [ 105.528222][ T5757] #2: ffffffff8eea86e0 (&subsys->su_mutex){+.+.}-{4:4}, at: configfs_mkdir+0x4b0/0x9e0 [ 105.528277][ T5757] #3: ffffffff8f1defd8 (tpg_instances_lock){+.+.}-{4:4}, at: usbg_make_tpg+0xf7/0x590 [ 105.528337][ T5757] #4: ffff888032ce1510 (&opts->dep_lock){+.+.}-{4:4}, at: usbg_make_tpg+0x147/0x590 [ 105.528399][ T5757] [ 105.528399][ T5757] stack backtrace: [ 105.528424][ T5757] CPU: 1 UID: 0 PID: 5757 Comm: syz.2.9 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 105.528449][ T5757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 105.528470][ T5757] Call Trace: [ 105.528479][ T5757] [ 105.528487][ T5757] dump_stack_lvl+0xe8/0x150 [ 105.528516][ T5757] print_circular_bug+0x2e2/0x300 [ 105.528544][ T5757] check_noncircular+0x12f/0x150 [ 105.528573][ T5757] __lock_acquire+0x15ff/0x2e40 [ 105.528626][ T5757] lock_acquire+0x115/0x350 [ 105.528660][ T5757] ? configfs_depend_item_unlocked+0x153/0x420 [ 105.528695][ T5757] down_write+0x3a/0x50 [ 105.528719][ T5757] ? configfs_depend_item_unlocked+0x153/0x420 [ 105.528746][ T5757] configfs_depend_item_unlocked+0x153/0x420 [ 105.528776][ T5757] usbg_make_tpg+0x1f6/0x590 [ 105.528811][ T5757] ? __pfx_usbg_make_tpg+0x10/0x10 [ 105.528845][ T5757] ? lockdep_hardirqs_on+0x7a/0x110 [ 105.528867][ T5757] target_fabric_make_tpg+0xa8/0x6d0 [ 105.528899][ T5757] configfs_mkdir+0x4f6/0x9e0 [ 105.528925][ T5757] ? __pfx_current_check_access_path+0x10/0x10 [ 105.528953][ T5757] ? __pfx_configfs_mkdir+0x10/0x10 [ 105.528978][ T5757] ? generic_permission+0x2bf/0x670 [ 105.529002][ T5757] ? bpf_lsm_inode_mkdir+0x9/0x20 [ 105.529032][ T5757] vfs_mkdir+0x408/0x620 [ 105.529062][ T5757] filename_mkdirat+0x289/0x520 [ 105.529093][ T5757] ? __pfx_filename_mkdirat+0x10/0x10 [ 105.529120][ T5757] ? strncpy_from_user+0x150/0x2c0 [ 105.529146][ T5757] ? do_getname+0x151/0x250 [ 105.529179][ T5757] __se_sys_mkdir+0x34/0x150 [ 105.529208][ T5757] do_syscall_64+0x17b/0x530 [ 105.529228][ T5757] ? irqentry_exit+0x10f/0x8f0 [ 105.529247][ T5757] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.529268][ T5757] ? clear_bhb_loop+0x40/0x90 [ 105.529291][ T5757] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.529312][ T5757] RIP: 0033:0x7f575f6bdf99 [ 105.529339][ T5757] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.529358][ T5757] RSP: 002b:00007f575d916028 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 105.529380][ T5757] RAX: ffffffffffffffda RBX: 00007f575f945fa0 RCX: 00007f575f6bdf99 [ 105.529397][ T5757] RDX: 0000000000000000 RSI: 00000000000001ff RDI: 0000200000000c00 [ 105.529411][ T5757] RBP: 00007f575f754ec4 R08: 0000000000000000 R09: 0000000000000000 [ 105.529425][ T5757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.529439][ T5757] R13: 00007f575f946038 R14: 00007f575f945fa0 R15: 00007ffc99c1a4e8 [ 105.529463][ T5757] [ 105.915232][ T5759] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 107.909993][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.149050][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.709413][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.959892][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 109.338210][ T12] bridge_slave_1: left allmulticast mode [ 109.338237][ T12] bridge_slave_1: left promiscuous mode [ 109.338428][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.498456][ T12] bridge_slave_0: left allmulticast mode [ 109.498484][ T12] bridge_slave_0: left promiscuous mode [ 109.498699][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 110.218188][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 110.278173][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 110.319048][ T12] bond0 (unregistering): Released all slaves [ 110.341722][ T5251] 8021q: adding VLAN 0 to HW filter on device eth1 [ 110.637080][ T5251] 8021q: adding VLAN 0 to HW filter on device eth2 [ 111.351601][ T5251] 8021q: adding VLAN 0 to HW filter on device eth3 [ 111.607673][ T12] hsr_slave_0: left promiscuous mode [ 111.647660][ T12] hsr_slave_1: left promiscuous mode [ 111.649241][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 111.649261][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 111.688311][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 111.688329][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 111.748058][ T12] veth1_macvtap: left promiscuous mode [ 111.748106][ T12] veth0_macvtap: left promiscuous mode [ 111.748216][ T12] veth1_vlan: left promiscuous mode [ 111.748302][ T12] veth0_vlan: left promiscuous mode [ 112.308762][ T12] team0 (unregistering): Port device team_slave_1 removed [ 112.348144][ T12] team0 (unregistering): Port device team_slave_0 removed [ 112.450052][ T5251] 8021q: adding VLAN 0 to HW filter on device eth4 [ 113.449356][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.658979][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.869708][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.079179][ T12] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.499801][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.617972][ T5251] 8021q: adding VLAN 0 to HW filter on device eth5 [ 114.758896][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.019307][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.065861][ T5251] 8021q: adding VLAN 0 to HW filter on device eth6 [ 115.309293][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.354468][ T5251] 8021q: adding VLAN 0 to HW filter on device eth7