last executing test programs: 16.890926353s ago: executing program 1 (id=10): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000000)={0x1, 0x0, [{0x0, 0x10000, &(0x7f0000001000)}]}) ioctl$VHOST_SET_VRING_NUM(r0, 0x4008af10, &(0x7f00000002a0)={0x1, 0x100}) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f00000002c0)={0x1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000001000), &(0x7f0000002000), &(0x7f0000003000)}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f0000000000)=0x1000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x1, r1}) r2 = eventfd(0x0) write(r2, &(0x7f0000001000)="0100000000000000", 0x8) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000190)={0x1, r2}) write(r2, &(0x7f00000001a0)="0100000000000000", 0x8) 16.581352019s ago: executing program 3 (id=11): r0 = syz_usb_connect$uac3(0x3, 0xed, &(0x7f0000000800)=ANY=[@ANYBLOB="1201000200000040820582054000010203010902db000301008032080b0003010030000904000000010130000a2401003d00000000000c240a03030000000000000014240201010200030000000000000000000000001324030201030001030000000000000000000009040100000102300009040101010102300017240102000000000100010000000000000002100000000624020102100905010900020100000a25010000000000000009040200000102300009040201010102300017240101000000000100010000000000000002100000000624020102100905820900020100000a250100000000000000"], 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000300)={0x44, &(0x7f0000000400)={0xa1, 0x1, 0x6, "060020010000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000000)={0x1}, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc00855da, &(0x7f0000000200)={0x1, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc00855da, &(0x7f0000000200)={0x2, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc00855da, &(0x7f0000000200)={0x3, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc00855da, &(0x7f0000000200)={0x4, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc00855da, &(0x7f0000000200)={0x5, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r2, 0xc00855da, &(0x7f0000000200)={0x1, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r2, 0xc00855da, &(0x7f0000000200)={0x2, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r2, 0xc00855da, &(0x7f0000000200)={0x3, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r2, 0xc00855da, &(0x7f0000000200)={0x4, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r2, 0xc00855da, &(0x7f0000000200)={0x5, 0x20, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) 14.604494056s ago: executing program 1 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfs_share\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfs_share\x00', &(0x7f0000000040)='tmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./rpc\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./rpc\x00', &(0x7f0000000740)='rpc_pipefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='nfsd 127.0.0.1 2147483647 mydomain\n', 0x23) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='mydomain ./nfs_share 2147483647 8192 0 0 0\n', 0x2b) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfsd\x00', &(0x7f0000000240)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/versions\x00', 0x1, 0x0) write(r2, &(0x7f0000000540)='-2 -3 +4\n', 0x9) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/nfsv4gracetime\x00', 0x1, 0x0) write(r3, &(0x7f0000000640)='10\n', 0x3) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./nfsd/nfsv4leasetime\x00', 0x1, 0x0) write(r4, &(0x7f00000006c0)='10\n', 0x3) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0) write(r5, &(0x7f00000002c0)='tcp 2049\n', 0x9) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x1, 0x0) write(r6, &(0x7f0000000340)='1\n', 0x2) (async) close(r6) nanosleep(&(0x7f0000000380)={0x0, 0x1dcd6500}, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./rpc/nfsd/cld\x00', 0x2, 0x0) close(r7) nanosleep(&(0x7f0000000380)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f0000000440)='127.0.0.1:/\x00', &(0x7f0000000400)='./mnt\x00', &(0x7f0000000480), 0x0, &(0x7f00000004c0)={[{'addr=127.0.0.1,port=2049'}]}) r8 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/file1\x00', 0x42, 0x1ff) close(r8) linkat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/file1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./mnt/file2\x00', 0x0) 11.423387877s ago: executing program 3 (id=16): syz_usb_connect(0x3, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407205feca00010000000109022e0001010080fa0904000004ff00000007058102400000070501024000000705820240000007050202400000"], 0x0) nanosleep(&(0x7f0000000100)={0x1}, 0x0) setns(0xc9, 0x0) r0 = socket(0x8, 0x2, 0x0) setsockopt(r0, 0x108, 0x42020054, &(0x7f0000000200)='0100000000000000000000000000000000000000dc050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000dc0500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000', 0x9c) bind(r0, &(0x7f0000000300)=@generic={0x8}, 0xc) 11.022247992s ago: executing program 1 (id=18): syz_usb_connect(0x0, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000408c0d030100010000000109026e0002010080320904000000010100000924010001280001010c24020101010002030000000a240602010101020200092403030103000200090401000001020000090401010101020000072401010101000b2402010202100180bb0009050109c00001000007250100000000"], 0x0) nanosleep(&(0x7f0000000100)={0x1}, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x1, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x2, 0x0) ioctl(r0, 0xc4c85512, &(0x7f0000000300)="0000000003000000000000000000000049454339353820506c61796261636b204d61736b00"/72) ioctl(r1, 0xc4c85512, &(0x7f0000000300)="0000000003000000000000000000000049454339353820506c61796261636b204d61736b00"/72) ioctl(r2, 0xc4c85512, &(0x7f0000000300)="0000000003000000000000000000000049454339353820506c61796261636b204d61736b00"/72) 7.873201962s ago: executing program 3 (id=23): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x48, 0x10, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x1, 0x1}}}}}}]}, 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x58, 0x10, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}, @IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BATADV_ALGO_NAME={0xd, 0x1, 'BATMAN_IV'}]}}}]}, 0x58}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, [@IFLA_IFNAME={0x14, 0x3, 'veth0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000500)={'veth1\x00', 0x0}) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000700)="ffffffffffff0011223344554305000f32000000000100112233445500112233445500ff0000", 0x26, 0x0, &(0x7f0000000800)={0x11, 0x300, r3, 0x1, 0x0, 0x6, @broadcast}, 0x14) nanosleep(&(0x7f0000000a00)={0x0, 0x10000000}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000b80)=@setlink={0x34, 0x10, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}]}, 0x34}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000980)=@dellink={0x34, 0x11, 0x5, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'batadv0\x00'}]}, 0x34}}, 0x0) 7.489480622s ago: executing program 4 (id=24): setns(0xc9, 0x0) r0 = socket(0x8, 0x2, 0x0) setsockopt(r0, 0x108, 0x42020054, &(0x7f0000000000)="010000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000005000000", 0x54) bind(r0, &(0x7f0000000100)=@generic={0x8, "0000ffff01002000"}, 0xc) 7.26802305s ago: executing program 1 (id=25): r0 = timerfd_create(0x9, 0x0) timerfd_settime(r0, 0x0, &(0x7f0000000040)={{}, {0x1}}, 0x0) 7.201659395s ago: executing program 0 (id=26): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'lo\x00', &(0x7f0000000100)=@ethtool_sfeatures={0x3b, 0x2, [{0xffffffff}, {0xffffffff}]}}) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x1) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040)=0x12, 0x4) connect$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10) accept(r0, 0x0, 0x0) r2 = memfd_create(&(0x7f0000000300)='test\x00', 0x0) ftruncate(r2, 0x10000) sendfile(r1, r2, 0x0, 0x10000) 6.878451046s ago: executing program 4 (id=27): syz_usb_connect(0x0, 0x4c, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000408c0d030100010000000109023a0001010080320904000000010100000924010001280001010c24020101010002030000000a240602010101020200092403030103000200"], 0x0) nanosleep(&(0x7f0000000100)={0x1}, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x1, 0x0) ioctl(r0, 0xc4c85512, &(0x7f0000000300)="0000000003000000000000000000000049454339353820506c61796261636b204d61736b00"/64) 6.735442931s ago: executing program 1 (id=28): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x1286, 0x1fa4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xff, 0xff, 0xff, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x86, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_ep_read(r0, 0x2, 0x6, &(0x7f0000000200)=""/6) (async) syz_usb_ep_write(r0, 0x86, 0x2, &(0x7f0000000300)='\x00\x00') (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/power/state\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)='mem\x00', 0x4) 6.170554027s ago: executing program 0 (id=30): syz_usb_connect(0x5, 0xa1, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ba23000100010102030109028f00020100803209040000000101000009240100011e0001010c2402010101000203000000092403020103000100090401000001020000090401010101020000072401010101000b2402010202100180bb0009050109000201000007250100000000090401020101020000072401010101000b2402010202100180bb0009050109000201000007250100000000"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r0, 0xc2604111, &(0x7f0000000200)={0x0, [[0x8], [0x0, 0x200000], [0x1]], '\x00', [{0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x2, 0x2, 0x0, 0x0, 0x1}, {0xbb80, 0xbb80, 0x0, 0x0, 0x1}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}, {0x0, 0xffffffff}], '\x00', 0xffffffff}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r0, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0) 5.650781909s ago: executing program 3 (id=31): r0 = syz_usb_connect(0x0, 0x67, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002e00101408d0e3f760001000000010902550002010080320904000003e00101000705810310000107050202000200070582020002000904010002e001010007050301000001070583010000010904010102e00101000705030109000107058301090001"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000600)={0x84, &(0x7f0000000700)={0x0, 0x0, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000400)={0x1}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r1, 0x400448ca, &(0x7f0000000300)="01000000") bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0x1, 0x1}, 0x6) write(r1, &(0x7f0000000200)="f100040000", 0x5) 5.213087642s ago: executing program 2 (id=32): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/drivers/e1000/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='0000:00:02.0\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/drivers/e1000e/new_id\x00', 0x1, 0x0) write(r1, &(0x7f0000000000)='8086 100e\x00', 0xa) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/pci/drivers/e1000e/bind\x00', 0x1, 0x0) write(r2, &(0x7f0000000100)='0000:00:02.0\x00', 0xd) 4.829284864s ago: executing program 2 (id=33): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./proc/net/afs/cells\x00', 0x2, 0x0) write(r0, &(0x7f0000000080)='add syz0 127.0.0.1\n\x00', 0x13) r1 = openat(0xffffffffffffff9c, &(0x7f00000000a0)='./proc/net/afs/rootcell\x00', 0x2, 0x0) write(r1, &(0x7f00000000c0)='syz0\n\x00', 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1ff) mount$afs(&(0x7f0000000200)=@cell={0x25, '', 'syz0', '.readonly'}, &(0x7f0000000000)='./file0\x00', &(0x7f00000000e0), 0x0, &(0x7f0000000300)={[{}]}) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/foo@sys\x00', 0x0, 0x0) 4.004241337s ago: executing program 2 (id=34): r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001080)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x5}, 0x100) r1 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) listen(r1, 0x1) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) accept(r1, 0x0, 0x0) write(r2, &(0x7f0000001000)='\x00'/80, 0x50) 2.903879529s ago: executing program 1 (id=35): unshare(0x40000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff) mount(&(0x7f0000000640)=@filename='proc\x00', &(0x7f0000000680)='./proc\x00', &(0x7f00000006c0)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='-2 -3 +4\n', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0) write(r1, &(0x7f0000000740)='10\n', 0x3) r2 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./nfsd/nfsv4leasetime\x00', 0x2, 0x0) write(r2, &(0x7f00000007c0)='10\n', 0x3) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f00000001c0)='tcp 2049\n', 0x9) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f0000000240)='1\n', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f0000000440)='127.0.0.1:/\x00', &(0x7f0000000480)='./mnt\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1\x00']) openat(0xffffffffffffff9c, &(0x7f0000000540)='./mnt/file1\x00', 0x42, 0x1ff) rename(&(0x7f0000000580)='./mnt/file1\x00', &(0x7f00000005c0)='./mnt/file2\x00') 2.902919069s ago: executing program 4 (id=36): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) write(r0, &(0x7f0000000100)="1500000065ffff0020000008003950323030302e4c1400000069000080000000000100000000000000a0000000190100ff3f00000000000080000000000100000000000000ff41000000000000000000000200000000000000000000000000000000100000000000000010000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000160000006f0200010080000000000200000000000000a0000000190300ff3f00000000000080000000000200000000000000ff41000000000000000000000200000000000000000000000000000000100000000000000010000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000004b040007000000790500", 0x18d) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount$9p_fd(0x0, &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESDEC=r1, @ANYBLOB=',wfdno=', @ANYRESDEC=r1, @ANYBLOB=',version=9p2000.L\x00']) unlinkat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/dir\x00', 0x200) 2.785983768s ago: executing program 0 (id=37): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/testnqn\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testnqn/attr_allow_any_host\x00', 0x2, 0x0) write(r0, &(0x7f0000000340)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testnqn/namespaces/1\x00', 0x1ed) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./backing_file\x00', 0x42, 0x1ed) ftruncate(r1, 0x100000) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testnqn/namespaces/1/device_path\x00', 0x2, 0x0) write(r2, &(0x7f0000000480)='./backing_file\x00', 0xe) r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testnqn/namespaces/1/buffered_io\x00', 0x2, 0x0) write(r3, &(0x7f0000000500)='1\x00', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/subsystems/testnqn/namespaces/1/enable\x00', 0x2, 0x0) write(r4, &(0x7f0000000580)='1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1\x00', 0x1ed) r5 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_trtype\x00', 0x2, 0x0) write(r5, &(0x7f0000000680)='loop\x00', 0x4) symlinkat(&(0x7f00000006c0)='./config/nvmet/subsystems/testnqn\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/subsystems/testnqn\x00') r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) write(r6, &(0x7f0000000780)='transport=loop,nqn=testnqn\x00', 0x1a) nanosleep(&(0x7f0000000800)={0x1}, 0x0) nanosleep(&(0x7f0000000800)={0x1}, 0x0) nanosleep(&(0x7f0000000800)={0x1}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000840)='./sys\x00', &(0x7f0000000880)='sysfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./sys/class/nvme/nvme0/nvme0n1/wwid\x00', 0x0, 0x0) read(r7, &(0x7f0000000900), 0x64) r8 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/nvme/nvme1/nvme1n1/wwid\x00', 0x0, 0x0) read(r8, &(0x7f0000000980), 0x64) 1.995247729s ago: executing program 3 (id=38): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) (async) read$nci(r0, &(0x7f0000000200)=""/100, 0x64) write$nci(r0, &(0x7f0000000280)=@NCI_OP_CORE_RESET_RSP={0x0, 0x0, 0x2, 0x0, 0x3, {0x0, 0x1}}, 0x6) read$nci(r0, &(0x7f00000002c0)=""/100, 0x64) write$nci(r0, &(0x7f0000000340)=@NCI_OP_CORE_INIT_RSP={0x0, 0x0, 0x2, 0x1, 0x11}, 0x14) read$nci(r0, &(0x7f0000000380)=""/100, 0x64) write$nci(r0, &(0x7f0000000400)=@NCI_OP_RF_DISCOVER_MAP_RSP={0x1, 0x0, 0x2, 0x0, 0x1}, 0x4) sendmsg$NFC_CMD_START_POLL(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x24, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0xffffffff}]}, 0x24}}, 0x0) (async) read$nci(r0, &(0x7f0000000500)=""/100, 0x64) write$nci(r0, &(0x7f0000000580)=@NCI_OP_CORE_SET_CONFIG_RSP={0x0, 0x0, 0x2, 0x2, 0x2}, 0x5) read$nci(r0, &(0x7f00000005c0)=""/100, 0x64) write$nci(r0, &(0x7f0000000640)=@NCI_OP_CORE_SET_CONFIG_RSP={0x0, 0x0, 0x2, 0x2, 0x2}, 0x5) read$nci(r0, &(0x7f0000000680)=""/100, 0x64) write$nci(r0, &(0x7f0000000700)=@NCI_OP_RF_DISCOVER_RSP={0x1, 0x0, 0x2, 0x3, 0x1}, 0x4) write$nci(r0, &(0x7f0000000740)=@NCI_OP_RF_INTF_ACTIVATED_NTF={0x1, 0x0, 0x3, 0x5, 0x1f, @a={0x1, 0x3, 0x5, 0x1, 0xff, 0x1, 0x4, {}, 0x0, 0x0, 0x0, 0x10, 0xf, '\x00'/15}}, 0x22) sendmsg$NFC_CMD_DEP_LINK_UP(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_TARGET_INDEX={0x8}, @NFC_ATTR_COMM_MODE={0x5}]}, 0x2c}}, 0x0) (async) read$nci(r0, &(0x7f0000000840)=""/100, 0x64) write$nci(r0, &(0x7f00000008c0)=@NCI_OP_CORE_SET_CONFIG_RSP={0x0, 0x0, 0x2, 0x2, 0x2}, 0x5) write$nci(r0, &(0x7f0000000900)=@DATA={0x0, 0x0, 0x0, 0x0, 0x2, "0100"}, 0x5) 1.994542666s ago: executing program 4 (id=39): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup\x00', 0x1ff) mount$cgroup2(0x0, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0), 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/cgroup.subtree_control\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='+memory\x00', 0x8) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup/syz0\x00', 0x1ff) rmdir(&(0x7f00000001c0)='./cgroup/syz0\x00') nanosleep(&(0x7f0000000000)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000000)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000000)={0x0, 0x1dcd6500}, 0x0) nanosleep(&(0x7f0000000000)={0x0, 0x1dcd6500}, 0x0) 1.965737752s ago: executing program 2 (id=40): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/class/thermal/cooling_device0/cur_state\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='0\n\x00', 0x3) 1.286577013s ago: executing program 2 (id=41): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @empty}, 0x10) 1.086889207s ago: executing program 0 (id=42): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/vtconsole/vtcon1/bind\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)='0\x00', 0x1) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) write(r1, &(0x7f0000000500)="1b5b3f356800", 0x5) 961.116949ms ago: executing program 2 (id=43): r0 = syz_usb_connect(0x0, 0x43, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402020b10000000000010902310002010080320904000000ffffff00080b0101ffffff000904010002ffffff000705810200020007050202000200"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0xd, 0x100, '\x00'/256}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) syz_usb_control_io(r0, 0x0, &(0x7f0000000100)) 849.237926ms ago: executing program 4 (id=44): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/firewire/devices\x00', 0x90000, 0x0) getdents64(r0, &(0x7f0000000100), 0x1000) 657.528317ms ago: executing program 4 (id=45): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00') symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00') symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00') symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00') symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6) nanosleep(&(0x7f00000007c0)={0x1}, 0x0) r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559}) 629.804285ms ago: executing program 3 (id=46): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/nfs/parameters/delay_retrans\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='1\n\x00', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x2, 0x0) read(r1, &(0x7f0000000540), 0x64) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f00000001c0)='8\n\x00', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./nfs_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./nfs_mnt\x00', &(0x7f0000000240)='nfs4\x00', 0x0, &(0x7f0000000280)='addr=127.0.0.1,port=2049,vers=4.2,softerr\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/clients/1/info\x00', 0x0, 0x0) read(r3, &(0x7f0000000400), 0x64) r4 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./nfsd/clients/2/info\x00', 0x0, 0x0) read(r4, &(0x7f0000000400), 0x64) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd/clients/3/info\x00', 0x0, 0x0) read(r5, &(0x7f0000000400), 0x64) 306.444816ms ago: executing program 0 (id=47): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:03.0/driver_override\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='ahci\x00', 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/ahci/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='0000:00:03.0\x00', 0xd) 0s ago: executing program 0 (id=48): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000000)={0x1, 0x0, [{0x0, 0x10000, &(0x7f0000001000)}]}) ioctl$VHOST_SET_VRING_NUM(r0, 0x4008af10, &(0x7f00000002a0)={0x1, 0x100}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000001000), &(0x7f0000002000), &(0x7f0000003000)}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1002}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x1, r1}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.132' (ED25519) to the list of known hosts. [ 97.722707][ T5580] cgroup: Unknown subsys name 'net' [ 97.965543][ T5580] cgroup: Unknown subsys name 'cpuset' [ 98.037767][ T5580] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 99.473350][ T10] cfg80211: failed to load regulatory.db [ 100.379751][ T5580] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 104.966202][ T5607] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 104.974501][ T5604] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 105.019016][ T5600] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 105.027420][ T5607] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 105.050308][ T5607] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 105.068380][ T5607] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 105.070300][ T5607] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 105.071718][ T5607] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 105.072922][ T5607] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 105.073957][ T5607] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 105.074353][ T5600] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 105.102724][ T5600] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 105.138001][ T4909] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 105.141187][ T5600] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 105.142001][ T5600] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 105.309463][ T5607] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 105.358556][ T5607] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 105.360223][ T5607] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 105.392091][ T5607] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 105.404583][ T5607] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 105.457841][ T5597] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 105.476866][ T5597] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 105.481580][ T5597] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 105.502959][ T5597] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 105.505051][ T5597] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 107.227522][ T5597] Bluetooth: hci2: command tx timeout [ 107.390302][ T5597] Bluetooth: hci1: command tx timeout [ 107.390754][ T5604] Bluetooth: hci0: command tx timeout [ 107.468068][ T5597] Bluetooth: hci4: command tx timeout [ 107.630768][ T5597] Bluetooth: hci3: command tx timeout [ 108.366701][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.367178][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.368948][ T5594] bridge_slave_0: entered allmulticast mode [ 108.374269][ T5594] bridge_slave_0: entered promiscuous mode [ 108.430804][ T5593] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.430949][ T5593] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.431181][ T5593] bridge_slave_0: entered allmulticast mode [ 108.444058][ T5593] bridge_slave_0: entered promiscuous mode [ 108.486307][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.486415][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.487185][ T5594] bridge_slave_1: entered allmulticast mode [ 108.496300][ T5594] bridge_slave_1: entered promiscuous mode [ 108.518597][ T5595] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.518713][ T5595] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.518871][ T5595] bridge_slave_0: entered allmulticast mode [ 108.520872][ T5595] bridge_slave_0: entered promiscuous mode [ 108.523248][ T5593] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.523506][ T5593] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.524039][ T5593] bridge_slave_1: entered allmulticast mode [ 108.526235][ T5593] bridge_slave_1: entered promiscuous mode [ 108.612487][ T5595] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.612710][ T5595] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.613346][ T5595] bridge_slave_1: entered allmulticast mode [ 108.615242][ T5595] bridge_slave_1: entered promiscuous mode [ 108.761892][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 108.795378][ T5593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 108.795660][ T5596] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.795874][ T5596] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.796055][ T5596] bridge_slave_0: entered allmulticast mode [ 108.804626][ T5596] bridge_slave_0: entered promiscuous mode [ 108.851531][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 108.855025][ T5595] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 108.875929][ T5593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 108.876199][ T5596] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.876327][ T5596] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.876486][ T5596] bridge_slave_1: entered allmulticast mode [ 108.886563][ T5596] bridge_slave_1: entered promiscuous mode [ 108.897780][ T5599] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.898118][ T5599] bridge0: port 1(bridge_slave_0) entered disabled state [ 108.898750][ T5599] bridge_slave_0: entered allmulticast mode [ 108.914745][ T5599] bridge_slave_0: entered promiscuous mode [ 108.964561][ T5595] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.006645][ T5599] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.006780][ T5599] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.008275][ T5599] bridge_slave_1: entered allmulticast mode [ 109.015935][ T5599] bridge_slave_1: entered promiscuous mode [ 109.131979][ T5594] team0: Port device team_slave_0 added [ 109.161276][ T5593] team0: Port device team_slave_0 added [ 109.164678][ T5596] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.200235][ T5594] team0: Port device team_slave_1 added [ 109.202908][ T5595] team0: Port device team_slave_0 added [ 109.223816][ T5593] team0: Port device team_slave_1 added [ 109.226443][ T5596] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.246091][ T5599] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 109.272034][ T5595] team0: Port device team_slave_1 added [ 109.308703][ T5597] Bluetooth: hci2: command tx timeout [ 109.311574][ T5599] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 109.406549][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.406570][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.406591][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.467150][ T5597] Bluetooth: hci1: command tx timeout [ 109.467186][ T5597] Bluetooth: hci0: command tx timeout [ 109.470345][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.470362][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.470390][ T5593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.475460][ T5596] team0: Port device team_slave_0 added [ 109.542024][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.542044][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.542072][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.543351][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 109.543364][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.543383][ T5595] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 109.544834][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.544850][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.544879][ T5593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.547197][ T5604] Bluetooth: hci4: command tx timeout [ 109.563543][ T5596] team0: Port device team_slave_1 added [ 109.585542][ T5599] team0: Port device team_slave_0 added [ 109.655706][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 109.655769][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 109.655855][ T5595] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 109.707216][ T5604] Bluetooth: hci3: command tx timeout [ 110.167541][ T5599] team0: Port device team_slave_1 added [ 110.223085][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 110.223100][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 110.223120][ T5596] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 110.304018][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 110.304032][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 110.304052][ T5596] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 110.305088][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 110.305099][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 110.305118][ T5599] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 110.432591][ T5599] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 110.432610][ T5599] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 110.432637][ T5599] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 110.467413][ T5594] hsr_slave_0: entered promiscuous mode [ 110.488645][ T5594] hsr_slave_1: entered promiscuous mode [ 110.525177][ T5593] hsr_slave_0: entered promiscuous mode [ 110.528988][ T5593] hsr_slave_1: entered promiscuous mode [ 110.532292][ T5593] debugfs: 'hsr0' already exists in 'hsr' [ 110.532673][ T5593] Cannot create hsr debugfs directory [ 110.571122][ T5595] hsr_slave_0: entered promiscuous mode [ 110.572193][ T5595] hsr_slave_1: entered promiscuous mode [ 110.572875][ T5595] debugfs: 'hsr0' already exists in 'hsr' [ 110.572908][ T5595] Cannot create hsr debugfs directory [ 110.721778][ T5596] hsr_slave_0: entered promiscuous mode [ 110.722926][ T5596] hsr_slave_1: entered promiscuous mode [ 110.723639][ T5596] debugfs: 'hsr0' already exists in 'hsr' [ 110.723658][ T5596] Cannot create hsr debugfs directory [ 110.989910][ T5599] hsr_slave_0: entered promiscuous mode [ 110.990947][ T5599] hsr_slave_1: entered promiscuous mode [ 110.991627][ T5599] debugfs: 'hsr0' already exists in 'hsr' [ 110.991652][ T5599] Cannot create hsr debugfs directory [ 111.387122][ T5604] Bluetooth: hci2: command tx timeout [ 111.547310][ T5604] Bluetooth: hci0: command tx timeout [ 111.547348][ T5604] Bluetooth: hci1: command tx timeout [ 111.637302][ T5597] Bluetooth: hci4: command tx timeout [ 111.785289][ T5594] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 111.787620][ T5597] Bluetooth: hci3: command tx timeout [ 111.860897][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 111.879942][ T5594] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 111.921048][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 111.924813][ T5594] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 111.973301][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 112.016483][ T5594] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 112.033739][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 112.145696][ T5593] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 112.186860][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 112.202964][ T5593] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 112.230862][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 112.260855][ T5593] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 112.293532][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 112.325571][ T5593] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 112.352890][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 112.531487][ T5599] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 112.573066][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 112.598422][ T5599] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 112.631345][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 112.637036][ T5599] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 112.661464][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 112.704266][ T5599] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 112.743957][ T5599] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 112.949680][ T5596] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 112.973075][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 112.997766][ T5596] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 113.030968][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 113.055096][ T5596] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 113.081751][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 113.120112][ T5596] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 113.146807][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 113.333333][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 113.334126][ T5595] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 113.381789][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 113.410255][ T5595] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 113.446646][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 113.459305][ T5595] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 113.467269][ T5597] Bluetooth: hci2: command tx timeout [ 113.515909][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 113.537838][ T5595] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 113.581093][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 113.627133][ T5597] Bluetooth: hci1: command tx timeout [ 113.627171][ T5597] Bluetooth: hci0: command tx timeout [ 113.707167][ T5604] Bluetooth: hci4: command tx timeout [ 113.715464][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 113.770299][ T5593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 113.816849][ T657] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.819363][ T657] bridge0: port 1(bridge_slave_0) entered forwarding state [ 113.868830][ T5604] Bluetooth: hci3: command tx timeout [ 113.873036][ T657] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.873248][ T657] bridge0: port 2(bridge_slave_1) entered forwarding state [ 113.972433][ T5593] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.029046][ T5599] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.046117][ T548] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.046281][ T548] bridge0: port 1(bridge_slave_0) entered forwarding state [ 114.106242][ T548] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.106378][ T548] bridge0: port 2(bridge_slave_1) entered forwarding state [ 114.212274][ T5599] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.236857][ T5596] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.270326][ T1179] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.270473][ T1179] bridge0: port 1(bridge_slave_0) entered forwarding state [ 114.346491][ T657] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.355522][ T657] bridge0: port 2(bridge_slave_1) entered forwarding state [ 114.449944][ T5596] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.533805][ T5595] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.551820][ T657] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.552051][ T657] bridge0: port 1(bridge_slave_0) entered forwarding state [ 114.631352][ T657] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.636538][ T657] bridge0: port 2(bridge_slave_1) entered forwarding state [ 114.792490][ T5595] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.903453][ T55] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.903782][ T55] bridge0: port 1(bridge_slave_0) entered forwarding state [ 115.015355][ T1186] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.015510][ T1186] bridge0: port 2(bridge_slave_1) entered forwarding state [ 115.739315][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 116.102410][ T5593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 116.475883][ T5594] veth0_vlan: entered promiscuous mode [ 116.606291][ T5599] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 116.691546][ T5594] veth1_vlan: entered promiscuous mode [ 116.726381][ T5593] veth0_vlan: entered promiscuous mode [ 116.776188][ T5596] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 116.822460][ T5593] veth1_vlan: entered promiscuous mode [ 116.995490][ T5594] veth0_macvtap: entered promiscuous mode [ 117.040513][ T5595] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 117.046845][ T5594] veth1_macvtap: entered promiscuous mode [ 117.157877][ T5599] veth0_vlan: entered promiscuous mode [ 117.179168][ T5593] veth0_macvtap: entered promiscuous mode [ 117.240607][ T5593] veth1_macvtap: entered promiscuous mode [ 117.273984][ T5599] veth1_vlan: entered promiscuous mode [ 117.302457][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 117.343498][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 117.396549][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 117.451844][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 117.574731][ T5595] veth0_vlan: entered promiscuous mode [ 117.696107][ T5599] veth0_macvtap: entered promiscuous mode [ 117.943317][ T5599] veth1_macvtap: entered promiscuous mode [ 117.958077][ T5595] veth1_vlan: entered promiscuous mode [ 118.079176][ T5596] veth0_vlan: entered promiscuous mode [ 118.398627][ T5596] veth1_vlan: entered promiscuous mode [ 118.439706][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.439740][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.444309][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 118.536574][ T5599] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 118.606006][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.606032][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.649280][ T5595] veth0_macvtap: entered promiscuous mode [ 118.849391][ T5595] veth1_macvtap: entered promiscuous mode [ 118.884371][ T548] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.884392][ T548] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.037222][ T5596] veth0_macvtap: entered promiscuous mode [ 119.042276][ T548] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.042298][ T548] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.245864][ T5596] veth1_macvtap: entered promiscuous mode [ 119.292289][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 119.569248][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 119.671731][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 119.703139][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.703163][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.741171][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 120.201788][ T657] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.201822][ T657] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.190722][ T10] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 121.573671][ T10] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0043, bcdDevice= 1.01 [ 121.573703][ T10] usb 3-1: New USB device strings: Mfr=2, Product=3, SerialNumber=1 [ 121.573722][ T10] usb 3-1: Product: syz [ 121.573738][ T10] usb 3-1: Manufacturer: syz [ 121.573754][ T10] usb 3-1: SerialNumber: syz [ 121.875279][ T10] em28xx 3-1:1.0: New device syz syz @ 480 Mbps (0ccd:0043, interface 0, class 0) [ 121.875327][ T10] em28xx 3-1:1.0: DVB interface 0 found: bulk [ 121.941253][ T657] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.941278][ T657] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.437792][ T10] em28xx 3-1:1.0: unknown em28xx chip ID (64) [ 122.458523][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.458546][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.677095][ T822] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 122.695439][ T657] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.695461][ T657] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.829748][ T68] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.830158][ T548] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 122.830177][ T548] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 122.830522][ T68] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.015771][ T822] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0043, bcdDevice= 1.01 [ 123.015806][ T822] usb 4-1: New USB device strings: Mfr=2, Product=3, SerialNumber=1 [ 123.015828][ T822] usb 4-1: Product: syz [ 123.015845][ T822] usb 4-1: Manufacturer: syz [ 123.015861][ T822] usb 4-1: SerialNumber: syz [ 123.335165][ T5714] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 123.542148][ T1174] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.561858][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.607961][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.614909][ T657] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.615584][ T657] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.615774][ T657] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.616136][ T657] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.616423][ T657] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.685360][ T822] em28xx 4-1:1.0: New device syz syz @ 480 Mbps (0ccd:0043, interface 0, class 0) [ 123.685399][ T822] em28xx 4-1:1.0: DVB interface 0 found: bulk [ 123.734320][ T657] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.736180][ T657] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.795821][ T43] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.796016][ T43] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.796246][ T43] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.796668][ T43] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.849339][ T43] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.040153][ T5810] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.096753][ T5714] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice= 1.01 [ 124.096785][ T5714] usb 2-1: New USB device strings: Mfr=2, Product=3, SerialNumber=1 [ 124.096805][ T5714] usb 2-1: Product: syz [ 124.096819][ T5714] usb 2-1: Manufacturer: syz [ 124.096833][ T5714] usb 2-1: SerialNumber: syz [ 124.168146][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.188720][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.402436][ T5714] pvrusb2: Hardware description: Terratec Grabster AV400 [ 124.402471][ T5714] pvrusb2: ********** [ 124.402479][ T5714] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 124.402490][ T5714] pvrusb2: Important functionality might not be entirely working. [ 124.402498][ T5714] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 124.402507][ T5714] pvrusb2: ********** [ 125.084232][ T5815] em28xx 3-1:1.0: writing to i2c device at 0x0 failed (error=-5) [ 125.178408][ T822] em28xx 4-1:1.0: unknown em28xx chip ID (0) [ 125.205139][ T2392] pvrusb2: Failed to submit write-control URB status=-2 [ 125.205159][ T2392] pvrusb2: Device being rendered inoperable [ 125.249339][ T2392] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 125.249358][ T2392] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 125.371147][ T10] em28xx 3-1:1.0: reading from i2c device at 0xa0 failed (error=-5) [ 125.371173][ T10] em28xx 3-1:1.0: board has no eeprom [ 125.447051][ T10] em28xx 3-1:1.0: Identified as Terratec Cinergy T XS (MT2060) (card=44) [ 125.447095][ T10] em28xx 3-1:1.0: dvb set to bulk mode. [ 125.456276][ T9] em28xx 3-1:1.0: Binding DVB extension [ 125.558532][ T5714] usb 2-1: USB disconnect, device number 2 [ 125.714302][ T9] em28xx 3-1:1.0: writing to i2c device at 0x1e failed (error=-5) [ 125.714335][ T9] zl10353_read_register: readreg error (reg=127, ret==-5) [ 125.714424][ T9] em28xx 3-1:1.0: frontend initialization failed [ 125.855413][ T9] em28xx 3-1:1.0: Remote control support is not available for this card. [ 126.102599][ T822] em28xx 4-1:1.0: reading from i2c device at 0xa0 failed (error=-5) [ 126.102634][ T822] em28xx 4-1:1.0: board has no eeprom [ 126.136519][ T10] usb 3-1: USB disconnect, device number 2 [ 126.159535][ T822] em28xx 4-1:1.0: Identified as Terratec Cinergy T XS (MT2060) (card=44) [ 126.159567][ T822] em28xx 4-1:1.0: dvb set to bulk mode. [ 126.161017][ T36] em28xx 4-1:1.0: Binding DVB extension [ 126.307321][ T822] usb 4-1: USB disconnect, device number 2 [ 126.474602][ T36] em28xx 4-1:1.0: writing to i2c device at 0x1e failed (error=-19) [ 126.474634][ T36] zl10353_read_register: readreg error (reg=127, ret==-19) [ 126.474671][ T36] em28xx 4-1:1.0: frontend initialization failed [ 126.475087][ T36] em28xx 4-1:1.0: Remote control support is not available for this card. [ 127.201403][ T10] em28xx 3-1:1.0: Disconnecting em28xx [ 127.219933][ T10] em28xx 3-1:1.0: Closing input extension [ 127.328035][ T822] em28xx 4-1:1.0: Disconnecting em28xx [ 127.328101][ T822] em28xx 4-1:1.0: Closing input extension [ 127.536433][ T5827] input: PS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input5 [ 127.797617][ T5766] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 127.952653][ T5766] usb 5-1: New USB device found, idVendor=041e, idProduct=3010, bcdDevice= 1.00 [ 127.952679][ T5766] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.001305][ T5846] batman_adv: batadv0: Adding interface: veth0 [ 128.001329][ T5846] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 128.001354][ T5846] batman_adv: batadv0: Interface activated: veth0 [ 128.159427][ T822] em28xx 4-1:1.0: Freeing device [ 128.179370][ T10] em28xx 3-1:1.0: Freeing device [ 128.592735][ T5844] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.592770][ T5844] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 128.673328][ T5844] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 128.673354][ T5844] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 128.787157][ T822] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 128.872375][ T5844] batman_adv: batadv0: Interface deactivated: veth0 [ 128.872410][ T5844] batman_adv: batadv0: Removing interface: veth0 [ 129.030189][ T822] usb 4-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 129.030224][ T822] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.030243][ T822] usb 4-1: Product: syz [ 129.030256][ T822] usb 4-1: Manufacturer: syz [ 129.030270][ T822] usb 4-1: SerialNumber: syz [ 131.939551][ T5766] usb 5-1: 1:1: cannot set freq 48000 to ep 0x81 [ 132.413380][ T5864] loop0: detected capacity change from 0 to 128 [ 132.774774][ T5870] ubi0: attaching mtd0 [ 132.909632][ T5603] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 133.070212][ T5870] ubi0: scanning is finished [ 133.070246][ T5870] ubi0: empty MTD device detected [ 133.121019][ T5603] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0103, bcdDevice= 1.00 [ 133.121061][ T5603] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.511037][ T5865] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 134.308166][ T5870] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 134.308196][ T5870] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 134.308224][ T5870] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 134.308243][ T5870] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 134.308260][ T5870] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 134.308278][ T5870] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 134.308295][ T5870] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 3435391811 [ 134.308317][ T5870] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 134.402835][ T5882] ubi0: background thread "ubi_bgt0d" started, PID 5882 [ 134.428056][ T822] usb 4-1: Unsupported UAC3 BADD profile [ 134.811910][ T5766] usb 5-1: USB disconnect, device number 2 [ 135.226611][ T5887] batman_adv: batadv0: Adding interface: veth0 [ 135.226631][ T5887] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 135.226668][ T5887] batman_adv: batadv0: Interface activated: veth0 [ 135.407922][ T822] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 135.438244][ T5603] usb 2-1: 2:0: failed to get current value for ch 0 (-22) [ 135.477213][ T5603] usb 2-1: 2:0: cannot get min/max values for control 2 (id 2) [ 135.477260][ T5603] usb 2-1: Warning! Unlikely small volume range (=1), linear volume or custom curve? [ 135.477281][ T5603] usb 2-1: [2] FU [PCM Playback Volume] ch = 2, val = 0/1/1 [ 135.835541][ T822] usb 4-1: USB disconnect, device number 3 [ 135.881136][ T5892] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 135.881171][ T5892] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 135.965329][ T5603] usb 2-1: 2:0: cannot get min/max values for control 2 (id 2) [ 136.002201][ T5892] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 136.002234][ T5892] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 136.116012][ T5892] batman_adv: batadv0: Interface deactivated: veth0 [ 136.116044][ T5892] batman_adv: batadv0: Removing interface: veth0 [ 136.302806][ T5603] usb 2-1: USB disconnect, device number 3 [ 136.858235][ T5609] udevd[5609]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 137.446824][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 137.629879][ T5727] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 137.631037][ C0] raw-gadget.3 gadget.3: ignoring, device is not running [ 137.709468][ T10] usb 1-1: New USB device found, idVendor=23ba, idProduct=0100, bcdDevice= 1.00 [ 137.709506][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.709528][ T10] usb 1-1: Product: syz [ 137.709543][ T10] usb 1-1: Manufacturer: syz [ 137.709559][ T10] usb 1-1: SerialNumber: syz [ 137.807037][ T5727] usb 4-1: device descriptor read/64, error -32 [ 138.087476][ T5727] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 138.266392][ T5727] usb 4-1: New USB device found, idVendor=0e8d, idProduct=763f, bcdDevice= 1.00 [ 138.266430][ T5727] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.527757][ T5766] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 138.721792][ T5766] usb 5-1: New USB device found, idVendor=0d8c, idProduct=0103, bcdDevice= 1.00 [ 138.721889][ T5766] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 138.870580][ T5603] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 139.094241][ T5604] Bluetooth: hci5: Can't claim NULL iso interface [ 139.173406][ T5603] usb 2-1: New USB device found, idVendor=1286, idProduct=1fa4, bcdDevice= 0.00 [ 139.173440][ T5603] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 139.762788][ T5603] usb 2-1: can't set config #1, error -71 [ 139.973392][ T5603] usb 2-1: USB disconnect, device number 4 [ 140.109545][ T5604] Bluetooth: hci5: Failed to get device id (-71) [ 140.110354][ T5604] Bluetooth: hci5: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported. [ 140.143936][ T5727] usb 4-1: USB disconnect, device number 5 [ 140.343073][ T5935] nvmet: adding nsid 1 to subsystem testnqn [ 140.492902][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 140.493047][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 140.554349][ T37] audit: type=1800 audit(1785852695.643:2): pid=5935 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.37" name="device_path" dev="configfs" ino=9401 res=0 errno=0 [ 140.554412][ T37] audit: type=1800 audit(1785852695.703:3): pid=5938 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.37" name="buffered_io" dev="configfs" ino=8556 res=0 errno=0 [ 140.621037][ T5766] usb 5-1: 0:1 : does not exist [ 140.635016][ T5766] usb 5-1: 2:0: failed to get current value for ch 0 (-22) [ 140.661585][ T5766] usb 5-1: 2:0: cannot get min/max values for control 2 (id 2) [ 140.661623][ T5766] usb 5-1: Warning! Unlikely small volume range (=1), linear volume or custom curve? [ 140.661649][ T5766] usb 5-1: [2] FU [PCM Playback Volume] ch = 2, val = 0/1/1 [ 140.702239][ T10] usb 1-1: USB disconnect, device number 2 [ 140.864956][ T37] audit: type=1800 audit(1785852696.013:4): pid=5935 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.37" name="enable" dev="configfs" ino=8574 res=0 errno=0 [ 140.866313][ T5935] nvmet: failed to open block device (null): (-22) [ 141.178675][ T5766] usb 5-1: 2:0: cannot get min/max values for control 2 (id 2) [ 141.700133][ T5766] usb 5-1: USB disconnect, device number 3 [ 142.219529][ T822] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 142.424784][ T822] usb 3-1: New USB device found, idVendor=2040, idProduct=b120, bcdDevice= 0.00 [ 142.424817][ T822] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.433228][ T822] cx231xx 3-1:1.1: New device @ 480 Mbps (2040:b120) with 2 interfaces [ 143.462960][ T822] cx231xx 3-1:1.1: bad scenario!!!!! [ 143.462960][ T822] config_info=0 [ 143.462985][ T822] cx231xx 3-1:1.1: Failed to read PCB config [ 143.514613][ T5978] UDC core: g1: couldn't find an available UDC or it's busy [ 143.646727][ T5977] Need at least one configuration in g1. [ 143.673292][ T5977] udc pcspkr: failed to start g1: -22 [ 143.673327][ T5977] configfs-gadget.g1 gadget.33: probe with driver configfs-gadget.g1 failed with error -22 [ 143.767348][ T5977] ================================================================== [ 143.767368][ T5977] BUG: KASAN: slab-use-after-free in klist_dec_and_del+0x386/0x3d0 [ 143.767428][ T5977] Write of size 8 at addr ffff8880329628e0 by task syz.4.45/5977 [ 143.767448][ T5977] [ 143.767476][ T5977] CPU: 1 UID: 0 PID: 5977 Comm: syz.4.45 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 143.767503][ T5977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 143.767526][ T5977] Call Trace: [ 143.767545][ T5977] [ 143.767562][ T5977] dump_stack_lvl+0xe8/0x150 [ 143.767606][ T5977] print_address_description+0x55/0x1e0 [ 143.767640][ T5977] ? klist_dec_and_del+0x386/0x3d0 [ 143.767674][ T5977] print_report+0x58/0x70 [ 143.767703][ T5977] kasan_report+0x117/0x150 [ 143.767731][ T5977] ? klist_dec_and_del+0x386/0x3d0 [ 143.767768][ T5977] klist_dec_and_del+0x386/0x3d0 [ 143.767800][ T5977] klist_next+0xc3/0x2f0 [ 143.767832][ T5977] bus_for_each_drv+0x268/0x2f0 [ 143.767858][ T5977] ? __pfx___device_attach_driver+0x10/0x10 [ 143.767894][ T5977] ? __pfx_bus_for_each_drv+0x10/0x10 [ 143.767918][ T5977] ? rt_spin_unlock+0x163/0x200 [ 143.767945][ T5977] __device_attach+0x2c7/0x450 [ 143.767976][ T5977] ? __pfx___device_attach+0x10/0x10 [ 143.768005][ T5977] ? rt_spin_unlock+0x163/0x200 [ 143.768030][ T5977] device_initial_probe+0xa1/0xd0 [ 143.768060][ T5977] bus_probe_device+0x12d/0x220 [ 143.768086][ T5977] device_add+0x7d7/0xb80 [ 143.768115][ T5977] usb_add_gadget+0x47d/0x700 [ 143.768148][ T5977] ? __pfx_usb_udc_nop_release+0x10/0x10 [ 143.768176][ T5977] usb_add_gadget_udc_release+0x1a4/0x1f0 [ 143.768209][ T5977] vudc_probe+0x89f/0x9d0 [ 143.768234][ T5977] ? __pfx_vudc_probe+0x10/0x10 [ 143.768274][ T5977] platform_probe+0xf9/0x190 [ 143.768303][ T5977] ? __pfx_platform_probe+0x10/0x10 [ 143.768329][ T5977] really_probe+0x254/0xae0 [ 143.768362][ T5977] __driver_probe_device+0x1e8/0x360 [ 143.768396][ T5977] device_driver_attach+0xe0/0x1d0 [ 143.768427][ T5977] bind_store+0x1d3/0x220 [ 143.768455][ T5977] ? __pfx_sysfs_kf_write+0x10/0x10 [ 143.768476][ T5977] kernfs_fop_write_iter+0x3a5/0x540 [ 143.768508][ T5977] vfs_write+0x61e/0xbb0 [ 143.768541][ T5977] ? __pfx_vfs_write+0x10/0x10 [ 143.768570][ T5977] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 143.768601][ T5977] ? lockdep_hardirqs_on+0x7a/0x110 [ 143.768631][ T5977] ? mutex_lock_nested+0x152/0x1d0 [ 143.768652][ T5977] ? fdget_pos+0x252/0x320 [ 143.768679][ T5977] ksys_write+0x156/0x270 [ 143.768707][ T5977] ? __pfx_ksys_write+0x10/0x10 [ 143.768738][ T5977] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.768762][ T5977] do_syscall_64+0x174/0x580 [ 143.768791][ T5977] ? trace_irq_disable+0x3b/0x140 [ 143.768813][ T5977] ? clear_bhb_loop+0x40/0x90 [ 143.768836][ T5977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.768865][ T5977] RIP: 0033:0x7fabe65ee019 [ 143.768895][ T5977] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 143.768919][ T5977] RSP: 002b:00007fabe4846028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 143.768956][ T5977] RAX: ffffffffffffffda RBX: 00007fabe6875fa0 RCX: 00007fabe65ee019 [ 143.768973][ T5977] RDX: 0000000000000006 RSI: 0000200000000140 RDI: 0000000000000004 [ 143.768987][ T5977] RBP: 00007fabe668500c R08: 0000000000000000 R09: 0000000000000000 [ 143.769001][ T5977] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 143.769013][ T5977] R13: 00007fabe6876038 R14: 00007fabe6875fa0 R15: 00007ffeb7f127b8 [ 143.769038][ T5977] [ 143.769046][ T5977] [ 143.769051][ T5977] Allocated by task 5978: [ 143.769075][ T5977] kasan_save_track+0x3e/0x80 [ 143.769098][ T5977] __kasan_kmalloc+0x93/0xb0 [ 143.769119][ T5977] __kmalloc_cache_noprof+0x3d2/0x6b0 [ 143.769140][ T5977] bus_add_driver+0x165/0x670 [ 143.769161][ T5977] driver_register+0x23a/0x320 [ 143.769184][ T5977] usb_gadget_register_driver_owner+0xf9/0x270 [ 143.769215][ T5977] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 143.769233][ T5977] configfs_write_iter+0x33a/0x430 [ 143.769265][ T5977] vfs_write+0x61e/0xbb0 [ 143.769289][ T5977] ksys_write+0x156/0x270 [ 143.769312][ T5977] do_syscall_64+0x174/0x580 [ 143.769338][ T5977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.769358][ T5977] [ 143.769363][ T5977] Freed by task 5978: [ 143.769381][ T5977] kasan_save_track+0x3e/0x80 [ 143.769400][ T5977] kasan_save_free_info+0x40/0x50 [ 143.769428][ T5977] __kasan_slab_free+0x5c/0x80 [ 143.769448][ T5977] kfree+0x1c5/0x6c0 [ 143.769465][ T5977] kobject_put+0x222/0x550 [ 143.769481][ T5977] bus_remove_driver+0x248/0x320 [ 143.769503][ T5977] usb_gadget_register_driver_owner+0x223/0x270 [ 143.769532][ T5977] gadget_dev_desc_UDC_store+0x1c9/0x2f0 [ 143.769550][ T5977] configfs_write_iter+0x33a/0x430 [ 143.769572][ T5977] vfs_write+0x61e/0xbb0 [ 143.769595][ T5977] ksys_write+0x156/0x270 [ 143.769620][ T5977] do_syscall_64+0x174/0x580 [ 143.769652][ T5977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.769673][ T5977] [ 143.769679][ T5977] The buggy address belongs to the object at ffff888032962800 [ 143.769679][ T5977] which belongs to the cache kmalloc-512 of size 512 [ 143.769698][ T5977] The buggy address is located 224 bytes inside of [ 143.769698][ T5977] freed 512-byte region [ffff888032962800, ffff888032962a00) [ 143.769720][ T5977] [ 143.769725][ T5977] The buggy address belongs to the physical page: [ 143.769745][ T5977] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32960 [ 143.769770][ T5977] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 143.769788][ T5977] flags: 0x80000000000040(head|node=0|zone=1) [ 143.769811][ T5977] page_type: f5(slab) [ 143.769831][ T5977] raw: 0080000000000040 ffff88813ffb2c80 dead000000000100 dead000000000122 [ 143.769850][ T5977] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 143.769869][ T5977] head: 0080000000000040 ffff88813ffb2c80 dead000000000100 dead000000000122 [ 143.769886][ T5977] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 143.769905][ T5977] head: 0080000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 143.769924][ T5977] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004 [ 143.769934][ T5977] page dumped because: kasan: bad access detected [ 143.769952][ T5977] page_owner tracks the page as allocated [ 143.769965][ T5977] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5832, tgid 5822 (syz.0.1), ts 126620428538, free_ts 125246166491 [ 143.770003][ T5977] post_alloc_hook+0x1f9/0x250 [ 143.770024][ T5977] get_page_from_freelist+0x262a/0x26a0 [ 143.770048][ T5977] __alloc_frozen_pages_noprof+0x18d/0x380 [ 143.770072][ T5977] allocate_slab+0x79/0x5e0 [ 143.770098][ T5977] refill_objects+0x2d8/0x350 [ 143.770126][ T5977] __pcs_replace_empty_main+0x330/0x690 [ 143.770151][ T5977] __kmalloc_cache_noprof+0x468/0x6b0 [ 143.770172][ T5977] userio_char_open+0x51/0x1b0 [ 143.770195][ T5977] misc_open+0x2de/0x350 [ 143.770215][ T5977] chrdev_open+0x4dc/0x600 [ 143.770252][ T5977] do_dentry_open+0x849/0x1420 [ 143.770267][ T5977] vfs_open+0x3b/0x350 [ 143.770281][ T5977] path_openat+0x2e60/0x3850 [ 143.770301][ T5977] do_file_open+0x23e/0x4a0 [ 143.770322][ T5977] do_sys_openat2+0x115/0x200 [ 143.770340][ T5977] __x64_sys_openat+0x138/0x170 [ 143.770361][ T5977] page last free pid 4960 tgid 4960 stack trace: [ 143.770372][ T5977] __free_frozen_pages+0x10e7/0x11c0 [ 143.770389][ T5977] __slab_free+0x252/0x2a0 [ 143.770406][ T5977] qlist_free_all+0x99/0x100 [ 143.770422][ T5977] kasan_quarantine_reduce+0x148/0x160 [ 143.770437][ T5977] __kasan_slab_alloc+0x22/0x80 [ 143.770454][ T5977] __kmalloc_noprof+0x3b6/0x780 [ 143.770470][ T5977] tomoyo_realpath_from_path+0xef/0x640 [ 143.770495][ T5977] tomoyo_check_open_permission+0x229/0x470 [ 143.770513][ T5977] security_file_open+0xa9/0x240 [ 143.770532][ T5977] do_dentry_open+0x4be/0x1420 [ 143.770549][ T5977] vfs_open+0x3b/0x350 [ 143.770562][ T5977] path_openat+0x2e60/0x3850 [ 143.770583][ T5977] do_file_open+0x23e/0x4a0 [ 143.770603][ T5977] do_sys_openat2+0x115/0x200 [ 143.770619][ T5977] __x64_sys_openat+0x138/0x170 [ 143.770636][ T5977] do_syscall_64+0x174/0x580 [ 143.770660][ T5977] [ 143.770666][ T5977] Memory state around the buggy address: [ 143.770683][ T5977] ffff888032962780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 143.770696][ T5977] ffff888032962800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 143.770709][ T5977] >ffff888032962880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 143.770718][ T5977] ^ [ 143.770729][ T5977] ffff888032962900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 143.770743][ T5977] ffff888032962980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 143.770753][ T5977] ================================================================== [ 143.770902][ T5977] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 143.770920][ T5977] CPU: 1 UID: 0 PID: 5977 Comm: syz.4.45 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 143.770942][ T5977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 143.770954][ T5977] Call Trace: [ 143.770962][ T5977] [ 143.770972][ T5977] vpanic+0x56c/0xa60 [ 143.770994][ T5977] ? __pfx_vpanic+0x10/0x10 [ 143.771012][ T5977] ? __pfx___schedule+0x10/0x10 [ 143.771037][ T5977] panic+0xc5/0xd0 [ 143.771053][ T5977] ? __pfx_panic+0x10/0x10 [ 143.771069][ T5977] ? preempt_schedule_thunk+0x16/0x40 [ 143.771095][ T5977] ? klist_dec_and_del+0x386/0x3d0 [ 143.771121][ T5977] check_panic_on_warn+0x89/0xb0 [ 143.771139][ T5977] ? klist_dec_and_del+0x386/0x3d0 [ 143.771165][ T5977] end_report+0x73/0x170 [ 143.771187][ T5977] ? klist_dec_and_del+0x386/0x3d0 [ 143.771213][ T5977] kasan_report+0x128/0x150 [ 143.771248][ T5977] ? klist_dec_and_del+0x386/0x3d0 [ 143.771279][ T5977] klist_dec_and_del+0x386/0x3d0 [ 143.771315][ T5977] klist_next+0xc3/0x2f0 [ 143.771354][ T5977] bus_for_each_drv+0x268/0x2f0 [ 143.771376][ T5977] ? __pfx___device_attach_driver+0x10/0x10 [ 143.771406][ T5977] ? __pfx_bus_for_each_drv+0x10/0x10 [ 143.771426][ T5977] ? rt_spin_unlock+0x163/0x200 [ 143.771450][ T5977] __device_attach+0x2c7/0x450 [ 143.771479][ T5977] ? __pfx___device_attach+0x10/0x10 [ 143.771505][ T5977] ? rt_spin_unlock+0x163/0x200 [ 143.771527][ T5977] device_initial_probe+0xa1/0xd0 [ 143.771557][ T5977] bus_probe_device+0x12d/0x220 [ 143.771580][ T5977] device_add+0x7d7/0xb80 [ 143.771608][ T5977] usb_add_gadget+0x47d/0x700 [ 143.771641][ T5977] ? __pfx_usb_udc_nop_release+0x10/0x10 [ 143.771669][ T5977] usb_add_gadget_udc_release+0x1a4/0x1f0 [ 143.771698][ T5977] vudc_probe+0x89f/0x9d0 [ 143.771724][ T5977] ? __pfx_vudc_probe+0x10/0x10 [ 143.771746][ T5977] platform_probe+0xf9/0x190 [ 143.771774][ T5977] ? __pfx_platform_probe+0x10/0x10 [ 143.771799][ T5977] really_probe+0x254/0xae0 [ 143.771833][ T5977] __driver_probe_device+0x1e8/0x360 [ 143.771867][ T5977] device_driver_attach+0xe0/0x1d0 [ 143.771900][ T5977] bind_store+0x1d3/0x220 [ 143.771929][ T5977] ? __pfx_sysfs_kf_write+0x10/0x10 [ 143.771951][ T5977] kernfs_fop_write_iter+0x3a5/0x540 [ 143.771984][ T5977] vfs_write+0x61e/0xbb0 [ 143.772017][ T5977] ? __pfx_vfs_write+0x10/0x10 [ 143.772043][ T5977] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 143.772073][ T5977] ? lockdep_hardirqs_on+0x7a/0x110 [ 143.772102][ T5977] ? mutex_lock_nested+0x152/0x1d0 [ 143.772124][ T5977] ? fdget_pos+0x252/0x320 [ 143.772157][ T5977] ksys_write+0x156/0x270 [ 143.772188][ T5977] ? __pfx_ksys_write+0x10/0x10 [ 143.772220][ T5977] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.772259][ T5977] do_syscall_64+0x174/0x580 [ 143.772292][ T5977] ? trace_irq_disable+0x3b/0x140 [ 143.772314][ T5977] ? clear_bhb_loop+0x40/0x90 [ 143.772340][ T5977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.772361][ T5977] RIP: 0033:0x7fabe65ee019 [ 143.772382][ T5977] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 143.772401][ T5977] RSP: 002b:00007fabe4846028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 143.772426][ T5977] RAX: ffffffffffffffda RBX: 00007fabe6875fa0 RCX: 00007fabe65ee019 [ 143.772443][ T5977] RDX: 0000000000000006 RSI: 0000200000000140 RDI: 0000000000000004 [ 143.772458][ T5977] RBP: 00007fabe668500c R08: 0000000000000000 R09: 0000000000000000 [ 143.772473][ T5977] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 143.772487][ T5977] R13: 00007fabe6876038 R14: 00007fabe6875fa0 R15: 00007ffeb7f127b8 [ 143.772512][ T5977] [ 143.773132][ T5977] Kernel Offset: disabled