last executing test programs: 3.325205869s ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./cfg\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./cfg\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cfg/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./cfg/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='0x1d6b\x00', 0x6) write(0xffffffffffffffff, &(0x7f0000000500)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./cfg/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./cfg/usb_gadget/g1/functions/midi.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000700)='./cfg/usb_gadget/g1/functions/midi.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./cfg/usb_gadget/g1/configs/c.1/midi.usb0\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./cfg/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r1, &(0x7f0000000a00)='dummy_udc.0\x00', 0xb) r2 = epoll_create1(0x0) epoll_pwait2(r2, &(0x7f0000001000)=[{}], 0x1, &(0x7f0000001040)={0x1}, 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000b00), 0x0, 0x2) write(r3, &(0x7f0000000c00)='data\x00', 0x4) r4 = syz_open_dev$sndmidi(&(0x7f0000000b00), 0x1, 0x2) write(r4, &(0x7f0000000c00)='data\x00', 0x4) r5 = syz_open_dev$sndmidi(&(0x7f0000000b00), 0x2, 0x2) write(r5, &(0x7f0000000c00)='data\x00', 0x4) r6 = syz_open_dev$sndmidi(&(0x7f0000000b00), 0x3, 0x2) write(r6, &(0x7f0000000c00)='data\x00', 0x4) 3.083423646s ago: executing program 3 (id=4): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='0x0525\x00', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='0xa4a2\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='config/usb_gadget/g1/functions/rndis.usb0\x00', 0x1ff) symlinkat(&(0x7f00000002c0)='config/usb_gadget/g1/functions/rndis.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='config/usb_gadget/g1/configs/c.1/rndis.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000340)='config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000380)='dummy_udc.0\x00', 0xb) write(r2, &(0x7f00000003c0)='dummy_udc.1\x00', 0xb) write(r2, &(0x7f0000000440)='dummy_udc.3\x00', 0xb) r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='config/usb_gadget/g1/UDC\x00', 0x0, 0x0) read(r3, &(0x7f00000004c0)=""/64, 0x40) 2.214431463s ago: executing program 1 (id=6): ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f00000000c0)={0xc}) ioctl$IOMMU_HWPT_ALLOC$TEST(0xffffffffffffffff, 0x3b89, 0x0) ioctl$IOMMU_HWPT_INVALIDATE$TEST(0xffffffffffffffff, 0x3b8d, &(0x7f0000000280)={0x20, 0x0, &(0x7f00000002c0)}) ioctl$IOMMU_DESTROY$hwpt(0xffffffffffffffff, 0x3b80, &(0x7f0000000300)={0x8}) ioctl$IOMMU_DESTROY$hwpt(0xffffffffffffffff, 0x3b80, &(0x7f0000000340)={0x8}) ioctl$IOMMU_DESTROY$stdev(0xffffffffffffffff, 0x3b80, &(0x7f0000000400)={0x8}) close(0xffffffffffffffff) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000002000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f00000004c0)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0}) ioctl(r0, 0x3b8e, &(0x7f0000000000)="10000000") ioctl$IOMMU_HWPT_ALLOC$NONE(r0, 0x3b89, &(0x7f0000000540)={0x28, 0x1, r2, r1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)}) ioctl(r0, 0x3b89, &(0x7f0000001000)="300000000400000004000000070000000000000000000000adde00000800000000200000007f00000600000000000000") ioctl(r0, 0x3ba0, &(0x7f0000004000)="480000000200000000000000000000000400000000000000000000000100"/72) read(0x4, &(0x7f0000003000)=""/40, 0x28) 2.109294696s ago: executing program 3 (id=7): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='config/usb_gadget/g1\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000140)='config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(0xffffffffffffffff, &(0x7f0000000440)='dummy_udc.3\x00', 0xb) r0 = openat(0xffffffffffffff9c, &(0x7f0000000480)='config/usb_gadget/g1/UDC\x00', 0x0, 0x0) read(r0, &(0x7f00000004c0)=""/64, 0x40) 1.633690236s ago: executing program 1 (id=8): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x2, 0x0) 1.633304845s ago: executing program 3 (id=9): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='0x1d6b\x00', 0x6) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/idProduct\x00', 0x2, 0x0) write(r1, &(0x7f0000000200)='0x0104\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x2, 0x0) 1.361699378s ago: executing program 1 (id=10): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff) mount(&(0x7f0000000400)=@filename='sysfs\x00', &(0x7f0000000300)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config/usb_gadget/g_uac2\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g_uac2/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='0x1234\n', 0x7) write(0xffffffffffffffff, &(0x7f0000000400)='0x5678\n', 0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g_uac2/functions/uac2.usb0/c_chmask\x00', 0x1, 0x0) write(r1, &(0x7f0000000700)='0\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g_uac2/functions/uac2.usb0/p_chmask\x00', 0x1, 0x0) write(r2, &(0x7f0000000900)='1\n', 0x2) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g_uac2/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g_uac2/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g_uac2/configs/c.1/uac2.usb0\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000001500)='./config/usb_gadget/g_uac2/UDC\x00', 0x1, 0x0) write(r3, &(0x7f0000001600)='usbip-vudc.0\n', 0xd) 1.338620726s ago: executing program 3 (id=11): r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000400a0400030000010200010902190001010080320904000001ff00000007058101400001"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x8, &(0x7f0000000180)={0xc0, 0x0, 0x2, 'D\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000300)={0x2}, 0x0) r1 = syz_open_dev$video(&(0x7f0000000400), 0x0, 0x2) ioctl$VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000500)=0x1) r2 = syz_open_dev$video(&(0x7f0000000400), 0x1, 0x2) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000500)=0x1) r3 = syz_open_dev$video(&(0x7f0000000400), 0x2, 0x2) ioctl$VIDIOC_STREAMON(r3, 0x40045612, &(0x7f0000000500)=0x1) r4 = syz_open_dev$video(&(0x7f0000000400), 0x3, 0x2) ioctl$VIDIOC_STREAMON(r4, 0x40045612, &(0x7f0000000500)=0x1) r5 = syz_open_dev$video(&(0x7f0000000400), 0x4, 0x2) ioctl$VIDIOC_STREAMON(r5, 0x40045612, &(0x7f0000000500)=0x1) r6 = syz_open_dev$video(&(0x7f0000000400), 0x5, 0x2) ioctl$VIDIOC_STREAMON(r6, 0x40045612, &(0x7f0000000500)=0x1) r7 = syz_open_dev$video(&(0x7f0000000400), 0x6, 0x2) ioctl$VIDIOC_STREAMON(r7, 0x40045612, &(0x7f0000000500)=0x1) r8 = syz_open_dev$video(&(0x7f0000000400), 0x7, 0x2) ioctl$VIDIOC_STREAMON(r8, 0x40045612, &(0x7f0000000500)=0x1) r9 = syz_open_dev$video(&(0x7f0000000400), 0x8, 0x2) ioctl$VIDIOC_STREAMON(r9, 0x40045612, &(0x7f0000000500)=0x1) r10 = syz_open_dev$video(&(0x7f0000000400), 0x9, 0x2) ioctl$VIDIOC_STREAMON(r10, 0x40045612, &(0x7f0000000500)=0x1) r11 = syz_open_dev$video(&(0x7f0000000400), 0xa, 0x2) ioctl$VIDIOC_STREAMON(r11, 0x40045612, &(0x7f0000000500)=0x1) r12 = syz_open_dev$video(&(0x7f0000000400), 0xb, 0x2) ioctl$VIDIOC_STREAMON(r12, 0x40045612, &(0x7f0000000500)=0x1) r13 = syz_open_dev$video(&(0x7f0000000400), 0xc, 0x2) ioctl$VIDIOC_STREAMON(r13, 0x40045612, &(0x7f0000000500)=0x1) r14 = syz_open_dev$video(&(0x7f0000000400), 0xd, 0x2) ioctl$VIDIOC_STREAMON(r14, 0x40045612, &(0x7f0000000500)=0x1) ioctl$VIDIOC_STREAMON(0xffffffffffffffff, 0x40045612, &(0x7f0000000500)=0x1) 1.148406518s ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/devices/system/cpu/cpu1/online\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='0\n\x00', 0x2) write(r0, &(0x7f00000001a0)='1\n\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/devices/system/machinecheck/machinecheck0/tolerant\x00', 0x2, 0x0) write(r1, &(0x7f0000000380)='1\n\x00', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/devices/system/machinecheck/machinecheck0/bank0\x00', 0x2, 0x0) write(r2, &(0x7f0000000480)='1\n\x00', 0x2) r3 = syz_open_dev$MSR(&(0x7f0000000800), 0x0, 0x0) pread64(r3, &(0x7f0000000900)=""/8, 0x8, 0x403) pread64(r3, &(0x7f0000000a00)=""/8, 0x8, 0x10) close(r3) 705.687515ms ago: executing program 1 (id=12): mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='0x1d6b\n', 0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) close(r1) mkdir(&(0x7f0000000800)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/strings/0x409/serialnumber\x00', 0x1, 0x0) write(r2, &(0x7f0000000a00)='fedcba9876543210\n', 0x11) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./config/usb_gadget/g1/strings/0x409/manufacturer\x00', 0x1, 0x0) write(r3, &(0x7f0000000c00)='Linux Foundation\n', 0x11) close(r3) write(0xffffffffffffffff, &(0x7f0000000e00)='Multifunction Gadget\n', 0x15) close(0xffffffffffffffff) mkdir(&(0x7f0000001000)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/configs/c.1/strings/0x409/configuration\x00', 0x1, 0x0) mkdir(&(0x7f0000001300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000001c00)='./config/usb_gadget/g1/functions/ecm.usb0/ifname\x00', 0x1, 0x0) write(r4, &(0x7f0000001d00)='veth0\n', 0x6) close(r4) symlink(&(0x7f0000001400)='./config/usb_gadget/g1/functions/ecm.usb0\x00', &(0x7f0000001500)='./config/usb_gadget/g1/configs/c.1/ecm.usb0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000001600)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f0000001700)='dummy_udc.0\n', 0xc) close(r5) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000001900)={'veth0\x00', 0x1}) write(r6, &(0x7f0000001b00)="00112233445566778899aabb0800"/76, 0x40) 0s ago: executing program 1 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nvmet\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nvmet/subsystems/testsubsys\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f00000001c0), 0x0) close(r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ed) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0) write(r1, &(0x7f0000000280)='/dev/nullb0\x00', 0xc) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0) write(r2, &(0x7f0000000300)='1\x00', 0x2) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1\x00', 0x1ed) r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)='loop\x00', 0x5) close(r3) symlinkat(&(0x7f0000000440)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/subsystems/testsubsys\x00') r4 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write(r4, &(0x7f0000000500)='nqn=testsubsys,transport=loop\x00', 0x1f) close(r4) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.29' (ED25519) to the list of known hosts. [ 77.212222][ T5565] cgroup: Unknown subsys name 'net' [ 77.453626][ T5565] cgroup: Unknown subsys name 'cpuset' [ 77.507455][ T5565] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 79.161466][ T5565] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 82.792313][ T4893] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 82.796331][ T4893] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 82.799174][ T4893] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 82.805296][ T4893] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 82.811350][ T4893] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 82.852080][ T59] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 82.855576][ T5585] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 82.875783][ T5585] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 82.901151][ T5585] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 82.923895][ T5594] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 82.937557][ T5594] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 82.958473][ T5594] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 82.959826][ T5594] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 82.963606][ T5591] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 82.995161][ T4893] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 83.008547][ T4893] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 83.031171][ T5591] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 83.034503][ T5591] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 83.034911][ T5591] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 83.035800][ T5591] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 83.039607][ T5591] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 83.039850][ T5591] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 83.041744][ T5591] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 83.131245][ T5591] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 83.161292][ T59] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 84.917920][ T5585] Bluetooth: hci0: command tx timeout [ 85.079178][ T5585] Bluetooth: hci4: command tx timeout [ 85.157887][ T5585] Bluetooth: hci2: command tx timeout [ 85.158006][ T5585] Bluetooth: hci3: command tx timeout [ 85.236988][ T59] Bluetooth: hci1: command tx timeout [ 85.403477][ T5578] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.404180][ T5578] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.404290][ T5578] bridge_slave_0: entered allmulticast mode [ 85.406414][ T5578] bridge_slave_0: entered promiscuous mode [ 85.446355][ T5577] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.446442][ T5577] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.446767][ T5577] bridge_slave_0: entered allmulticast mode [ 85.468511][ T5577] bridge_slave_0: entered promiscuous mode [ 85.487678][ T5578] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.487771][ T5578] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.487920][ T5578] bridge_slave_1: entered allmulticast mode [ 85.490226][ T5578] bridge_slave_1: entered promiscuous mode [ 85.539857][ T5577] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.539953][ T5577] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.540060][ T5577] bridge_slave_1: entered allmulticast mode [ 85.542853][ T5577] bridge_slave_1: entered promiscuous mode [ 85.544122][ T5580] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.544222][ T5580] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.544311][ T5580] bridge_slave_0: entered allmulticast mode [ 85.545631][ T5580] bridge_slave_0: entered promiscuous mode [ 85.594023][ T5581] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.594143][ T5581] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.594339][ T5581] bridge_slave_0: entered allmulticast mode [ 85.597423][ T5581] bridge_slave_0: entered promiscuous mode [ 85.639809][ T5580] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.639930][ T5580] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.640022][ T5580] bridge_slave_1: entered allmulticast mode [ 85.641344][ T5580] bridge_slave_1: entered promiscuous mode [ 85.660539][ T5581] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.660652][ T5581] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.661125][ T5581] bridge_slave_1: entered allmulticast mode [ 85.664788][ T5581] bridge_slave_1: entered promiscuous mode [ 85.669264][ T5579] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.669377][ T5579] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.669908][ T5579] bridge_slave_0: entered allmulticast mode [ 85.672414][ T5579] bridge_slave_0: entered promiscuous mode [ 85.752612][ T5578] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.770041][ T5579] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.770139][ T5579] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.770234][ T5579] bridge_slave_1: entered allmulticast mode [ 85.771667][ T5579] bridge_slave_1: entered promiscuous mode [ 85.775637][ T5577] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.811054][ T5578] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.838898][ T5577] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.940795][ T5580] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.960710][ T5581] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.990496][ T5580] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.008246][ T5581] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.010784][ T5579] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.044374][ T5578] team0: Port device team_slave_0 added [ 86.061133][ T5579] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.062720][ T5577] team0: Port device team_slave_0 added [ 86.093528][ T5578] team0: Port device team_slave_1 added [ 86.120620][ T5577] team0: Port device team_slave_1 added [ 86.122210][ T5580] team0: Port device team_slave_0 added [ 86.141614][ T5581] team0: Port device team_slave_0 added [ 86.170186][ T5580] team0: Port device team_slave_1 added [ 86.188673][ T5581] team0: Port device team_slave_1 added [ 86.190300][ T5579] team0: Port device team_slave_0 added [ 86.222153][ T5578] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.222164][ T5578] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.222177][ T5578] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.285137][ T5579] team0: Port device team_slave_1 added [ 86.292727][ T5577] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.292742][ T5577] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.292763][ T5577] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.352082][ T5578] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.352096][ T5578] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.352116][ T5578] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.390188][ T5577] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.390202][ T5577] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.390223][ T5577] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.394854][ T5580] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.394867][ T5580] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.394887][ T5580] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.414637][ T5581] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.414652][ T5581] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.414672][ T5581] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.458213][ T5580] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.458228][ T5580] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.458249][ T5580] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.464565][ T5581] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.464584][ T5581] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.464605][ T5581] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.470536][ T5579] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.470550][ T5579] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.470569][ T5579] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.514214][ T5579] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.514230][ T5579] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.514250][ T5579] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.663907][ T5578] hsr_slave_0: entered promiscuous mode [ 86.665373][ T5578] hsr_slave_1: entered promiscuous mode [ 86.705447][ T5577] hsr_slave_0: entered promiscuous mode [ 86.706745][ T5577] hsr_slave_1: entered promiscuous mode [ 86.708436][ T5577] debugfs: 'hsr0' already exists in 'hsr' [ 86.709360][ T5577] Cannot create hsr debugfs directory [ 86.756161][ T1232] cfg80211: failed to load regulatory.db [ 86.790106][ T5580] hsr_slave_0: entered promiscuous mode [ 86.790845][ T5580] hsr_slave_1: entered promiscuous mode [ 86.791353][ T5580] debugfs: 'hsr0' already exists in 'hsr' [ 86.791370][ T5580] Cannot create hsr debugfs directory [ 86.801201][ T5581] hsr_slave_0: entered promiscuous mode [ 86.802431][ T5581] hsr_slave_1: entered promiscuous mode [ 86.803352][ T5581] debugfs: 'hsr0' already exists in 'hsr' [ 86.803372][ T5581] Cannot create hsr debugfs directory [ 86.855741][ T5579] hsr_slave_0: entered promiscuous mode [ 86.856500][ T5579] hsr_slave_1: entered promiscuous mode [ 86.867439][ T5579] debugfs: 'hsr0' already exists in 'hsr' [ 86.867465][ T5579] Cannot create hsr debugfs directory [ 86.997026][ T59] Bluetooth: hci0: command tx timeout [ 87.157101][ T59] Bluetooth: hci4: command tx timeout [ 87.238189][ T5585] Bluetooth: hci2: command tx timeout [ 87.238268][ T59] Bluetooth: hci3: command tx timeout [ 87.317321][ T59] Bluetooth: hci1: command tx timeout [ 87.915145][ T5578] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 87.950523][ T5578] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 87.972004][ T5578] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 88.011913][ T5578] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.016420][ T5578] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 88.062311][ T5578] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.082111][ T5578] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 88.111484][ T5578] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.201249][ T5577] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 88.241697][ T5577] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.244517][ T5577] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 88.271126][ T5577] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.276198][ T5577] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 88.321226][ T5577] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.343785][ T5577] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 88.375490][ T5577] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.496673][ T5581] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.524412][ T5581] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.543646][ T5581] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 88.581086][ T5581] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.585246][ T5581] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.612007][ T5581] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.636079][ T5581] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.670769][ T5581] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.796250][ T5579] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 88.841130][ T5579] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.846198][ T5579] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 88.864578][ T5579] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.883470][ T5579] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 88.910861][ T5579] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.942375][ T5579] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 88.970483][ T5579] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.000882][ T5578] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.076975][ T59] Bluetooth: hci0: command tx timeout [ 89.122078][ T5580] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 89.152675][ T5580] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 89.163504][ T5580] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 89.190531][ T5580] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 89.204561][ T5580] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 89.232985][ T5580] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 89.234825][ T5578] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.248361][ T59] Bluetooth: hci4: command tx timeout [ 89.262625][ T5580] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 89.291067][ T5580] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 89.321353][ T59] Bluetooth: hci3: command tx timeout [ 89.321371][ T5585] Bluetooth: hci2: command tx timeout [ 89.326053][ T4652] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.326802][ T4652] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.389892][ T5577] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.397014][ T5585] Bluetooth: hci1: command tx timeout [ 89.413193][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.413378][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.514961][ T5577] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.561981][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.562080][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.588573][ T5581] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.629015][ T4652] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.629151][ T4652] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.694200][ T5581] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.744187][ T1968] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.744403][ T1968] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.774308][ T5579] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.834895][ T1968] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.835016][ T1968] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.964080][ T5579] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.986250][ T5580] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.011422][ T1968] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.011541][ T1968] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.099910][ T1968] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.100033][ T1968] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.231998][ T5580] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.310186][ T1387] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.311049][ T1387] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.430525][ T1387] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.431900][ T1387] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.774850][ T5578] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.156995][ T5585] Bluetooth: hci0: command tx timeout [ 91.179966][ T5578] veth0_vlan: entered promiscuous mode [ 91.200752][ T5577] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.253896][ T5578] veth1_vlan: entered promiscuous mode [ 91.318214][ T5585] Bluetooth: hci4: command tx timeout [ 91.397519][ T5585] Bluetooth: hci3: command tx timeout [ 91.407503][ T5585] Bluetooth: hci2: command tx timeout [ 91.478396][ T5585] Bluetooth: hci1: command tx timeout [ 91.522175][ T5578] veth0_macvtap: entered promiscuous mode [ 91.530844][ T5577] veth0_vlan: entered promiscuous mode [ 91.540018][ T5578] veth1_macvtap: entered promiscuous mode [ 91.552928][ T5581] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.592474][ T5577] veth1_vlan: entered promiscuous mode [ 91.682182][ T5578] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.768957][ T5578] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.852268][ T5579] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.869900][ T5577] veth0_macvtap: entered promiscuous mode [ 91.960069][ T5581] veth0_vlan: entered promiscuous mode [ 91.963017][ T5577] veth1_macvtap: entered promiscuous mode [ 91.966460][ T5580] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.220194][ T5581] veth1_vlan: entered promiscuous mode [ 92.281815][ T5577] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.341278][ T5577] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.463537][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.463568][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.579130][ T5579] veth0_vlan: entered promiscuous mode [ 92.615434][ T5581] veth0_macvtap: entered promiscuous mode [ 92.726689][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.726708][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.726708][ T5581] veth1_macvtap: entered promiscuous mode [ 92.821355][ T5579] veth1_vlan: entered promiscuous mode [ 93.018148][ T158] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.018168][ T158] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.024718][ T5581] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.033090][ T5580] veth0_vlan: entered promiscuous mode [ 93.068992][ T5581] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.146620][ T5580] veth1_vlan: entered promiscuous mode [ 93.186359][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.186378][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.225175][ T5579] veth0_macvtap: entered promiscuous mode [ 93.323733][ T5579] veth1_macvtap: entered promiscuous mode [ 93.520999][ T37] audit: type=1800 audit(1786955110.020:2): pid=5773 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.2" name="idVendor" dev="configfs" ino=7527 res=0 errno=0 [ 93.769406][ T37] audit: type=1800 audit(1786955110.310:3): pid=5773 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.2" name="UDC" dev="configfs" ino=7539 res=0 errno=0 [ 93.906234][ T5579] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.922603][ T5580] veth0_macvtap: entered promiscuous mode [ 94.035341][ T5579] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.098929][ T5580] veth1_macvtap: entered promiscuous mode [ 94.128781][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.128798][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.326790][ T37] audit: type=1804 audit(1786955110.860:4): pid=5781 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.3.4" name="/newroot/0/config/usb_gadget/g1/UDC" dev="configfs" ino=7539 res=1 errno=0 [ 94.523283][ T5580] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.570193][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.570210][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.570869][ T5784] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 94.633843][ T5787] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 94.707525][ T5580] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.711323][ T37] audit: type=1800 audit(1786955111.250:5): pid=5786 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.3.7" name="UDC" dev="configfs" ino=8469 res=0 errno=0 [ 94.937702][ T5719] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 95.173061][ T37] audit: type=1800 audit(1786955111.720:6): pid=5792 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.3.9" name="idVendor" dev="configfs" ino=7686 res=0 errno=0 [ 95.174116][ T37] audit: type=1800 audit(1786955111.720:7): pid=5792 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.3.9" name="idProduct" dev="configfs" ino=7687 res=0 errno=0 [ 95.359090][ T5719] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0104, bcdDevice= 7.02 [ 95.457688][ T5719] usb 1-1: Dual-Role OTG device on HNP port [ 95.459615][ T5719] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.781733][ T1387] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.781751][ T1387] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.877050][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 96.200940][ T10] usb 4-1: New USB device found, idVendor=040a, idProduct=0300, bcdDevice= 0.00 [ 96.221267][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 96.221292][ T10] usb 4-1: Product: syz [ 96.221314][ T10] usb 4-1: Manufacturer: syz [ 96.380882][ T5719] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 96.483309][ T56] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.483325][ T56] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.595711][ T56] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.750853][ T5798] smpboot: CPU 1 is now offline [ 96.780021][ T10] gspca_main: spca500-2.14.0 probing 040a:0300 [ 97.096345][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.096359][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.143784][ C0] [ 97.143794][ C0] ============================================ [ 97.143797][ C0] WARNING: possible recursive locking detected [ 97.143808][ C0] syzkaller #0 Not tainted [ 97.143814][ C0] -------------------------------------------- [ 97.143817][ C0] ktimers/0/16 is trying to acquire lock: [ 97.143824][ C0] ffff8880b873a990 (&pool->cb_lock){+...}-{3:3}, at: bh_worker+0x7d/0x880 [ 97.143865][ C0] [ 97.143865][ C0] but task is already holding lock: [ 97.143868][ C0] ffff8880b863a990 (&pool->cb_lock){+...}-{3:3}, at: bh_worker+0x7d/0x880 [ 97.143889][ C0] [ 97.143889][ C0] other info that might help us debug this: [ 97.143892][ C0] Possible unsafe locking scenario: [ 97.143892][ C0] [ 97.143895][ C0] CPU0 [ 97.143897][ C0] ---- [ 97.143900][ C0] lock(&pool->cb_lock); [ 97.143910][ C0] lock(&pool->cb_lock); [ 97.143916][ C0] [ 97.143916][ C0] *** DEADLOCK *** [ 97.143916][ C0] [ 97.143919][ C0] May be due to missing lock nesting notation [ 97.143919][ C0] [ 97.143922][ C0] 6 locks held by ktimers/0/16: [ 97.143927][ C0] #0: ffffffff8e059220 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 97.143951][ C0] #1: ffffffff8e1c3000 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 97.143972][ C0] #2: ffff8880b863a990 (&pool->cb_lock){+...}-{3:3}, at: bh_worker+0x7d/0x880 [ 97.143994][ C0] #3: ffffffff8e1c3000 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 97.144019][ C0] #4: ffff88813ff1dd38 ((wq_completion)events_bh){+...}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 97.144042][ C0] #5: ffffc90000157ba0 ((work_completion)(&dead_work.work)){+...}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 97.144063][ C0] [ 97.144063][ C0] stack backtrace: [ 97.144075][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 97.144089][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 97.144100][ C0] Call Trace: [ 97.144104][ C0] [ 97.144108][ C0] dump_stack_lvl+0xe8/0x150 [ 97.144121][ C0] print_deadlock_bug+0x279/0x290 [ 97.144133][ C0] __lock_acquire+0x24df/0x2ce0 [ 97.144142][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 97.144155][ C0] ? __pfx_hlock_conflict+0x10/0x10 [ 97.144165][ C0] ? check_path+0x21/0x40 [ 97.144176][ C0] ? bh_worker+0x7d/0x880 [ 97.144185][ C0] lock_acquire+0x106/0x350 [ 97.144193][ C0] ? bh_worker+0x7d/0x880 [ 97.144203][ C0] ? lockdep_unlock+0x5d/0xd0 [ 97.144217][ C0] rt_spin_lock+0x83/0x400 [ 97.144234][ C0] ? bh_worker+0x7d/0x880 [ 97.144245][ C0] ? __pfx_rt_spin_lock+0x10/0x10 [ 97.144258][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 97.144271][ C0] bh_worker+0x7d/0x880 [ 97.144281][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 97.144292][ C0] drain_dead_softirq_workfn+0x95/0x220 [ 97.144303][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 97.144312][ C0] process_scheduled_works+0xa8e/0x14e0 [ 97.144327][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 97.144336][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 97.144350][ C0] bh_worker+0x46a/0x880 [ 97.144361][ C0] tasklet_action+0xc/0x70 [ 97.144372][ C0] handle_softirqs+0x1d9/0x6c0 [ 97.144383][ C0] run_ktimerd+0x69/0x100 [ 97.144394][ C0] smpboot_thread_fn+0x57c/0xa80 [ 97.144405][ C0] ? smpboot_thread_fn+0x4e/0xa80 [ 97.144417][ C0] kthread+0x388/0x470 [ 97.144428][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 97.144439][ C0] ? __pfx_kthread+0x10/0x10 [ 97.144450][ C0] ret_from_fork+0x514/0xb70 [ 97.144464][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 97.144475][ C0] ? __switch_to+0xc89/0x1420 [ 97.144486][ C0] ? __pfx_kthread+0x10/0x10 [ 97.144497][ C0] ret_from_fork_asm+0x1a/0x30 [ 97.144512][ C0] [ 97.144655][ C0] BUG: workqueue leaked atomic, lock or RCU: ktimers/0[16] [ 97.144655][ C0] preempt=0x00000000 lock=4->0 RCU=2->2 workfn=drain_dead_softirq_workfn [ 97.144677][ C0] INFO: lockdep is turned off. [ 97.144683][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 97.144693][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 97.144698][ C0] Call Trace: [ 97.144701][ C0] [ 97.144705][ C0] dump_stack_lvl+0xe8/0x150 [ 97.144718][ C0] process_scheduled_works+0x1161/0x14e0 [ 97.144738][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 97.144747][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 97.144762][ C0] bh_worker+0x46a/0x880 [ 97.144774][ C0] tasklet_action+0xc/0x70 [ 97.144784][ C0] handle_softirqs+0x1d9/0x6c0 [ 97.144796][ C0] run_ktimerd+0x69/0x100 [ 97.144806][ C0] smpboot_thread_fn+0x57c/0xa80 [ 97.144818][ C0] ? smpboot_thread_fn+0x4e/0xa80 [ 97.144829][ C0] kthread+0x388/0x470 [ 97.144841][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 97.144851][ C0] ? __pfx_kthread+0x10/0x10 [ 97.144862][ C0] ret_from_fork+0x514/0xb70 [ 97.144876][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 97.144887][ C0] ? __switch_to+0xc89/0x1420 [ 97.144898][ C0] ? __pfx_kthread+0x10/0x10 [ 97.144910][ C0] ret_from_fork_asm+0x1a/0x30 [ 97.144925][ C0] [ 97.261452][ T5580] ieee80211 phy12: Selected rate control algorithm 'minstrel_ht' [ 97.457763][ T67] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.501965][ T1968] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.514657][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.514719][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.514892][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.514952][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.515006][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.515148][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.515211][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.515358][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.515414][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.515469][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.515523][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.815381][ T5811] blk-mq: failed to allocate request map [ 97.864573][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.864586][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.942552][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.942706][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.942825][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.942926][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.117853][ T1968] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.118353][ T67] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 98.875866][ T5815] usb 4-1: USB disconnect, device number 2