last executing test programs: 1m52.70918873s ago: executing program 0 (id=9): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dev_mnt\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x1) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x1b6) ftruncate(r1, 0x1000000) r2 = syz_open_dev$loop(&(0x7f0000000280), 0x0, 0x2) ioctl$LOOP_SET_FD(r2, 0x4c00, r1) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0x42, 0x1b6) ftruncate(r3, 0x1000000) r4 = syz_open_dev$loop(&(0x7f0000000300), 0x1, 0x2) ioctl$LOOP_SET_FD(r4, 0x4c00, r3) r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x42, 0x1b6) ftruncate(r5, 0x1000000) r6 = syz_open_dev$loop(&(0x7f0000000380), 0x2, 0x2) ioctl$LOOP_SET_FD(r6, 0x4c00, r5) r7 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./dev_mnt/mapper/control\x00', 0x2, 0x0) ioctl(r7, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d795f636163686500"/312) ioctl(r7, 0xc138fd09, &(0x7f0000010000)="040000000000000000000000a001000038010000010000000000000000000000000000000000000000000000000000006d795f636163686500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000068000000636163686500000000000000000000002e2f6465765f6d6e742f6c6f6f7030202e2f6465765f6d6e742f6c6f6f7031202e2f6465765f6d6e742f6c6f6f703220313238203020736d7120300000000000") ioctl(r7, 0xc138fd06, &(0x7f0000020000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d795f636163686500"/312) r8 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev_mnt/mapper/my_cache\x00', 0x2, 0x0) write(r8, &(0x7f0000000440)='hello world\x00', 0xc) fsync(r8) ioctl(r7, 0xc138fd06, &(0x7f0000030000)="0400000000000000000000003801000038010000000000000000000002000000000000000000000000000000000000006d795f636163686500"/312) ioctl(r7, 0xc138fd06, &(0x7f0000040000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d795f636163686500"/312) 1m26.262529993s ago: executing program 0 (id=11): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0x4, 0x4, 0x400, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x2, 0x4, 0x4, 0x400, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x17, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x1, 0x2, &(0x7f0000000400)=@raw=[@generic={0xb7}, @exit], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) 1m5.076214621s ago: executing program 0 (id=13): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./sys\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/module/firmware_class/parameters/path\x00', 0x1, 0x0) write(r0, &(0x7f0000000500)='.', 0x1) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./af9005.fw\x00', 0x41, 0x1ff) write(r1, &(0x7f0000000700)='dummy', 0x5) close(r1) syz_usb_connect(0x3, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x15a4, 0x9020, 0x100, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, [], [{{0x9, 0x5, 0x81, 0x2, 0x200}}, {{0x9, 0x5, 0x2, 0x2, 0x200}}, {{0x9, 0x5, 0x84, 0x2, 0x200}}]}}]}}]}}, 0x0) nanosleep(&(0x7f0000000800)={0x1}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/bus/usb/drivers/dvb_usb_af9005/unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000040)='-', 0x1) close(r2) 1m4.83538206s ago: executing program 1 (id=14): r0 = socket$packet(0x11, 0x2, 0x300) bind$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x1, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000000c0)=@req={0x1000, 0x4, 0x800, 0x8}, 0x10) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x3, 0x11, r0, 0x0) write(r0, &(0x7f0000000000)="01000000000000002000000020000000", 0x10) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) 55.99716951s ago: executing program 1 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dev_mnt\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x1) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x1b6) ftruncate(r1, 0x1000000) r2 = syz_open_dev$loop(&(0x7f0000000280), 0x0, 0x2) ioctl$LOOP_SET_FD(r2, 0x4c00, r1) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0x42, 0x1b6) ftruncate(r3, 0x1000000) r4 = syz_open_dev$loop(&(0x7f0000000300), 0x1, 0x2) ioctl$LOOP_SET_FD(r4, 0x4c00, r3) r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x42, 0x1b6) ftruncate(r5, 0x1000000) r6 = syz_open_dev$loop(&(0x7f0000000380), 0x2, 0x2) ioctl$LOOP_SET_FD(r6, 0x4c00, r5) r7 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./dev_mnt/mapper/control\x00', 0x2, 0x0) ioctl(r7, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d795f636163686500"/312) ioctl(r7, 0xc138fd09, &(0x7f0000010000)="040000000000000000000000a001000038010000010000000000000000000000000000000000000000000000000000006d795f636163686500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000068000000636163686500000000000000000000002e2f6465765f6d6e742f6c6f6f7030202e2f6465765f6d6e742f6c6f6f7031202e2f6465765f6d6e742f6c6f6f703220313238203020736d7120300000000000") ioctl(r7, 0xc138fd06, &(0x7f0000020000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d795f636163686500"/312) r8 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev_mnt/mapper/my_cache\x00', 0x2, 0x0) write(r8, &(0x7f0000000440)='hello world\x00', 0xc) fsync(r8) ioctl(r7, 0xc138fd06, &(0x7f0000030000)="0400000000000000000000003801000038010000000000000000000002000000000000000000000000000000000000006d795f636163686500"/312) ioctl(r7, 0xc138fd06, &(0x7f0000040000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d795f636163686500"/312) 44.74377788s ago: executing program 0 (id=16): syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x1, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r0, 0x80045518, &(0x7f0000000100)=0x1) ioctl$USBDEVFS_RELEASE_PORT(r0, 0x80045519, &(0x7f0000000100)=0x1) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000200)={0x0, 0x2, 'usbfs\x00'}) 37.876911615s ago: executing program 1 (id=17): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/split_huge_pages\x00', 0x1, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x32, 0xffffffffffffffff, 0x0) madvise(0x0, 0x400000, 0xe) madvise(0x0, 0x400000, 0x17) madvise(0x0, 0x400000, 0x19) write(r0, &(0x7f0000000140)='1,0x7f0000000000,0x7f0000400000,0,-1\x00', 0x24) write(r0, &(0x7f0000000180)='2,0x7f0000000000,0x7f0000400000,0,-1\x00', 0x24) write(r0, &(0x7f00000001c0)='3,0x7f0000000000,0x7f0000400000,0,-1\x00', 0x24) write(r0, &(0x7f0000000200)='4,0x7f0000000000,0x7f0000400000,0,-1\x00', 0x24) write(r0, &(0x7f0000000240)='5,0x7f0000000000,0x7f0000400000,0,-1\x00', 0x24) write(r0, &(0x7f0000000280)='6,0x7f0000000000,0x7f0000400000,0,-1\x00', 0x24) write(r0, &(0x7f00000002c0)='7,0x7f0000000000,0x7f0000400000,0,-1\x00', 0x24) write(r0, &(0x7f0000000300)='8,0x7f0000000000,0x7f0000400000,0,-1\x00', 0x24) write(r0, &(0x7f0000000340)='9,0x7f0000000000,0x7f0000400000,0,-1\x00', 0x24) write(r0, &(0x7f0000000380)='10,0x7f0000000000,0x7f0000400000,0,-1\x00', 0x25) 20.932578141s ago: executing program 1 (id=18): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000040)='bridge0\x00') ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syz_tun\x00'}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f00000000c0)={'bridge0\x00', @ifru_ivalue}) ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000100)={'bridge0\x00', @ifru_flags=0x1}) ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000140)={'syz_tun\x00', @ifru_flags=0x1}) syz_emit_ethernet(0x3c, &(0x7f0000000180)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x6, 0x0, @remote, @local}, {{0x4e20, 0x4e21, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2}, {'\x00\x00'}}}}}}, 0x0) 20.932413801s ago: executing program 0 (id=19): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x2b, 0x18, 0xb05, 0x101, 0x0, 0x0, "05010902a1010901a100050919012903150025017501950381027505950181030501093009311581257f750895028106c0c0"}}, 0x14a) nanosleep(&(0x7f0000000200)={0x0, 0x1dcd6500}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x1d, ']\b\x00'/29}}, 0x23) 10.124941626s ago: executing program 0 (id=20): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./my_configfs/usb_gadget/g1\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./my_configfs/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r0, &(0x7f00000001c0)='0x0525\x00', 0x7) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./my_configfs/usb_gadget/g1/idProduct\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='0xa4a5\x00', 0x7) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/target/usb_gadget/naa.1234567890abcdef\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./my_configfs/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./my_configfs/target/core/rd_mcp_0/dev0/control\x00', 0x1, 0x0) write(r2, &(0x7f0000000440)='rd_pages=8\x00', 0xb) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./my_configfs/target/core/rd_mcp_0/dev0/enable\x00', 0x1, 0x0) write(r3, &(0x7f00000004c0)='1\x00', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000580)='./my_configfs/target/core/rd_mcp_0/dev0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/lun/lun_0/virtual_lun\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1/enable\x00', 0x1, 0x0) write(r4, &(0x7f00000006c0)='1\x00', 0x2) close(r4) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./my_configfs/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000740)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./my_configfs/usb_gadget/g1/configs/c.1/tcm.usb0\x00') r5 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./my_configfs/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f0000000800)='dummy_udc.0\x00', 0xc) close(r5) nanosleep(&(0x7f0000000840)={0x0, 0x5f5e100}, 0x0) 7.227650794s ago: executing program 1 (id=21): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./dev_mnt\x00', &(0x7f00000001c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x1) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x1b6) ftruncate(r1, 0x1000000) r2 = syz_open_dev$loop(&(0x7f0000000280), 0x0, 0x2) ioctl$LOOP_SET_FD(r2, 0x4c00, r1) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0x42, 0x1b6) ftruncate(r3, 0x1000000) r4 = syz_open_dev$loop(&(0x7f0000000300), 0x1, 0x2) ioctl$LOOP_SET_FD(r4, 0x4c00, r3) r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x42, 0x1b6) ftruncate(r5, 0x1000000) r6 = syz_open_dev$loop(&(0x7f0000000380), 0x2, 0x2) ioctl$LOOP_SET_FD(r6, 0x4c00, r5) r7 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./dev_mnt/mapper/control\x00', 0x2, 0x0) ioctl(r7, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d795f636163686500"/312) ioctl(r7, 0xc138fd09, &(0x7f0000010000)="040000000000000000000000a001000038010000010000000000000000000000000000000000000000000000000000006d795f636163686500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000068000000636163686500000000000000000000002e2f6465765f6d6e742f6c6f6f7030202e2f6465765f6d6e742f6c6f6f7031202e2f6465765f6d6e742f6c6f6f703220313238203020736d7120300000000000") ioctl(r7, 0xc138fd06, &(0x7f0000020000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d795f636163686500"/312) r8 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./dev_mnt/mapper/my_cache\x00', 0x2, 0x0) write(r8, &(0x7f0000000440)='hello world\x00', 0xc) fsync(r8) ioctl(r7, 0xc138fd06, &(0x7f0000030000)="0400000000000000000000003801000038010000000000000000000002000000000000000000000000000000000000006d795f636163686500"/312) ioctl(r7, 0xc138fd06, &(0x7f0000040000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d795f636163686500"/312) 0s ago: executing program 1 (id=22): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, 0x0, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000400)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000420)={0x2, 0xcc}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000900)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000910)={0x2, 0x33}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000930)={0x2, 0x1}, 0x2) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:62955' (ED25519) to the list of known hosts. syzkaller login: [ 637.996450][ T3240] cgroup: Unknown subsys name 'net' [ 638.988568][ T3240] cgroup: Unknown subsys name 'cpuset' [ 639.149849][ T3240] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 727.720390][ T3240] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 852.201865][ T3248] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 852.716945][ T3248] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 855.996132][ T3247] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 856.271681][ T3247] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 873.138883][ T3248] hsr_slave_0: entered promiscuous mode [ 873.187295][ T3248] hsr_slave_1: entered promiscuous mode [ 879.157545][ T3247] hsr_slave_0: entered promiscuous mode [ 879.215281][ T3247] hsr_slave_1: entered promiscuous mode [ 879.238553][ T3247] debugfs: 'hsr0' already exists in 'hsr' [ 879.240670][ T3247] Cannot create hsr debugfs directory [ 889.148623][ T3248] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 889.351118][ T3248] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 889.401931][ T3248] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 889.483655][ T3248] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 889.550447][ T3248] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 889.682366][ T3248] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 889.765786][ T3248] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 889.851164][ T3248] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 892.427889][ T3247] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 892.579300][ T3247] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 892.756461][ T3247] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 893.039643][ T3247] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 893.117684][ T3247] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 893.316298][ T3247] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 893.368400][ T3247] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 893.510405][ T3247] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 908.821208][ T3248] 8021q: adding VLAN 0 to HW filter on device bond0 [ 915.044337][ T3247] 8021q: adding VLAN 0 to HW filter on device bond0 [ 988.688226][ T3248] veth0_vlan: entered promiscuous mode [ 990.756505][ T3248] veth1_vlan: entered promiscuous mode [ 995.290626][ T3248] veth0_macvtap: entered promiscuous mode [ 996.079534][ T3248] veth1_macvtap: entered promiscuous mode [ 999.381181][ T3415] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1000.879211][ T54] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1000.944697][ T54] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1001.216056][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1011.809909][ T3247] veth0_vlan: entered promiscuous mode [ 1011.978938][ T3248] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 1012.486348][ T3247] veth1_vlan: entered promiscuous mode [ 1017.290407][ T3247] veth0_macvtap: entered promiscuous mode [ 1018.753446][ T3247] veth1_macvtap: entered promiscuous mode [ 1021.169789][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1021.194363][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1021.196265][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1021.616685][ T3251] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1029.290040][ T3871] dlm: no local IP address has been set [ 1029.314023][ T3871] dlm: cannot start dlm midcomms -107 [ 1036.439134][ T3866] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1037.505244][ T3866] usb 2-1: New USB device found, idVendor=0bda, idProduct=8152, bcdDevice= 0.00 [ 1037.508350][ T3866] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.510328][ T3866] usb 2-1: Product: syz [ 1037.511727][ T3866] usb 2-1: Manufacturer: syz [ 1037.525520][ T3866] usb 2-1: SerialNumber: syz [ 1038.070172][ T3866] r8152-cfgselector 2-1: Unknown version 0x0000 [ 1043.085171][ T3866] r8152-cfgselector 2-1: reset high-speed USB device number 2 using dummy_hcd [ 1048.569540][ T3866] r8152-cfgselector 2-1: device descriptor read/64, error -110 [ 1049.024866][ T3866] r8152-cfgselector 2-1: reset high-speed USB device number 2 using dummy_hcd [ 1049.367169][ T3866] r8152-cfgselector 2-1: device descriptor read/64, error -32 [ 1049.830543][ T3866] r8152-cfgselector 2-1: reset high-speed USB device number 2 using dummy_hcd [ 1050.005044][ T3866] r8152-cfgselector 2-1: device descriptor read/8, error -32 [ 1050.496888][ T3866] r8152-cfgselector 2-1: reset high-speed USB device number 2 using dummy_hcd [ 1050.629011][ T3866] r8152-cfgselector 2-1: device descriptor read/8, error -32 [ 1050.754586][ T3866] raw-gadget.0 gadget.1: failed to queue suspend event [ 1050.875754][ T3866] r8152 2-1:1.0: USB reset failed, errno=-19 [ 1051.976148][ T3866] r8152-cfgselector 2-1: USB disconnect, device number 2 [ 1055.546431][ T3866] raw-gadget.0 gadget.1: failed to queue reset event [ 1055.665662][ T3866] raw-gadget.0 gadget.1: failed to queue resume event [ 1055.871981][ T3866] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1055.915930][ C1] raw-gadget.0 gadget.1: ignoring, device is not running [ 1055.945472][ T3866] raw-gadget.0 gadget.1: failed to queue reset event [ 1056.091739][ T3866] raw-gadget.0 gadget.1: failed to queue resume event [ 1056.238926][ T3866] usb 2-1: device descriptor read/64, error -32 [ 1056.399731][ T3866] raw-gadget.0 gadget.1: failed to queue suspend event [ 1056.441401][ T3866] raw-gadget.0 gadget.1: failed to queue reset event [ 1056.528793][ T3866] raw-gadget.0 gadget.1: failed to queue resume event [ 1056.637848][ T3866] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 1056.650329][ C1] raw-gadget.0 gadget.1: ignoring, device is not running [ 1056.667400][ T3866] raw-gadget.0 gadget.1: failed to queue reset event [ 1056.760476][ T3866] raw-gadget.0 gadget.1: failed to queue resume event [ 1056.858769][ T3874] raw-gadget.0 gadget.1: failed to queue suspend event [ 1056.874867][ T3866] usb 2-1: device descriptor read/64, error -32 [ 1056.944590][ T3874] raw-gadget.0 gadget.1: failed to queue disconnect event [ 1057.017317][ T3866] usb usb2-port1: attempt power cycle [ 1062.509776][ T3771] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 1065.858408][ T3898] ubi0: attaching mtd0 [ 1065.954457][ T3771] usb 1-1: New USB device found, idVendor=0fc5, idProduct=1227, bcdDevice= 1.00 [ 1065.964661][ T3771] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1065.970683][ T3771] usb 1-1: Product: syz [ 1065.984886][ T3771] usb 1-1: Manufacturer: syz [ 1065.990272][ T3771] usb 1-1: SerialNumber: syz [ 1066.916347][ T3898] ubi0: scanning is finished [ 1066.923487][ T3898] ubi0: empty MTD device detected [ 1067.277526][ T3771] usbsevseg 1-1:1.0: USB 7 Segment device now attached [ 1070.366637][ T3242] usb 1-1: USB disconnect, device number 2 [ 1071.080811][ T3242] usbsevseg 1-1:1.0: USB 7 Segment now disconnected [ 1073.991492][ T3898] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1073.996143][ T3898] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1073.997886][ T3898] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1073.998944][ T3898] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1074.003944][ T3898] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1074.005162][ T3898] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1074.006274][ T3898] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 3271487388 [ 1074.007485][ T3898] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1074.015420][ T3917] ubi0: background thread "ubi_bgt0d" started, PID 3917 [ 1092.165364][ T3903] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 1094.440220][ T3903] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1094.458588][ T3903] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 1095.155932][ T3903] usb 1-1: New USB device found, idVendor=0bfd, idProduct=0004, bcdDevice= 0.01 [ 1095.158356][ T3903] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1095.160263][ T3903] usb 1-1: Product: syz [ 1095.161818][ T3903] usb 1-1: Manufacturer: syz [ 1095.186101][ T3903] usb 1-1: SerialNumber: syz [ 1097.238524][ T3919] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1097.364885][ T3919] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1098.117507][ T3903] kvaser_usb 1-1:1.0: error -EPROTO: Cannot get software info [ 1098.160262][ T3903] kvaser_usb 1-1:1.0: probe with driver kvaser_usb failed with error -71 [ 1104.631109][ T3866] usb 1-1: USB disconnect, device number 3 [ 1112.062173][ T9] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 1112.806210][ T9] usb 2-1: New USB device found, idVendor=0421, idProduct=1234, bcdDevice= 1.00 [ 1112.822129][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1117.898152][ T3942] loop0: detected capacity change from 0 to 32768 [ 1120.221640][ T3947] loop1: detected capacity change from 0 to 32768 [ 1122.044589][ T3866] usb 2-1: USB disconnect, device number 6 [ 1158.846432][ T3736] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 1160.700063][ T3736] usb 1-1: New USB device found, idVendor=15a4, idProduct=9020, bcdDevice= 1.00 [ 1160.727250][ T3736] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1160.746062][ T3736] usb 1-1: Product: syz [ 1160.757622][ T3736] usb 1-1: Manufacturer: syz [ 1160.784225][ T3736] usb 1-1: SerialNumber: syz [ 1167.027439][ T3243] usb 1-1: USB disconnect, device number 4 [ 1171.178878][ T3991] loop0: detected capacity change from 0 to 32768 [ 1172.509939][ T3991] loop1: detected capacity change from 0 to 32768 [ 1172.797636][ T3991] loop2: detected capacity change from 0 to 32768 [ 1174.325108][ T3996] device-mapper: table: 248:0: zero-length target [ 1174.378894][ T3996] device-mapper: ioctl: error adding target to table [ 1181.086833][ T10] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 1181.426952][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 1181.616988][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1181.624104][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1181.631284][ T10] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1181.647339][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1182.069567][ T10] usb 1-1: config 0 descriptor?? [ 1188.084384][ T10] usbhid 1-1:0.0: can't add hid device: -32 [ 1188.155126][ T10] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 1189.557088][ T10] usb 1-1: USB disconnect, device number 5 [ 1203.216808][ T3866] asus 0018:0B05:0101.0001: item fetching failed at offset 42/43 [ 1203.332493][ T3866] asus 0018:0B05:0101.0001: Asus hid parse failed: -22 [ 1203.377926][ T3866] asus 0018:0B05:0101.0001: probe with driver asus failed with error -22 [ 1215.504027][ T4035] loop0: detected capacity change from 0 to 32768 [ 1216.032028][ T4035] loop1: detected capacity change from 0 to 32768 [ 1217.290709][ T4039] device-mapper: table: 248:0: zero-length target [ 1217.297888][ T4039] device-mapper: ioctl: error adding target to table [ 1221.189883][ T4033] se_device not configured yet, cannot port link [ 1221.758503][ T4033] [ 1221.759153][ T4033] ====================================================== [ 1221.759694][ T4033] WARNING: possible circular locking dependency detected [ 1221.760697][ T4033] syzkaller #0 Not tainted [ 1221.761258][ T4033] ------------------------------------------------------ [ 1221.761861][ T4033] syz.0.20/4033 is trying to acquire lock: [ 1221.762481][ T4033] ffffffff89acc060 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x2a/0x3fc [ 1221.765677][ T4033] [ 1221.765677][ T4033] but task is already holding lock: [ 1221.766326][ T4033] ffffaf8031bde390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x4a/0x31a [ 1221.767905][ T4033] [ 1221.767905][ T4033] which lock already depends on the new lock. [ 1221.767905][ T4033] [ 1221.768526][ T4033] [ 1221.768526][ T4033] the existing dependency chain (in reverse order) is: [ 1221.769140][ T4033] [ 1221.769140][ T4033] -> #3 (&gi->lock){+.+.}-{4:4}: [ 1221.770350][ T4033] lock_acquire+0x23e/0x4f2 [ 1221.771304][ T4033] __mutex_lock+0x164/0x192e [ 1221.772192][ T4033] mutex_lock_nested+0x14/0x1c [ 1221.772951][ T4033] config_usb_cfg_link+0x4a/0x31a [ 1221.773736][ T4033] configfs_symlink+0x460/0xfee [ 1221.774507][ T4033] vfs_symlink+0x162/0x45e [ 1221.775418][ T4033] filename_symlinkat+0x264/0x4ca [ 1221.776280][ T4033] __riscv_sys_symlinkat+0x90/0xce [ 1221.776989][ T4033] syscall_handler+0x92/0x114 [ 1221.777678][ T4033] do_trap_ecall_u+0x3e4/0x636 [ 1221.778421][ T4033] handle_exception+0x168/0x174 [ 1221.779179][ T4033] [ 1221.779179][ T4033] -> #2 (&sb->s_type->i_mutex_key#23){++++}-{4:4}: [ 1221.780518][ T4033] lock_acquire+0x23e/0x4f2 [ 1221.781194][ T4033] down_write+0x9c/0x18e [ 1221.781984][ T4033] configfs_depend_item_unlocked+0xdc/0x5b0 [ 1221.782716][ T4033] usbg_make_tpg+0x27e/0x602 [ 1221.783349][ T4033] target_fabric_make_tpg+0x88/0x76c [ 1221.784143][ T4033] configfs_mkdir+0x478/0xa24 [ 1221.785112][ T4033] vfs_mkdir+0x2ea/0x708 [ 1221.786034][ T4033] filename_mkdirat+0x414/0x54a [ 1221.786712][ T4033] __riscv_sys_mkdirat+0x84/0xbc [ 1221.787387][ T4033] syscall_handler+0x92/0x114 [ 1221.788083][ T4033] do_trap_ecall_u+0x3e4/0x636 [ 1221.788860][ T4033] handle_exception+0x168/0x174 [ 1221.789558][ T4033] [ 1221.789558][ T4033] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 1221.790733][ T4033] lock_acquire+0x23e/0x4f2 [ 1221.791422][ T4033] __mutex_lock+0x164/0x192e [ 1221.792140][ T4033] mutex_lock_nested+0x14/0x1c [ 1221.792905][ T4033] usbg_make_tpg+0x1d0/0x602 [ 1221.793541][ T4033] target_fabric_make_tpg+0x88/0x76c [ 1221.794424][ T4033] configfs_mkdir+0x478/0xa24 [ 1221.795449][ T4033] vfs_mkdir+0x2ea/0x708 [ 1221.796077][ T4033] filename_mkdirat+0x414/0x54a [ 1221.796758][ T4033] __riscv_sys_mkdirat+0x84/0xbc [ 1221.797448][ T4033] syscall_handler+0x92/0x114 [ 1221.798206][ T4033] do_trap_ecall_u+0x3e4/0x636 [ 1221.798855][ T4033] handle_exception+0x168/0x174 [ 1221.799516][ T4033] [ 1221.799516][ T4033] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 1221.800618][ T4033] check_noncircular+0x138/0x14c [ 1221.801309][ T4033] __lock_acquire+0xe9c/0x25aa [ 1221.802021][ T4033] lock_acquire+0x23e/0x4f2 [ 1221.802728][ T4033] __mutex_lock+0x164/0x192e [ 1221.803495][ T4033] mutex_lock_nested+0x14/0x1c [ 1221.804259][ T4033] tcm_alloc+0x2a/0x3fc [ 1221.804865][ T4033] usb_get_function+0x50/0xbc [ 1221.805755][ T4033] config_usb_cfg_link+0x1a4/0x31a [ 1221.806508][ T4033] configfs_symlink+0x460/0xfee [ 1221.807201][ T4033] vfs_symlink+0x162/0x45e [ 1221.807804][ T4033] filename_symlinkat+0x264/0x4ca [ 1221.808493][ T4033] __riscv_sys_symlinkat+0x90/0xce [ 1221.809182][ T4033] syscall_handler+0x92/0x114 [ 1221.809900][ T4033] do_trap_ecall_u+0x3e4/0x636 [ 1221.810539][ T4033] handle_exception+0x168/0x174 [ 1221.811229][ T4033] [ 1221.811229][ T4033] other info that might help us debug this: [ 1221.811229][ T4033] [ 1221.811898][ T4033] Chain exists of: [ 1221.811898][ T4033] tpg_instances_lock --> &sb->s_type->i_mutex_key#23 --> &gi->lock [ 1221.811898][ T4033] [ 1221.813669][ T4033] Possible unsafe locking scenario: [ 1221.813669][ T4033] [ 1221.814286][ T4033] CPU0 CPU1 [ 1221.815044][ T4033] ---- ---- [ 1221.815527][ T4033] lock(&gi->lock); [ 1221.816235][ T4033] lock(&sb->s_type->i_mutex_key#23); [ 1221.817211][ T4033] lock(&gi->lock); [ 1221.818045][ T4033] lock(tpg_instances_lock); [ 1221.818755][ T4033] [ 1221.818755][ T4033] *** DEADLOCK *** [ 1221.818755][ T4033] [ 1221.819351][ T4033] 3 locks held by syz.0.20/4033: [ 1221.819908][ T4033] #0: ffffaf8013bb2450 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x42/0x39e [ 1221.821595][ T4033] #1: ffffaf8020b70ac0 (&sb->s_type->i_mutex_key#23){++++}-{4:4}, at: configfs_symlink+0x336/0xfee [ 1221.823619][ T4033] #2: ffffaf8031bde390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x4a/0x31a [ 1221.825366][ T4033] [ 1221.825366][ T4033] stack backtrace: [ 1221.826376][ T4033] CPU: 1 UID: 0 PID: 4033 Comm: syz.0.20 Not tainted syzkaller #0 PREEMPT [ 1221.826782][ T4033] Hardware name: riscv-virtio,qemu (DT) [ 1221.827159][ T4033] Call Trace: [ 1221.827365][ T4033] [] dump_backtrace+0x2e/0x3c [ 1221.827809][ T4033] [] show_stack+0x30/0x3c [ 1221.828108][ T4033] [] dump_stack_lvl+0x114/0x1aa [ 1221.828565][ T4033] [] dump_stack+0x1c/0x24 [ 1221.829025][ T4033] [] print_circular_bug+0x250/0x29c [ 1221.829377][ T4033] [] check_noncircular+0x138/0x14c [ 1221.829776][ T4033] [] __lock_acquire+0xe9c/0x25aa [ 1221.830149][ T4033] [] lock_acquire+0x23e/0x4f2 [ 1221.830479][ T4033] [] __mutex_lock+0x164/0x192e [ 1221.830869][ T4033] [] mutex_lock_nested+0x14/0x1c [ 1221.831257][ T4033] [] tcm_alloc+0x2a/0x3fc [ 1221.831525][ T4033] [] usb_get_function+0x50/0xbc [ 1221.831827][ T4033] [] config_usb_cfg_link+0x1a4/0x31a [ 1221.832201][ T4033] [] configfs_symlink+0x460/0xfee [ 1221.832542][ T4033] [] vfs_symlink+0x162/0x45e [ 1221.832818][ T4033] [] filename_symlinkat+0x264/0x4ca [ 1221.833157][ T4033] [] __riscv_sys_symlinkat+0x90/0xce [ 1221.833495][ T4033] [] syscall_handler+0x92/0x114 [ 1221.833916][ T4033] [] do_trap_ecall_u+0x3e4/0x636 [ 1221.834231][ T4033] [] handle_exception+0x168/0x174 [ 1223.928030][ T4044] misc userio: Invalid payload size [ 1223.990428][ T4044] misc userio: The device must be registered before sending interrupts [ 1224.017836][ T4044] misc userio: The device must be registered before sending interrupts [ 1224.041293][ T4044] misc userio: The device must be registered before sending interrupts [ 1224.068969][ T4044] misc userio: The device must be registered before sending interrupts [ 1224.144267][ T4044] misc userio: The device must be registered before sending interrupts