last executing test programs: 455.915834ms ago: executing program 1 (id=2): r0 = syz_usb_connect(0x3, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040801b09e30001010200010902190001010080fa0904000001ff00000007058202000200"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r1 = syz_open_dev$video(&(0x7f0000000000), 0x1, 0x2) r2 = syz_open_dev$video(&(0x7f0000000040), 0x2, 0x2) r3 = syz_open_dev$video(&(0x7f0000000080), 0x0, 0x2) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000100)={0x2, 0x1, 0x1}) ioctl$VIDIOC_QBUF(r1, 0xc044560f, &(0x7f0000000200)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0}) ioctl$VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000300)=0x1) ioctl$VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f0000000100)={0x2, 0x1, 0x1}) ioctl$VIDIOC_QBUF(r2, 0xc044560f, &(0x7f0000000200)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0}) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000300)=0x1) ioctl$VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000100)={0x2, 0x1, 0x1}) ioctl$VIDIOC_QBUF(r3, 0xc044560f, &(0x7f0000000200)=@mmap={0x0, 0x1, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x1, {}, 0x0, 0x0, 0x0}) ioctl$VIDIOC_STREAMON(r3, 0x40045612, &(0x7f0000000300)=0x1) syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="000102030405060708090a0b0c0d0e0f") 383.520963ms ago: executing program 2 (id=3): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x38, r1, 0x5, 0x0, 0x0, {{}, {@void, @val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'wlan1\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}]}, 0x38}}, 0x0) sendmsg$NL80211_CMD_START_NAN(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x28, r1, 0x5, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x1}}}}, [@NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}]}, 0x28}}, 0x0) 342.436898ms ago: executing program 2 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) symlinkat(&(0x7f00000001c0)='./file0/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0/usb_gadget/g1/configs/c.1/uvc.0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='dummy_udc.0\x00', 0xc) 273.260943ms ago: executing program 2 (id=7): ppoll(&(0x7f0000000040), 0x0, &(0x7f0000000080), &(0x7f00000000c0), 0x8) 273.074254ms ago: executing program 2 (id=8): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='sysfs\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/devices\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/platform/devices/serial8250/driver_override\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/platform/devices/alarmtimer/driver_override\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/serial8250/bind\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/platform/drivers/alarmtimer/bind\x00', 0x1, 0x0) 267.419396ms ago: executing program 2 (id=9): syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040000000000000000000010902200001010080320904000002fe0300000705020240000007058102400000"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x1) ioctl$USBDEVFS_RESET(r0, 0x5304) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x2) ioctl$USBDEVFS_RESET(r1, 0x5304) 227.080728ms ago: executing program 3 (id=4): syz_usb_connect(0x0, 0x35, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000202000040257d15a400010102030109022300010100c001090400000102090000052400100105241400020705810310000a"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r0, &(0x7f0000000200), 0x100) 181.645915ms ago: executing program 0 (id=1): socket(0xa, 0x2, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140), r0) sendmsg$NLBL_CALIPSO_C_ADD(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x24}}, 0x0) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x1c}}, 0x0) 154.120963ms ago: executing program 0 (id=10): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x2b, 0x3, 0xb05, 0x1866, 0x0, 0x0, "05010902a1010901a100050919012903150025017501950381027505950181030501093009311581257f750895028106c0c0"}}, 0x14a) nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x1d, ']\b\x00'/29}}, 0x23) 145.201802ms ago: executing program 4 (id=5): write(0xffffffffffffffff, &(0x7f0000000040)='freeze', 0x6) 77.22273ms ago: executing program 4 (id=11): syz_usb_connect(0x3, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401107000900010000000109023c0001010080320904000006ffffff0007058e0200020007050e02000200070501020002000705030200020007058d0200020007050d02000200"], 0x0) nanosleep(&(0x7f0000000a00)={0x1}, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x42, 0x1ff) pread64(r0, &(0x7f0000000b00), 0x2, 0xd000) 26.546763ms ago: executing program 0 (id=12): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='-2 -3 +4\n\x00', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='inet 2049\x00', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000200)='1\n\x00', 0x2) write(r2, &(0x7f0000000240)='0\n\x00', 0x2) 0s ago: executing program 0 (id=13): r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040fd0b0b000001010203010902200001010080320904000002ff0000000705010200020007058202000200"], 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x2faf080}, 0x0) syz_usb_ep_write(r0, 0x82, 0x27, &(0x7f0000000500)='\'\'\x00'/39) syz_usb_ep_write(r0, 0x82, 0x27, &(0x7f0000000600)='\'#\x00'/39) 0s ago: executing program 1 (id=14): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x777) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget\x00', 0x777) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x777) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/phonet.usb0\x00', 0x777) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/phonet.usb0/ifname\x00', 0x0, 0x0) read(r0, &(0x7f0000000200), 0x100) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.48' (ED25519) to the list of known hosts. [ 28.932652][ T4701] cgroup: Unknown subsys name 'net' [ 29.082675][ T4701] cgroup: Unknown subsys name 'cpuset' [ 29.084830][ T4701] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 29.264984][ T4701] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 30.050147][ T4717] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 30.050716][ T4717] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 30.050903][ T4717] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 30.051399][ T4717] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 30.051621][ T4717] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 30.062953][ T4716] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 30.078943][ T4726] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 30.079444][ T4726] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 30.079621][ T4726] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 30.079813][ T4726] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 30.082022][ T4726] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 30.082171][ T4728] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 30.082769][ T4728] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 30.091907][ T4728] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 30.092352][ T4726] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 30.092568][ T4726] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 30.094196][ T4728] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 30.095600][ T4726] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 30.097146][ T4726] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 30.102918][ T50] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 30.102943][ T4716] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 30.119587][ T4716] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 30.121599][ T4716] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 30.124603][ T4726] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 30.127067][ T4726] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 30.346339][ T4713] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.346691][ T4713] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.346779][ T4713] bridge_slave_0: entered allmulticast mode [ 30.347294][ T4713] bridge_slave_0: entered promiscuous mode [ 30.348470][ T4713] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.348501][ T4713] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.348584][ T4713] bridge_slave_1: entered allmulticast mode [ 30.349054][ T4713] bridge_slave_1: entered promiscuous mode [ 30.391035][ T4713] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.394456][ T4713] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.394508][ T4712] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.397743][ T4712] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.397817][ T4712] bridge_slave_0: entered allmulticast mode [ 30.398258][ T4712] bridge_slave_0: entered promiscuous mode [ 30.399108][ T4712] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.399129][ T4712] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.399176][ T4712] bridge_slave_1: entered allmulticast mode [ 30.399582][ T4712] bridge_slave_1: entered promiscuous mode [ 30.407931][ T4712] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.422171][ T4712] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.436736][ T4712] team0: Port device team_slave_0 added [ 30.438432][ T4713] team0: Port device team_slave_0 added [ 30.443603][ T4712] team0: Port device team_slave_1 added [ 30.448038][ T4713] team0: Port device team_slave_1 added [ 30.469481][ T4712] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.470799][ T4712] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.476144][ T4712] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.490150][ T4712] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.490179][ T4712] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.490193][ T4712] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.501087][ T4712] hsr_slave_0: entered promiscuous mode [ 30.503142][ T4712] hsr_slave_1: entered promiscuous mode [ 30.505225][ T4713] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.505246][ T4713] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.511063][ T4713] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.512920][ T4713] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.512930][ T4713] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.512945][ T4713] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.541122][ T4713] hsr_slave_0: entered promiscuous mode [ 30.542062][ T4713] hsr_slave_1: entered promiscuous mode [ 30.542260][ T4713] debugfs: 'hsr0' already exists in 'hsr' [ 30.542303][ T4713] Cannot create hsr debugfs directory [ 30.604908][ T4718] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.606435][ T4718] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.608034][ T4718] bridge_slave_0: entered allmulticast mode [ 30.609772][ T4718] bridge_slave_0: entered promiscuous mode [ 30.614492][ T4718] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.614532][ T4718] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.614628][ T4718] bridge_slave_1: entered allmulticast mode [ 30.615057][ T4718] bridge_slave_1: entered promiscuous mode [ 30.645950][ T4718] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.650796][ T4721] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.650907][ T4721] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.650963][ T4721] bridge_slave_0: entered allmulticast mode [ 30.651736][ T4721] bridge_slave_0: entered promiscuous mode [ 30.663475][ T4718] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.663623][ T4721] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.663681][ T4721] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.663735][ T4721] bridge_slave_1: entered allmulticast mode [ 30.664308][ T4721] bridge_slave_1: entered promiscuous mode [ 30.682697][ T4721] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.686330][ T4721] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.697366][ T4720] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.697453][ T4720] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.697548][ T4720] bridge_slave_0: entered allmulticast mode [ 30.697987][ T4720] bridge_slave_0: entered promiscuous mode [ 30.699432][ T4720] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.699453][ T4720] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.699502][ T4720] bridge_slave_1: entered allmulticast mode [ 30.699972][ T4720] bridge_slave_1: entered promiscuous mode [ 30.704879][ T4721] team0: Port device team_slave_0 added [ 30.705558][ T4718] team0: Port device team_slave_0 added [ 30.706897][ T4721] team0: Port device team_slave_1 added [ 30.714124][ T4718] team0: Port device team_slave_1 added [ 30.720497][ T4720] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.721631][ T4720] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.738641][ T4721] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.738674][ T4721] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.738705][ T4721] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.739369][ T4718] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.739376][ T4718] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.739387][ T4718] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.739883][ T4718] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.739890][ T4718] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.739903][ T4718] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.744246][ T4712] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 30.753725][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.754104][ T4712] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 30.755575][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.756295][ T4721] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.756303][ T4721] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.756318][ T4721] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.769195][ T4720] team0: Port device team_slave_0 added [ 30.770254][ T4720] team0: Port device team_slave_1 added [ 30.773938][ T4712] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 30.775785][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.785396][ T4712] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 30.788331][ T4712] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.794910][ T4718] hsr_slave_0: entered promiscuous mode [ 30.795241][ T4718] hsr_slave_1: entered promiscuous mode [ 30.795438][ T4718] debugfs: 'hsr0' already exists in 'hsr' [ 30.795448][ T4718] Cannot create hsr debugfs directory [ 30.798787][ T4720] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.798796][ T4720] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.798808][ T4720] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.799375][ T4720] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.799382][ T4720] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.799396][ T4720] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.825204][ T4721] hsr_slave_0: entered promiscuous mode [ 30.825541][ T4721] hsr_slave_1: entered promiscuous mode [ 30.825743][ T4721] debugfs: 'hsr0' already exists in 'hsr' [ 30.825752][ T4721] Cannot create hsr debugfs directory [ 30.844031][ T4713] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 30.846594][ T4713] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.859161][ T4713] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 30.862727][ T4713] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.866887][ T4713] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 30.869232][ T4713] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.875778][ T4712] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.875842][ T4712] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.876011][ T4712] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.876052][ T4712] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.882711][ T4720] hsr_slave_0: entered promiscuous mode [ 30.883059][ T4720] hsr_slave_1: entered promiscuous mode [ 30.883242][ T4720] debugfs: 'hsr0' already exists in 'hsr' [ 30.883252][ T4720] Cannot create hsr debugfs directory [ 30.883347][ T4713] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 30.884849][ T4713] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.922142][ T4713] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.922195][ T4713] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.922279][ T4713] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.922316][ T4713] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.986960][ T4718] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 30.989263][ T4718] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.990895][ T4718] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 30.993184][ T4718] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.994887][ T4718] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 30.997164][ T4718] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.998850][ T4718] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 31.000873][ T4718] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.013375][ T4712] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.031662][ T4721] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 31.033993][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.034318][ T4721] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 31.036170][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.039758][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.041319][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.043753][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 31.045168][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 31.052957][ T4721] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 31.055089][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.055444][ T4721] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 31.057302][ T4721] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.059938][ T4712] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.073880][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.073935][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.082783][ T4713] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.089316][ T4713] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.093762][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.093803][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.094720][ T4720] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 31.096335][ T4720] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 31.114463][ T4720] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 31.116644][ T4720] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 31.116962][ T4720] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 31.118643][ T4720] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 31.119714][ T1454] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.119737][ T1454] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.120132][ T1454] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.120152][ T1454] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.123167][ T4718] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.126838][ T4712] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.126852][ T4712] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.141887][ T4720] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 31.144363][ T4720] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 31.150429][ T4718] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.180538][ T1454] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.180584][ T1454] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.189543][ T1454] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.189591][ T1454] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.227252][ T4718] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.229378][ T4718] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.274299][ T4720] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.295011][ T4712] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.299784][ T4721] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.305711][ T4720] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.307429][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.307476][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.327180][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.327227][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.340196][ T4721] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.354616][ T15] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.354666][ T15] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.364272][ T4713] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.390772][ T4712] veth0_vlan: entered promiscuous mode [ 31.398810][ T4721] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.399781][ T4721] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.402386][ T3791] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.402418][ T3791] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.423803][ T4712] veth1_vlan: entered promiscuous mode [ 31.447721][ T4713] veth0_vlan: entered promiscuous mode [ 31.450782][ T4712] veth0_macvtap: entered promiscuous mode [ 31.454639][ T4712] veth1_macvtap: entered promiscuous mode [ 31.460736][ T4712] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.463667][ T4712] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.469447][ T4713] veth1_vlan: entered promiscuous mode [ 31.483638][ T4718] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.501934][ T15] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.503868][ T3652] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.511782][ T3791] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.512213][ T3791] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.545113][ T4713] veth0_macvtap: entered promiscuous mode [ 31.546233][ T4713] veth1_macvtap: entered promiscuous mode [ 31.549928][ T4713] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.565559][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.565590][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.568520][ T4718] veth0_vlan: entered promiscuous mode [ 31.569690][ T4713] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.576290][ T4718] veth1_vlan: entered promiscuous mode [ 31.589709][ T4720] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.591439][ T15] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.592767][ T15] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.592826][ T15] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.592848][ T15] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.614191][ T4718] veth0_macvtap: entered promiscuous mode [ 31.617990][ T1454] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.618023][ T1454] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.627262][ T4721] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.640736][ T4718] veth1_macvtap: entered promiscuous mode [ 31.666901][ T4721] veth0_vlan: entered promiscuous mode [ 31.668559][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.668585][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.673325][ T4721] veth1_vlan: entered promiscuous mode [ 31.676228][ T4712] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 31.704922][ T4894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 31.707099][ T4718] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.707185][ T4894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 31.714918][ T3652] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.714956][ T3652] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.716957][ T4721] veth0_macvtap: entered promiscuous mode [ 31.719080][ T4718] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.724598][ T4721] veth1_macvtap: entered promiscuous mode [ 31.742645][ T4721] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.746076][ T4721] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.781421][ T4720] veth0_vlan: entered promiscuous mode [ 31.783137][ T15] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.783191][ T15] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.783211][ T15] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.783228][ T15] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.783243][ T15] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.783258][ T15] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.783273][ T15] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.797780][ T3791] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.797813][ T3791] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.817000][ T4720] veth1_vlan: entered promiscuous mode [ 31.847166][ T1454] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.847478][ T1454] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.866118][ T4720] veth0_macvtap: entered promiscuous mode [ 31.867294][ T4720] veth1_macvtap: entered promiscuous mode [ 31.882652][ T15] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.883104][ T3791] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.883113][ T3791] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.893256][ T4720] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.896060][ T4720] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.903522][ T4905] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 31.903712][ T4905] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 31.908742][ T1454] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.908781][ T1454] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.932508][ T3791] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.933822][ T15] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.933945][ T15] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.934055][ T15] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.949190][ T1454] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.949217][ T1454] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.954657][ T4907] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 31.956103][ T4907] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 31.968341][ T3791] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.968380][ T3791] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.005670][ T4725] asus 0003:0B05:1866.0001: item fetching failed at offset 42/43 [ 32.007513][ T4725] asus 0003:0B05:1866.0001: Asus hid parse failed: -22 [ 32.009073][ T4725] asus 0003:0B05:1866.0001: probe with driver asus failed with error -22 [ 32.042590][ T4917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 32.042793][ T4917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 32.101768][ T4714] Bluetooth: hci1: command tx timeout [ 32.173976][ T4726] Bluetooth: hci2: command tx timeout [ 32.174452][ T4717] Bluetooth: hci0: command tx timeout [ 32.174455][ T4726] Bluetooth: hci4: command tx timeout [ 32.174680][ T4714] Bluetooth: hci3: command tx timeout [ 32.391808][ T4820] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 32.541726][ T4820] usb 1-1: New USB device found, idVendor=0bfd, idProduct=000b, bcdDevice= 1.00 [ 32.544347][ T4820] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 32.544569][ T4820] usb 1-1: Product: syz [ 32.544582][ T4820] usb 1-1: Manufacturer: syz [ 32.544595][ T4820] usb 1-1: SerialNumber: syz [ 32.749052][ T4926] ================================================================== [ 32.749069][ T4926] BUG: KASAN: slab-out-of-bounds in gether_get_ifname+0x104/0x124 [ 32.749093][ T4926] Read of size 1 at addr ffff0000cb6cd042 by task syz.1.14/4926 [ 32.749103][ T4926] [ 32.749108][ T4926] CPU: 0 UID: 0 PID: 4926 Comm: syz.1.14 Not tainted syzkaller #0 PREEMPT [ 32.749118][ T4926] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 32.749124][ T4926] Call trace: [ 32.749127][ T4926] show_stack+0x2c/0x3c (C) [ 32.749142][ T4926] __dump_stack+0x30/0x40 [ 32.749155][ T4926] dump_stack_lvl+0xd8/0x12c [ 32.749168][ T4926] print_address_description+0xb0/0x238 [ 32.749183][ T4926] print_report+0x68/0x84 [ 32.749193][ T4926] kasan_report+0x8c/0xc4 [ 32.749205][ T4926] __asan_report_load1_noabort+0x20/0x2c [ 32.749218][ T4926] gether_get_ifname+0x104/0x124 [ 32.749228][ T4926] f_phonet_ifname_show+0x4c/0x60 [ 32.749240][ T4926] configfs_read_iter+0x234/0x508 [ 32.749254][ T4926] vfs_read+0x498/0x8c8 [ 32.749262][ T4926] ksys_read+0x12c/0x228 [ 32.749270][ T4926] __arm64_sys_read+0x84/0x98 [ 32.749278][ T4926] invoke_syscall+0x98/0x244 [ 32.749290][ T4926] el0_svc_common+0xec/0x23c [ 32.749302][ T4926] do_el0_svc+0x4c/0x5c [ 32.749314][ T4926] el0_svc+0x64/0x260 [ 32.749324][ T4926] el0t_64_sync_handler+0x44/0x104 [ 32.749335][ T4926] el0t_64_sync+0x198/0x19c [ 32.749344][ T4926] [ 32.749347][ T4926] Allocated by task 4926: [ 32.749351][ T4926] kasan_save_track+0x40/0x78 [ 32.749361][ T4926] kasan_save_alloc_info+0x40/0x50 [ 32.749371][ T4926] __kasan_kmalloc+0x9c/0xb4 [ 32.749380][ T4926] __kvmalloc_node_noprof+0x460/0x7d8 [ 32.749389][ T4926] alloc_netdev_mqs+0xac/0xf2c [ 32.749396][ T4926] gphonet_setup_default+0x38/0x88 [ 32.749407][ T4926] phonet_alloc_inst+0x84/0x100 [ 32.749417][ T4926] try_get_usb_function_instance+0xe4/0x164 [ 32.749427][ T4926] usb_get_function_instance+0x24/0xb0 [ 32.749436][ T4926] function_make+0x110/0x300 [ 32.749445][ T4926] configfs_mkdir+0x374/0x7d4 [ 32.749451][ T4926] vfs_mkdir+0x2dc/0x464 [ 32.749460][ T4926] filename_mkdirat+0x228/0x3f4 [ 32.749469][ T4926] __arm64_sys_mkdirat+0x9c/0xc0 [ 32.749478][ T4926] invoke_syscall+0x98/0x244 [ 32.749489][ T4926] el0_svc_common+0xec/0x23c [ 32.749499][ T4926] do_el0_svc+0x4c/0x5c [ 32.749509][ T4926] el0_svc+0x64/0x260 [ 32.749517][ T4926] el0t_64_sync_handler+0x44/0x104 [ 32.749525][ T4926] el0t_64_sync+0x198/0x19c [ 32.749532][ T4926] [ 32.749534][ T4926] The buggy address belongs to the object at ffff0000cb6cc000 [ 32.749534][ T4926] which belongs to the cache kmalloc-cg-4k of size 4096 [ 32.749541][ T4926] The buggy address is located 314 bytes to the right of [ 32.749541][ T4926] allocated 3848-byte region [ffff0000cb6cc000, ffff0000cb6ccf08) [ 32.749550][ T4926] [ 32.749553][ T4926] The buggy address belongs to the physical page: [ 32.749557][ T4926] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000cb6ca000 pfn:0x10b6c8 [ 32.749565][ T4926] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 32.749571][ T4926] memcg:ffff0000cc7b5381 [ 32.749575][ T4926] flags: 0x5ffc00000000240(workingset|head|node=0|zone=2|lastcpupid=0x7ff) [ 32.749584][ T4926] page_type: f5(slab) [ 32.749592][ T4926] raw: 05ffc00000000240 ffff0000c000b500 fffffdffc32e3e10 ffff0000c000a7c8 [ 32.749600][ T4926] raw: ffff0000cb6ca000 0000000800040003 00000000f5000000 ffff0000cc7b5381 [ 32.749608][ T4926] head: 05ffc00000000240 ffff0000c000b500 fffffdffc32e3e10 ffff0000c000a7c8 [ 32.749615][ T4926] head: ffff0000cb6ca000 0000000800040003 00000000f5000000 ffff0000cc7b5381 [ 32.749623][ T4926] head: 05ffc00000000003 fffffdffc32db201 00000000ffffffff 00000000ffffffff [ 32.749630][ T4926] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 32.749634][ T4926] page dumped because: kasan: bad access detected [ 32.749638][ T4926] [ 32.749639][ T4926] Memory state around the buggy address: [ 32.749643][ T4926] ffff0000cb6ccf00: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.749649][ T4926] ffff0000cb6ccf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.749654][ T4926] >ffff0000cb6cd000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.749658][ T4926] ^ [ 32.749663][ T4926] ffff0000cb6cd080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.749668][ T4926] ffff0000cb6cd100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.749672][ T4926] ================================================================== [ 32.750660][ T4926] Disabling lock debugging due to kernel taint [ 34.171206][ T4714] Bluetooth: hci1: command tx timeout [ 34.251165][ T4714] Bluetooth: hci3: command tx timeout [ 34.251196][ T4714] Bluetooth: hci0: command tx timeout [ 34.261214][ T4717] Bluetooth: hci4: command tx timeout [ 34.261238][ T4714] Bluetooth: hci2: command tx timeout [ 35.162978][ T4820] kvaser_usb 1-1:1.0: error -EPROTO: Cannot get software info [ 35.163037][ T4820] kvaser_usb 1-1:1.0: probe with driver kvaser_usb failed with error -71 [ 35.166978][ T4820] usb 1-1: USB disconnect, device number 2 [ 36.251441][ T4714] Bluetooth: hci1: command tx timeout [ 36.331680][ T4714] Bluetooth: hci2: command tx timeout [ 36.331952][ T4717] Bluetooth: hci4: command tx timeout [ 36.331972][ T4717] Bluetooth: hci0: command tx timeout [ 36.331987][ T4717] Bluetooth: hci3: command tx timeout [ 38.331188][ T4714] Bluetooth: hci1: command tx timeout [ 38.411441][ T4714] Bluetooth: hci2: command tx timeout [ 38.411455][ T4716] Bluetooth: hci3: command tx timeout [ 38.411480][ T4716] Bluetooth: hci0: command tx timeout [ 38.411501][ T4716] Bluetooth: hci4: command tx timeout