last executing test programs: 2.648732818s ago: executing program 2 (id=3): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:05.0/remove\x00', 0x1, 0x0) write(r0, &(0x7f0000000300)='1\x00', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='1\x00', 0x1) 2.625983718s ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='-2 -3 +4\n\x00', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='tcp 2049\n\x00', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000140)='8\n\x00', 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f00000001c0)='127.0.0.1:/\x00', &(0x7f0000000180)='./mnt\x00', &(0x7f0000000200), 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='vers=4.1,addr=127.0.0.1,clientaddr=127.0.0.1\x00']) 2.605334715s ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='tcp 2049\n\x00', 0x9) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./tmp\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./tmp\x00', &(0x7f0000000440)='tmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='nfsd 127.0.0.1 2147483647 *\n\x00', 0x1c) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r2, &(0x7f0000000140)='* ./tmp 2147483647 0 0 0 0 fsloc 1 127.0.0.1 /\n\x00', 0x2f) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f0000000540)='127.0.0.1:./tmp\x00', &(0x7f0000000500)='./mnt\x00', &(0x7f0000000580), 0x0, &(0x7f00000005c0)={[{'clientaddr=127.0.0.1'}, {'addr=127.0.0.1'}]}) 2.305477513s ago: executing program 2 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/module/firmware_class/parameters/path\x00', 0x2, 0x0) write(r0, &(0x7f0000000100)='./fw\x00', 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./fw\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./fw/carl9170-1.fw\x00', 0x42, 0x1b6) write(r1, &(0x7f0000000200)="4f544152200007078504000000001000000000000000000040000010100101014c41535408000202", 0x28) r2 = syz_usb_connect(0x2, 0x40, &(0x7f0000000300)=ANY=[@ANYBLOB="12010002ffffff40f30c709100010000000109022e0001010080fa0904000004ffffff0007050102000200070582020002000705830340000107050403400001"], &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000400)={0x1}, 0x0) syz_usb_ep_write(r2, 0x83, 0x8, &(0x7f0000000500)="04cc000000000000") 1.643129129s ago: executing program 1 (id=9): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000000c0)={0x38, 0x1403, 0x1, 0x70bd2c, 0x25dfdbfc, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) nanosleep(&(0x7f0000000a00)={0x0, 0x2faf080}, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000200)={0x3, 0x48, 0xfa00, {{0xa, 0x0, 0x0, @local, 0x2}, {0xa, 0x0, 0x0, @remote, 0x2}, r2, 0x3e8}}, 0x50) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000600)={0xc, 0x18, 0xfa00, {&(0x7f0000000700)}}, 0x18) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000400)={0x4, 0x8, 0xfa00, {r2, 0x3e8}}, 0x10) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000800)={0xc, 0x18, 0xfa00, {&(0x7f0000000900)}}, 0x18) write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000500)={0x6, 0x118, 0xfa00, {{0x6, 0xf, '\x00', 0x0, 0x40, 0x4, 0xa8, 0x3, 0xf, 0x4, 0x1}, r2}}, 0x120) 875.062107ms ago: executing program 0 (id=10): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/power/state\x00', 0x1, 0x0) 789.569195ms ago: executing program 0 (id=12): io_uring_setup(0x10, &(0x7f0000000000)={0x0, 0x0, 0x8000}) 789.295936ms ago: executing program 0 (id=14): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:01.3/driver_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='thunderbolt\x00', 0xc) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/drivers/thunderbolt/bind\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='0000:00:01.3\x00', 0xd) 730.503795ms ago: executing program 0 (id=15): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/sys/net/ipv4/conf/all/forwarding\x00', 0x2, 0x0) write(r0, &(0x7f00000000c0)='1\n\x00', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/ipv4/conf/lo/forwarding\x00', 0x2, 0x0) write(r1, &(0x7f0000000140)='1\n\x00', 0x2) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001080)={0x6, 0x18, &(0x7f0000000a40)=ANY=[@ANYBLOB="bf16000000000000b7000000000000007b0af8ff000000007b0af0ff000000007b0ae8ff000000007b0ae0ff000000007b0ad8ff000000007b0ad0ff000000007b0ac8ff000000007b0ac0ff00000000b702000002000000732ac0ff00000000b702000001000000632ac8ff00000000b70200007f000001632ae0ff00000000bf61000000000000bfa200000000000007020000c0ffffffb703000040000000b7040000000000008500000045000000b7000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r2, 0x0, 0xe, 0x0, &(0x7f00000003c0)="e02742e86c0d85ff9782764532db", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 730.228148ms ago: executing program 3 (id=16): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x34, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x1c) r1 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x0}, &(0x7f0000000280)="0123456789abcdef", 0x8, r1) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f0000000140)='syz\x00', 0x4) listen(r0, 0xa) r2 = socket$rxrpc(0x21, 0x2, 0x2) add_key$user(&(0x7f0000000300), &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000380)="0100000002000800ffffff7f010000000123456789abcdef0123456789abcdef", 0x20, 0xfffffffffffffffe) setsockopt$RXRPC_SECURITY_KEY(r2, 0x110, 0x1, &(0x7f0000000340)='syz\x00', 0x4) connect$rxrpc(r2, &(0x7f0000000000)=@in4={0x21, 0x34, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x1c) sendto$rxrpc(r2, &(0x7f0000000400)='hello', 0x5, 0x0, 0x0, 0x0) 730.08791ms ago: executing program 0 (id=17): syz_usb_connect(0x0, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001000000408c0d030100010000000109026e0002010080320904000000010100000924010001280001010c24020101010002030000000a240602010101020200092403030103000200090401000001020000090401010101020000072401010101000b2402010202100180bb0009050109c00001000007250101000000"], 0x0) nanosleep(&(0x7f0000000100)={0x1}, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x1, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x2, 0x0) ioctl(r0, 0xc4c85512, &(0x7f0000000300)="0000000002000000000000000000000049454339353820506c61796261636b2053776974636800"/74) ioctl(r1, 0xc4c85512, &(0x7f0000000300)="0000000002000000000000000000000049454339353820506c61796261636b2053776974636800"/74) ioctl(r2, 0xc4c85512, &(0x7f0000000300)="0000000002000000000000000000000049454339353820506c61796261636b2053776974636800"/74) 670.203905ms ago: executing program 3 (id=18): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/dlm\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/dlm/cluster\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/dlm/cluster/comms\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/dlm/cluster/comms/1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/dlm/cluster/comms/2\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/dlm/cluster/comms/1/local\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='1\n\x00', 0x2) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/dlm/cluster/comms/1/addr\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)="020052487f00000100"/128, 0x80) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/dlm/cluster/comms/2/addr\x00', 0x1, 0x0) write(r2, &(0x7f0000000440)="020030397f00000100"/128, 0x80) close(r2) r3 = syz_io_uring_setup(0x20, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000540)=0x0, &(0x7f0000000580)=0x0, &(0x7f00000005c0)=0x0) r7 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000640)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r7, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000700)="0600000000000000020000000401000000000000000000006d796c7300"/128, 0x80}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r3, 0x1, 0x0, 0x0, 0x0, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) r8 = socket(0x2, 0x1, 0x0) setsockopt(r8, 0x1, 0x2, &(0x7f0000000780)="01000000", 0x4) bind(r8, &(0x7f00000007c0)=@generic={0x2, "30397f00000100"}, 0x10) connect(r8, &(0x7f0000000840)=@generic={0x2, "52487f00000100"}, 0x10) write(r8, &(0x7f00000008c0)="02000300000000000200000028000300050000000000000002000300000000000200000010000500", 0x28) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) write(r8, &(0x7f0000000900)="02000300010000000200000010000400", 0x10) 225.460258ms ago: executing program 1 (id=19): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./img\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000200)="789c926c5560666060e0f99070678664eb0346060606c3c30a7763191818406c106002119c1c0c0c0ff223e4927bec77a665e6a4ea25e7e7a4fcffff5fb2f501483e2c3c2cb80caa969181a1f12d546f0a0326100289831466975c992e907cff5a314325431543364322430e430e432a435134d85c90fdbad7151b85a06e0161905b195859181842e32c4eea1f5a9e07728b01c21d2e4bde2bd941d531323038bec5623f567089ab7a2d163b4166b280ede46060687d7f6055c4d1e93f40761a22ecf473b13aad005587ec772e2cd670c1c41bef3c4a768af4b9515c59959d9893935a540c368f838181c160a779ff2e989f19d918d8ce5af17d6d39e494549158525264c800a120f673323030c86ceb3ff512613f03d3adb51c0fd0cc628299756b4fc49af71aa65660438c20661961370becf792bcebac58c20514beacb070f167e2cd3978e69813285c8c10e19232bf91e91b541d52b8286b60091705060601b085e70bdc2b79764d5cc8f01f3fc46207136e3b0430ece87494ca27d20e9f5526ab78a07630e3b6039404183818189835409a9c0ff058ed3cf12e0d6a963a963064410e43a3426e936da7bf5d0185a1f17f8cf40f0b6f36987aa6b0bacd58d27f5c64ef6d17a83aa4306791c212e65220719026cd1bf315991ed7bcc0c887ffb3ffa7feaffa9f2388d53d203bd8c1eee16260589d7c29004bdec8e6b7934f87aa63646058f81f6ab73a16f7a8c3c40576994eb8ee93cba15f925ba05f5c59a59b999b989e9a9e9a6764646c66606260606aa40ff63784fc0f080000ffffad9719da", 0x1000) r1 = syz_open_dev$loop(&(0x7f0000000300), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/module/block2mtd/parameters/block2mtd\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)='/dev/loop0,65536\x00', 0x11) mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./mnt\x00', 0x1ff) mount(&(0x7f0000000900)=@filename='mtd1\x00', &(0x7f0000000800)='./mnt\x00', &(0x7f0000000a00)='jffs2\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./mnt/test\x00', 0x42, 0x1ff) write(r3, &(0x7f0000000c00)='A', 0x1000) unlinkat(0xffffffffffffff9c, &(0x7f0000000b00)='./mnt/test\x00', 0x0) 144.742252ms ago: executing program 1 (id=20): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='0000:00:02.0\x00', 0xc) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:02.0/config\x00', 0x2, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0) write(r2, &(0x7f0000000180)='e100\x00', 0x4) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/pci/drivers/e100/bind\x00', 0x1, 0x0) r4 = syz_io_uring_setup(0xf00, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, &(0x7f0000000400)=0x0, &(0x7f0000000440)=0x0, &(0x7f0000000480)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f00000004c0)=@IORING_OP_TIMEOUT={0xb, 0x8, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x0, 0xf4240}}) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000540)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r1, 0x4, &(0x7f0000000200)=[{&(0x7f0000000240)='\x00\x00', 0x2}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) syz_io_uring_submit(r5, r6, r7, &(0x7f00000005c0)=@IORING_OP_TIMEOUT={0xb, 0x8, 0x0, 0x0, 0x0, &(0x7f0000000320)={0x0, 0x1e8480}}) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000640)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r1, 0x4, &(0x7f0000000200)=[{&(0x7f0000000240)='\x00\x00', 0x2}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) syz_io_uring_submit(r5, r6, r7, &(0x7f00000006c0)=@IORING_OP_TIMEOUT={0xb, 0x8, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x0, 0x2dc6c0}}) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000740)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r1, 0x4, &(0x7f0000000200)=[{&(0x7f0000000240)='\x00\x00', 0x2}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r4, 0x6, 0x0, 0x0, 0x0, 0x0) write(r3, &(0x7f0000000280)='0000:00:02.0\x00', 0xc) 144.494616ms ago: executing program 3 (id=21): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:07.0/driver_override\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='thunderbolt\x00', 0xc) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/drivers/thunderbolt/bind\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='0000:00:07.0\x00', 0xd) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/thunderbolt/devices/0-0/authorized\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='1', 0x1) 135.949414ms ago: executing program 2 (id=22): r0 = syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040c41060ea0001000000010902200001010080320904000002ff0000000705810240000007050202400000"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000140)={0x84, &(0x7f0000001000)=ANY=[@ANYBLOB="40370100000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) nanosleep(&(0x7f0000000100)={0x1}, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./ttyUSB0\x00', 0x81b6, 0xbc00) r1 = syz_io_uring_setup(0x1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000002c0)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000340)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000380)=@IORING_OP_OPENAT={0x12, 0x10, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000440)='./ttyUSB0\x00', 0x0, 0x802, 0x12345}) io_uring_enter(r1, 0x1, 0x0, 0x0, 0x0, 0x0) nanosleep(&(0x7f0000000100)={0x0, 0x1dcd6500}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000480)={0x84, &(0x7f0000001001)=ANY=[@ANYBLOB='@\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000540)={0x84, &(0x7f0000001002)=ANY=[@ANYBLOB="401d0400000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000600)={0x84, &(0x7f0000001003)=ANY=[@ANYBLOB="4004020000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f0000001004)=ANY=[@ANYBLOB="40130400000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000001005)=ANY=[@ANYBLOB="401906000000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000840)={0x84, &(0x7f0000001006)=ANY=[@ANYBLOB="401e00000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, &(0x7f0000001007)=ANY=[@ANYBLOB="400300000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000009c0)={0x84, &(0x7f0000001008)=ANY=[@ANYBLOB="401900000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000001009)=ANY=[@ANYBLOB="401300000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) io_uring_enter(r1, 0x0, 0x1, 0x1, 0x0, 0x0) syz_io_uring_complete(r2, r3) syz_usb_ep_write(r0, 0x81, 0x7, &(0x7f0000000400)="01020304050607") 80.794468ms ago: executing program 3 (id=23): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200)={0xffffffffffffffff}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000300)={0x14, 0x88, 0xfa00, {r2, 0x10, 0x0, @in={0x2, 0x0, @empty}}}, 0x90) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f00000003a0)={0x15, 0x110, 0xfa00, {r2, 0x3e8, 0x10, 0x10, 0x0, @in={0x2, 0x0, @empty}, @in={0x2, 0x0, @remote}}}, 0x118) read(r1, &(0x7f0000000400)=""/1024, 0x400) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000380)={0x4, 0x8, 0xfa00, {r2, 0x3e8}}, 0x10) read(r1, &(0x7f0000000800)=""/1024, 0x400) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f00000003c0)={0xb, 0x10, 0xfa00, {&(0x7f0000000500), r2}}, 0x18) 80.596935ms ago: executing program 3 (id=24): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./upper\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./work\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000100)='./lower/file\x00', 0x41, 0x1ff) mount(0x0, &(0x7f00000000c0)='./merge\x00', &(0x7f0000000140)='overlay\x00', 0x0, &(0x7f0000000180)='lowerdir=./lower,upperdir=./upper,workdir=./work,index=on,nfs_export=on\x00') r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./merge\x00', 0x0, 0x0) name_to_handle_at(r0, &(0x7f0000000200)='file\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="8000"/144], &(0x7f0000000300), 0x0) open_by_handle_at(r0, &(0x7f0000000240), 0x0) 0s ago: executing program 3 (id=25): r0 = syz_usb_connect(0x2, 0x49, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100100000040cc1769190001000000010902370001010080fa0904000000ffffff000904000104ffffff0007058102400000070501024000000705820100020107050601000201"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_read(r0, 0x1, 0x40, &(0x7f0000000300)=""/64) syz_usb_ep_write(r0, 0x81, 0xf, &(0x7f0000000100)="010000000001010102020202010100") nanosleep(&(0x7f0000000200)={0x0, 0x10000000}, 0x0) syz_usb_disconnect(r0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:40867' (ED25519) to the list of known hosts. [ 42.030102][ T5731] cgroup: Unknown subsys name 'net' [ 42.217751][ T5731] cgroup: Unknown subsys name 'cpuset' [ 42.221901][ T5731] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 43.153168][ T5731] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 46.988275][ T5749] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 46.993772][ T5753] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 46.997708][ T5752] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 47.001779][ T5752] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 47.004866][ T5752] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 47.005062][ T5753] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 47.008413][ T5760] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 47.009297][ T5762] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 47.010098][ T5762] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 47.010957][ T5753] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 47.010972][ T5762] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 47.011446][ T5761] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 47.014020][ T5761] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 47.014869][ T5760] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 47.016218][ T64] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 47.017741][ T5105] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 47.022646][ T5760] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 47.028946][ T5105] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 47.034604][ T5760] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 47.044460][ T5758] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 47.579542][ T5746] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.583544][ T5746] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.587569][ T5746] bridge_slave_0: entered allmulticast mode [ 47.590433][ T5746] bridge_slave_0: entered promiscuous mode [ 47.600531][ T5746] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.602941][ T5746] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.605609][ T5746] bridge_slave_1: entered allmulticast mode [ 47.608322][ T5746] bridge_slave_1: entered promiscuous mode [ 47.611505][ T5745] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.613763][ T5745] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.616984][ T5745] bridge_slave_0: entered allmulticast mode [ 47.619741][ T5745] bridge_slave_0: entered promiscuous mode [ 47.639276][ T5745] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.641752][ T5745] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.644064][ T5745] bridge_slave_1: entered allmulticast mode [ 47.648323][ T5745] bridge_slave_1: entered promiscuous mode [ 47.688540][ T5746] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.698213][ T5746] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.701314][ T5757] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.704163][ T5757] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.707605][ T5757] bridge_slave_0: entered allmulticast mode [ 47.710363][ T5757] bridge_slave_0: entered promiscuous mode [ 47.738106][ T5745] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.766177][ T5757] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.769230][ T5757] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.772275][ T5757] bridge_slave_1: entered allmulticast mode [ 47.776098][ T5757] bridge_slave_1: entered promiscuous mode [ 47.789818][ T5751] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.793064][ T5751] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.797368][ T5751] bridge_slave_0: entered allmulticast mode [ 47.801160][ T5751] bridge_slave_0: entered promiscuous mode [ 47.810166][ T5745] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.816903][ T5746] team0: Port device team_slave_0 added [ 47.831892][ T5746] team0: Port device team_slave_1 added [ 47.834425][ T5751] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.837039][ T5751] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.839381][ T5751] bridge_slave_1: entered allmulticast mode [ 47.842025][ T5751] bridge_slave_1: entered promiscuous mode [ 47.858325][ T5757] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.878780][ T5757] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.888890][ T5751] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.893450][ T5751] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.897605][ T5745] team0: Port device team_slave_0 added [ 47.907464][ T5746] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.910313][ T5746] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.920121][ T5746] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.932749][ T5745] team0: Port device team_slave_1 added [ 47.956623][ T5746] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.959252][ T5746] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 47.970129][ T5746] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.990922][ T5757] team0: Port device team_slave_0 added [ 48.002729][ T5751] team0: Port device team_slave_0 added [ 48.008501][ T5751] team0: Port device team_slave_1 added [ 48.010901][ T5745] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.013880][ T5745] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.024600][ T5745] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.029696][ T5757] team0: Port device team_slave_1 added [ 48.056565][ T5745] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.059163][ T5745] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.067436][ T5745] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.081739][ T5757] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.084728][ T5757] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.095135][ T5757] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.101341][ T5757] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.104396][ T5757] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.115125][ T5757] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.141388][ T5746] hsr_slave_0: entered promiscuous mode [ 48.143671][ T5746] hsr_slave_1: entered promiscuous mode [ 48.154498][ T5751] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.157639][ T5751] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.168337][ T5751] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.173379][ T5751] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.175675][ T5751] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.183378][ T5751] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.201887][ T5745] hsr_slave_0: entered promiscuous mode [ 48.204122][ T5745] hsr_slave_1: entered promiscuous mode [ 48.206466][ T5745] debugfs: 'hsr0' already exists in 'hsr' [ 48.208357][ T5745] Cannot create hsr debugfs directory [ 48.248533][ T5757] hsr_slave_0: entered promiscuous mode [ 48.251141][ T5757] hsr_slave_1: entered promiscuous mode [ 48.253283][ T5757] debugfs: 'hsr0' already exists in 'hsr' [ 48.255562][ T5757] Cannot create hsr debugfs directory [ 48.307743][ T5751] hsr_slave_0: entered promiscuous mode [ 48.310059][ T5751] hsr_slave_1: entered promiscuous mode [ 48.312016][ T5751] debugfs: 'hsr0' already exists in 'hsr' [ 48.313796][ T5751] Cannot create hsr debugfs directory [ 48.556651][ T5746] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 48.565657][ T5746] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.568627][ T5746] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 48.575242][ T5746] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.578991][ T5746] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 48.584541][ T5746] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.587756][ T5746] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 48.592577][ T5746] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.635323][ T5745] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 48.639580][ T5745] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.645966][ T5745] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 48.650565][ T5745] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.653357][ T5745] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 48.657251][ T5745] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.669265][ T5745] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 48.674151][ T5745] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.711251][ T5751] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 48.719221][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.725743][ T5751] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 48.731714][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.735421][ T5751] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 48.741902][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.746552][ T5751] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 48.752311][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.813208][ T5757] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 48.817251][ T5757] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 48.820176][ T5757] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 48.824424][ T5757] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 48.827835][ T5757] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 48.831717][ T5757] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 48.834462][ T5757] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 48.838504][ T5757] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 48.868068][ T5746] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.911593][ T5746] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.919507][ T5745] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.930880][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.933449][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.951477][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.953781][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.963350][ T5745] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.972489][ T5751] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.991975][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.994273][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.000479][ T5751] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.008041][ T5757] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.016058][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.018365][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.030018][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.032246][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.047619][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.049838][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.055752][ T5757] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.078215][ T5749] Bluetooth: hci2: command tx timeout [ 49.078477][ T5758] Bluetooth: hci0: command tx timeout [ 49.078550][ T5105] Bluetooth: hci3: command tx timeout [ 49.078731][ T5105] Bluetooth: hci1: command tx timeout [ 49.081750][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.089123][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.103661][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.105933][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.378402][ T5745] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.386216][ T5751] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.392380][ T5746] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.439181][ T5751] veth0_vlan: entered promiscuous mode [ 49.446144][ T5757] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 49.452770][ T5751] veth1_vlan: entered promiscuous mode [ 49.472710][ T5745] veth0_vlan: entered promiscuous mode [ 49.492474][ T5751] veth0_macvtap: entered promiscuous mode [ 49.497481][ T5745] veth1_vlan: entered promiscuous mode [ 49.501991][ T5746] veth0_vlan: entered promiscuous mode [ 49.506390][ T5751] veth1_macvtap: entered promiscuous mode [ 49.519767][ T5746] veth1_vlan: entered promiscuous mode [ 49.531657][ T5751] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.539713][ T5757] veth0_vlan: entered promiscuous mode [ 49.543789][ T5751] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.561417][ T5757] veth1_vlan: entered promiscuous mode [ 49.577320][ T5745] veth0_macvtap: entered promiscuous mode [ 49.587923][ T5745] veth1_macvtap: entered promiscuous mode [ 49.596987][ T5746] veth0_macvtap: entered promiscuous mode [ 49.603567][ T5746] veth1_macvtap: entered promiscuous mode [ 49.617691][ T5745] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.641786][ T5757] veth0_macvtap: entered promiscuous mode [ 49.641987][ T41] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.647009][ T5745] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.649483][ T5746] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.653343][ T41] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.653885][ T5757] veth1_macvtap: entered promiscuous mode [ 49.668603][ T5746] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.684204][ T222] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.687912][ T222] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.695831][ T5757] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 49.701904][ T5757] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 49.742284][ T5751] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 49.763343][ T5751] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 49.774430][ T5751] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 49.781950][ T5751] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 49.791261][ T61] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.795755][ T61] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.799562][ T5751] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 49.805314][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.835751][ T222] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.838374][ T222] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.846532][ T5854] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.849816][ T5854] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.860753][ T222] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.863132][ T222] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.873280][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.877235][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.886751][ T222] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.889218][ T222] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.916440][ T222] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 49.918886][ T222] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 49.925355][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.933190][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.937306][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.940344][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.943819][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.947418][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.950799][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.953577][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.985352][ T5854] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.992635][ T5854] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 49.998243][ T5854] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.003530][ T5854] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.011259][ T5854] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.103240][ T5906] pci 0000:00:05.0: [1af4:1009] type 00 class 0x000200 conventional PCI endpoint [ 50.111372][ T5906] pci 0000:00:05.0: BAR 0 [io 0xc0c0-0xc0df] [ 50.113478][ T5906] pci 0000:00:05.0: BAR 1 [mem 0xfeaf6000-0xfeaf6fff] [ 50.124613][ T5906] pci 0000:00:05.0: BAR 4 [mem 0xfe204000-0xfe207fff 64bit pref] [ 50.138755][ T5906] pci 0000:00:05.0: Adding to iommu group 5 [ 50.154113][ T5906] pci 0000:00:05.0: BAR 4 [mem 0x580000000-0x580003fff 64bit pref]: assigned [ 50.160074][ T5906] pci 0000:00:05.0: BAR 1 [mem 0x80000000-0x80000fff]: assigned [ 50.164257][ T5906] pci 0000:00:05.0: BAR 0 [io 0x2000-0x201f]: assigned [ 50.545106][ T1045] usb 7-1: new full-speed USB device number 2 using dummy_hcd [ 52.764623][ T5961] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 52.766935][ T5961] CPU: 0 UID: 0 PID: 5961 Comm: syz.1.20 Not tainted syzkaller #0 PREEMPT(full) [ 52.769834][ T5961] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 52.772885][ T5961] Call Trace: [ 52.773919][ T5961] [ 52.774826][ T5961] dump_stack_lvl+0x100/0x190 [ 52.776353][ T5961] vpanic+0x552/0x970 [ 52.777574][ T5961] ? __pfx_vpanic+0x10/0x10 [ 52.778950][ T5961] panic+0xd1/0xe0 [ 52.780122][ T5961] ? __pfx_panic+0x10/0x10 [ 52.781469][ T5961] check_panic_on_warn.cold+0x19/0x34 [ 52.783093][ T5961] __ubsan_handle_shift_out_of_bounds+0x279/0x2a0 [ 52.785016][ T5961] e100_eeprom_load.cold+0x55/0x9e [ 52.786597][ T5961] ? dma_alloc_attrs+0x1cd/0x3a0 [ 52.788116][ T5961] ? __pfx_e100_eeprom_load+0x10/0x10 [ 52.789760][ T5961] ? lockdep_init_map_type+0x5c/0x250 [ 52.791793][ T5961] e100_probe+0xd07/0x1ab0 [ 52.793204][ T5961] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 52.794963][ T5961] ? __pfx_e100_probe+0x10/0x10 [ 52.796544][ T5961] local_pci_probe+0xdd/0x1b0 [ 52.798007][ T5961] pci_call_probe+0x176/0x800 [ 52.799473][ T5961] ? __pfx_pci_call_probe+0x10/0x10 [ 52.801087][ T5961] ? find_held_lock+0x2b/0x80 [ 52.802544][ T5961] ? pci_match_device+0x450/0x5f0 [ 52.804120][ T5961] ? pci_match_device+0x450/0x5f0 [ 52.805722][ T5961] ? pci_match_id+0x34d/0x3f0 [ 52.807350][ T5961] ? pci_match_device+0xb4/0x5f0 [ 52.808890][ T5961] pci_device_probe+0x1cd/0x370 [ 52.810414][ T5961] ? __pfx_pci_device_probe+0x10/0x10 [ 52.812072][ T5961] really_probe+0x241/0xa60 [ 52.813492][ T5961] __driver_probe_device+0x20e/0x450 [ 52.815170][ T5961] device_driver_attach+0xd1/0x220 [ 52.816788][ T5961] bind_store+0xf4/0x190 [ 52.818157][ T5961] ? __pfx_bind_store+0x10/0x10 [ 52.819928][ T5961] drv_attr_store+0x74/0xb0 [ 52.821727][ T5961] ? __pfx_drv_attr_store+0x10/0x10 [ 52.823834][ T5961] sysfs_kf_write+0xf2/0x150 [ 52.825772][ T5961] kernfs_fop_write_iter+0x3e0/0x5f0 [ 52.827795][ T5961] ? __pfx_sysfs_kf_write+0x10/0x10 [ 52.829791][ T5961] vfs_write+0x6ac/0x1050 [ 52.831398][ T5961] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 52.833518][ T5961] ? __pfx_vfs_write+0x10/0x10 [ 52.835408][ T5961] ? find_held_lock+0x2b/0x80 [ 52.837176][ T5961] ksys_write+0x12a/0x250 [ 52.838831][ T5961] ? __pfx_ksys_write+0x10/0x10 [ 52.840556][ T5961] __do_fast_syscall_32+0xe7/0x970 [ 52.842215][ T5961] do_fast_syscall_32+0x32/0x70 [ 52.843737][ T5961] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 52.845688][ T5961] RIP: 0023:0xf6ffefec [ 52.847080][ T5961] Code: Unable to access opcode bytes at 0xf6ffefc2. [ 52.849498][ T5961] RSP: 002b:00000000f53cc50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 52.852165][ T5961] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000280 [ 52.854731][ T5961] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 [ 52.857489][ T5961] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 52.860085][ T5961] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 52.862702][ T5961] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 52.865317][ T5961] [ 52.866935][ T5961] Kernel Offset: disabled [ 52.868428][ T5961] Rebooting in 86400 seconds..